Privacy policy

1. Who we are

Heritage Cars is a trading name of HERITAGE CARS SPORTS AND PRESTIGE LIMITED, a company registered in England and Wales with company number 17522939, registered office Waltham House, Riverview Road, Beverley, England, HU17 8DY. We are the controller of your personal data under the UK General Data Protection Regulation and the Data Protection Act 2018. For anything about your data, email [email protected] with the subject "Data request".

2. What we collect

• Account details: your name, email address and, if you add it, your phone number. Your password is handled by our sign-in provider and is never stored by us in readable form.
• Buying activity: cars you watch, searches you save, your notification choices, and a record of when you gave or withdrew marketing consent.
• Purchases: sales, invoices, payment status and payment references. Payments are made through your own bank; we never see your online banking login.
• Messages: emails and enquiries you send us and our replies.
• Collection checks: we check photo ID at handover and record that the check was done.
• Security records: a log of sign-ins and of changes made to accounts, sales and settings, and our hosting provider's server logs, which include IP addresses and browser details.

3. How and why we use it

• To run your account, auctions and purchases, and to send service emails such as invoices and payment confirmations. Lawful basis: contract.
• To keep accounting and tax records and to prevent fraud and money laundering. Lawful basis: legal obligation and legitimate interests.
• To keep the site and your account secure and to investigate misuse. Lawful basis: legitimate interests.
• To send alerts and marketing you have chosen to receive. Marketing is off until you switch it on, and you can switch it off at any time in your account preferences. Lawful basis: consent.

4. No advertising trackers

We do not use advertising pixels, third-party analytics or tracking cookies. The only cookies we set are the ones needed to keep you signed in; see our cookie policy.

Our "Review us on Trustpilot" buttons are ordinary links: nothing from Trustpilot runs on our pages until you click one. If we show a box from Trustpilot with our rating, it is optional and only with your permission: we ask first in a banner, and until you choose "Allow Trustpilot" no Trustpilot code runs on our pages. If you allow it, Trustpilot receives the usual information any website receives (such as your IP address and browser) and may store information in your browser; Trustpilot's own privacy and cookie policies apply to that. While the box is in use, "Cookie settings" at the bottom of our pages lets you change your choice at any time.

We count visits to our website using our own cookieless statistics: no cookies are set and nothing is stored on your device, your IP address is not stored, and each visit is recorded under an anonymous code that changes every day, so visits cannot be linked to you or to each other across days. If your browser sends Do Not Track or Global Privacy Control, we do not count your visit at all.

5. Who we share it with

We share data only with providers that help us run the service, under contracts that require them to protect it:

• Railway: website hosting and our database.
• Supabase: account sign-in and authentication.
• Resend: delivery of our emails.
• Fena Labs Ltd: pay-by-bank payments (Open Banking).
• Trustpilot: if we ask you to review us on Trustpilot, we give Trustpilot your name, email address and lot number so it can send you its review invitation. Whether you leave a review is up to you.
• Transport partners, when you book delivery, and our professional advisers.

We also share data with authorities when the law requires it, and with a buyer of our business if it is ever sold. We never sell your data.

6. International transfers

Some of these providers store or process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the International Data Transfer Agreement or Addendum.

7. How long we keep it

• Account details: while your account is open. When you close it we remove or anonymise your details, except where we must keep them.
• Sales, invoices and payments: 6 years after the end of the financial year they relate to, as tax law requires.
• Security and audit records: as long as needed to keep an accurate record of sales and account changes and to deal with disputes and fraud.
• Marketing consent records: for as long as we rely on the consent and for 6 years after, so we can show it was given.

8. How we protect it

The site is served over encrypted connections only. Payment and email keys are stored encrypted. Staff access is limited by role, admin accounts require two-step sign-in, and changes to accounts, sales and settings are recorded in an audit log that cannot be edited.

9. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable format and to withdraw consent at any time. Email [email protected] and we will reply within one month.

You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Our services are not intended for anyone under 18.

10. Changes

We will update this policy when our practices change and show the new date at the top. If a change affects you significantly, we will tell you by email.