Privacy Policy

This policy explains what personal data we collect, why we collect it, how long we keep it, and the rights you have over it. Last updated: 16 August 2026.

Who we are

The data controller for the personal data described in this policy is Car Owl Ltd, a private limited company registered in England and Wales (company number 15130731), whose registered office is Unit A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE.

"We", "us" and "our" mean Car Owl Ltd. "You" means the individual using our website or services. For any privacy question, or to exercise any of the rights below, email support@carowl.co.uk or write to us at the registered office address.

Scope

This privacy policy covers:

Visitors to our website ("Guests"); and
Registered users of the Platform.

What we collect

We may collect the following kinds of information when you use our service:

your contact details, such as full name, email address and telephone number;
your account details, including your password in encrypted form;
details of the vehicles you list, search for or run checks against, including registration marks and VINs;
the content of messages and enquiries you send through the platform;
billing information and a record of your transactions. Card details are handled by our payment provider and are never stored on our systems;
information you provide when you contact support, leave feedback, or write a review;
technical information, including your IP address, device and browser type, and the pages you visit.

We treat IP addresses and similar online identifiers as personal data, because they can be used to identify you indirectly, and we apply this policy to them accordingly.

If you give us personal data about somebody else, please make sure they are happy for you to do so and that they know about this policy.

Where we get it from

Most of the personal data we hold comes directly from you. We also receive vehicle records from third-party sources, including the DVLA, the DVSA, the police, insurers, finance houses and industry registers. Those records relate to vehicles, but they can sometimes include information about individuals, such as the number of previous keepers. We may also receive information from fraud prevention and identity verification providers.

Why we use it, and our lawful basis

Under UK GDPR we must have a lawful basis for each use of your personal data. Ours are as follows.

To provide the service you have asked for, including creating your account, running history checks, publishing your listings and passing on enquiries. Lawful basis: performance of a contract with you.
To take payment and keep financial records. Lawful basis: performance of a contract, and legal obligation for accounting records.
To provide customer support and handle complaints. Lawful basis: performance of a contract, and our legitimate interest in running our business well.
To prevent fraud and misuse, and to keep the platform secure. Lawful basis: our legitimate interest in protecting our users and our business, and legal obligation where we are required to act.
To improve our services, including analytics and research. Lawful basis: our legitimate interest in improving what we offer. Where this relies on non-essential cookies, we act on your consent.
To send you marketing about our services. Lawful basis: your consent, or our legitimate interest where you are an existing customer and we are telling you about similar services. You can opt out at any time, in every message we send and in your account settings.
To share your chosen contact details with a seller when you enquire about a vehicle. Lawful basis: your consent.
To comply with the law, including responding to lawful requests from the police or a regulator. Lawful basis: legal obligation.

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you can ask us for details of that assessment. Where we rely on consent, you can withdraw it at any time by contacting us or using the controls in your account. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

Who we share it with

We do not sell your personal data. We share it only as described here:

Service providers acting on our instructions, including our payment provider (Stripe), our hosting and email providers, and our analytics providers (Google, Microsoft). They may only use your data to provide their service to us.
Sellers you choose to contact, and only the contact details you have chosen to share. See the section below.
Fraud prevention and identity verification providers, where we need to check identity or investigate misuse.
The police, regulators and other authorities, where we are legally required to provide information or where it is necessary to prevent or detect crime.
A buyer of our business, if we are ever sold or merged. We will tell you if that happens.

Sending data outside the UK

Some of our service providers are based outside the United Kingdom, or store data outside it, including in the United States and the European Economic Area. Where personal data leaves the UK, we make sure it is protected to a standard equivalent to UK law, by relying on UK adequacy regulations where they apply, or otherwise on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards we use.

How long we keep it

We keep personal data only for as long as we need it, and no longer than the periods below. We review the data we hold periodically and delete or anonymise anything that has passed its retention period.

Account data: for as long as your account is open, and for 12 months after you close it, so that we can deal with any follow-up query.
History check reports and purchase records: 24 months, matching the archive period we offer you in your account.
Financial and transaction records: 6 years from the end of the relevant financial year, because tax law requires it.
Enquiries and platform messages: 24 months from the date of the message.
Support correspondence and complaints: 6 years, which matches the period in which a claim could be brought.
Marketing preferences: until you withdraw consent, plus a suppression record kept indefinitely so that we do not contact you again by mistake.
Analytics data: up to 14 months.

