Privacy Policy

1. Who we are

AutoIdeal is an online vehicle advertising and marketplace platform operated by AutoIdeal UK Ltd (“AutoIdeal”, “we”, “us” or “our”).

AutoIdeal allows motor dealers and, where available, private sellers to advertise vehicles and allows buyers to search for vehicles and contact sellers.

For the purposes of UK data protection law, AutoIdeal UK Ltd is the data controller responsible for personal information processed through the AutoIdeal website and dealer portal, except where another organisation acts as a separate controller as explained in this policy.

Our website is autoideal.co.uk.

You can contact us about privacy or data protection matters at:

Email: customersupport@autoideal.co.uk Postal address: 113-115 Codicote Road, Welwyn, Hertfordshire, AL6 9TY, United Kingdom

2. What this Privacy Policy covers

This Privacy Policy explains:

• what personal information we collect;
• how and why we use it;
• the legal bases we rely upon;
• who we may share it with;
• how long we keep it;
• how we protect it; and
• the rights available to you.

This policy applies to the AutoIdeal website, user accounts, dealer portal and related AutoIdeal services.

Our use of cookies and similar technologies is explained separately in our Cookie Policy.

3. Personal information we collect

The information we collect depends on how you use AutoIdeal.

3.1 If you browse AutoIdeal or contact a seller

When you send an enquiry about a vehicle, we may collect:

• your first and last name;
• your email address;
• your telephone number;
• your preferred method of contact;
• the contents of your enquiry; and
• information identifying the vehicle you are enquiring about.

Where you request information about vehicle delivery, we may also collect a postcode or delivery location so that the delivery can be priced or arranged.

You do not necessarily need an AutoIdeal account to send an enquiry.

3.2 If you create a buyer account

We may collect:

• your name;
• email address;
• account credentials;
• email-verification status;
• records showing acceptance of our Terms & Conditions and relevant policy versions; and
• information about vehicles you save or favourite.

Passwords are not stored by us in readable form. They are protected using secure one-way password hashing.

3.3 If you advertise a vehicle as a private seller

Where private advertising is available, we may collect:

• first and last name;
• email address;
• telephone number;
• date of birth;
• postal address and postcode;
• vehicle registration;
• mileage;
• make and model;
• derivative or specification;
• year;
• fuel type;
• transmission;
• body type;
• VIN;
• MOT information;
• photographs and description of the vehicle; and
• other information reasonably required to verify you or the vehicle.

We may also retain information generated through checks carried out in connection with the advertisement.

3.4 If you apply for or operate a motor-dealer account

We may collect information including:

• contact person’s name;
• email address;
• telephone number;
• dealership trading name;
• legal company name;
• company registration number;
• VAT number, where applicable;
• business and trading address;
• dealership website;
• dealership telephone number and email address;
• information about the dealership and its inventory;
• information supplied as part of the dealer application;
• verification information; and
• documents uploaded to support an application.

For dealership users, we may also process the name, email address, role and account activity of authorised users.

3.5 Payments

Payments may be processed on our behalf by Stripe.

AutoIdeal does not receive or store your complete payment-card number.

We may receive and retain limited payment information such as:

• card type or brand;
• last four digits;
• expiry month and year;
• payment-provider identifiers;
• amount;
• currency;
• payment status;
• payment date;
• description; and
• receipt or transaction information.

Stripe processes payment information in accordance with its own privacy and security arrangements.

3.6 Reporting advertisements or users

If you report an advertisement, dealer, seller or other issue to us, we may collect:

• your name;
• email address or other contact details;
• the reason for the report;
• comments and information you provide;
• information about the relevant advertisement or account; and
• correspondence concerning the report.

3.7 Information collected automatically

When you use AutoIdeal, we may collect technical and usage information such as:

• browser and device information;
• IP address or a privacy-protected representation of it;
• pages and vehicle advertisements viewed;
• date and time of activity;
• interactions with advertisements;
• contact-form activity;
• telephone, email or website-link clicks;
• security information; and
• technical error information.

We use this information for security, fraud prevention, service operation, troubleshooting and, where permitted, measuring the performance of advertisements and the platform.

AutoIdeal does not use this information to track you across unrelated websites for advertising purposes.

Where cookies or similar technologies require consent, they will only be used in accordance with the choices you make through our cookie-consent system.

Further information is available in our Cookie Policy.

4. Where we obtain information

Most personal information we process is provided directly by you.

We may also receive information from:

Vehicle-data providers

When a vehicle registration is entered, we may obtain vehicle specification, MOT, provenance, finance, theft, write-off or other vehicle-history information from third-party vehicle-data providers.

Google

If you choose to use Sign in with Google, Google provides information necessary to authenticate your account, such as your basic account identity details.

You can instead create an account using the alternative registration methods we make available.

Sellers and dealerships

Dealership administrators may provide information about authorised dealership users.

Service providers and security systems

Our hosting, security, payment and technical providers may generate technical information necessary to provide and protect the service.

Public and official sources

Where reasonably necessary to verify a dealer, business or vehicle, we may check information against legitimate public or official sources.

5. Why we use your information and our legal bases

Under UK data protection law, we need a lawful basis for processing personal information.

Depending on the circumstances, we rely on one or more of the following.

Contract

We process information where necessary to provide services you have requested or to take steps at your request before entering into a contract.

This includes:

• creating and administering accounts;
• publishing and managing advertisements;
• processing advertising payments;
• providing account functionality;
• sending essential service communications; and
• processing enquiries you ask us to send.

Legitimate interests

We may process information where this is necessary for our legitimate business interests or those of another person, provided those interests are not overridden by your rights.

These interests include:

• operating and improving AutoIdeal;
• preventing fraud and misuse;
• protecting the security of the platform;
• verifying dealers and sellers;
• verifying vehicle information;
• moderating advertisements;
• investigating complaints and reports;
• maintaining appropriate business and audit records;
• establishing, exercising or defending legal claims; and
• understanding the effectiveness and performance of vehicle advertisements where permitted by law.

Where required, we carry out appropriate assessments before relying on legitimate interests.

Legal obligations

We may process and retain information where necessary to comply with legal obligations, including taxation, accounting, regulatory, fraud-prevention and law-enforcement requirements.

Consent

Where consent is legally required, including for certain cookies or similar technologies, we rely on your consent.

You may withdraw consent at any time.

Withdrawal does not affect processing that took place lawfully before consent was withdrawn.

6. Vehicle information and provenance checks

When a vehicle is submitted for advertising, we may send its registration number or other identifying information to a vehicle-data provider.

Our current vehicle-data provider is Vehicle Data Global.

Information returned may include vehicle specification and history and indicators relating to matters such as:

• theft;
• insurance write-off history;
• outstanding finance;
• MOT information; and
• other vehicle provenance information.

Some vehicle information, including a vehicle registration or VIN, may constitute personal data where it can be linked to an identifiable individual. We therefore handle this information in accordance with applicable data protection law.

7. Who we share information with

We only disclose personal information where reasonably necessary for providing AutoIdeal, operating our business, complying with the law or protecting legitimate interests.

Sellers and dealers

When you contact a seller through AutoIdeal, we provide that seller with the information necessary to deal with your enquiry.

This may include your:

• name;
• email address;
• telephone number;
• message; and
• information relating to the vehicle enquiry.

Once the seller receives your personal information, that seller may act as an independent data controller and will be responsible for its own processing of your information.

Service providers

We use third-party service providers to help operate AutoIdeal. These may include:

Stripe – payment processing.

Postmark – transactional and service email delivery.

DigitalOcean – hosting, database and file-storage infrastructure.

Vehicle Data Global – vehicle specification and provenance information.

Cloudflare – website security, performance and protection against automated abuse.

Cookiebot / Usercentrics – cookie-consent management.

Sentry – technical error monitoring and diagnostics.

Google – authentication where you choose Sign in with Google.

Postcodes.io – postcode and location-related functionality.

We require service providers processing personal information on our behalf to handle that information appropriately and in accordance with applicable data protection requirements.

Professional advisers and authorities

We may disclose information where reasonably necessary to:

• accountants;
• solicitors;
• insurers;
• professional advisers;
• courts;
• law-enforcement authorities;
• regulators;
• tax authorities; or
• other public authorities.

We may also disclose information in connection with a merger, acquisition, restructuring or sale of all or part of our business, subject to appropriate safeguards.

We do not sell your personal information.

8. International transfers

Our primary application, database and uploaded files are hosted using DigitalOcean infrastructure in the United Kingdom.

However, some of the third-party service providers we use may process information in, or make information accessible from, countries outside the United Kingdom.

Where personal information is transferred internationally, we take appropriate steps to ensure that the transfer complies with UK data protection law.

Depending on the destination and provider, these safeguards may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved contractual clauses; or
• another legally recognised transfer mechanism.

9. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, accounting, regulatory, security and dispute-resolution requirements.

Our retention periods vary depending on the type of information.

