Privacy notice

Tug & Tow Recovery. Last updated: 19 October 2026

This notice explains what personal information I collect, why, how long I keep it and what your rights are. It covers two groups of people:

• customers and anyone who enquires about a recovery, breakdown, transport or collection job, and
• people at local businesses (garages, car and van dealers, and taxi and private-hire firms) whom I contact to offer my services.

Who I am

Tug & Tow Recovery is run by me, Scott Farrant, as a sole trader. I decide how your information is used, so I'm the "controller" under UK data protection law.

• Name: Scott Farrant, trading as Tug & Tow Recovery
• Address: 37 Mill Lane, Sandy, Bedfordshire SG19 1NL
• Email: hello@tugtowrecovery.co.uk
• Phone or WhatsApp: 07866 000888

If you have any question about your information, or want to use any of your rights below, contact me using any of these. You don't need to fill in a form.

Part A: customers and enquirers

What I collect

When you call, text, WhatsApp or email me, or use the quote form on this website, I may collect:

• your name and phone number, and your email address if you email me
• where the vehicle is (address, road, postcode or a shared map location) and where it's going
• the vehicle's make, model, colour and registration number, and its condition (for example "won't start", "low car", "keys available")
• job details: date, time, what I did, photos of the vehicle before and after loading (to show its condition), and any notes
• payment details: the amount, the date, how you paid and invoice or receipt records. I don't keep full card numbers.
• if a garage, dealer, insurer or breakdown provider books the job for you, the details they give me

Please don't tell me more than I need. If there's been an accident I may need to know whether anyone is still in the vehicle or hurt, so I can work safely, but I don't keep a record of anyone's health.

The quote form on this website doesn't send anything to me or store anything. It just opens WhatsApp, your text messages or your email app with your details filled in. Nothing reaches me unless you press send in that app.

Why I use it and my lawful basis

I don't send marketing emails or texts to customers. If I ever want to, I'll only do it in a way the law allows, and every message will give you an easy way to opt out.

Who I share it with

• the garage, dealer or address you ask me to take the vehicle to
• whoever booked the job for you (for example your garage, insurer or breakdown provider), to report back on the job
• my insurer, or anyone involved in a claim, if something goes wrong
• my accountant, if I use one, and HMRC, for tax
• the police, courts or other authorities, only if the law requires me to

I never sell your information.

How long I keep it

• Job, invoice and payment records: HMRC says self-employed people must keep their records for at least 5 years after the 31 January submission deadline for the tax year concerned (GOV.UK: how long to keep your records). So a job in October 2026 (tax year 2026 to 2027, deadline 31 January 2028) is kept until at least the end of January 2033.

Part B: local businesses I contact (garages, dealers, taxi and private-hire firms)

I send occasional one-to-one emails to local motor-trade and taxi businesses to offer recovery, collection and vehicle-moving work. This part explains where I got your details and what I do with them.

Who I email

I only email businesses that I've checked on Companies House are limited companies or LLPs, and only at a business email address they have published. I don't send cold marketing emails to sole traders or ordinary partnerships. If I can't confirm that a business is incorporated, I don't email it.

Where your details came from

Depending on the business, I found the details in one or more of these public sources:

• your own website
• the DVSA list of active MOT test stations, published on GOV.UK (garages)
• Companies House: your company name, number, status and registered office, used to check you're a company
• public business directories and online listings, such as garage-finder sites, vehicle-sales showroom pages and local directories
• Central Bedfordshire Council's public register of licensed private hire operators (taxi and private-hire firms)
• Bedford Borough Council's published list of approved passenger transport operators (taxi and private-hire firms)

I'm not connected with any council and have no council contracts. Using a council's published list doesn't mean the council endorses me or has passed your details to me.

What I hold

• business name, and your company name and number from Companies House
• business address or base town (whatever is published), phone number, business email and website
• brief notes about your services (for example "MOT and servicing", "used car dealer", "private hire") and, for taxi firms, your licence expiry date as shown on the public register
• if the published address includes a name (for example jane@…), that name as part of the address
• a record of when I emailed you, and whether you replied, opted out or the email bounced

I don't use any home address or personal contact details shown on a council list.

