This policy covers how SortedCars Trade Ltd (the platform) handles personal data.
When you transact with a dealer through our platform, that dealer is a separate data controller for your purchase-related data — please also read the dealer's own privacy policy.
1. Who we are
SortedCars Trade Ltd ("SortedTrade", "we", "us", "our") operates the SortedTrade platform
at sortedcarstrade.uk. We provide a technology platform that
connects independent car dealers with car buyers and private sellers.
There are two distinct data-controller relationships on this platform:
SortedCars Trade Ltd is the controller for data relating to your use of the
SortedTrade platform — your dealer account, subscription and billing, access credentials,
and your interactions with our tools and website.
The individual dealer is the controller for personal data relating to your
vehicle purchase or enquiry — your name, contact details, appointment records, payment records,
and identity documents held in connection with a sale. SortedTrade acts as a data processor
on the dealer's behalf for that data. Please refer to the dealer's own privacy policy for how
they process your personal data as a customer.
3. What data we collect
Dealers & dealer staff
Business name, trading address, FCA reference number
Contact email address and phone number
Billing information (processed by Stripe — we do not store card numbers)
Stock data (vehicle listings, photos, pricing)
Communication logs and audit trails generated by platform activity
Car buyers
Name, email address, phone number
Vehicle interest history and appointment records
Payment records (deposit and balance transactions)
Identity documents where required for AML compliance (stored encrypted)
Listing information provided when posting a car for sale or valuation
All visitors
IP address and browser type (server logs, retained for 30 days)
Pages visited and session data (functional cookies — always active)
Analytics data: page views, referral source, device type (only if you accepted analytics cookies)
4. How we use your data
To operate and improve the SortedTrade platform and its tools
To process payments, manage subscriptions, and issue invoices
To authenticate users and maintain secure sessions
To connect buyers with dealers and facilitate vehicle transactions
To comply with legal obligations — FCA Consumer Duty, Anti-Money Laundering regulations, GDPR
To send transactional communications: appointment confirmations, payment receipts, OTP codes
With your consent: analytics and site performance monitoring
We do not use your data for automated profiling that produces legal or similarly significant effects.
5. Cookies
We use three categories of cookie:
Strictly necessary — session tokens and login state. These cannot be disabled;
the site will not function without them.
Functional — remember your cookie and policy preferences (the consent you gave
on first visit). Always active.
Analytics — understand how visitors use the site (page views, journeys,
referral source). Only active if you chose "Accept all cookies" on first visit.
You can change your cookie preference at any time by clearing this site's data in your browser settings.
On your next visit you will be prompted again.
6. Who we share data with
We do not sell personal data. We share it only as necessary:
The dealer you are transacting with — to fulfil the vehicle purchase
Anthropic — powers the AI chat agent. Chat messages are processed by Anthropic's API. We pass the minimum data needed and do not send payment card numbers or identity document content to Anthropic.
Regulatory bodies — where we are legally required to disclose (FCA, HMRC, law enforcement)
All third-party processors are bound by data processing agreements consistent with UK GDPR.
7. Retention
Buyer transaction data — 7 years from the date of sale (Companies Act / HMRC requirement)
AML identity records — 5 years from the end of the business relationship (Money Laundering Regulations 2017)
Dealer account data — duration of the active subscription + 2 years
Server logs — 30 days
Analytics data — 26 months (aggregate only after 90 days)
Deleted accounts — anonymised within 30 days of a verified deletion request, except where legal holds apply
8. Your rights (UK GDPR)
You have the right to:
Access — request a copy of the personal data we hold about you
Rectification — ask us to correct inaccurate or incomplete data
Erasure — ask us to delete your data ("right to be forgotten"), subject to legal hold obligations
Restriction — ask us to pause processing while a dispute is resolved
Portability — receive your data in a machine-readable format
Objection — object to processing based on legitimate interests
Withdraw consent — at any time, for processing based on consent (e.g. analytics cookies)
To exercise any of these rights, email privacy@sortedcarstrade.uk.
We will respond within one calendar month. We may ask you to verify your identity before acting on a request.