Privacy policy

Who we are

Baseline Motors Ltd (“we”) is the data controller for the personal data described here. You can reach us at [email protected] or on 07936 843890.

Our registration with the Information Commissioner’s Office is in progress and the number will be published here once issued.

What we collect, and why

We collect as little as we can get away with, because data we don’t hold is data we can’t lose.

When you send us an enquiry

Your name, and whichever of an email address or phone number you chose to give us. Optionally a postcode, and whatever you write in the message. If the enquiry came from a car listing or a part-exchange valuation we also record which car, or the registration you entered.

Why: to answer you. Lawful basis: legitimate interests — you asked us a question and would reasonably expect a reply. If your enquiry leads to a purchase, the basis becomes performance of a contract.

When you buy a car from us

Your address, date of birth, driving licence details and proof of identity, because we are required to verify who we are selling a vehicle to and to notify the DVLA of the change of keeper.

Lawful basis: performance of a contract, and legal obligation (DVLA notification, and money-laundering checks on cash transactions above £9,000).

When you look up a registration

A vehicle registration is not personal data about you in itself, but we send it to the DVSA and DVLA to retrieve the vehicle’s record. We keep the result only if you go on to submit an enquiry. If you type a plate and leave, nothing is stored.

Cookies

One cookie is set for staff only: a session cookie on the private portal at /admin, so a signed-in member of staff stays signed in. It is strictly necessary, contains no personal data beyond a signed user reference, and expires after twelve hours.

We also use Google Analytics to count visits and see which cars get looked at, so we know what to buy next. It sets cookies in your browser and sends Google a record of the pages you viewed, with your IP address anonymised.

None of it loads until you agree to it. Until you answer the banner, and if you answer no, the analytics script is never requested, no cookie is set and nothing is sent to Google. Your answer is stored in your own browser, not on our systems. To change it, clear this site’s data in your browser and the banner will ask again.

Who we share it with

Nobody, for marketing. Ever. We do not sell, rent or share your details with third parties for their own purposes.

The only parties who see your data are:

• Our hosting and database providers, who store it on our behalf under a data processing agreement and cannot use it for anything else.
• The DVLA, when we notify them of a change of keeper — a legal requirement.
• Your lender, if you ask us to settle outstanding finance on a car we are buying from you, and only the details needed to do that.
• Our warranty administrator, if you take out cover, so they can register the policy in your name.

All of the above are in the UK or the EEA. We do not transfer your data outside them.

How long we keep it

• Enquiries that don’t lead anywhere: 12 months, then deleted.
• Sale records: 6 years after the sale. This is not us being acquisitive — the Consumer Rights Act gives you up to six years to bring a claim, and we need the record to be able to honour one.
• Anything we are required to keep for tax: 6 years from the end of the accounting period, per HMRC.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of everything we hold about you (a subject access request);
• correct anything that is wrong;
• delete it, where we have no continuing legal reason to keep it;
• stop or restrict what we are doing with it;
• hand it over in a portable format;
• object to processing we are carrying out under legitimate interests.

Email [email protected] and we will respond within one month. There is no charge and you do not need to give a reason.

Complaining about how we handle data

Come to us first if you can — see our complaints procedure. But you have the right to go straight to the regulator, and we would rather you did that than let something sit unresolved. The Information Commissioner’s Office can be reached at ico.org.uk or on 0303 123 1113.

Security

Passwords for the staff portal are hashed with scrypt and a per-user salt, so they cannot be read even by us. Staff sessions are signed, HTTP-only and expire after twelve hours. Access to customer enquiries is limited to named staff accounts, each with its own login — there is no shared password.

Changes to this policy

If we change how we handle your data we will update this page and change the date at the top. Material changes affecting people who have already given us data will be notified directly.