Privacy policy
Version 1.0
Effective date: [REQUIRED BEFORE PUBLICATION: EFFECTIVE DATE].
This policy explains how Veramotive collects, uses, shares and keeps personal information, and how you can exercise your rights. It applies to our website and the services described below. Agreeing to our terms does not give us blanket consent to use your information.
1. Who is responsible for your information
[REQUIRED: FULL LEGAL ENTITY NAME AND LEGAL FORM, OR SOLE TRADER'S FULL NAME], trading as Veramotive ("we", "us" or "our"), is the controller responsible for the personal information described in this policy.
- Business address: [REQUIRED: FULL GEOGRAPHICAL BUSINESS ADDRESS].
- Privacy contact: [REQUIRED: MONITORED PRIVACY EMAIL ADDRESS].
- Telephone: [REQUIRED: PUBLIC CONTACT TELEPHONE NUMBER].
- Company number and place of registration: [IF A COMPANY: NUMBER AND JURISDICTION; OTHERWISE REMOVE THIS LINE].
- Data protection officer: [IF APPOINTED: CONTACT DETAILS; OTHERWISE REMOVE THIS LINE].
- ICO registration reference: [IF REGISTERED: REFERENCE; OTHERWISE REMOVE THIS LINE AFTER CONFIRMING EXEMPTION].
Use these details to ask about your information, exercise a right or make a privacy complaint.
This policy covers visitors, account holders, private sellers, buyers making enquiries and people who contact us. Veramotive provides vehicle advertising and enquiry facilities; it does not process the purchase price or deposit for a vehicle.
2. Information we collect and its sources
We receive information directly from you when you register, browse, prepare an advert, upload photographs, send an enquiry, pay a listing fee or contact us. We also receive records from the providers described below and reports from other users.
| Category | Information involved |
|---|---|
| Account | Name, email address, hashed password, email verification status, adult declaration and account status. An adult declaration is not documentary identity verification. |
| Advert and vehicle | Registration, specifications, asking price and reductions, mileage, description, photographs, advert status, dates and ownership links to your account. Vehicle data may be personal information when associated with a person. |
| Location | Outward postcode area; optional seller full postcode and approximate coordinates; buyer postcode used for distance search. |
| MOT records | Vehicle details and selected MOT test results, dates, mileage and defects obtained from DVSA using the registration supplied. |
| Enquiries and support | Message text, buyer email, linked buyer and advert, dates, delivery status, support correspondence and reports. |
| Listing payments | Listing fee, currency, payment and checkout references, payment status and relevant reconciliation records received through Stripe. Card details are entered into Stripe's checkout; our application does not store full card numbers or security codes. |
| Technical and safety | Session identifiers, IP address and browser/user-agent information where recorded, security and error logs, moderation reasons and operator actions. |
Please avoid including financial account details, identity documents, health information or other sensitive personal information in adverts or enquiries. Do not upload information about other people without a lawful reason. Visible number plates, faces, documents or addresses in photographs may identify people even after image metadata is removed.
3. Why we use information
Under UK data protection law, we need a lawful basis for each use of your personal information. The table explains the purposes and bases for this service. We only use the information reasonably needed for each purpose.
| Purpose | Lawful basis |
|---|---|
| Create and manage your account, save drafts, publish and manage adverts, deliver enquiries and administer listing payments | Contract: information necessary to provide the service you request, or to take steps at your request before entering a contract. |
| Provide requested vehicle lookup and postcode distance features | Performance of our contract where necessary to deliver the feature to an account holder; legitimate interests in providing requested search functionality to visitors. |
| Protect accounts, detect misuse, investigate reports and maintain service reliability | Legitimate interests in operating a secure, reliable marketplace and protecting users. We balance those interests against people's rights. |
| Handle ordinary support requests and service complaints | Contract where the request concerns our service to you; otherwise legitimate interests in responding and resolving issues. |
| Keep legally required tax/accounting records, respond to binding legal demands and fulfil applicable regulatory duties | Compliance with legal obligations. |
| Preserve necessary evidence and establish, exercise or defend legal claims | Legitimate interests in protecting legal rights, with any additional conditions required for sensitive data. |
We do not send marketing campaigns or use your information for behavioural advertising. If that changes, we will explain the proposed use and obtain consent where required. Service messages, such as verification and enquiry notifications, are distinct from marketing.
Where processing is necessary for your account, advert, enquiry or payment, withholding the required information means we cannot provide that feature. Full seller postcodes are optional, but adverts without resolved coordinates are excluded from radius-filtered results. You can browse without an account.
4. What other users and the public can see
Published adverts expose vehicle details, asking prices, seller descriptions, processed photographs, outward postcode areas and saved MOT information. Sold advert pages remain public with a sold notice, even though removed from search. Public pages and photographs may be indexed, copied or shared by other people and search engines. Removal from Veramotive cannot guarantee removal of their copies.
