CarZoon Privacy Policy

1. Who we are

CarZoon Automotive Ltd is the controller of the personal data described in this policy. This means we decide why and how that personal data is used.

CarZoon operates an online automotive marketplace that enables private sellers and dealers to advertise vehicles and enables prospective buyers to browse adverts and contact advertisers. Unless we state otherwise, CarZoon is not the seller, buyer, owner, lender, insurer or payment processor for vehicles advertised on the platform.

Our registered office is 5 South Charlotte Street, Edinburgh, Scotland, EH2 4AN, United Kingdom. You can contact us about privacy at support@carzoon.co.uk.

2. Scope of this policy

This policy applies when you:

• visit carzoon.co.uk;
• create or manage a CarZoon account;
• create, manage, promote or respond to a vehicle advert;
• use a dealer profile or dealer-management feature;
• submit a message, support request, seller enquiry, test-drive request, offer, trade-in request, valuation request or other website form;
• submit a CarZoon lead form or message through a social-media platform;
• subscribe separately to a CarZoon newsletter or other optional marketing communication; or
• otherwise communicate or interact with CarZoon.

This policy should be read with our Cookie Policy, Terms of Website Use and Acceptable Use Policy.

3. Personal data we collect

The personal data we collect depends on how you use CarZoon. It may include:

Identity and contact information

• first name and last name;
• email address and telephone or mobile number;
• postal or business address where relevant;
• profile photograph or account image; and
• your preferred contact method and suitable contact time.

Account and security information

• username, account type and account status;
• password hash and authentication information;
• email-verification and password-reset records;
• sign-in activity, device information and security logs; and
• account preferences, saved vehicles and dashboard activity.

Dealer and business information

• dealership or business name and trading details;
• business address, website and business contact details;
• your role or authority to act for a business;
• stock size, service area and onboarding requirements; and
• verification or supporting information reasonably required to review a dealer account.

Vehicle, advert and seller information

• vehicle registration number, make, model, year, mileage, condition, price, location and other listing information;
• vehicle descriptions, photographs, videos and documents;
• seller or dealer identity and contact details;
• advert status, dates, views and enquiry statistics; and
• available vehicle, MOT, tax, emissions, mileage or history information obtained through public or licensed data sources.

Enquiry and communication information

• the contents of messages and support requests;
• test-drive, viewing, offer, trade-in or price-request details;
• the vehicle or dealer connected with an enquiry;
• dates, times, status and outcomes of communications; and
• records of complaints, reports, disputes or safety concerns.

Technical and usage information

• IP address, browser type, device type and operating system;
• approximate location derived from IP address;
• pages visited, links selected, referral source, session information and timestamps;
• cookie identifiers and consent choices; and
• diagnostic, performance, security and error information.

Consent and preference information

• cookie-consent selections;
• newsletter or marketing choices, where separately offered; and
• records showing when and how a choice was made or withdrawn.

4. Where the data comes from

We may obtain personal data:

• directly from you when you use CarZoon or contact us;
• from another user where they send an enquiry, identify a business contact or report a concern involving you;
• from a social-media platform when you submit a CarZoon form, send a message or otherwise contact CarZoon through that platform;
• from dealers, private sellers or authorised staff who create or manage an account or advert;
• from public registers and vehicle-information sources, including available MOT, tax and vehicle-registration data; and
• automatically through cookies, logs and similar technologies when you use the website, subject to applicable consent requirements.

5. How and why we use personal data

We only use personal data where we have a lawful basis. The main purposes and lawful bases are set out below.

Where we rely on legitimate interests, those interests include operating and improving the marketplace, responding to users, preventing fraud, protecting accounts, maintaining evidence of activity and defending legal rights. We consider the likely impact on users and do not rely on legitimate interests where the impact on your rights and freedoms outweighs our interests.

6. Marketplace information and enquiries

Vehicle adverts and dealer profiles are intended to be public. Information submitted for publication—such as seller or dealer name, general location, business details, vehicle information, photographs, descriptions and selected contact options—may be visible to website visitors and may appear in search-engine results or social-media link previews.

Do not include private home-address details, payment information, full vehicle identification numbers, logbook images or unrelated personal information in public advert text or photographs.

When a prospective buyer sends an enquiry, we may disclose the enquiry and the buyer's submitted contact details to the relevant private seller or dealer so that they can respond. That seller or dealer may become a separate controller of the enquiry information and is responsible for using it lawfully. CarZoon does not authorise advertisers to add enquiry details to unrelated marketing lists without an appropriate lawful basis and any consent required by law.

7. Social-media leads and platform interactions

CarZoon may use lead forms, direct messages and other contact features on social-media platforms such as TikTok, Instagram and Facebook to receive dealer, partnership, customer-support or other enquiries. A form may ask for your name, email address, dealership or business name, location, stock size and the information you choose to include in your message.

We use this information only to review and respond to the enquiry, understand your onboarding needs and communicate about the service you asked about. We do not use ordinary website enquiries or social-media lead-form details for marketing and do not add them to a marketing list. If CarZoon introduces optional marketing in future, it will use a separate, clear opt-in.

Each social-media provider also processes information about use of its own platform under its own privacy terms. Depending on the feature, a provider may act as a service provider to CarZoon or as a separate controller for its own purposes. You can review the TikTok Privacy Policy and the Meta Privacy Policy , which covers Facebook and Instagram.