Where we no longer need data, we delete it or irreversibly anonymise it.

Cookies and similar technologies

We use cookies and similar technologies. Cookies that are strictly necessary to make the site work, such as those that keep you signed in and protect against fraud, are set automatically because the site cannot function without them.

All other cookies, including those used for analytics, advertising and session recording, are only set after you have given your consent through our cookie banner. If you do not consent, those technologies are not loaded at all. You can change your mind at any time by clearing the cookie for this site in your browser, which will bring the banner back.

The categories we use are:

Necessary cookies: required for the site to work, including authentication and security. Always on.
Functionality cookies: remember choices you have made, such as preferences. Consent-based.
Analytics and performance cookies: help us understand how the site is used so we can improve it. Consent-based.
Advertising cookies: help us measure the effectiveness of our advertising. Consent-based.

Analytics

Subject to your consent, we use Google Analytics and Google Ads to understand how our site is used and how our advertising performs, and Microsoft Clarity to see anonymised interaction patterns such as where people click. These providers process data on our behalf and may transfer it outside the UK under the safeguards described above. You can read more in Google's privacy policy and Microsoft's privacy statement.

Links to Other Sites

Our site may contain links to other websites that we do not operate. If you follow a link, we strongly advise you to review the privacy policy of the site you land on. We have no control over, and take no responsibility for, the content or privacy practices of third-party sites.

Keeping your data secure

We use appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls, and restricting access to staff and contractors who need it. No method of transmission or storage is completely secure, but we take our obligations here seriously and we will tell you and the Information Commissioner's Office if a breach occurs that is likely to affect your rights.

Your rights

Under UK data protection law you have the following rights:

Access. You can ask for a copy of the personal data we hold about you. This is free of charge. We may only charge a reasonable fee, or refuse, if a request is manifestly unfounded or excessive, and we will explain why if that ever applies.
Rectification. You can ask us to correct data that is inaccurate, or complete data that is incomplete.
Erasure. You can ask us to delete your personal data in certain circumstances.
Restriction. You can ask us to limit how we use your data in certain circumstances.
Objection. You can object to us using your data where we rely on legitimate interests. You can object to direct marketing at any time, and we will always stop.
Portability. You can ask us to provide the data you gave us in a machine-readable format, or send it to another organisation.
Withdraw consent. Where we rely on your consent, you can withdraw it at any time.
Complain. You can complain to us about how we have handled your personal data, and to the Information Commissioner's Office. See the two sections below.

To exercise any of these rights, email support@carowl.co.uk. We will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you if that happens and why.

Automated decision-making

We do not make decisions that produce legal effects for you, or similarly significantly affect you, based solely on automated processing.

Complaining to us

You have the right to complain directly to us about how we have handled your personal data. Email support@carowl.co.uk with the details, or write to us at the address below.

When you complain to us about your personal data, we will:

acknowledge your complaint within 30 days of receiving it, unless we are able to give you a full response within that time;
investigate it without undue delay, taking appropriate steps to look into what happened; and
tell you the outcome, and what we have done about it.

This reflects our duties under the Data (Use and Access) Act 2025, which have applied since 19 June 2026. You do not have to complain to us before going to the ICO, but it is usually the fastest way to get something fixed.

Complaining to the regulator

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection. You can reach the ICO at ico.org.uk/make-a-complaint, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Complaining to us first is not a condition of complaining to the ICO.

Sharing Your Details With Vehicle Sellers

When you show interest in a vehicle on Car Owl, you have the choice of which contact details to share with the seller. Before submitting your interest, you will be asked to:

Choose whether to share your email address with the seller
Choose whether to share your phone number with the seller
Provide your explicit consent to share your selected details

We only pass on the contact details that you agree to share. This is based on your consent under UK GDPR (Article 6(1)(a)). The seller will use your shared details solely to contact you about the vehicle you expressed interest in.

You can withdraw your consent at any time by contacting us. However, please note that the seller may have already received and used your details before your withdrawal.

If you are a verified dealer expressing interest in a vehicle, your business name and website (if provided) may be shared with the seller to help them understand who they are dealing with.

Children

Our services are not intended for children. You must be at least 17 to hold an account. If we learn that we hold personal data about a child, we will delete it.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date above. Where a change materially affects how we use your data, we will tell you by email or a prominent notice on the site before it takes effect.

Contact Us

For any question about this policy or your personal data, contact support@carowl.co.uk, or write to Car Owl Ltd, Unit A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE.