This policy explains what personal data Sell Your Toyota collects, why we collect it, how long we keep it, and your rights under UK GDPR.
Who we are
Sell Your Toyota (the "company", "we", "us") is a UK business based at 238-240 Bethnal Green Road, London E2 0AA. We are registered with the Information Commissioner's Office as a data controller (ICO registration in progress).
What we collect
- Vehicle data: registration, mileage, declared condition, finance status
- Contact data: name, email, phone, address, postcode
- Identity data: photo ID and V5C at point of purchase only
- Payment data: bank details to make the transfer (held for one settlement cycle, then redacted)
- Usage data: anonymised analytics (only if you accept analytics cookies)
- Consent records: timestamp, IP, user-agent, exportable on ICO request
- Public register data: what we find when we check your name or email domain against public registers, principally Companies House
Why we collect it
To value, contact, pay, and provide after-sale support to you, and to comply with our legal obligations as a UK motor trade buyer (V5C verification, Companies House & FCA records where applicable, anti-money-laundering checks).
Checks against public registers
When you send us an enquiry we may check your name and your email domain against public registers, mainly the Companies House officer index, to work out whether you are selling as a private individual or as a business. That distinction changes the VAT treatment of a sale and which consumer rights apply to it, so we need to know before we make you an offer.
We rely on our legitimate interests for this. We only use sources that are already public, the result is seen only by our own staff and never published, and no decision about your offer is made automatically on the strength of it. A name on a public register is not proof of identity, so anything we find is treated as a prompt to ask you rather than a conclusion about you. You can object at any time using the contact details below.
How long we keep it
- Driver leads: 3 years from last activity
- Marketplace seller accounts: 12 months inactive, then anonymised
- Message logs (email + SMS): 6 months
- Sale records (V5C, settlement statements): 6 years to satisfy HMRC and DVLA obligations
Beyond these windows, data is automatically purged.
Who we share it with
The dealers and buyers described below, and the processors strictly required to deliver the service. Nobody else:
- Trade and private buyers. Three different things may be shared, depending on the stage:
- An alert to the dealer network we work with, sent when your enquiry arrives, before any offer is made. It describes the vehicle: make, model, year, fuel, colour, mileage, registration, MOT status and the town it would be collected from. It does not include your name, email address, phone number or postcode, so a dealer cannot contact you. If one is interested they quote a reference back to us, we speak to you, and we come back to them. You always deal with us.
- A general listing to trade contacts, sent only once we have agreed to buy your vehicle and are arranging its onward sale or collection: make, model, year, fuel, colour, a mileage band rather than the exact reading, and the general area it would be collected from. It carries no name, phone number, email address or registration.
- Full details to our own buyers, sent only once we have agreed to buy your vehicle, which do include your name, phone number, registration and postcode, so the buyer can complete the purchase and arrange collection with you.
- Payment provider (UK bank) for the bank transfer at sale
- Cloud host (Vercel)
- Database (Supabase, EU region)
- Email and SMS provider (Brevo, EU region)
- Image hosting (Cloudinary) when you upload optional vehicle photos with your enquiry
- Spam protection (Google reCAPTCHA) on enquiry forms
- Product analytics (Google Analytics 4 with IP anonymisation, and Microsoft Clarity for anonymised session insights) — statistics cookies, only with your consent. We never link analytics data to your name, email, or registration.
- Google Ads measurement (first-party, only with consent) — we send the conversion event so we can measure whether a paid ad led to your enquiry. No personal data is passed to Google Ads.
- Meta (Facebook) measurement (first-party, only with consent), when a Meta paid campaign is connected — hashed (one-way) email and phone may be sent to Meta for Conversions API matching. Never re-sold.
- Government APIs (DVLA, DVSA) for vehicle verification
We never sell your data.
Your rights
Under UK GDPR you have the right to access, correct, port, restrict, or delete your data, and to withdraw consent at any time. Use the self-service form below, we'll acknowledge by email immediately and complete the request within 30 days.
Prefer email? Send to enquiries@sellyourtoyota.co.uk with the subject "Subject Access Request".
Marketing
We separate transactional messages (booking confirmations, payment trackers) from marketing (re-engagement, market updates). You consent to each channel separately. STOP on SMS or unsubscribe in email is honoured server-side within minutes.
Cookies
See our cookie policy for the categories we use, who sets them, and how to manage your choices.
Complaints
Please raise concerns with us first, we'll act within 30 days. You also have the right to complain to the ICO at ico.org.uk.