Privacy Notice
Last updated: May 2026. Effective: May 2026.
Production-quality starting point grounded in UK GDPR, the Data Protection Act 2018, and PECR. Final review by a UK data protection solicitor required before publication.
1. Who we are
Vansold is operated by New Reg Limited, registered in England and Wales (company no. 03143909). Registered office: Unit 5, 117 Liverpool Road, Longton, Preston, PR4 5AA. We are the data controller for personal data collected on vansold.co.uk.
For privacy-related questions:
- Contact form: vansold.co.uk/contact (select "Privacy / GDPR / data request")
- Post: Data Protection, New Reg Limited, Unit 5, 117 Liverpool Road, Longton, Preston, PR4 5AA
New Reg Limited is registered with the UK Information Commissioner's Office (ICO registration number: [to be confirmed]).
2. The data we collect about you
| Category | Examples | Source |
|---|---|---|
| Identifiers | First/last name, email, mobile | You |
| Vehicle data | VRM, postcode, make, model, year, fuel type | Reg + postcode entered by you; remaining fields retrieved from DVLA / vehicle data API |
| Technical data | IP, device, browser, OS, time zone, referring URL | Captured automatically |
| Usage data | Pages, time on page, conversion events | Captured automatically |
| Marketing preferences | Whether you have consented | You |
| Quote and transaction data | Price quoted, acceptance, route | Generated when you request a quote |
We do not collect: special category personal data, criminal offence data, or financial / banking data. Bank details for payment are entered on Car.co.uk's systems after you accept an offer, never on Vansold.
3. How we use your data, purposes and lawful bases
We process your personal data only where we have a lawful basis under UK GDPR Article 6:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Generate your quote and route to the appropriate exit | All identifiers, vehicle data, postcode | Article 6(1)(b), performance of a contract you have requested |
| Pass details to Car.co.uk for acceptance, collection, and payment | All identifiers, vehicle data, postcode | Article 6(1)(b) |
| Pre-fill your reg on Trader.co.uk if you choose listing | VRM only | Article 6(1)(b) |
| Improve the website, fix bugs, prevent fraud | Technical, usage | Article 6(1)(f), legitimate interests |
| Send marketing communications | Email, mobile, marketing preferences | Article 6(1)(a), consent (withdrawable) |
| Regulatory and legal obligations | Quote and transaction data | Article 6(1)(c), legal obligation |
4. Automated decision-making
When you submit a reg and postcode, our systems pass that data to the Car.co.uk pricing engine, which automatically generates a price for your vehicle. This is automated decision-making within the meaning of UK GDPR Article 22, but it does not produce legal or similarly significant effects on you, you are free to accept the price, reject and list on Trader.co.uk instead, or simply not respond. There is no penalty for any of these choices.
You have the right to request human review of the price or contest the outcome. Use the contact form and select "Privacy / GDPR / data request".
5. Who we share your data with
| Recipient | What | Why | Role |
|---|---|---|---|
| Car.co.uk (New Reg Ltd) | All identifiers, vehicle data, postcode | Quote, booking, payment, collection | Joint controller |
| Trader.co.uk (New Reg Ltd) | VRM only (URL parameter) | Pre-fill listing if you reject quote | Joint controller |
| DVLA / vehicle data API | Reg + postcode | Retrieve make/model/year/fuel | Processor |
| Supabase Inc. | All collected data | Storage | Processor |
| Netlify Inc. | Technical data only | Hosting | Processor |
| Google Analytics (Google Ireland Ltd) | Anonymised usage data | Site performance | Processor |
| Microsoft Clarity (Microsoft Corp) | Session recordings, heatmaps | UX improvement | Processor |
We do not sell your personal data. We do not pass your details to third parties for their own marketing.
6. International transfers
Where the processors above operate outside the UK, transfers are subject to appropriate safeguards under UK GDPR Article 46 (UK SCCs / IDTA / adequacy decisions where applicable).
7. How long we keep your data
| Data type | Retention period | Reason |
|---|---|---|
| Lead data (no quote) | 6 months | Customer service window |
| Lead + quote (not accepted) | 24 months | Seasonal remarketing, complaints |
| Lead + quote + acceptance | 7 years | UK financial record-keeping |
| Marketing consent records | 6 years | PECR proof of consent |
| Technical and usage data | 26 months | Trend analysis |
8. Your rights
- Access, copy of personal data we hold.
- Rectification, correct inaccurate or incomplete data.
- Erasure, delete your data ("right to be forgotten"), subject to legal obligations.
- Restrict processing, limit how we use your data while a dispute is resolved.
- Data portability, receive your data in a machine-readable format.
- Object, object to processing based on legitimate interests, including marketing.
- Withdraw consent, at any time.
- Not be subject to automated decision-making, see Section 4.
To exercise any of these rights, use the contact form and select "Privacy / GDPR / data request". We will respond within one calendar month. You also have the right to complain to the ICO at ico.org.uk or 0303 123 1113.
9. Security
TLS 1.3 in transit, encryption at rest, access controls, audit logs, and processor security review. If we ever experience a personal data breach that is likely to affect your rights, we will notify the ICO within 72 hours and contact you directly where required.
10. Cookies
Read alongside our Cookie Policy.
11. Changes to this notice
Material changes will be highlighted on the home page for 30 days. The "Last updated" date above always reflects the current version.