Privacy Policy | Exchange My Car

Defined terms used in this Policy

Capitalised terms used in this Policy have the meanings set out below.

Buyer Network: our network of UK-based vehicle buying companies, car dealerships, brokers and similar service providers to whom we introduce Customers (each such recipient, a Buyer).

Customer: a prospective, current or past customer of the Website who makes an enquiry, registers an account, places a request or completes a transaction.

Personal Data: has the meaning given in the UK GDPR.

Professional: an individual or business that registers with us to provide services to Customers (for example, a Buyer or other service provider).

Quote: any valuation, price, offer, estimate or other commercial information generated by a Buyer in response to information you submit.

Referral Network: our network of referral partners, introducers, agents, consultants and associated service providers.

UK GDPR: the UK General Data Protection Regulation (Regulation (EU) 2016/679 as retained in UK law).

Vehicle Data Services: our service of providing MOT history, ULEZ compliance, tax status and vehicle history information.

Website User: any individual who accesses the Website (whether or not a Customer).

1 - About us

Exchange My Car is the trading name for Exchange My Car Limited, a company registered in England and Wales (registration number 12119911), at Manufactory House, Bell Lane, Hertford, England, SG14 1BP. Our VAT number is GB 353 942 876. We are registered with the Information Commissioner's Office (ICO) under number ZB525460.

We act as the data controller for Personal Data we collect from you through the Website or in connection with our services.

2 - Who this Policy applies to

This Policy applies to anyone whose Personal Data we process, including:

Customers (including prospective and former Customers);
Professionals, including Buyers in our Buyer Network; and
Website Users.

3 - Personal Data we collect

We collect and process different categories of Personal Data depending on whether you are a Customer, a Professional or a Website User. This clause 3 explains the categories we collect, which apply to each category of individual, and where we obtain them from.

Categories of Personal Data

We may collect any of the following categories of Personal Data:

Category	What it includes
Identity Data	Your name, postcode and (where collected) date of birth, gender or other identity information you provide.
Contact Data	Your email address, telephone number and postal address.
Vehicle Data	Information about your vehicle, including registration number, mileage, declared condition, service history and other specifications.
Communications Data	The content of communications between you and us, including any images, videos or documents you upload as part of an enquiry or service request.
Marketing Preferences	The marketing permissions, consents and contact preferences you give us, including how you wish to be contacted and whether you want to receive marketing from us or from Buyers in our Buyer Network.
Account Data	Information relating to your account, including your profile generated from enquiries, usernames, passwords and other log-in credentials, activity history and any analysis we carry out on account usage.
Payment Data	Card details, billing address and other payment information collected to process a transaction.
Enquiry Data	Your draft, actual and suggested request(s), search request(s), enquiries made, and correspondence Feedback on the Website usage for Customers, and feedback, comments and ratings of Professionals
Technical Data	Information about your device and connection, including IP address, browser type, operating system, mobile carrier, device identifiers and similar technical information.
Usage Data	Information about how you use the Website, including pages visited, browsing history, time and date stamps and other interactions.
Location Data	Approximate geographical location derived from your device or from information you provide.
Professional Data (Professionals only)	Information about the services you or your employer provide through the Website, performance analysis we carry out, payment records and bank account details for paying you, and your activity history.

Which categories apply to you, and where we collect them from

The categories of Personal Data we collect, and the sources we collect them from, depend on whether you are a Customer, a Professional or a Website User.

You are a:	We collect:	From:
Customer	Identity Data, Contact Data, Vehicle Data, Communications Data, Marketing Preferences, Account Data, Payment Data, Enquiry Data, Technical Data, Usage Data and Location Data.	You directly; the Website and your device (including cookies and similar technologies); and third-party sources including the DVLA, vehicle data suppliers, social media, search engines, online maps, online marketplaces, online customer review sites and directories. Where you have been referred to us, we may also receive Personal Data from the referring member of our Referral Network.
Professional	Identity Data, Contact Data, Communications Data, Marketing Preferences, Account Data, Professional Data, Technical Data, Usage Data and Location Data.	You directly; your employer; the Website and your device (including cookies); your own website (where you have one); your CRM or customer management systems (where you connect them); and the same third-party sources listed above.
Website User	Identity Data and Contact Data (only if you provide them for example by contacting us through the Website), Communications Data, Technical Data, Usage Data and Location Data.	You directly (where you provide information); the Website and your device (including cookies and similar technologies).

