Privacy policy

Motor Village Prestige Ltd is a company registered in England & Wales (company number 16878118), located at Simonstone House, Simonstone Lane, Simonstone, Burnley, BB12 7NP.

We are the data controller for the personal information collected through this website and our services. This means we decide how and why your data is used.

• Company registration: 16878118 (England & Wales)
• ICO registration number: [ICO number TBD — must register before launch at ico.org.uk]
• Data controller contact: admin@motorvillageprestige.co.uk
• Privacy enquiries: privacy@motorvillageprestige.co.uk

We only collect personal data that is necessary for the purposes described in this policy (data minimisation principle, UK-GDPR Article 5(1)(c)).

Enquiry, test-drive, and trade-in forms

• Full name
• Phone number
• Email address
• Message or enquiry text
• Vehicle of interest (make, model, stock reference)
• Preferred contact time
• Marketing consent preference (collected separately, unchecked by default)
• IP address (for fraud prevention and reCAPTCHA)

Test-drive booking — additional fields

• Driving licence attestation (checkbox confirming a valid UK driving licence is held — we do not collect the licence number or a copy)
• Preferred appointment date and time

Trade-in valuation — additional fields

• Vehicle registration plate
• Current mileage
• Vehicle condition and service-history notes
• Up to four photographs of your current vehicle (optional, uploaded by you)

Staff authentication (admin dashboard only)

• Work email address
• Password (stored as a cryptographic hash — never in plain text)
• TOTP two-factor authentication secret (encrypted at rest)
• Session tokens
• Login timestamps and IP addresses (audit log)

Cookies and analytics

• Strictly necessary cookies: session management cookies set by our authentication system (see cookie policy for the full list).
• Analytics cookies: we use [Plausible or Google Analytics 4 — confirm at G-4] to understand how visitors use the site. These are only set after you give consent via the cookie banner.
• Marketing cookies: none in v1.

reCAPTCHA

We use Google reCAPTCHA v3 on public forms to prevent automated abuse. reCAPTCHA collects hardware and software information, browser data, and a cookie. This data is sent to Google and processed under Google's own privacy policy.

Under UK-GDPR Article 6, we must have a lawful basis for processing your personal data. We rely on the following bases:

Responding to enquiries and bookings

Legal basis: legitimate interests (UK-GDPR Art. 6(1)(f)) — it is in both our and your interests to respond to a request you have made. Where a contract is being formed (e.g. a test-drive booking), we also rely on contract performance (Art. 6(1)(b)).

Marketing communications

Legal basis: consent (UK-GDPR Art. 6(1)(a)) — we only send marketing messages if you have opted in via the separate marketing-consent checkbox on our forms. You can withdraw consent at any time by contacting us or clicking the unsubscribe link in any marketing email.

Fraud prevention and site security

Legal basis: legitimate interests (UK-GDPR Art. 6(1)(f)) — we have a legitimate interest in protecting our business and other users from fraudulent or malicious activity. IP addresses and reCAPTCHA data are processed for this purpose.

Analytics (with consent)

Legal basis: consent (UK-GDPR Art. 6(1)(a) and PECR Regulation 6) — analytics cookies are only placed after you accept analytics cookies via our consent banner.

Staff authentication and audit logging

Legal basis: legitimate interests / contract performance — data processed about staff as part of their role is necessary to fulfil the employment relationship and to maintain system security.

We do not sell your personal data. We share it only with the following processors, each bound by a data processing agreement (or standard contractual clauses where applicable):

