Loading...
Loading...
Last updated: June 2026
MK Car Mats Ltd is the data controller for personal data collected through this website. We are a UK-based manufacturer of custom car mats, van mats, boot liners, and accessories.
We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We collect and use the following categories of personal data:
What: Name, email address, phone number, delivery address, vehicle registration, order details.
Why / Lawful basis:Performance of a contract (Article 6(1)(b) UK GDPR) — we need this to process and fulfil your order, send order confirmations, and arrange delivery.
Retention: We retain order records for 7 years to comply with HMRC tax record-keeping requirements.
What:Email address, password (hashed — we never store your password in readable form), account preferences.
Why / Lawful basis:Contract performance — to manage your account and enable order tracking. Legitimate interests (Article 6(1)(f)) — to secure your account.
Retention: Account data is kept until you delete your account or request deletion.
What: Email address, newsletter subscription status.
Why / Lawful basis:Consent (Article 6(1)(a)) — we only send marketing emails where you have opted in. You can unsubscribe at any time using the link in any marketing email or by contacting us.
Retention: Until you unsubscribe or withdraw consent.
What: IP addresses, browser type, pages visited, timestamps.
Why / Lawful basis:Legitimate interests (Article 6(1)(f)) — to detect and prevent fraud, protect the security of our website, and defend against cyberattacks. We do not use this data to profile you for marketing.
Retention: Security logs are retained for up to 90 days, then deleted.
What: Transaction records, correspondence.
Why / Lawful basis:Legal obligation (Article 6(1)(c)) — to comply with tax law, consumer law, and to resolve disputes.
Retention: 7 years in line with HMRC requirements.
Payments are processed by Square Inc., a PCI DSS-compliant payment processor based in the United States. When you pay, your card details are submitted directly to Square — we never see or store your full card number, CVV, or expiry date on our servers. Square processes your payment data under its own privacy policy. As Square is a US company, this involves a transfer of data outside the UK; Square relies on standard contractual clauses and its certification under applicable data transfer frameworks to ensure adequate protections.
When you enter a vehicle registration number to find compatible mats, we query the DVLA Vehicle Enquiry Service on your behalf. The registration number and the vehicle details returned (make, colour, year) are used solely to identify the correct mat specification for your vehicle. We do not retain vehicle registration numbers beyond your session unless you proceed to purchase, in which case it forms part of your order record.
We use the following types of cookies and session technologies:
We do not use Google Analytics, Facebook Pixel, or any other third-party advertising or tracking technologies. You can control cookies through your browser settings; however, disabling essential cookies will prevent you from logging in.
We do not sell or rent your personal data. We may share it with:
Some of the third parties listed above (Square, Cloudflare) are based in or may process data in the United States or other countries outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the UK Information Commissioner's Office (ICO), or we rely on service providers who are certified under recognised data protection frameworks.
You have the following rights regarding your personal data:
To exercise any of these rights, contact us at [email protected]. We will respond within one month. There is no fee for most requests.
We implement appropriate technical and organisational security measures including HTTPS encryption, HTTP-only secure session cookies, hashed passwords (bcrypt), and access controls to protect your personal data. No internet transmission is 100% secure; we cannot guarantee the absolute security of data transmitted to our website, but we take reasonable and proportionate steps to protect it.
Our website is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us and we will delete it promptly.
If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the UK's data protection regulator:
We may update this Privacy Policy from time to time. The date at the top indicates when it was last revised. Significant changes will be communicated by email where we hold your email address.
For any data protection queries or to exercise your rights: