Carporium's Privacy Notice
Updated 01 August, 2025
Carporium (located at 1-3B Ladypool Road) is committed to protecting your privacy and handling your personal data in accordance with the UK Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR) . This Privacy Policy explains what personal information we collect, how and why we use it, who we share it with, how long we keep it, and your rights under the law . It applies to data we collect both in person at our dealership and via our website. For the purposes of UK GDPR, Carporium is the data controller of your personal information.
We collect personal data that is necessary to serve you as a car dealership. “Personal data” means any information related to an identified or identifiable person[4]. This includes:
-
Identity and contact information: your name, postal address, phone number, email address, date of birth, and similar details (e.g. national insurance or other government identifiers).
-
Identity documents: copies of driving licenses, passports, utility bills or other ID when needed to verify your identity or eligibility (for example, for test drives or anti-fraud checks)[5].
-
Vehicle and transaction details: information about the vehicle(s) you buy, sell or service (make, model, registration number, VIN), service history, insurance or finance details, and transaction information.
-
Payment information: banking or card details necessary to process payments (if you pay by bank transfer, debit/credit card, or finance). Note: we do not store full card details on our systems; payments are handled securely via our payment processor.
-
Location and delivery information: your delivery or billing address, and details needed to deliver or collect vehicles.
-
CCTV footage: images or video captured by our on-site CCTV cameras (collected for security purposes)[6].
-
Optional or additional data: any other information you choose to provide to us voluntarily (for example, feed back, contact preferences, or additional contact numbers). We will always make clear which information is required (to fulfill our contract or legal obligations) and which is optional[7].
We collect this information directly from you when you communicate with us, visit our dealership, use our web site or complete forms. We may also obtain data from third-party sources with your consent (for example, credit reference agencies) or from publicly available sources, but only as permitted by law. We do not collect special category data (e.g. health, racial or political data), and we do not knowingly collect datfrom children without parental involvement.
-
We use your personal information to serve you as our customer, in compliance with the law[1][2]. In particular, we process data on the following lawful bases: contract performance, legal obligation, legitimate interests, and (where needed) your consent. Specifically:
-
To fulfill orders and services (Contract): We use your data to process and deliver any vehicle, parts or ser vice you order. This includes authorizing payments, registering the vehicle in your name, providing any warranty or after-sales service, and responding to your inquiries (e.g. answering questions about a vehicle or arranging a test drive)[8]. For example, if you buy a car from us, we need your contact and payment details to complete the sale, and your address to deliver the vehicle.
-
To comply with legal obligations: We process data as required by law. For instance, UK anti-money laundering regulations may require us to verify your identity (hence collecting ID documents), and we must keep accurate sales records for tax and accounting purposes[9]. We also use your information to register your vehicle with the DVLA or to notify relevant authorities after a sale, as the law requires. We will retain records (such as sales contracts or finance agreements) for the legally-required period (typically 6 years for financial records) and no longer than necessary[10].
-
With your consent: Where applicable, with your permission we will use your data for activities such as contacting you about finance or insurance for a purchase, or sending you promotional news and special offers in the way you have requested (email, SMS, post, etc.)[11]. For example, if you agree, we may send you in formation about upcoming sales or events. You can withdraw consent to marketing communications at any time (see Your Rights below)[12].
-
For legitimate interests: We may process your data when it is in our legitimate interest as a small business and does not unduly prejudice your rights. Examples include: maintaining security and preventing fraud (e.g. using CCTV to protect our premises and staff)[13]; improving our services and customer relations (e.g. ana lyzing sales data to better meet customer needs); enforcing or defending our legal rights (e.g. to collect pay ment or pursue claims); or managing our IT systems and operations (ensuring accurate customer records, notifying you of important updates to terms or policies)[13]. We also use data to remind you about service or MOT appointments, as this helps keep vehicles safe and maintains warranties (a legitimate interest in ongoing customer service)[13]. Under UK GDPR, we carefully balance these interests against your privacy rights and will not use your data beyond what you would reasonably expect.
If you fail to provide certain personal data when requested (for example, identification or payment information), we may be unable to fulfill our contract with you (e.g. complete a sale or test drive)[14]. In such cases we will inform you of the consequence. We will not use your data for any purpose other than those described above unless required or permitted by law (for example, if we believe you are at risk of serious harm, or to cooperate with law enforcement).
-
We will not sell your personal data to third parties. We share information only as necessary to carry out the ser vices you request, or as required by law[13][3]. Typical disclosures include:
-
Service providers and subcontractors: We may share data with companies who assist us in running our business (for example, vehicle delivery firms, payment processors, IT and CRM software providers, or marketing agencies). These parties are under contract to keep your data confidential and secure.
-
Financial and insurance partners: If you request financing or insurance through us, we will share relevant information with lenders or insurers (with your consent) to secure quotes or process agreements[11].
-
Vehicle manufacturers or networks: If applicable, we may share information with a car manufacturer for warranty or recall purposes[13].
-
Legal and government authorities: We will disclose personal data if required by law, regulation or legal process. For example, we cooperate with police or fraud investigations and supply data to HM Revenue & Customs or the DVLA when legally required.
-
Potential buyers of our business: If Carporium (or its assets) is sold, your personal data might be transferred to the new owner, but only if that entity agrees to keep it protected in line with this policy.
We require all third parties to take appropriate security measures and only process your data in accordance with our instructions. Wherever we share data, we limit it to what is necessary and applicable, and we trust these parties to comply with UK GDPR.
