Privacy Policy

This policy explains what personal data CAR REPORT collects, why, and what you can do about it.

1. What we collect

When you send an enquiry. Your name, email address, phone number and, if you write one, your message — together with the vehicle the enquiry is about and the time you sent it. All four of the first fields are required; we cannot answer an enquiry without them.

Automatically. We do not store your IP address alongside your enquiry; it is held only transiently, in memory, to rate-limit the form against spam. The site sets no cookies for ordinary visitors — see the Cookie Policy.

If you contact us on Telegram. Telegram passes us the identifiers it chooses to share for that conversation, under Telegram’s own privacy terms.

We do not run advertising trackers, we do not build behavioural profiles, and we do not collect payment details on this site.

2. Why we use it, and on what basis

• To answer your enquiry and arrange a purchase — because it is necessary to take steps you asked for before entering a contract.
• To keep the site working and secure, including rate-limiting and an internal audit log of administrative actions — our legitimate interest in running the service safely.
• To meet legal obligations where one applies, such as record-keeping around a transaction.

3. Who sees it

Your enquiry is visible to our own staff through an access-controlled admin panel, where every action is written to an audit log. It is delivered to us by email and, where configured, as a Telegram message.

Where you ask us to pursue a specific vehicle, we share what is needed with the seller or marketplace holding it, and with the parties arranging transport and paperwork. We do not sell your data and we do not share it for anyone else’s marketing.

Our infrastructure providers — hosting, CDN, email delivery — process data on our behalf under contract. Some are outside the EEA; where that is so, transfers rely on the safeguards those providers publish.

4. How long we keep it

Enquiries are retained while they are being handled and afterwards for as long as we may need them for a live or foreseeable transaction, or to meet a legal obligation. Ask us to delete an enquiry that has not led anywhere and we will.

The internal audit log of administrative actions and sign-in attempts, which records the IP address an attempt came from, is kept for twelve months and then deleted automatically.

5. Your rights

Subject to local law, you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. You can also complain to your national data protection authority.

To exercise any of these, contact us through the channels in the site footer. We may need to confirm who you are before we act.

6. Children

The site is not directed at children and we do not knowingly collect their data.