Why, and my lawful basis

I use these details to offer my recovery services to local businesses that are likely to need them. My lawful basis is legitimate interests (UK GDPR Article 6(1)(f)): it's reasonable for a local recovery operator to tell local garages, dealers and taxi firms about a trade service. I've weighed this against your interests and written it up in a legitimate interests assessment, which you can ask to see. I keep it low-volume: one-to-one emails, no mass mailing, and at most one follow-up.

Your right to object: opting out

You can stop my emails at any time. Reply STOP (or just say "no thanks") to any email, or ring or text 07866 000888. I'll take you off my list straight away and you won't get any more emails from me. You don't need to give a reason.

How long I keep it

• If you don't reply: I delete your details 12 months after my last email.
• If you opt out: I delete your details, but I keep your email address, business name and the date you opted out on a do-not-contact list, indefinitely. That's the only way to make sure you're never emailed again, even if your details turn up in a new source.
• If we start working together, Part A applies to the job records.

Who helps me run the business (service providers)

I use these services. They store or carry information for me, and I've chosen ones with recognised security:

• Microsoft Outlook / Hotmail (tug-tow@hotmail.com): email
• Google Gmail (tugandtowuk@gmail.com): email, including messages sent to hello@tugtowrecovery.co.uk
• Porkbun (my domain provider): forwards emails sent to hello@tugtowrecovery.co.uk to my Gmail
• GitHub Pages (GitHub, Inc., part of Microsoft): hosts this website
• my mobile phone network and WhatsApp (Meta): calls, texts and WhatsApp messages

Information sent outside the UK

Microsoft, Google, GitHub and Meta (which runs WhatsApp) are US companies, so information held in their services may be stored or accessed in the United States.

Microsoft, Google and GitHub: Microsoft Corporation, Google LLC and GitHub are certified under the UK Extension to the EU-US Data Privacy Framework (the UK's "data bridge" with the US). Transfers to them are covered by the Data Protection (Adequacy) (United States of America) Regulations 2023. You can check their certification on the Data Privacy Framework list.

WhatsApp: for UK users, WhatsApp is provided directly by WhatsApp LLC in the US. Neither WhatsApp LLC nor Meta Platforms, Inc. is certified under the UK Extension, so the data bridge doesn't cover WhatsApp. WhatsApp explains how it handles and transfers information in its privacy policy, and says personal messages and calls are end-to-end encrypted. If you'd rather not use WhatsApp, you can call, text or email me instead.

This website: cookies and analytics

• This website doesn't set any cookies and doesn't use Google Analytics or any other analytics, advertising or tracking tools. That's why there's no cookie banner.
• Fonts: the site loads its fonts (Oswald and Barlow) from Google Fonts, so your browser connects to Google, which receives your IP address.
• Weather (home page only): the live weather panel asks the Open-Meteo weather service for the current weather in Sandy. Your browser connects to Open-Meteo directly, so it receives your IP address. The site doesn't send it your location.
• Hosting: GitHub Pages logs visitors' IP addresses for security (GitHub Docs).
• Links to WhatsApp, Facebook, Instagram and X take you to those services, and their own privacy policies apply.

Your rights

Under UK data protection law you have the right to:

• be told how your information is used (this notice)
• get a copy of the information I hold about you
• have it corrected if it's wrong
• have it deleted, where I no longer have a good reason to keep it
• restrict how I use it in some circumstances
• object to my using it on the basis of legitimate interests, and always to direct marketing (see "Opting out" above)
• data portability, where the basis is contract and it's held electronically

To use any of these rights, just email, call or text me. I'll reply within one month. There's normally no charge. I may need to check who you are before I give out any information.

Complaints

If you're unhappy with how I've handled your information, please tell me first and I'll try to put it right. You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator:

• online: ico.org.uk/make-a-complaint
• phone: 0303 123 1113
• more about your rights: ico.org.uk/for-the-public

Changes to this notice

I'll update this page if anything changes. The date at the top shows when it was last updated.