• Resend (email delivery) — transactional emails (enquiry acknowledgements, booking confirmations) are processed by Resend. Data is handled under Resend's data processing agreement. Region: [confirm UK/EU region at account setup].
• Neon (Postgres database) — customer enquiry data, booking records, and trade-in submissions are stored in a Neon Postgres database. Region: EU (recommended — confirm at provisioning).
• Cloudflare R2 — vehicle images (and any trade-in photos you upload) are stored in Cloudflare R2 object storage. Cloudflare acts as a processor under their data processing addendum.
• Sentry (error monitoring) — runtime errors are logged to Sentry to help us fix bugs. We configure Sentry to exclude request bodies and to anonymise user identifiers where possible. Sentry processes data under its Data Processing Addendum.
• [Plausible Analytics or Google Analytics 4 — confirm at G-4] — analytics data (page views, events) is shared with this provider only if you consent to analytics cookies. If Plausible is chosen, data remains in the EU and no personal data is transferred. If Google Analytics 4 is chosen, data may be transferred to the USA under standard contractual clauses.
• Google reCAPTCHA — form submissions pass reCAPTCHA data to Google for fraud-prevention scoring. Processed under Google's privacy policy.
• Finance partner (v1.1, not yet active) — when the finance introducer relationship is live (pending G-2), we will share your finance enquiry data with our chosen finance broker. We will update this policy and obtain any additional consents required before that feature launches.

We may also disclose personal data where required by law, court order, or to enforce our legal rights.

We retain personal data only for as long as necessary. The following are our default retention periods:

• Enquiry, test-drive, and trade-in lead records: 24 months from the date of submission, unless the enquiry progresses to a sale (in which case sales records are retained per the financial records period below).
• Marketing consent records: retained for the duration of the consent, plus 12 months after withdrawal (for accountability purposes).
• Staff account data: for the duration of employment/engagement, then 12 months after deactivation, after which the account is fully and irreversibly deleted.
• Audit logs (admin actions, authentication events): 6 years, to support legal and regulatory accountability obligations.
• Financial / sales records: 6 years from the end of the accounting period in which the transaction occurred, as required by HMRC.
• reCAPTCHA data: processed momentarily at submission; not stored by us beyond the fraud-prevention score. Google's own retention applies.

When the retention period expires, data is securely deleted or anonymised. You may also request earlier deletion — see "Your rights" below.

Under the UK General Data Protection Regulation (UK-GDPR) and the Data Protection Act 2018, you have the following rights regarding your personal data:

• Right of access (Subject Access Request): You may request a copy of the personal data we hold about you, free of charge, within one calendar month.
• Right to rectification: You may ask us to correct inaccurate data or complete incomplete data.
• Right to erasure (“right to be forgotten”): You may ask us to delete your personal data where we no longer have a lawful basis to hold it, or where you withdraw consent.
• Right to restriction of processing: You may ask us to pause processing your data in certain circumstances (e.g. while we verify its accuracy).
• Right to object: You may object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to data portability: Where we process your data based on consent or contract performance, and processing is automated, you may receive a structured, machine-readable copy of your data.
• Right to withdraw consent: Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
• Right to complain to the ICO: If you believe we have mishandled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the opportunity to address your concern directly first.

To exercise any of these rights, please contact us at privacy@motorvillageprestige.co.uk. We will respond within one calendar month (extendable to three months for complex requests, with notice).

For any data protection queries, Subject Access Requests, or to exercise any of the rights listed above, please contact us at:

• Email: privacy@motorvillageprestige.co.uk
• Post: Motor Village Prestige, [Registered address TBD], [Town], [Postcode]

Please include enough information to identify yourself and describe the data you are enquiring about. We may need to verify your identity before processing the request.

We use cookies on this website. For full details of the cookies we set, the categories they fall into, and how to manage your preferences, please read our Cookie policy.

Most of the personal data we collect is stored and processed within the United Kingdom or European Economic Area (EEA). Where we use service providers based outside the UK/EEA (for example, certain Google services), we ensure that appropriate safeguards are in place, typically:

• Standard contractual clauses (SCCs) approved by the ICO or the European Commission, as appropriate.
• A transfer to a country with an adequacy decision from the UK Government or European Commission.

If you would like more information about the specific safeguards applicable to a particular transfer, please contact us at privacy@motorvillageprestige.co.uk.

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. We will update the "Last updated" date below and, where changes are material, we will notify you by email (if you have provided one) or by a prominent notice on this page.

We recommend reviewing this policy periodically. Continued use of our website after changes are posted constitutes your acceptance of the revised policy.

This privacy policy was last updated on 18 April 2026.

Document version: draft-2026-04-18. Pending solicitor review (G-5).