Working draft updated: 3 October 2026. This Preview Dev policy is incomplete and is not ready for publication on the live website. Items marked TO CONFIRM remain unresolved. The working-draft date is not the policy’s effective date; that date will be set on final approval.
1. Who we are and who this policy covers
Classic Car Experts Limited operates classiccarexperts.co.uk. We are the data controller for the personal information we use as described in this policy. This means we decide why and how that information is used.
This policy explains how we use personal information about website visitors, people applying for business membership (including sole traders), people representing applicant or member businesses, trade referees, and people who contact us.
If you have questions about this policy or how we use your personal information, email greg@classiccarexperts.co.uk.
2. Information we collect and where it comes from
When you apply, we collect your contact name, checkout email address, business contact details, business address, and information about your business, including its services, specialisms, description, opening hours and trading history. You can also provide your website and, where applicable, company registration number.
We collect the business images and logo you upload, together with your confirmation that you have permission to share the images and authorise their publication on your listing. The application requires business images; photographs of yourself are optional.
We also collect details of your nominated trade referee: their business name, contact name and phone number, and an email address if supplied.
If you book an onboarding call, we collect your name, email address, phone number and appointment details through Google Calendar appointment scheduling.
Information comes directly from applicants and business representatives, from referees, from the payment and booking services we use, and from public online sources used for verification. We also receive information you provide in enquiries, support requests and complaints. Sections 3, 4, 6, 8 and 9 explain these uses and sources further. Work contact details and business information that identify a person, including a sole trader, can be personal information.
TO CONFIRM: Any additional relevant application fields; the complete Stripe information we access and use; and website, analytics and provider-log information. Access to or storage of full payment-card details has not been established.
3. Applications, payments and membership
Businesses pay through Stripe before providing their listing information. Membership renews yearly through Stripe. If an application is unsuccessful, we refund the payment and cancel the subscription.
We use email addresses and phone numbers supplied through Stripe checkout to arrange onboarding calls. Applicants can complete our Tally form themselves, or we complete the same form while speaking with them. These calls are not audio recorded. Form responses are stored in Tally and Google Sheets. Stripe manages payment processing and payment records.
At launch, membership is paid and listings are created and managed by Classic Car Experts. Applicants and visitors do not have website accounts. There are no public customer reviews or newsletters at launch. Visitors contact listed businesses directly.
4. Manual verification and trade references
Every business listed on Classic Car Experts has been manually checked against our verification standard. Our directory contains verified businesses only.
Before verification begins, we tell applicants that we will contact their nominated trade referee, review online sources and carry out a CCJ check through TrustOnline.
Before asking reference questions, we explain to referees how their name, role and answers will be used. Reference responses are recorded using Tally and stored in Tally and Google Sheets.
Our CCJ checks cover applicant companies and sole traders. We do not check individual company directors.
We review verification evidence manually and make the final decision ourselves.
During verification, we may contact a trade referee by phone. We record the referee’s name, role and their answers in a standard form. We don’t make audio recordings.
We also carry out online checks, which may include looking at Trustpilot, Indeed and Google reviews. We keep a summary of what we find, with links to sources where possible, and don’t copy or scrape full reviews.
We use this information to assess applications. If any concerns arise, we offer the applicant a chance to explain or correct them before a decision is made.
We do not routinely share referee answers with applicants. Any request for personal information is assessed under applicable data-protection law.
We carry out a County Court Judgement check using TrustOnline. We record a brief outcome and the date checked rather than keeping the full report. Only authorised staff access this. If a concern arises, the applicant has a chance to explain or correct before a decision is made.
5. Information published on listings
Public business listings contain business information and work contact details. We do not publish private personal contact details.
People may also choose to upload photographs of themselves for publication on their business listing.
Business listings are publicly accessible. If personal information about you appears on a listing, you can email greg@classiccarexperts.co.uk to request a correction or removal.
When membership ends, we remove the business listing from public view.
TO CONFIRM: Search-engine indexing and third-party copies, and the lawful basis for photographs of identifiable people. Upload permission does not by itself settle the lawful basis for every person shown.
6. Enquiries, support and complaints
If you contact us with an enquiry, support request or complaint, we use the information you provide to deal with it and respond to you.
If your complaint concerns a listed business, we may share relevant complaint information with that business to help investigate and respond to the complaint.
When you contact a listed business directly, that business handles the information you give it under its own privacy arrangements.
7. Why we use personal information and our proposed lawful bases
We use personal information only where we have a lawful basis under UK data-protection law. The following purpose and basis mapping is a working proposal. TO CONFIRM: The relevant contract-necessity and legitimate-interests assessments and the remaining lawful bases. This draft does not establish that those assessments are complete.
| Purpose | Proposed lawful basis |
|---|---|
| Process applications and administer membership, payments, refunds, renewals and essential listing information for a sole trader who contracts with us | Contract, where the use is necessary to take steps they request before entering a contract or to provide their membership service. |
| Communicate with people representing applicant and member companies and administer those business relationships | Legitimate interests in managing applications and memberships. |
| Obtain trade references, review online sources and carry out sole-trader CCJ checks to assess applicants | Legitimate interests in assessing suitability for membership and maintaining a directory of manually verified businesses. |
| Publish work-related personal information needed for business listings | Contract where necessary to provide a sole trader’s requested listing; legitimate interests where necessary to publish appropriate work contacts for company listings. |
| Respond to enquiries, support requests and complaints, including necessary complaint sharing with a listed business | Legitimate interests in responding to people, supporting members and investigating concerns; contract where necessary to provide support under a contract with the individual. |
TO CONFIRM: Lawful bases for optional photographs, accounting or tax records, website logs, cookies, analytics and membership invitations. Particular care is needed in assessing sole-trader CCJ checks and complaint sharing. Choosing to upload a photograph or publishing a business email address does not by itself establish consent.
