Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how GCB Marketplace collects, uses, stores, shares and otherwise processes personal data when users visit the website, create accounts, list or purchase vehicles, bid, use Buy It Now or Make Offer, communicate with support, make or receive payments, and arrange collection or transport.

It applies to private sellers, trade sellers, trade buyers, staff users, customer service contacts, site visitors, and persons whose data is provided in connection with marketplace transactions.

2. Who we are

For UK GDPR and Data Protection Act 2018 purposes, the controller is [INSERT FULL LEGAL ENTITY NAME], trading as GCB Marketplace.

• Legal entity: [INSERT FULL LEGAL ENTITY NAME]
• Registered office: [INSERT REGISTERED OFFICE ADDRESS]
• Company number: [INSERT COMPANY NUMBER]
• General contact: [INSERT SUPPORT EMAIL / PHONE]
• Privacy contact: info@guaranteedcarbuyers.co.uk
• Data protection lead: [INSERT NAME OR ROLE, IF APPLICABLE]

Postal contact: Friars House, Manor House Drive, Coventry, CV1 2TE.

3. Minimum age

Marketplace use is for adults aged 18+ only. If child data is submitted in breach of terms, account and related data may be restricted or deleted subject to legal obligations.

4. The personal data we collect

• Identity and contact data
• Account and profile data
• Vehicle and transaction data
• Payment and financial data (including tokenised references and payment status)
• Collection, delivery and logistics data
• Customer service and communications data
• Technical and usage data (including cookies and device info)
• Compliance and risk data (including fraud and misuse signals)

5. Where we collect personal data from

• Directly from users through forms, account actions and transactions
• From other users involved in the same transaction
• From service providers (payments, compliance, logistics, analytics, support)
• From provenance and vehicle-history data suppliers
• From cookies and similar technologies
• From public and official sources where reasonably necessary

6. How and why we use personal data

Lawful bases used include contract, legitimate interests, legal obligation, consent, and establishing/exercising/defending legal claims where relevant.

7. Our legitimate interests

Legitimate interests include running a secure marketplace, fraud prevention, managing payment default risk, improving service performance, coordinating logistics, and handling legal claims. We balance these interests against individual rights and freedoms.

8. Special category and criminal-offence related information

Users should not upload sensitive special-category data unless strictly necessary and specifically requested for a lawful purpose. In limited fraud, legal or regulatory contexts, related risk data may be processed where permitted by law.

9. Cookies, tracking and online identifiers

Cookies and similar technologies are used for security, session continuity, consent management, analytics and (where enabled) campaign attribution/advertising. Consent controls apply where required under PECR.

10. Automated decision-making and profiling

Rules-based automation may support bidding controls, payment reminders, overdue restrictions, fraud screening, duplicate-account detection and logistics routing. High-impact solely automated decisioning is not intended without suitable safeguards and notice.

11. Sharing personal data

• Payment providers, banks and open-banking providers
• Identity, fraud, compliance and security providers
• Hosting, analytics, messaging, CRM and support providers
• Transport and logistics providers (including Auto Transporter UK or equivalent where used)
• Transaction parties and operational contacts to the extent necessary
• Advisers, regulators, law enforcement and courts where required
• Potential acquirers/investors in corporate transactions under confidentiality safeguards

We do not sell personal data.

12. International transfers

Where data is transferred outside the UK, safeguards may include adequacy regulations, UK IDTA, UK Addendum to SCCs, or another lawful mechanism.

13. Data retention

Personal data is retained only as long as reasonably necessary, including for legal, tax, accounting, fraud-prevention and dispute requirements.

• Account/profile data: life of account + reasonable period
• Transaction/invoice/payment records: usually at least 6 years
• Bid/offer/auction logs: usually 6 years
• Collection/logistics records: usually 3-6 years
• Complaints/disputes: usually 6 years after closure
• Marketing consent and suppression records: as needed for compliance
• Cookie consent logs: aligned with CMP audit configuration

14. Security

Controls may include encryption in transit, access controls, MFA for admin access, password hashing, role-based permissions, logging/monitoring, secure backups, provider due diligence and incident response processes.

15. Your rights

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure (in certain cases)
• Right to restriction (in certain cases)
• Right to object
• Right to data portability (where applicable)
• Right to withdraw consent where consent is the basis
• Right to complain to the Information Commissioner's Office (ICO)

16. Marketing communications

Service messages necessary for marketplace operation are sent as operational communications. Promotional messages are sent under consent, soft opt-in, or other lawful route where applicable, and opt-out controls are provided.

17. Complaints about data protection

Contact info@guaranteedcarbuyers.co.uk or [INSERT POSTAL ADDRESS / COMPLAINT FORM URL] with privacy complaints. If unresolved, users may complain to the ICO.

18. Changes to this Privacy Policy

This policy may be updated periodically. Material updates may be highlighted by banner, account message or email.

19. Contact us

For privacy rights requests or concerns: info@guaranteedcarbuyers.co.uk, Friars House, Manor House Drive, Coventry, CV1 2TE.