Whether you must provide your Personal Data

You are not legally required to provide us with your Personal Data. However, where you submit an enquiry, request a vehicle valuation or Quote, create an account, or otherwise use our services, we will need certain Personal Data to provide those services and respond to your request.

Where information is required, we will make this clear at the point of collection. If you choose not to provide certain Personal Data, we may be unable to provide some or any of our services.

4 - How we share your Personal Data

We share your Personal Data only as set out in this clause 4. Each recipient is identified by name or category and the purpose of the sharing.

International transfers of your Personal Data

We primarily store and process your Personal Data within the United Kingdom. However, some of our staff, contractors and some of the third-party service providers we use may store or process Personal Data outside the United Kingdom, including in countries that are not subject to the same data protection laws as the UK.

Where Personal Data is transferred outside the United Kingdom, we will only do so where:

(a) the transfer is to a country which has been deemed by the UK to provide an adequate level of protection for personal data This includes transfers to countries in the European Economic Area and transfers to recipients in the United States that are certified under the UK Extension to the EU-US Data Privacy Framework; or

(b) where we have put in place appropriate safeguards to ensure that the transferred Personal Data continues to benefit from the same protection it has in the UK. The safeguards we use are specific standard contractual terms namely the International Data Transfer Agreement or The International Data Transfer Addendum.

Sharing your Personal Data with our Buyer Network

Where you submit an enquiry to value or sell your vehicle, we share the Personal Data you submit with members of our Buyer Network so that they can prepare a Quote and contact you about a potential purchase.

The Buyer Network is made up of the following categories of UK based buyer:

franchised and independent vehicle dealerships;
trade and wholesale vehicle buyers;
scrap and salvage vehicle buyers;
vehicle export and wholesale brokers;
online/instant vehicle purchase platforms; and
vehicle auction platforms.

Not every category will receive your data on every enquiry, only those Buyers whose purchasing criteria match your vehicle will receive your Personal Data and provide you with a Quote.

Each Buyer is an independent data controller of the Personal Data we share with it. Its processing of your Personal Data is governed by its own privacy notice, which you should review before relying on any Quote or communication from that Buyer.

Sharing your Personal Data with the member who referred you

We operate through a network of referral partners, introducers, affiliates, agents, consultants, and associated service providers (the “Referral Network”).

Where you have been referred to us, or where your enquiry, transaction, or account is connected with a member of our Referral Network, we may collect, use, and share relevant Personal Data with that referring member of the Referral Network for the purposes of:

administering and managing referrals;
verifying referral activity and entitlement;
onboarding and customer management;
facilitating the provision of services;
customer support and communications;
compliance, fraud prevention, and risk management;
invoicing, commission calculation, and payment administration;
business administration and operational management.

The categories of Personal Data shared may include your name; postcode; contact details; vehicle details; account or enquiry reference information; referral status; transaction or onboarding status; service usage information relevant to the referral arrangement; and other information reasonably necessary for the above purposes. We share only Personal Data that is reasonably necessary and proportionate for the relevant purpose.

Where the referring member acts as an independent data controller in respect of your Personal Data, its processing of your Personal Data is governed by its own privacy notice. You will already know the identity of the referring member, as you came to us through them.

Lawful basis

Our lawful basis for sharing your Personal Data with a referring member of the Referral Network is our legitimate interests (and theirs) in administering, verifying and paying for referral arrangements, and in providing you with continuity of service. For the underlying processing of your Personal Data by us (delivering our services to you), we rely on performance of a contract with you. Where required by law (for example, certain electronic marketing communications), we rely on your consent. Where we are required to share data with a public body, we rely on legal obligation.

Your right to object

Where we share your Personal Data with the referring member on the basis of our legitimate interests, you have the right to object to that processing at any time.

Vehicle Data Services

Our Vehicle Data Services provide you with MOT history, ULEZ compliance status, vehicle tax status and vehicle history information. We are the data controller of the Personal Data you submit to request this information.

We only share your vehicle registration number with UK based third party data providers that help us to provide the service on request. These third parties provide us with database information; analytics services; or IT processing and data storage services.

