1. Who we are
Auto Insights Limited ("Auto Insights", "we", "us") is the data controller for the personal data described in this policy. We are a company registered in England and Wales, company number 15035802, with a registered office at 5 Brayford Square, London, E1 0SG, United Kingdom.
We provide UK used-vehicle valuation and market data to business customers. You can reach us about anything in this policy at sales@autoinsights.co.uk.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
2. Data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Business contact data | Name, job title, employer, work email address, telephone number, correspondence with us | You, when you enquire, sign up or email us |
| Account and access data | User name, hashed credentials, API keys, permissions, sign-in timestamps and IP address | Created when an account or key is issued |
| Usage data | Requests made to our API and platform, endpoints called, search terms, volumes, error logs | Generated automatically as you use the service |
| Device and technical data | IP address, browser type and version, operating system, referring page | Your browser, our servers and our hosting provider |
| Billing data | Billing contact, purchase order references, invoice and payment records | You and our payment provider |
| Marketing preferences | Whether you have subscribed to or opted out of our updates | You |
We do not seek to collect special category data, and we ask that you do not send it to us. We do not carry out automated decision-making that has legal or similarly significant effects on individuals.
3. Purposes and lawful bases
| Purpose | Lawful basis | Notes |
|---|---|---|
| Providing the valuation platform and API | Contract | Necessary to deliver what you have subscribed to |
| Account administration, support and billing | Contract | Includes responding to your requests |
| Service security, abuse prevention and rate limiting | Legitimate interests | Protecting the service and other customers |
| Improving accuracy, models and analyst review processes | Legitimate interests | Aggregated and de-identified wherever possible |
| Business-to-business marketing of related services | Legitimate interests / consent | Opt-out in every message; consent where PECR requires it |
| Meeting legal, tax and accounting obligations | Legal obligation | Includes retaining records for statutory periods |
Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. You can ask us for a summary of that assessment.
4. Vehicle data and personal data
Most of the data we hold is about vehicles rather than people: registrations, specifications, mileages, advertised prices and sale results. A vehicle registration mark can be personal data when it is combined with information that identifies an individual keeper. We therefore:
- hold registration and transaction data for valuation purposes only, and never to build profiles of individual keepers;
- do not receive keeper names or addresses from the DVLA or from any other source, and do not attempt to link vehicles to individuals;
- treat lookups submitted by our customers as our customers' data — where a customer submits a registration relating to an identifiable individual, that customer is the controller and we act as their processor for that lookup.
Where we act as a processor, we do so under written terms that set out the subject matter, duration, nature and purpose of the processing, and we only act on the customer's documented instructions.
5. Who we share data with
- Service providers — cloud hosting, email delivery, error monitoring, analytics, payment processing and accounting, each under a written data processing agreement.
- Professional advisers — auditors, accountants and lawyers, where they need it to advise us.
- Authorities — where we are legally required to disclose data, or to establish, exercise or defend legal claims.
- Acquirers — if we reorganise, merge or sell part of our business, under confidentiality obligations.
We do not sell personal data, and we do not share it with third parties for their own marketing.
6. International transfers
We aim to keep personal data in the United Kingdom or the European Economic Area. Where a provider processes data outside those areas, we rely on UK adequacy regulations or on the International Data Transfer Agreement — or the EU Standard Contractual Clauses with the UK Addendum — together with a transfer risk assessment. You can request details of the safeguards that apply.
7. Retention
| Data | Retained for |
|---|---|
| Enquiries that do not become accounts | 24 months from the last contact |
| Account and access records | The life of the account, then 12 months |
| API and platform request logs | 13 months, then aggregated |
| Security and audit logs | 12 months |
| Invoices and financial records | 7 years, as required by UK tax law |
| Marketing preferences and opt-outs | Kept indefinitely so we can honour them |
8. Security
Access to personal data is limited to staff who need it, protected by individual accounts, multi-factor authentication and least-privilege permissions. Data is encrypted in transit using TLS and at rest by our hosting providers. API keys are issued per environment and can be rotated or revoked by you at any time. We log administrative access, review our suppliers, and maintain a documented incident response process — including notifying the Information Commissioner's Office within 72 hours where a breach is reportable.
9. Your rights
Subject to the conditions in the UK GDPR, you have the right to:
- be informed about how we use your personal data;
- request a copy of the personal data we hold about you;
- have inaccurate data corrected, and incomplete data completed;
- ask us to erase data where we no longer have a reason to hold it;
- ask us to restrict processing while a concern is investigated;
- receive certain data in a portable, machine-readable format;
- object to processing based on our legitimate interests; and
- opt out of direct marketing at any time.
Email sales@autoinsights.co.uk and we will respond within one month. We may ask for proof of identity, and will explain any extension or refusal.
10. Cookies
Our website uses a small number of cookies and similar technologies. Non-essential cookies are set only with your consent, which you can change at any time. See the cookie policy for the full list.
11. Children
Our services are sold to businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16.
12. Changes to this policy
We may update this policy as our services or the law change. The "last updated" date above always reflects the current version, and we will tell account holders by email about material changes before they take effect.
13. Contact and complaints
Write to the Data Protection Lead, Auto Insights Limited, 5 Brayford Square, London, E1 0SG, or email sales@autoinsights.co.uk.
If you are unhappy with our response you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF (ico.org.uk). We would appreciate the chance to put things right first.