8. Cookies and analytics

CarZoon uses essential cookies and similar technologies where needed for account security, sessions, preferences, forms and core website functions. These cannot always be switched off through our website because the service may not work correctly without them.

With your consent, we may also use Google Analytics, tags deployed through Google Tag Manager and social-media pixels, such as the TikTok Pixel or Meta Pixel, to measure website use, understand campaign performance and improve the service. Non-essential analytics and advertising technologies are not activated until the relevant consent has been given. You can change or withdraw your choices through the website's cookie controls.

More information about cookie names, purposes, providers and durations is available in our Cookie Policy. Google and the relevant social-media providers may also process data under their own privacy policies.

9. Who we share personal data with

We may share personal data only where reasonably necessary with the following recipients:

• private sellers and dealers, when you contact them or ask us to pass on an enquiry;
• Hostinger, which provides website hosting, related infrastructure and email services;
• Google, where consented analytics or tags are used;
• social-media providers, including TikTok and Meta platforms such as Facebook and Instagram, where you interact with CarZoon, submit a lead form or consent to a website pixel;
• technical suppliers that provide website development, security, backup, communications or support services under appropriate confidentiality and data-protection terms;
• professional advisers, including accountants, insurers, lawyers and auditors where necessary;
• courts, regulators, law-enforcement bodies and public authorities where disclosure is required by law or reasonably necessary to protect rights, users or the public; and
• a buyer, investor or successor organisation in connection with a genuine proposed sale, restructuring, investment or transfer of CarZoon's business, subject to appropriate safeguards.

Some providers act as processors on CarZoon's instructions, while others may act as independent controllers for their own services. We require processors to protect personal data and use it only for the agreed services.

CarZoon does not sell personal data.

10. International transfers

Some technology and social-media providers, including Google, Meta and TikTok, operate internationally. This means personal data may be accessed from or processed in countries outside the United Kingdom.

Where UK data-protection law requires additional protection for an international transfer, we use an available lawful transfer mechanism. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another safeguard permitted by law. You may contact us for more information about the safeguards relevant to your data.

11. How long we keep personal data

We keep personal data only for as long as needed for the purpose for which it was collected, including legal, security, accounting and dispute-resolution requirements. Our usual retention schedule is:

When a retention period ends, we delete or anonymise the information. Residual copies may remain temporarily in secure backups until they are overwritten through the normal backup cycle. We may keep anonymous, aggregated statistics that no longer identify an individual.

12. Security

We use appropriate technical and organisational measures designed to protect personal data from accidental loss, destruction, alteration, unauthorised disclosure or access. Measures may include access controls, authentication, encryption in transit, software updates, backups, monitoring and limiting staff or supplier access to those who need it.

No internet service is completely secure. You are responsible for using a strong, unique password, protecting your sign-in information and telling us promptly if you suspect unauthorised account access. Please email support@carzoon.co.uk if you identify a privacy or security concern.

13. Your data-protection rights

Depending on the circumstances and lawful basis, UK data-protection law may give you the right to:

• ask for access to your personal data and a copy of it;
• ask us to correct inaccurate or incomplete personal data;
• ask us to erase personal data in certain circumstances;
• ask us to restrict how personal data is used in certain circumstances;
• object to processing based on legitimate interests;
• receive certain personal data in a structured, commonly used and machine-readable format, and ask us to transfer it where applicable;
• withdraw consent at any time where processing relies on consent; and
• complain to the Information Commissioner's Office.

To exercise a right, email support@carzoon.co.uk. Please describe your request clearly. We may ask for reasonable information to verify your identity and protect the account or data involved. You will not normally have to pay a fee. We usually respond within one month, subject to any lawful extension for a complex request.

These rights are not absolute, and an exemption may apply in some situations. If we cannot fulfil a request, we will explain why where the law permits.

14. Children

CarZoon account, vehicle-advertising, seller-contact, test-drive and paid services are intended for people aged 18 or over. We do not knowingly collect personal data from children for these services. If you believe a person under 18 has provided personal data contrary to this requirement, please contact us so we can review and take appropriate action.

15. Automated decisions and moderation

We may use rules, filters and technical tools to identify spam, suspicious activity, duplicate content, account-security risks or adverts that may require review. These tools may help prioritise a matter for manual review.

CarZoon does not currently make decisions based solely on automated processing that produce legal effects or similarly significant effects for users. If this changes, we will update this policy and provide the information and safeguards required by law.

16. Third-party websites and services

CarZoon may contain links to dealers, sellers, social platforms, vehicle-data services, finance or warranty providers and other external websites. Those organisations control their own websites and privacy practices. This policy does not cover personal data collected directly by an external organisation, so you should read its privacy information before providing data.

17. Changes to this policy

We may update this policy when CarZoon's services, providers or legal obligations change. The current version will be published on this page with its effective date. If a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of affected users before the new use begins where required.

18. Contact us and the ICO

Please contact CarZoon first if you have a question, request or concern about personal data. We will try to resolve the matter.

You also have the right to complain to the UK Information Commissioner's Office. Information about raising a data-protection complaint is available at ico.org.uk.

Last updated: 24 July 2026.