Privacy Policy

1. Who We Are

iAutoMotive Ltd (“iAutoMotive”, “we”, “us”, “our”) is a vehicle consignment platform registered in England and Wales. We operate the iAutoMotive platform at iautomotive.co.uk, which connects private vehicle sellers with buyers by managing the end-to-end consignment of used vehicles.

iAutoMotive Ltd is the data controller for personal data processed through our platform. This means we are responsible for deciding how and why your personal data is used.

Our contact details

2. What Personal Data We Collect

We collect and process different categories of personal data depending on how you use our platform. The tables below set out what we collect, from whom, and why.

2.1 Data collected from sellers (vehicle consignors)

2.2 Data collected from buyers

2.3 Data collected from third parties

In addition to data you provide directly, we receive personal data from the following third parties:

• DVLA: vehicle registration details and keeper history, used to verify seller authority and populate vehicle specifications.
• HPI Check / Experian: vehicle history data including outstanding finance, theft, write-off status, and mileage history.
• Identity verification providers (Stripe Identity): ID document authentication and liveness verification results.
• Credit reference agencies: soft-pull pre-qualification results for buyers seeking finance introductions (where FCA-authorised activity applies).
• Fraud prevention services (Point Predictive, Experian CrossCore): synthetic identity scores and fraud risk indicators.
• PEP and sanctions screening services: politically exposed person status and sanctions list matches, as required under the Money Laundering Regulations 2017.

3. How and Why We Use Your Data

We must have a lawful basis to process your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The table below sets out each purpose for which we process personal data, our lawful basis, and the data categories involved.

Legitimate interests

Where we rely on legitimate interests as our lawful basis, we have carried out a Legitimate Interests Assessment (LIA) to ensure that our interests are not overridden by your rights and interests. You have the right to object to processing based on legitimate interests at any time. Contact us at privacy@iautomotive.co.uk.

4. Sharing Your Personal Data

We share personal data with third parties only where necessary for our services, required by law, or with your consent. We do not sell your personal data to third parties for their own marketing purposes.

4.1 Our service providers (data processors)

We share personal data with the following categories of service provider, who process it on our behalf and under our instructions:

4.2 Other parties we may share data with

• Regulated lenders: where a buyer applies for vehicle finance, we share their application data with lenders in the RouteOne network for the purpose of credit assessment. Each lender is an independent data controller for their own processing.
• DVLA: we notify the DVLA of vehicle keeper changes within 5 working days of a sale as required by law.
• HM Revenue & Customs: we may be required to report certain seller transaction data to HMRC in accordance with our tax reporting obligations.
• Law enforcement and regulatory authorities: we will disclose personal data to the police, FCA, HMRC, or other authorities where we are legally required to do so, or where we reasonably believe disclosure is necessary to prevent or detect crime.
• Fraud prevention agencies: we share information with fraud prevention agencies as part of our AML and fraud screening obligations. This information may be used by those agencies to prevent fraud and money laundering and to verify your identity.
• Professional advisers: our solicitors, accountants, and insurers may receive personal data where necessary for their professional services.
• Business transfers: in the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred to the acquiring entity. We will notify you before your data is transferred and becomes subject to a different privacy policy.

5. International Data Transfers

Some of our third-party service providers are based outside the United Kingdom (UK). When we transfer personal data to countries outside the UK, we ensure that appropriate safeguards are in place to protect your data, in accordance with the UK GDPR.

The safeguards we rely on include:

• UK adequacy regulations: transfers to countries that the UK government has determined provide an adequate level of data protection.
• UK International Data Transfer Agreements (IDTAs): standard contractual clauses approved by the ICO for transfers to countries without an adequacy decision.
• UK Addendum to EU Standard Contractual Clauses: where we use the EU SCCs as a transfer mechanism with a UK Addendum.

Key international transfers include:

6. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. The table below sets out our standard retention periods.

When personal data is no longer required, we securely delete or anonymise it. Where anonymisation is not possible, we restrict access to the data until deletion is possible.

7. Your Rights

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to exemptions, but we will always consider your request carefully and respond within the required timeframe.

7.1 How to exercise your rights

To exercise any of your rights, please contact us at:

• Email: privacy@iautomotive.co.uk
• Post: iAutoMotive Ltd, [Registered address], Attention: Data Protection

We will respond to your request within one calendar month. In complex cases or where we receive multiple requests from the same individual, we may extend this period by a further two months and will notify you accordingly. We may need to verify your identity before processing your request.