-
Our premises are monitored by CCTV cameras for security and safety (protecting staff, customers and proper ty). This means we may collect video or images of individuals on our site[6]. The CCTV system is clearly sign posted as required by law. We use footage only for legitimate purposes – for example, to prevent and investigate theft, assault or other incidents. Access to CCTV footage is restricted to authorized personnel, and recordings are kept secure (e.g. on password-protected systems). We do not retain footage longer than necessary for these purposes, in line with the data minimisation and storage limitation principles of UK GDPR[10]. For example, unless needed for an ongoing investigation, CCTV recordings are typically overwritten or deleted after a short period (often 30 days or as regulations require).
Our services are not aimed at children under 18, and we do not seek to collect data from minors. However, we do not exclude minors who accompany adults or whose parents transact on their behalf (e.g. a parent buying a car for their teenage child). If we receive personal data about a child (someone under 18), we will handle it with care. UK GDPR provides extra protection for children’s data and requires us to use clear, plain language in any information we provide to them[15]. Parents or guardians should provide consent for any data processing where required. If a child is using our services with consent, we will not process more personal data about them than is strictly needed.
We take the security of your personal data seriously. We implement appropriate technical and organizational measures (such as locked filing, access controls, firewalls, encryption, and staff training) to protect your information from unauthorized access, loss or destruction[16]. Only authorized employees and service providers with a legitimate business need have access to identifiable data.
We retain your personal information only as long as necessary for the purposes described in this policy (and as required by law)[10]. For example, transactional records (sales and finance contracts) are typically kept for at least 6 years to comply with accounting and tax rules, after which they are securely destroyed. Customer records used for warranty or service reminders may be kept as long as your vehicle is under warranty. If you withdraw consent or ask us to delete your data, we will do so if there is no overriding legal reason to retain it (for example, we might keep minimal records to demonstrate regulatory compliance, if required).
If you use our website, we may use cookies and similar technologies to enhance your experience. A cookie is a small file placed on your device that helps us recognize returning visitors and remember their preferences[17]. Cookies allow us to analyze how our website is used (for example, which pages are most visited) and to im prove functionality. We might also use cookies for advertising (to show you relevant offers) only if you consent. In accordance with the Privacy and Electronic Communications Regulations (PECR) and ICO guidance, we inform users about our cookies and obtain consent for any that are not strictly necessary[17]. You can control or disable cookies through your web browser settings; instructions are available on browsers like Chrome, Firefox, Safari, etc. Please see our separate Cookie Policy for full details on what cookies we use and how to manage them.
Under UK GDPR, you have several rights regarding your personal data. These include:
-
Right to be informed: You have the right to know how we use your data and to receive a copy of this Privacy Policy.
-
Right of access: You can request a copy of the personal data we hold about you, and other supplementary information.
-
Right to rectification: You can ask us to correct or complete any inaccurate or incomplete personal information we hold about you.
-
Right to erasure (Right to be forgotten): You can ask us to delete your personal data if there is no good rea son for us to continue processing it. (This right is not absolute; for example, we may retain data if required by law or if needed to exercise legal claims.)
-
Right to restrict processing: You can request that we limit how we process your data in certain situations (for example, while a dispute is being resolved).
-
Right to data portability: You can ask for a copy of your data in a structured, commonly used format, and have it transferred to another controller (where technically feasible and lawful).
-
Right to object: You can object at any time to processing of your data for direct marketing or on grounds relating to our legitimate interests. If you do object, we will stop processing unless we can demonstrate compelling legitimate grounds to continue.
-
Right to withdraw consent: If we rely on your consent to process data (for example, to send you marketing), you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before withdrawal[12]
If you wish to exercise any of these rights, please contact us (see below). We will respond as required by law. If you are dissatisfied with our response, you have the right to lodge a complaint with the UK Information Com missioner’s Office (ICO)[12], the UK’s independent data protection regulator. Contact details for the ICO are available on their website.
-
We may update this Privacy Policy from time to time (for example, to reflect changes in the law or our business). Any changes will be posted on our website with the date of revision. We encourage you to review this policy periodically. Your continued use of our services after any changes indicates your acceptance of the revised policy.
If you have questions about Carporium’s Privacy Policy or how we handle your personal data—including situations where a third-party service provider is acting on our behalf—or if you’d like to contact our Data Protection Officer, please get in touch. You can reach us via:
-
Our privacy contact page at carporium.co.uk/legal/privacy
-
Calling our Customer Support line.
-
Writing to us at our registered business address: Carporium Ltd (Data Controller), 11 Deakins Road, Birmingham, England, B25 8DX
-
Visiting our dealership: 1-3B Ladypool Road, Birmingham, England, B11 1XD
-
Emailing our data controller: mydata@carporium.co.uk
You can also ask us how to submit a privacy complaint, and we will be happy to help.
Carporium takes your privacy concerns seriously. A dedicated team will review your inquiry and determine the best way to address your question or issue (including requests to access or delete your personal data). Generally, we aim to respond to substantive inquiries within one week. If we need more information from you or additional time to investigate, we will let you know.
If your feedback suggests a way we could improve our privacy practices, we will update our processes as soon as reasonably possible. If a privacy issue has negatively affected you or someone else, we will work to address it with the affected person.
You may at any time—even if you are not satisfied with our response—refer your complaint to the relevant data protection authority. Upon request, we will provide information about the appropriate complaint procedures or regulatory channels that may apply to your situation.
-