Privacy Policy

1. Data Controller Identification

CarWebb is committed to protecting and respecting your privacy in strict compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

The statutory Data Controller responsible for your personal data is:

• Legal Entity: CARWEBB LTD
• Company Registration Number: 17427407 (Registered in England and Wales)
• Registered Office: 334 Slade Lane, Manchester, United Kingdom, M19 2BL
• Data Protection Enquiries: support@carwebb.com

2. Lawful Bases for Processing (UK GDPR Article 6)

We process personal data only when a recognized lawful basis applies:

• Contract Performance (Art. 6(1)(b)): To create and manage your user account, publish vehicle listings, and enable buyer-seller communications.
• Legitimate Interests (Art. 6(1)(f)): To prevent fraudulent listings, secure our platform infrastructure, enforce our Terms of Service, and improve marketplace reliability.
• Legal Obligation (Art. 6(1)(c)): To comply with statutory financial accounting duties, anti-money laundering obligations, and lawful requests from UK law enforcement or regulatory authorities.
• Consent (Art. 6(1)(a)): For optional non-essential analytics storage and marketing communications, which can be withdrawn at any time.

3. Categories of Personal Data Collected

• Account & Identity Data: Full name, email address, contact telephone number, and dealer commercial credentials.
• Vehicle & Listing Data: Vehicle Registration Mark (VRM), mileage, vehicle history details, photographs, MOT status, and asking prices.
• Communication Records: Direct in-app messages between buyers and sellers, appointment schedules, and customer support correspondence.
• Financial & Payment Data: Payment status, invoice numbers, and Stripe customer identifiers. We do not store raw credit/debit card numbers on CarWebb servers; card transactions are tokenized and processed directly by Stripe Payments UK Ltd.
• Technical & Usage Data: IP address, browser type, operating system, and session interaction timestamps.

4. Third-Party Sub-Processors

We share data with vetted third-party service providers acting as sub-processors under binding data processing agreements:

• Supabase Inc: Managed cloud database and user authentication infrastructure.
• Stripe Payments UK Ltd: FCA-regulated payment processing and dealer billing infrastructure.
• Cloudflare Inc: Content delivery network (CDN), DDoS mitigation, and SSL/TLS security.
• Google / Gemini API: AI-assisted vehicle description drafting and specification matching, subject to mandatory human seller review prior to publication.

5. Data Retention Schedule

We retain personal data only as long as necessary to fulfill the purposes for which it was collected:

• User Accounts & Listings: Maintained for the duration of your active account, and permanently erased within 30 days of a verified account deletion request.
• Financial Transactions & Invoices: Retained for 7 years to satisfy statutory HMRC accounting and tax requirements.
• Enquiry & Message Logs: Retained for 2 years to assist with dispute conciliation, fraud investigation, and safety audits.
• Marketing & Non-Essential Consent Records: Retained until consent is updated or withdrawn.

6. Your Statutory Rights Under UK GDPR

Under UK data protection law, you have enforceable legal rights regarding your personal data:

• Right of Access (Subject Access Request): You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You may request that incorrect or incomplete data be corrected.
• Right to Erasure ('Right to be Forgotten'): You may request deletion of personal data where no overriding legal obligation requires retention.
• Right to Restrict Processing: You may request that we suspend processing your data in certain scenarios.
• Right to Data Portability: You may request a machine-readable copy of data provided under contract or consent.
• Right to Object: You may object to data processing based on legitimate interests or direct marketing.

7. Subject Access Request (SAR) Procedure & Timelines

To exercise your right of access, email our Data Protection team at support@carwebb.com with details of your request.

In accordance with statutory UK GDPR guidelines, CARWEBB will respond to your request without undue delay and within one month of receipt. In complex cases or where multiple requests are made, this period may be extended by up to two additional months, in which case we will notify you of the extension and reasons within the initial month. We do not charge a fee for standard access requests.

8. Supervisory Authority & Right to Complain

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the UK supervisory authority:

• Information Commissioner's Office (ICO)
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Telephone: 0303 123 1113
• Website: https://ico.org.uk