Other Recipients

We also share Personal Data with the following categories of third parties only to the extent reasonably necessary for the purposes set out below:

Suppliers: we share Personal Data with our IT support providers, payment providers (currently Stripe) , vehicle data providers, Government data services such as APIs from TfL and the DVLA, administration providers, and marketing agencies. These suppliers receive Personal Data only to the extent reasonably necessary to provide their services to us.
Email and phone platforms: We use a third party providers to send email communications (Sendgrid) and to manage telephone and SMS communications (8x8 and Twilio). Where you have consented, we may also use these providers for marketing communications.
Government bodies and regulatory bodies: we share Personal Data with HMRC and other government and regulatory bodies where required by law or to comply with our regulatory obligations. We may also share Personal Data with fraud prevention agencies to help detect and prevent fraud. These bodies act as independent controllers.
Our advisers: we share Personal Data with our lawyers, accountants, auditors, and insurance companies. Our professional advisers are subject to their professional duties of confidentiality.
We may share your Personal Data with the relevant third parties in corporate transactions in connection with any sale, merger, restructuring, refinancing or insolvency of all or part of our business, with prospective counterparties and their advisers, subject to appropriate confidentiality undertakings.

The lawful basis for each sharing activity is set out in clause 5. Processors are bound by written contracts complying with Article 28 of the UK GDPR. International transfers are subject to the safeguards set out under “International transfers” above.

5 - What we use your personal data for (Purpose and Lawful Basis)

Where we collect and process personal data, we identify both the purpose and legal basis for doing so. There are 6 possible legal bases, which are:

Consent - where we have consent from the individual to the processing of his or her personal data for one or more specific purposes.
Contract - where the processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject before entering into a contract.
Legal Obligation - The processing is necessary for compliance with a legal obligation to which we are subject.
Vital Interests - Where the processing is necessary to protect the vital interests of the data subject or another natural person.
Public Interest - Where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Legitimate Interests - Where the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Our purpose for processing	Lawful basis for using your personal data
Website users, Customers and Professionals
Corresponding with you, responding to your requests, enquiries, and/or complaints	This processing is necessary in order to take steps at your request prior to entering into a Contract. Contract performance (where correspondence relates to an existing service or agreement). Legitimate interests (to respond to your requests, enquiries and complaints and provide customer support)
Confirming and processing enquiries that you may make with us	This processing is necessary in order to take steps at your request prior to entering into a contract Contract performance (where a contract exists) Legitimate interests (to manage and respond to enquiries efficiently)
Confirming and processing purchases that you may make with us	Contract performance
Sending you service information (including direct marketing)	Contract performance (where updates are necessary to provide services to you) Legitimate interests (to keep you informed about important updates relating to your enquiry, account or use of our services) Consent in relation to direct marketing
Ensure and improve the operation and performance of the Website	Legitimate interests (to ensure the Website functions correctly and improve its functionality for the benefit of Website users)
To monitor and analyse the use of our services	Legitimate interests (to provide relevant services to you and to optimise your experience)
To facilitate the set-up and use of your account	Contract performance Legitimate interests (to grant you access to your account, where you can securely and easily access information relevant to you)
To understand and analyse how users engage with and use our services	Legitimate interests (to personalise and improve your experience and to better understand your needs and interests)
Establishing and enforcing our legal rights and obligations, and monitoring to identify and record fraudulent activity	Legal obligation Legitimate interests (to fulfil our contractual obligation where you represent your employer or organisation)
Complying with requests, orders and instructions from law enforcement agencies, regulators, any court, parties to proceedings or otherwise, deal with obligations required by law or regulators, and to ensure good governance and compliance	Legal obligation Legitimate interests (to maintain good governance and compliance where no legal obligation applies)
For our general record-keeping and relationship management	Contract performance Legitimate interests (where you represent your employer or organisation)
To keep records required by law or to evidence our compliance with laws, including tax laws, consumer protection laws and data protection laws	Legal obligation
Managing the proposed sale, restructuring or merging of any or all part(s) of our business, including to respond to queries from the prospective buyer or merging organisation	Legitimate interests (to sell or restructure any part of our business)
Resolving any complaints from or disputes with you	Contract performance Legitimate interests (to try and resolve any complaint or dispute you might raise with us and to deal with legal claims)
Customers and Professionals
To deal with your request for a service	Contract performance Legitimate interests (to fulfil our contractual obligation where you represent your employer or organisation)
To recommend suggested searches to you	Legitimate interests (to encourage you to use our services)
To take payment from you or the business you represent, or to receive services from you or the business you represent, or to deal with any complaints	Contract performance Legitimate interests (where you represent a business or organisation in connection with contractual arrangements )
To share feedback and statistics on Professionals with potential Buyers	Legitimate interests (To share feedback and statistics on Professionals with potential Customers)
To enable Professionals to provide their services through our website and otherwise to Customers who have submitted enquiries to us	Contract performance where applicable Legitimate interests (to enable Professionals to provide their services)
To onboard you as a Buyer and/or Professional	This processing is necessary in order to take steps at your request prior to entering into a contract Contract performance Legitimate interests (to administer onboarding and business relationships where you represent an organisation)

