Carwama Privacy Policy

1. Who We Are

Autonet Limited ("Carwama", "we", "us", "our") is the data controller for personal data processed through the Carwama platform, comprising the trader marketplace and the ops.carwama.com operations portal. We are registered with the Information Commissioner's Office (ICO) under registration number [INSERT ICO REGISTRATION NUMBER — register at ico.org.uk before go-live if not already done].

2. Scope

This policy applies to personal data we collect from: (a) Traders and their representatives who register for and use the Platform; (b) individuals whose data appears in vehicle listings or enquiries; and (c) visitors to our websites. It covers both ops.carwama.com and the trader-facing platform.

3. What Personal Data We Collect

Account and business data: name, job title, business name, address, phone number, email, Companies House registration number, VAT number.

Identity verification data: director/representative name, date of birth, and identity document details, collected as part of onboarding and KYC/KYB checks (including via our payment processor, Stripe).

Transaction data: listings created, enquiries sent and received, vehicles bought or sold, communications between Traders.

Payment data: processed directly by Stripe; we receive limited data such as payment status, amount, and last four digits of a card, but do not store full card numbers.

Technical and usage data: IP address, device and browser type, log data, and cookies (see section 11).

Support communications: records of correspondence when you contact our support team.

4. How We Use Your Data and Our Legal Basis

To create and administer your Account, and to provide the Platform — necessary for performance of our contract with you (UK GDPR Art. 6(1)(b)).

To verify your identity and business, and to prevent fraud and money laundering — necessary for compliance with legal obligations (Art. 6(1)(c)) and our legitimate interests in a safe marketplace (Art. 6(1)(f)).

To process payments — necessary for performance of our contract, and in accordance with Stripe's own privacy notice.

To communicate with you about your Account, Transactions, and support requests — necessary for performance of our contract.

To improve the Platform and understand usage — legitimate interests.

To send marketing communications — only with your consent, which you may withdraw at any time (Art. 6(1)(a)).

To comply with legal and regulatory obligations, including responding to lawful requests from public authorities.

5. Payment Processing via Stripe

Payments and payouts on the Platform are handled by Stripe. When you provide payment or payout details, you are also sharing data directly with Stripe, which acts as an independent data controller for that data under its own privacy policy (available at stripe.com/privacy). We recommend you review Stripe's privacy policy in addition to this one.

6. Who We Share Data With

Stripe, Inc. — for payment processing and identity/business verification (KYC/KYB).

Cloud hosting and infrastructure providers — currently [INSERT HOSTING PROVIDER, e.g. Amazon Web Services, eu-west-2 (London) region] for hosting the Platform and databases.

Identity verification and fraud-prevention providers, where used.

Professional advisers (legal, accounting, audit) under confidentiality obligations.

Law enforcement, regulators, or courts, where required by law.

A buyer or acquirer of the business, in the event of a merger, sale, or restructuring.

We do not sell personal data to third parties.

7. International Data Transfers

We aim to host and process personal data within the United Kingdom and/or the European Economic Area (EEA). Where any data is transferred outside the UK/EEA (for example, to a sub-processor with servers elsewhere), we will ensure an appropriate safeguard is in place, such as the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum. [CONFIRM final hosting region and update this section accordingly — see hosting recommendation.]

8. Data Retention

We retain personal data for as long as your Account is active, and for a further period afterwards to meet legal, accounting, tax, and anti-fraud obligations (typically [INSERT PERIOD, e.g. 6 years] from the end of the business relationship, in line with UK limitation periods and HMRC record-keeping rules). Identity verification records required under AML rules are retained for the period required by applicable regulations.

9. Data Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and regular security review. No system is completely secure, and we cannot guarantee absolute security.

10. Your Rights

Under UK GDPR, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure in certain circumstances; restrict or object to certain processing; request data portability; and withdraw consent at any time where processing is based on consent. To exercise these rights, contact us using the details in section 14. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you believe we have not handled your data properly.

11. Cookies

Our websites use cookies and similar technologies for essential functionality, analytics, and (where consented to) marketing. You can manage cookie preferences via the cookie banner shown on first visit, or through your browser settings. [INSERT/LINK a full cookie policy listing specific cookies used, consistent with PECR.]

12. Children

The Platform is a business-to-business service and is not directed at, or intended for use by, individuals under the age of 18. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via the Platform or by email before they take effect. The "last updated" date above reflects the current version.

14. Contact Us

Autonet Limited (t/a Carwama)

5 Green Street, Bradford, BD1 5HG, United Kingdom

Email: [INSERT SUPPORT/PRIVACY EMAIL — none currently set in Stripe profile]

Data protection contact: [INSERT NAMED CONTACT OR DPO IF APPOINTED]