Privacy Policy

1 Who We Are (Data Controller)

For the purposes of UK GDPR, the data controller is Website Designer Derby (trading as CarDealerCMS), 47 Western Drive, Heanor, Derbyshire, DE75 7DP.

If you have any questions about how we use your personal data, or wish to exercise any of your rights, please contact us at [email protected] or call 0800 6444 199.

2 Personal Data We Collect

Identity Information

• Full name, business name and trading name, job title or role

Contact Information

• Email address, telephone number, business address

Account and Transaction Information

• Account login credentials (passwords are never stored in plain text)
• Subscription and billing history
• Payment method details (processed via our payment provider — we do not store full card details)

Technical and Usage Information

• IP address and device information
• Browser type and version, pages visited, features used
• Cookies and similar tracking technologies (see our Cookie Policy)

Content You Upload

• Vehicle listings, images, and descriptions added to the Platform
• Customer enquiry data and lead information managed through the Platform

3 How We Collect Your Data

• Registration and account creation forms
• Subscription and payment processes
• Communications you send us by email, telephone, or contact forms
• Your use of the Platform (usage data collected automatically)
• Cookies and similar technologies when you visit our website
• Google OAuth authorisation when you voluntarily connect your Google account (dealer accounts only)

4 Why We Use Your Data

Purpose	Details	Lawful Basis
Account management	Creating and managing your account	Performance of a contract
Service delivery	Providing access to the Platform	Performance of a contract
Billing and payments	Processing subscription fees and invoices	Performance of a contract
Customer support	Responding to queries and support requests	Performance of a contract
Legal compliance	Meeting obligations under UK law (e.g. HMRC, data protection)	Legal obligation
Security	Protecting the Platform from fraud and unauthorised access	Legitimate interests
Platform improvement	Analysing usage to improve features and performance	Legitimate interests
Marketing	Sending news, updates, or promotional offers	Consent (opt out at any time)

5 Who We Share Your Data With

We do not sell your personal data to third parties. We may share it with:

Service Providers and Processors

• Hosting and infrastructure providers (UK or EEA servers where possible)
• Payment processors (such as PayPal) — they handle payment data under their own security standards
• Email delivery providers for transactional and support emails
• Analytics tools (configured to anonymise data where possible)

Legal and Regulatory Authorities

We may disclose data to law enforcement, courts, or regulatory bodies where legally required to do so. All third-party processors are bound by data processing agreements in accordance with UK GDPR.

6 Google Services Integration

CarDealerCMS offers an optional integration with Google services (including Google Business Profile) that allows dealers to post updates directly from the Platform. This integration uses Google's OAuth 2.0 authorisation flow.

What We Access

When you connect your Google account, we request permission to:

• View your Google account email address and basic profile information (to identify which account was connected)
• Access and post to your Google Business Profile on your behalf (specifically: the business.manage scope)

What We Store

• An OAuth access token and refresh token, stored securely in our database, used solely to perform posting actions you initiate within the Platform
• Your Google Business Profile location ID (to identify where posts are sent)

How We Use It

Google account data and tokens are used exclusively to post content to your Google Business Profile when you request it through the Platform. We do not use this access to read your Google account data beyond what is necessary to complete the connection, and we never share your Google OAuth tokens with any third party.

How to Disconnect

You can revoke this integration at any time from within the Platform (Admin → Google), which will delete the stored tokens from our database. You can also revoke access directly from your Google Account at myaccount.google.com/permissions. Upon disconnection, all stored Google tokens are permanently deleted from our systems.

Google's Privacy Policy

When you use the Google integration, your data is also subject to Google's Privacy Policy. Our use of Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

8 International Data Transfers

Some third-party service providers may process data outside the UK or EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or transfers to countries with UK Government adequacy decisions. Contact us if you have any concerns about international data transfers.

9 Cookies

Our website and Platform use cookies to improve your experience and help us understand how the service is used. For full details, please see our Cookie Policy.

10 How Long We Keep Your Data

• Account data — retained for the duration of your subscription, plus 2 years after account closure
• Financial and billing records — retained for 6 years after the end of the relevant tax year (HMRC requirement)
• Support and communication records — retained for 2 years
• Marketing data — retained until you withdraw consent or unsubscribe

After the relevant retention period, your data will be securely deleted or anonymised.

11 Your Rights Under UK GDPR

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — request deletion of your personal data (subject to legal exceptions)
• Right to restriction — ask us to restrict how we process your data
• Right to data portability — receive your data in a structured, portable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — withdraw consent at any time without affecting prior lawful processing

To exercise any of these rights, email us at [email protected]. We will respond within one calendar month. There is no charge for making a request unless it is manifestly unfounded or excessive.

12 How We Protect Your Data

• Encrypted storage of account passwords (never stored in plain text)
• HTTPS encryption for all data transmitted to and from the Platform
• Access controls ensuring only authorised personnel can access personal data
• Regular security reviews of our systems and processes

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected users without undue delay.

13 Children's Privacy

CarDealerCMS is a business-to-business platform and is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately.

14 Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are significant, we will notify you by email or via a notice on the Platform at least 14 days before the changes take effect.

15 How to Make a Complaint

If you are unhappy with how we have handled your personal data, please contact us first at [email protected]. If you remain dissatisfied, you may lodge a complaint with the ICO: