Privacy Policy

1. Introduction & Data Controller

This Privacy Policy sets out how CarLuxe (referred to herein as "we", "us", or "our"), trading as a specialist luxury automotive dealership and advisory based at 14 Berkeley Square, Mayfair, London W1K 4QT, processes, stores, and protects personal data obtained through our website, private client suites, and vehicle transaction records.

We operate in strict compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). For the purposes of data protection legislation, CarLuxe is the designated Data Controller registered with the Information Commissioner's Office (ICO).

2. Categories of Personal Data Collected

Depending on the nature of your interaction with our showroom, we may collect and process the following categories of data:

• Identity Data: Full legal name, title, date of birth, copies of government-issued photo identification (Passport or UK Driving Licence) required for vehicle registration and statutory anti-money laundering verification.
• Contact Data: Residential/registered business address, billing address, email address, and primary telephone/WhatsApp contact numbers.
• Financial & Transaction Data: Bank account payment details for vehicle purchases or consignments, proof of funds statements, credit history reports where finance brokerage is requested, and transaction invoices.
• Vehicle Asset Data: Vehicle registration marks (VRN), Vehicle Identification Numbers (VIN), mileage records, service history books, valuation parameters, and ownership documentation (V5C logbooks).
• Technical & Browsing Data: IP address, browser type, operating system version, time zone setting, and analytical engagement metrics captured via non-invasive telemetry.

3. Lawful Basis for Processing

Under Article 6 of the UK GDPR, we only process personal information where a recognized lawful basis applies:

1. Contractual Performance: Processing required to fulfil vehicle sale agreements, execute consignment contracts, process part-exchange equity, or structure specialist automotive finance agreements upon your request.
2. Legal & Regulatory Obligation: Compliance with the UK Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017, DVLA statutory registration requirements, HMRC accounting standards, and FCA consumer credit guidelines.
3. Legitimate Interests: Managing showroom appointments, preventing fraudulent transactions, securing our premises through CCTV, and improving our digital client portal.
4. Explicit Consent: Where you have voluntarily opted in to receive private off-market vehicle alerts or bespoke sourcing updates.

4. Data Sharing & Third-Party Disclosures

We may share your data with trusted professional partners solely to execute your requested vehicle transaction:

• Tier-1 Automotive Lenders: Regulated specialist finance providers when you formally request a finance proposal.
• DVLA & HPI Experian: Government and national automotive registers to record vehicle ownership changes and verify provenance.
• Enclosed Transport & Logistics: Vetted transport contractors delivering your vehicle to your private address.
• Law Enforcement & Regulators: Where strictly required by UK statutory law or court order.

5. Data Retention Periods

We retain transaction records, sales invoices, and anti-money laundering verification documentation for a statutory period of 7 years following the financial year of the transaction to satisfy HMRC and UK statutory audit obligations. General web enquiries not resulting in an active transaction are purged after 24 months.

6. Your Statutory Rights

Under the UK GDPR, you have comprehensive rights including:

• Right of Access (Subject Access Request): Request a copy of all personal data held about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of personal data where no statutory retention obligation overrides your request.
• Right to Restrict or Object to Processing: Limit how we process your personal data.

To exercise any of these rights, please submit a written request to our Data Protection Officer at enquiries@carluxe.com.