The application does not deliberately publish your registration field, account email or full postcode. Information you include in free text or photographs can nevertheless expose those details; review uploads before publication. Seller full postcodes are encrypted in the database and stored coordinates are rounded to two decimal places for approximate distance calculations. This is not a promise that the resulting information is anonymous.
When you send an enquiry, your message and verified email address are disclosed to the seller. The seller can use them to respond directly. Subsequent exchanges outside Veramotive are not hosted by us. We also store the enquiry for the relevant account views and service administration. The seller's email address is not displayed publicly by the enquiry feature.
5. Providers and other disclosures
We disclose information only as needed for the stated purpose, with appropriate arrangements for each recipient's role.
| Recipient | Information and purpose |
|---|---|
| Stripe | Listing checkout and payment information needed to collect our fee, confirm payment, prevent payment fraud and handle payment issues. Stripe may act as a processor or independent controller for different activities; see Stripe's privacy policy. It does not handle vehicle sale funds through Veramotive. |
| DVSA | The vehicle registration submitted for an MOT lookup. We receive selected vehicle and MOT records. |
| Postcodes.io | A buyer or seller postcode submitted to resolve location for distance search. We send the postcode from our server to Postcodes.io. It is not included in the public search URL or saved as a search-history record in our application database; it is processed in the active search and may appear in relevant service-provider logs. |
| Hosting, storage, network and backup providers | Account, advert, enquiry and technical information needed to host, deliver, protect and back up the service. These providers process information on our instructions for those purposes. |
| Email and support providers | Contact details and message contents needed for verification, enquiry notifications and support, processed on our instructions. |
| Authorised staff and professional advisers | Limited access for support, moderation, maintenance, accounting or legal advice as needed for their role. |
| Authorities and parties to legal proceedings | Relevant information where disclosure is required by law or otherwise lawful and necessary to prevent harm or protect legal rights. A request alone does not automatically justify disclosure. |
We do not sell personal information. If the business is transferred or restructured, relevant information may be disclosed where necessary for our legitimate interests in arranging that transaction, subject to confidentiality, data minimisation and notice of any change of controller.
Where a recipient processes information on our behalf, we require appropriate contractual protection. Where a recipient determines its own purposes, such as Stripe for some payment-security and regulatory activities, its own privacy notice also applies. This does not remove our responsibility for disclosures we make.
6. Where information is processed
Our primary website, database, photograph storage, backups and email hosting are located in the United Kingdom. Third-party services may process information in other countries, including for payment processing and technical support.
[REQUIRED BEFORE PUBLICATION: CONFIRM THE PROVIDERS AND ANY PROCESSING OUTSIDE THE UK, INCLUDING STRIPE, POSTCODE LOOKUP, PROVIDER SUBPROCESSORS AND REMOTE SUPPORT. IDENTIFY THE APPLICABLE UK ADEQUACY ARRANGEMENT OR CONTRACTUAL SAFEGUARD FOR EACH RESTRICTED TRANSFER.]
Processing outside the UK can include remote access by a service provider, even if the main database is hosted in the UK. For restricted transfers, the applicable protection must be a UK adequacy arrangement or another lawful transfer mechanism. Contractual safeguards may include the UK International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with any required assessment and additional measures.
Contact us using section 1 for details of a transfer affecting your information and a copy of the relevant safeguards. We may redact confidential information while explaining the protection that applies.
7. Retention and deletion
We retain information for the purposes described in this policy, not indefinitely simply because storage is available. Retention depends on the service involved, whether the information is still needed, and any applicable legal obligation or specific dispute. We use these criteria:
| Records | How we decide how long to keep them |
|---|---|
| Account and drafts | Whether you still use the account or need a saved draft, whether you request closure or deletion, and whether any linked payment, enquiry or complaint remains unresolved. Inactive accounts and abandoned drafts must not be retained without an ongoing need. |
| Adverts, photographs and MOT snapshots | Whether the advert is live, whether a sold record is still needed by the parties, and whether a complaint or legal claim requires evidence. Marking an advert sold does not automatically remove its public page. You can ask us to remove it; public display and private evidential retention are considered separately. |
| Enquiries and support | Whether the enquiry or support matter is active, whether follow-up is reasonably needed, and whether particular correspondence is required for an unresolved complaint or claim. We do not need to retain every message just because an accounting record is required. |
| Listing payments and accounting | The record-keeping period required by the tax and accounting rules applicable to the operator, measured from the relevant accounting period, and any unresolved refund, payment dispute or legal hold. |
| Moderation and security records | The nature and seriousness of the incident, whether the risk of repeated abuse remains, and whether evidence is required for an active investigation or claim. Records are reviewed when restrictions or investigations end. |
| Session and diagnostic records | The period needed to maintain the requested session, investigate an error or respond to a security incident. Cookie expiry is described in section 8; expiry of a cookie is not necessarily deletion of a server log. |
| Backups | The recovery period needed to restore the service following an incident. Deleted information may remain in restricted backups until those copies are overwritten or expire; it is not used for ordinary business purposes, and relevant deletions must be reapplied if a backup is restored. |
If a claim, investigation or legal obligation requires particular records for longer, we restrict their use to that need and review retention when it ends. When information is no longer required, it is deleted or irreversibly anonymised. We may retain anonymous statistics that no longer identify anyone.
