eCoC becomes mandatory on 29 November 2026. Get set up before the deadline.Get started →
Open the appGet started
Privacy

Privacy policy

What we hold, why, for how long, who else touches it, and how to get it back or removed. Plain English, and every promise here is something the software actually does.

Who we are

COC AutoDocs Ltd is the data controller. We are registered in England and Wales, company number 17449142, with our registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. The business is run from Greater Manchester, England. For anything about your data, email josh.atherton@cocautodocs.com. We are the controller for your account, enquiries, licences and payments. For the files and records your company creates in the app, your company is the controller and we process them on its instructions under our data processing terms.

What we hold and why

  • Your account: your work email address, optional name, when you last signed in. So you can sign in and work within your company. There are no passwords: you sign in with a link we email you.
  • Your company's records: company details including who signs certificates, vehicle models, every file made and its status, and which team member made it. So your team shares one history and audit trail. Only members of your company can see them.
  • Enquiries: what you type into the forms on this site, and notes we add while we talk to you. To reply, quote and set you up.
  • Licences and payments: the email a licence key was sent to, and payment references and amounts. To run your subscription and keep tax records.
  • VCA details, if you choose to send files from the app: the four codes the VCA issue your company. The secret one is stored encrypted and never shown again. You can remove them at any time.
  • Our own audit trail: what the operator did in the admin area and to whom, kept so decisions about access are accountable.

What we never hold: your signing key or certificate. They are created or loaded in your own browser and cannot be read by us. Card details: where you pay by card, the payment is taken by Stripe on their own pages; card numbers never reach us. Otherwise payments are by bank transfer. Website analytics: none, and no tracking cookies. The only cookie is the one that keeps you signed in to the app.

Our lawful bases

Providing the service you or your employer bought (contract); replying to enquiries and keeping the service secure (legitimate interests); keeping payment records (legal obligation). Your company relies on its legal duty to produce Certificates of Conformity.

How long we keep things

  • Your account and your company's records: for as long as the account exists. Deleted when you or your company delete them. Manufacturers must keep their own copy of each certificate for ten years under vehicle type-approval law, so export before closing an account.
  • Enquiries: 12 months after we decline or you decide not to go ahead; 24 months if we never hear back.
  • Invitations not accepted: 90 days. Sign-in sessions: until they expire.
  • Payment records: 6 years, for tax law.
  • Admin audit trail: 24 months. Technical logs: 6 months.
  • Backups: 30 days rolling, so anything deleted is gone from backups within 30 days.

These rules run automatically every day.

Who else touches your data

  • Our hosting provider is Railway Corporation, of San Francisco, California. The application, the database and its backups run in Railway's Amsterdam region, so your data is stored in the European Union. The Netherlands is covered by the UK's adequacy regulations. Because Railway itself is an American company, that arrangement is a restricted transfer under UK data protection law, and it is made under the International Data Transfer Addendum issued by the Information Commissioner, which forms part of Railway's data processing agreement with us.
  • Resend sends our emails: sign-in links, licence keys, invitations and enquiry copies. They see the address and the message. They are in the United States and work for us under the UK International Data Transfer Addendum.
  • The Vehicle Certification Agency receives files only when you send them, under your own VCA account. We never hold your VCA portal login.

Nobody else. We don't sell data, share it for marketing, or use it for anything but running the service for you. This website loads nothing from third parties; even the fonts are served from our own domain.

Your rights, and the buttons that do them

  • See everything we hold about you: Team page → Your account → Download my data. Instant, as a file you keep.
  • Delete your account: the same place. Files you made stay with your company's records but stop naming you as the person who made them, and the file history stops naming you. One thing cannot change: if you are the named signatory on a certificate that has been issued, your name and job title stay inside that sealed file, because altering it would break the seal and the certificate is a legal record the manufacturer must keep.
  • Take your company's data elsewhere (portability), or close the company: Company page → Your data. The owner can download everything or delete the company outright.
  • Correct something: edit it in the app, or email us.
  • Ask us to do any of this for you, object, or restrict processing: email josh.atherton@cocautodocs.com. We answer within a month, usually within days.
  • Complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113 if you think we have got something wrong. We'd rather you told us first.

Cookies

We use three cookies, all of them strictly necessary to sign you in and keep the sign-in form safe. There is no advertising, analytics or tracking cookie anywhere on this site, and nothing is shared with anyone else.

  • Session — keeps you signed in to the app. Deleted when you sign out, and expires on its own.
  • Sign-in token — stops someone else submitting the sign-in form on your behalf.
  • Return address — remembers which page to send you back to after you sign in.

All three are set only once you use the app itself. The pages you are reading now set no cookies at all, which is why there is no cookie banner: the law requires consent for tracking and advertising cookies, and we do not use any. Our fonts are served from our own server rather than a font network, so reading this site sends your details to nobody.

You can delete these cookies in your browser at any time. If you delete the session cookie you will simply be asked to sign in again. Each cookie is listed on the cookie policy page.

Decisions made about you

No decision affecting you is made automatically. Nothing on this site profiles you, scores you or decides anything about you without a person involved. The checks the app runs are on your vehicle files, against the VCA's published schema, not on you.

Security

Every connection is encrypted. The database accepts connections only from the application. Signing keys never reach us. The one secret we hold for you, your VCA client secret, is encrypted at rest. Every administrative action is logged. If we ever suffer a breach affecting your data we will tell affected customers within 48 hours and the ICO within 72 where the law requires.

Complaints

If you think we have handled your data badly, email josh.atherton@cocautodocs.com with "Complaint" in the subject line. We acknowledge every complaint within 30 days, and in practice within two working days, tell you who is dealing with it, and respond without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113 at any time. You do not have to come to us first, though we would rather you did.

Last updated 9 September 2026. If this policy changes in a way that affects you, we email account owners before it takes effect.