8. Website information, cookies and maps
Classic Car Experts operates the website. Hostinger provides website hosting.
We use Google Analytics to help us understand how visitors use our website. Google Analytics only runs after you accept analytics cookies. This describes the intended launch behaviour; the actual configuration remains TO CONFIRM.
Our website displays maps based on OpenStreetMap. We do not ask to access your device’s current location.
When a search returns no matching businesses, we record the search text, the location entered, and the date and time. We use this information to identify gaps in the directory. We do not add user identifiers or IP addresses to these missed-search records.
Search or location text can itself contain personal information. The statement about missed-search records does not describe other website or provider logs.
TO CONFIRM: Website and hosting-log data; actual analytics data and settings; cookies and their durations; consent controls, including withdrawal; analytics and log retention; the actual map-service provider and information sent to it; and any other embedded services. OpenStreetMap identifies the map source, not a confirmed recipient of browser information.
9. Service messages and membership invitations
We use contact details for application, onboarding, verification, payment, renewal and other membership communications.
We may use business contact details published on business websites to contact businesses about membership of Classic Car Experts.
There is no newsletter at launch. Direct invitations promoting membership are marketing, including individually addressed invitations.
TO CONFIRM: Whether invitations include sole traders or other individual subscribers; applicable email-marketing permissions and lawful basis; opt-out arrangements; suppression records; and privacy information for recipients. Public availability of contact details is not permission to send marketing, and this policy does not provide that permission.
10. Service providers and overseas processing
We use service providers for website hosting, business email and correspondence, forms and record storage, appointment booking, payment processing, verification checks and website analytics. We share information with these providers where needed for the relevant service.
The confirmed services described in this draft are Stripe, Tally, Google Sheets, Google Calendar appointment scheduling, TrustOnline, Hostinger and Google Analytics. Maps are based on OpenStreetMap; the actual map-service provider remains TO CONFIRM. Relevant complaint information may also be shared with the business concerned, as explained in section 6. Listing information is shared publicly, as explained in section 5.
TO CONFIRM: Each provider’s role; any other providers used; overseas storage, processing or access; and applicable international-transfer safeguards. This draft does not establish that all providers act solely on our instructions or that all information stays in the UK. Business email and correspondence providers can be described by a sufficiently specific category without publishing account or login details.
11. How long we keep information and how we protect it
When membership ends, we remove the listing and its content from public view. We may retain relevant membership records and supplied content for administrative, record-keeping, security or legal purposes, or to support a future application to relist the business, but only for as long as necessary for the relevant purpose.
In deciding how long to keep personal information, we consider why it was collected, whether it is still needed, any outstanding complaints or disputes, and any applicable legal record-keeping requirements.
We use two-step verification to help protect accounts holding applicant and member information. Access to trade-reference responses and verification summaries is restricted to authorised staff.
TO CONFIRM: Record-specific retention periods or meaningful criteria and actual deletion arrangements for unsuccessful applications, verification evidence, bookings, correspondence and complaints, logs, missed searches, analytics, payments and any backups. Public removal of a listing does not establish deletion of every internal record. No fixed blanket retention period or additional security safeguard is established by this draft.
12. Your rights and privacy complaints
Depending on why we use your personal information and the circumstances, you may have the right to:
- ask for access to your personal information and a copy of it;
- ask us to correct inaccurate or incomplete information;
- ask us to delete information or restrict how we use it; and
- receive information you have provided in a portable format, or have it transferred to another organisation, where this right applies.
Your right to object
You can object to our use of your personal information where we rely on legitimate interests. We must stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the information for legal claims.
You can object at any time to the use of your personal information for direct marketing. If you do, we will stop using it for that purpose.
Where we rely on your consent, you can withdraw it at any time. This does not affect the lawfulness of our use of your information before consent was withdrawn.
To exercise your rights or raise a privacy complaint, email greg@classiccarexperts.co.uk. We may ask for reasonable information to confirm your identity. We assess requests under applicable data-protection law, including any relevant exceptions and the rights of other people.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data-protection regulator. Visit https://ico.org.uk/make-a-complaint/.
TO CONFIRM: Rights-request and privacy-complaint handling arrangements, applicable response deadlines, proportionate identity checks, and correction or deletion across relevant systems. These arrangements require final review; the rights above are subject to applicable law.
13. Policy dates, changes and collection notices
We may update this privacy policy to reflect changes to our services, how we use personal information or legal requirements. The latest version will be published on our website, with its last-updated date shown at the top.
If a change materially affects how we use your personal information, we will take reasonable steps to bring it to your attention.
TO CONFIRM: The effective and published last-updated dates on final approval; notification arrangements; and short privacy notices for applications, bookings, referees and public-source outreach, together with cookie information. Providing a policy link only when a referee asks does not establish that the required privacy information has been provided.