You can request account closure or erasure using section 1. We will explain any information we need to retain and why. Removing an advert from public view is different from deleting all associated records. Copies held independently by buyers, sellers or other recipients are subject to their own obligations.
8. Cookies and similar technologies
Cookies are small files stored by your browser. We use session and request-security cookies to maintain your session, keep you signed in and help prevent unauthorised requests. These are used to provide and protect the service you request, rather than to track you for advertising.
| Technology | Purpose | Duration |
|---|---|---|
| Veramotive session cookie | Links your browser to its session, including sign-in state and service messages. | [REQUIRED BEFORE PUBLICATION: CONFIRM PRODUCTION SESSION COOKIE NAME AND EXPIRY/RENEWAL BEHAVIOUR]. |
| Request-security cookie, where set | Allows the application to check that a request belongs to the expected browser session. | [REQUIRED BEFORE PUBLICATION: CONFIRM WHETHER XSRF-TOKEN IS SET AND ITS LIFETIME; REMOVE THIS ROW IF ABSENT]. |
When you follow a link to Stripe's hosted checkout, Stripe may use its own cookies and similar technologies to provide and secure that payment service. Its privacy and cookie information is available from checkout and Stripe's privacy centre.
We do not currently use optional advertising or analytics cookies in the application. If we introduce technologies requiring consent, we will explain them and provide a choice before they operate, with an equally accessible way to withdraw consent. Refusing optional technologies will not prevent access to the core service.
Your browser settings allow you to remove or block cookies. Blocking session or security cookies may prevent sign-in, enquiries or other requested features. Clearing browser cookies does not delete records already held by us. Contact us if you need help exercising a data protection right.
9. Your rights and complaints
Depending on the circumstances, you have rights to:
- Access your personal information and receive a copy.
- Correct inaccurate or incomplete information.
- Request erasure or restrict how information is used.
- Receive a portable copy of information you supplied where processing is automated and based on consent or contract.
- Object to processing based on legitimate interests, including reasons relating to your situation. We must stop unless we have a valid legal reason to continue.
- Withdraw consent where we rely on it, without affecting the lawfulness of earlier use.
These rights have legal conditions and exceptions. You may also have rights relating to significant automated decisions, including human intervention and the ability to challenge a decision. Section 10 explains our use of automation.
Requests about your information
Use the contact details in section 1. You do not need to use a special form or legal terminology. We may ask for proportionate information to verify your identity or clarify a request where needed. Requests are normally free. If the law permits a fee or refusal, we will explain the reason.
We respond without undue delay, normally within one month. Where the law allows extra time for a complex request or multiple requests, we will tell you within the applicable initial period and explain why. Any permitted pause for necessary clarification or identity verification will be explained. We will also explain any refusal and how you can challenge it.
Privacy complaints
If you are concerned about how we use your information or handle a rights request, contact us using section 1. Tell us what happened and how you would like us to resolve it. We will acknowledge your complaint within 30 days, investigate without undue delay, keep you appropriately informed and explain the outcome.
You have the right to complain to the UK Information Commissioner's Office through the ICO complaints service, by calling 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. The ICO normally expects you to raise the matter with the organisation first. This does not remove your right to seek a remedy through the courts.
10. Security, children and automated decisions
We use access controls, password hashing, processed photo uploads and encryption of stored full seller postcodes. We limit access to private records according to role. No system can guarantee absolute security. Contact us promptly if you suspect misuse of your information or account.
Accounts, adverts and enquiries are intended for adults aged 18 or over. We collect an adult declaration, not proof of age. If you believe a child has supplied information, contact us so we can assess and respond appropriately. An age restriction does not remove our obligations where children access the service.
We use automated checks for account and advert eligibility, fee calculations and search filtering. These include checking email verification, adult declarations, advert completeness and payment status. We do not use these processes to make solely automated decisions with legal or similarly significant effects on you. Stripe may carry out its own payment and fraud checks under its privacy policy. You can contact us about a restriction or error and request human consideration.
11. Changes
We will date updated versions of this policy and bring material changes to your attention where appropriate. New purposes will be assessed for lawfulness and explained before use, with consent obtained where required.