This policy explains what personal data MotorSignet collects, why we collect it, how long we keep it, and your rights under UK GDPR.
Who we are
MotorSignet (the "company", "we", "us") is a UK business based at 43 Berkeley Square, London W1J 5AP, United Kingdom, and the data controller for the personal data described in this policy, subject to UK GDPR and the Data Protection Act 2018.
What we collect
- Vehicle data: registration, mileage, declared condition, finance status
- Contact data: name, email, phone, address, postcode
- Identity data: photo ID and V5C at point of purchase only
- Payment data: bank details to make the transfer (held for one settlement cycle, then redacted)
- Usage data: anonymised analytics (only if you accept analytics cookies)
- Consent records: timestamp, IP, user-agent, exportable on ICO request
- Public register data: what we find when we check your name or email domain against public registers, principally Companies House
Why we collect it
To assess, contact, pay, and provide after-sale support to you, and to comply with our legal obligations as a UK vehicle buyer (V5C verification and anti-money-laundering checks, where applicable).
Checks against public registers
When you send us an enquiry we may check your name and your email domain against public registers, mainly the Companies House officer index, to work out whether you are selling as a private individual or as a business. That distinction changes the VAT treatment of a sale and which consumer rights apply to it, so we need to know before we make you an offer.
We rely on our legitimate interests for this. We only use sources that are already public, the result is seen only by our own staff and never published, and no decision about your offer is made automatically on the strength of it. A name on a public register is not proof of identity, so anything we find is treated as a prompt to ask you rather than a conclusion about you. You can object at any time using the contact details below.
How long we keep it
- Enquiries: 3 years from last activity
- Message logs (email + SMS): 6 months
- Sale records (V5C, settlement statements): 6 years to satisfy HMRC and DVLA obligations
Beyond these windows, data is automatically purged.
Who we share it with
The dealers and buyers described below, and the processors strictly required to deliver the service. Nobody else:
- Trade and private buyers. Three different things may be shared, and none of them carries your name, email address or phone number except where stated:
- A general listing to trade contacts describing the vehicle only: make, model, year, fuel, colour, its mileage, the postcode it would be collected from, and the price we are asking. It carries no name, phone number, email address or registration.
- An alert to the dealers we work with, sent when your enquiry arrives. It describes the vehicle: make, model, year, fuel, colour, mileage, registration, asking price and the town it would be collected from. It does not include your postcode or address, and it does not include your name, email address or phone number, so a dealer cannot contact you. If one is interested they quote a reference back to us, we speak to you, and we come back to them. You always deal with us.
- Full details to our own buyers, which do include your name, phone number, registration and postcode, so the buyer can complete the purchase and arrange collection with you. This one happens only once we have agreed to buy your vehicle and are arranging its collection.
- Payment provider (UK bank) for the bank transfer at sale
- Cloud host (Vercel)
- Database (Supabase, EU region)
- Email and SMS provider (Brevo, EU region)
- Image hosting (Cloudinary) for vehicle photos held against your enquiry
- Messaging (WhatsApp, operated by Meta) if you choose to send us photos or messages there. Their terms apply to that conversation.
- Spam protection (Google reCAPTCHA) on enquiry forms
- Product analytics (Google Analytics 4 with IP anonymisation, and Microsoft Clarity for anonymised session insights): statistics cookies, only with your consent. We never link analytics data to your name, email, or registration.
- Google Ads measurement (first-party, only with consent): we send the conversion event so we can measure whether a paid ad led to your enquiry. No personal data is passed to Google Ads.
- Meta (Facebook) measurement (first-party, only with consent), when a Meta paid campaign is connected; hashed (one-way) email and phone may be sent to Meta for Conversions API matching. Never re-sold.
- Government APIs (DVLA, DVSA) for vehicle verification
- Postcode lookup (postcodes.io) to complete your address as you type and to work out roughly how far the vehicle is from us. Your postcode, or the part of it you have typed, is sent to them. The lookup runs from your browser as you type, and again on our server when your enquiry is saved.
- Public transport routing (Transitous) to estimate how our team would reach you. It receives an approximate location derived from your postcode, never your name or contact details.
We never sell your data.
Your rights
Under UK GDPR you have the right to access, correct, port, restrict, or delete your data, and to withdraw consent at any time. Use the self-service form below, we'll acknowledge by email immediately and complete the request within 30 days.
Prefer email? Send to hello@motorsignet.co.uk with the subject "Subject Access Request".
Marketing
We separate transactional messages (booking confirmations, payment trackers) from marketing (re-engagement, market updates). You consent to each channel separately. STOP on SMS or unsubscribe in email is honoured server-side within minutes.
Cookies
See our cookie policy for the categories we use, who sets them, and how to manage your choices.
Complaints
Please raise concerns with us first, we'll act within 30 days. You also have the right to complain to the ICO at ico.org.uk.