As a general approach:

• Account information: retained while the account remains active and for a limited period afterwards where necessary for legal, fraud-prevention or dispute purposes.
• Vehicle advertisements: retained while active and for a reasonable period following removal where required for record-keeping, fraud prevention or disputes.
• Buyer enquiries: normally retained for up to 24 months after the enquiry, unless longer retention is reasonably required in connection with a complaint, dispute or legal obligation.
• Listing reports and moderation records: normally retained for up to 24 months after the matter is closed, unless longer retention is necessary for safety, fraud prevention, repeat-abuse monitoring or legal claims.
• Private-seller applications: unsuccessful or abandoned applications will normally be deleted or anonymised within 12 months, unless there is a legitimate reason to retain particular information for longer.
• Dealer applications and verification records: retained while the dealer relationship continues and for an appropriate period afterwards for regulatory, fraud-prevention, contractual or dispute purposes.
• Payment and accounting records: normally retained for six years or for any longer period required by law.
• Security and administrative audit records: retained for a proportionate period according to security and operational requirements.
• Analytics and advertisement-performance information: retained only for the period reasonably necessary for reporting and analysis and, where possible, aggregated or anonymised.

Where information is required in connection with litigation, a complaint, fraud investigation, regulatory investigation or another legal matter, we may retain relevant information until the matter and any applicable limitation period have ended.

We periodically review information we hold and delete or anonymise information that is no longer required.

10. Your data protection rights

Depending on the circumstances, UK data protection law may give you the right to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of your personal information;
• request restriction of processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• complain about how your information has been handled.

These rights are not absolute and may be subject to legal exceptions.

To exercise your rights, contact:

customersupport@autoideal.co.uk

We may need to verify your identity before dealing with a request.

We normally respond within the period required by applicable data protection law.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

11. Deleting your AutoIdeal account

Where account deletion is available, deleting an account removes or deactivates the information required to operate that account and associated account functionality.

Some information may nevertheless need to be retained where we have a lawful reason to do so.

For example, we may retain limited information relating to:

• transactions and payments;
• previous advertisements;
• enquiries;
• complaints and reports;
• fraud or security incidents;
• regulatory requirements; or
• actual or potential legal disputes.

Where possible, information that no longer needs to identify you will be deleted or anonymised.

Account deletion therefore does not necessarily mean that every record relating to previous activity is immediately erased.

12. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration, disclosure or destruction.

Measures used by AutoIdeal may include:

• HTTPS encryption;
• secure password hashing;
• access controls;
• administrator authentication protections;
• session-management controls;
• rate limiting;
• automated-abuse protection;
• security monitoring; and
• restrictions on external code and system access.

No internet-based system can be guaranteed to be completely secure. We therefore continually review and improve our security arrangements as the platform develops.

If you believe your AutoIdeal account or personal information has been compromised, please contact us promptly.

13. Children and age restrictions

AutoIdeal is a vehicle marketplace intended primarily for adults.

You must be 18 years of age or older to:

• advertise a vehicle as a private seller;
• register or operate a motor-dealer account;
• enter into a paid advertising agreement with AutoIdeal; or
• enter into another transaction with us that requires you to be legally capable of entering into that agreement.

People under 18 may be able to browse publicly available vehicle advertisements, but should not provide personal information through AutoIdeal where they are not legally permitted to use the relevant service.

We do not knowingly use children’s personal information for behavioural advertising or build advertising profiles about children.

We keep the accessibility of AutoIdeal to children under review and will apply appropriate protections where required by applicable law.

14. Cookies and similar technologies

AutoIdeal uses cookies, local storage and similar technologies for purposes including:

• operating the website;
• maintaining security;
• remembering choices;
• authentication;
• preventing automated abuse;
• measuring website and advertisement performance; and
• diagnosing technical problems.

Where a technology is strictly necessary to provide the service or security requested by you, consent may not be required.

Where consent is required by law, the relevant technology will only be used after the appropriate consent has been obtained.

You can review or change your cookie choices through our cookie-consent controls.

Please see our Cookie Policy for more information.

15. Automated decision-making

AutoIdeal does not currently make decisions about individuals based solely on automated processing where those decisions produce legal effects or similarly significant effects.

We may use automated tools to assist with security, fraud prevention, vehicle-data checks and platform moderation, but significant decisions may be reviewed where appropriate.

If this changes, we will update this Privacy Policy and provide any additional information required by law.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, including where:

• AutoIdeal introduces new services;
• our technology or suppliers change;
• our data-processing activities change; or
• legal or regulatory requirements change.

The latest version will be published on AutoIdeal.

The “Last updated” date at the top of this policy shows when it was most recently revised.

Where a change materially affects how we use personal information, we will take reasonable steps to bring the change to the attention of affected users where required.

17. Contact us

If you have questions about this Privacy Policy, how AutoIdeal uses personal information or wish to exercise a data protection right, please contact:

AutoIdeal UK Ltd

Email: customersupport@autoideal.co.uk

Postal address: 113-115 Codicote Road, Welwyn, Hertfordshire, AL6 9TY, United Kingdom