Legitimate interests

Where we rely on legitimate interests under Article 6(1)(f) of the UK GDPR, the specific interests we pursue include:

operating, improving, securing and promoting our comparison platform and the services we offer to Customers and Professionals;
sharing your enquiry information with our Buyer Network so that Buyers can prepare Quotes and contact you;
administering, verifying and paying for arrangements with members of our Referral Network;
marketing our own similar services to existing Customers (subject to your right to opt out at any time);
preventing and detecting fraud, money laundering and other unlawful activity;
carrying out research, analytics and product development;
responding to enquiries, complaints, audits and regulatory or legal requests; and
protecting and enforcing our legal rights, including the establishment, exercise or defence of legal claims.

6 - How long do we keep your Personal Data?

We will only keep your Personal Data with legal and regulatory requirements and for no longer than is necessary to fulfil the purposes set out in this Policy.

We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and applicable legal, regulatory or other requirements.

We are committed to ensuring your data is kept secure. We review our security systems on a regular basis. This is to enable us to refer to our records for the purpose of contract performance, legitimate interests, legal obligations, accounting or for statistical reasons.

If you have consented to receiving marketing communications from us, we will store your Personal Data for marketing purposes until you unsubscribe from receiving marketing communications from us.

7 - Your rights

As a data subject you have rights in relation to your Personal Data, these are:

Right to access: you have the right to request copies of the personal information we hold about you at any time.

Right to rectification: you have the right to request that any information be corrected that you believe is inaccurate or to complete any information that you believe is incomplete.

Right to erasure: you have the right to request that we erase your personal information under certain conditions.

Right to restrict processing: you have the right to request that we restrict how we use your personal information under certain conditions.

Right to object to processing: you have the right to object to the collection and use of your personal information at any time.

Right to data portability: you have the right to obtain a copy of your personal information in a commonly used and machine readable format.

Right to be informed: you have the right to be informed about the collection and use of your Personal Data.

Right to Withdraw Consent: Where we rely on your consent to process your Personal Data, you have the right to withdraw that consent at any time.

8 - Automated decision-making and profiling

If a decision has been made electronically, you have the right to contest this decision.

9 - How you can lodge a complaint about the use of your personal information

You can lodge a complaint with us directly by contacting us as set out in the section below “Contact Us”.
You also have the right to lodge a complaint directly with the Information Commissioner's Office (ICO).
The ICO is the regulator who makes sure that we use your personal information in a lawful way.
You can lodge a complaint with the ICO by following this link: https://ico.org.uk/concerns/ or calling the ICO on 0303 123 1113.

10 - Cookies

We use cookies and similar technologies on the Website. The cookies we use, the categories they fall into and how to manage them are described in our Cookies policy at https://www.exchangemycar.co.uk/cookie-policy.

You may accept or reject non-essential cookies through the cookie banner that appears when you first visit the Website, and you may change your preferences at any time using the same banner.

11 - Contact us

If you have any questions about this Policy or how we use your Personal Data, please contact Karina Freitas, by:

Email: karina@exchangemycar.co.uk
Telephone: 01992 352 001
Post: Karina Freitas, Exchange My Car Limited, Manufactory House, Bell Lane, Hertford, England, SG14 1BP