Privacy Policy

1. Introduction

Scrap Car SW18 Wandsworth & Earlsfield ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our vehicle scrap and recycling services.

We comply with the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018. This policy applies to all personal data we collect through our website, phone, email, or in person.

2. Information We Collect

2.1 Personal Information

When you request a quote or book a collection, we collect:

• Full name
• Phone number
• Email address
• Postcode and collection address
• Bank account details (for payment transfer)

2.2 Vehicle Information

We collect information about your vehicle including:

• Vehicle Registration Mark (VRM)
• Make, model, and year
• Condition and any damage
• MOT and service history (where available)

2.3 Technical Information

When you visit our website, we automatically collect:

• IP address and browser type
• Pages visited and time spent on pages
• Referring website and search terms used
• Device information (mobile, desktop, operating system)

3. How We Use Your Information

We use your personal data for the following purposes:

3.1 Service Provision

• Processing your quote request and providing valuations
• Scheduling and completing vehicle collection
• Processing payment transfers to your bank account
• Notifying the DVLA of vehicle scrapping
• Issuing Certificate of Destruction (CoD)

3.2 Communication

• Sending booking confirmations and reminders
• Providing collection updates and driver notifications
• Responding to your inquiries and customer service requests
• Sending important service updates (with your consent)

3.3 Legal Compliance

• Complying with DVLA notification requirements
• Maintaining records for regulatory purposes
• Preventing fraud and ensuring transaction security
• Meeting environmental and waste disposal regulations

3.4 Business Improvement

• Analyzing service usage to improve our offerings
• Conducting customer satisfaction surveys (with consent)
• Training staff and improving customer service

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract: Processing necessary to fulfill our service agreement with you
• Legal obligation: DVLA notification and environmental compliance
• Legitimate interests: Fraud prevention, service improvement, and business operations
• Consent: Marketing communications (you can withdraw consent at any time)

5. Data Sharing and Third Parties

We may share your data with the following parties:

5.1 Essential Service Providers

• DVLA: Vehicle registration and scrapping notifications (legal requirement)
• Payment processors: For secure bank transfer processing
• Collection drivers: Authorized Transport Managers for vehicle collection
• Authorized Treatment Facilities (ATF): Licensed scrap yards and recycling centers

5.2 Technology Partners

• Hosting provider (Vercel): Secure website hosting and data storage
• Email service (Resend): Transactional email delivery
• SMS service (Twilio): Collection reminders and notifications
• Analytics (Google Analytics): Website usage analysis (anonymized where possible)

5.3 Legal Requirements

We may disclose your information if required by law, court order, or government authority, or to protect our legal rights.

We never sell your personal data to third parties.

6. Data Retention

We retain your personal data for the following periods:

• Customer records: 7 years (for accounting and legal compliance)
• Vehicle and DVLA records: 7 years (regulatory requirement)
• Marketing consent: Until you withdraw consent or 3 years of inactivity
• Website analytics: 26 months (Google Analytics default)
• Chat transcripts: 2 years (for service improvement and training)

After these periods, we securely delete or anonymize your data unless we have a legal obligation to retain it longer.

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): Request deletion of your data (subject to legal retention requirements)
• Right to restrict processing: Limit how we use your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: Withdraw consent for marketing or optional processing at any time
• Right to lodge a complaint: Contact the Information Commissioner's Office (ICO) if you believe your rights have been violated

To exercise any of these rights, please contact us using the details in Section 13 below.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your browsing experience and analyze site usage. For detailed information about our cookie usage, please see our Cookie Policy.

8.1 Essential Cookies

Required for website functionality (e.g., maintaining your session, remembering cookie preferences).

8.2 Analytics Cookies

Help us understand how visitors use our site (Google Analytics). You can opt out via browser settings or Google's opt-out tool.

8.3 Marketing Cookies

Used for targeted advertising (only with your consent). You can manage preferences in your browser or our cookie consent tool.

9. Data Security

We implement industry-standard security measures to protect your personal data:

• Encryption: SSL/TLS encryption for data in transit, AES-256 encryption for sensitive data at rest
• Access controls: Role-based access and multi-factor authentication for staff
• Secure hosting: Data stored in UK/EU data centers with ISO 27001 certification
• Regular audits: Security testing and vulnerability assessments
• Staff training: Regular data protection and security awareness training
• Incident response: Procedures in place to detect, report, and respond to data breaches

While we take all reasonable precautions, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security but will notify you promptly of any data breach that poses a risk to your rights.

10. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete it promptly.

To scrap a vehicle, you must be the registered keeper or have legal authority to dispose of it, which requires being at least 18 years old.

11. International Data Transfers

Your personal data is primarily stored and processed within the United Kingdom and European Economic Area (EEA). Some of our service providers may process data outside the UK/EEA, including:

• OpenAI (AI chatbot): USA - covered by EU-US Data Privacy Framework and Standard Contractual Clauses
• Twilio (SMS): USA - covered by Privacy Shield successor mechanisms and Standard Contractual Clauses

Where data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place through:

• Standard Contractual Clauses approved by the EU Commission
• Adequacy decisions by the UK government or EU Commission
• Binding Corporate Rules for multinational service providers

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated policy on our website with a new "Last updated" date
• Sending an email notification if you have an active booking or recent service history
• Displaying a prominent notice on our homepage for significant changes

Continued use of our services after changes become effective constitutes your acceptance of the updated Privacy Policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Data Protection Officer: For data protection inquiries, you can reach our Data Protection Officer at dpo@scrapcar.london

ICO Registration: We are registered with the Information Commissioner's Office (ICO). Our registration number is available upon request.

Complaints to the ICO

If you believe we have not handled your data properly or violated your rights, you have the right to lodge a complaint with the supervisory authority:

14. Glossary

Personal Data:

Any information relating to an identified or identifiable individual.

Processing:

Any operation performed on personal data, including collection, storage, use, and deletion.

Data Controller:

Scrap Car SW18 Wandsworth & Earlsfield (1st Auto Clear Ltd) - we determine how and why your data is processed.

Data Processor:

Third parties who process data on our behalf (e.g., hosting providers, email services).

GDPR:

General Data Protection Regulation - EU/UK data protection law.