7.2 Right to complain

If you are not satisfied with how we have handled your personal data or responded to your rights request, you have the right to complain to the Information Commissioner’s Office (ICO):

• ICO website: www.ico.org.uk
• ICO helpline: 0303 123 1113
• ICO address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would always prefer to resolve concerns directly before you approach the ICO, so please contact us first at privacy@iautomotive.co.uk.

8. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to make the platform work, to improve your experience, and — where you have consented — to show you relevant content and measure our marketing performance.

8.1 What are cookies?

Cookies are small text files placed on your device when you visit a website. They help the site remember information about your visit, such as your preferred settings or your login status. Some cookies are placed by us; others are placed by third parties whose services we use.

8.2 Categories of cookies we use

8.3 Managing your cookies

When you first visit our website, we will show you a cookie banner asking for your consent to non-essential cookies. You can change your cookie preferences at any time by visiting our Cookie Preferences page at iautomotive.co.uk/legal/cookies. You can also control cookies through your browser settings. Please note that disabling certain cookies may affect your ability to use some features of our platform.

9. Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or damage. Our security measures include:

• Encryption of all personal data in transit using TLS 1.3 and at rest using AES-256 encryption.
• Strict role-based access controls ensuring staff can only access data they need for their role.
• Multi-factor authentication required for all staff accessing personal data.
• Regular security assessments and vulnerability scanning as part of our CI/CD pipeline.
• Annual third-party penetration testing.
• Physical security at our vehicle lots including CCTV and access controls.
• Staff training on data protection, information security, and phishing awareness.
• Documented incident response procedures.

We are working towards achieving SOC 2 Type II certification within 18 months of launch.

9.1 Data breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, as required by Article 33 of the UK GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by Article 34.

10. Specific Processing Activities

10.1 Vehicle valuations and market data

When you request a valuation for your vehicle, we use your vehicle registration number and mileage to query third-party valuation services (including Cazana, Glass’s Guide, and AutoTrader pricing data). This processing is necessary to perform our contract with you. The results are used to generate your consignment offer and to price your vehicle on the platform.

10.2 Fraud detection and identity verification

We use automated fraud detection tools to assess the risk of fraudulent activity in connection with vehicle transactions. This includes assessing identity documents, cross-referencing against fraud databases, and generating a risk score. Where our automated systems flag a high risk, a human member of our team will review the case before any decision is made. You have the right to request human review of any automated decision.

Identity verification is conducted where required by our AML obligations, for high-value transactions, or where our fraud detection systems indicate a need for enhanced verification. This processing is based on legal obligation and legitimate interests.

10.3 Financial information and bank account data

We collect bank account details from sellers solely for the purpose of making consignment payouts. This data is stored securely and is not used for any other purpose. Bank account details are never displayed in full on our platform — only the last four digits are shown for confirmation purposes.

We do not store payment card details. All card payments are handled by Stripe, who is PCI DSS compliant. We receive only a tokenised reference from Stripe, not the card number itself.

10.4 Call recording

Where our cold-calling CRM team contacts sellers by telephone, calls may be recorded for quality assurance, training, and dispute resolution purposes. You will be informed at the start of any recorded call. If you prefer not to be recorded, you may decline and the call will proceed unrecorded. Recordings are retained for 12 months and then securely deleted.

10.5 CCTV at our vehicle lots

We operate CCTV at our vehicle storage lots for the purpose of security and theft prevention. CCTV is operated in accordance with the ICO’s CCTV code of practice. Footage is retained for 31 days and then automatically overwritten unless required for an investigation. Signage is displayed at all lot entrances informing visitors that CCTV is in operation.

10.6 Marketing communications

We may send you marketing communications about our services, new vehicles on our platform, or relevant automotive news. We will only send marketing communications where:

• You have given us your explicit consent; or
• You are an existing customer and we are marketing similar products or services to those you have previously used with us (the “soft opt-in” under PECR), and you have not objected to receiving marketing.

You can opt out of marketing communications at any time by clicking “unsubscribe” in any marketing email, by replying STOP to any marketing SMS, or by updating your preferences in your account settings. Opting out of marketing does not affect transactional communications related to your active consignment or purchase.

11. Children’s Privacy

Our platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@iautomotive.co.uk and we will delete it promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable law. When we make material changes, we will:

• Update the “Last updated” date at the top of this policy.
• Notify registered users by email where the changes are significant.
• Display a prominent notice on our website for a period of 30 days following a material update.

We encourage you to review this policy periodically. Continued use of our platform after a policy update constitutes acceptance of the revised policy. Previous versions of this Privacy Policy are available on request by contacting privacy@iautomotive.co.uk.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our processing of your personal data, please contact us using the details below: