carVertical
Policies

Privacy policy for users of the website/app services

1. GENERAL PROVISIONS

1.1. We care about your privacy and the security of your personal data, so in this privacy policy (the “Privacy Policy”), we explain how we process your personal data and what your rights are.

1.2. This Privacy Policy applies when you use the online vehicle history checking website www.carvertical.com or its Android and iOS mobile applications (the “Website” and the “Mobile Applications”, referred to collectively as the “Platform”), when you interact with us via third-party social media channels regarding our services in the UK, or when you contact us by email, telephone, or other electronic communication channels.

1.3. In this Privacy Policy, “personal data” (“Personal Data”) means any information or set of information from which we can directly or indirectly identify you, such as your name, surname, email address, telephone number, etc. As used in this Privacy Policy, “you” means a user of the Platform and its services, a person interacting with us via social media channels, or a person who communicates with us.

1.4. If you use the Platform, its services, interact with us via social media channels, contact us, or subscribe to our newsletters, we consider that you have read and understood the Privacy Policy.

1.5. The platform and the social media channels we use may contain links to our partners' websites or to websites for our other projects. This Privacy Policy does not apply to those websites.

1.6. You can read the Cookie Policy separately here. We have also developed privacy notices for vehicle owners or holders.

2. WHO ARE WE?

2.1. The controller of your Personal Data is Sovian Epublishing Limited, company number 16582008, address 1 Princeton Mews, 167-169 London Road, Kingston Upon Thames, Surrey, England KT2 6PT (hereinafter referred to as “carVertical” or “we”).

2.2. For any questions regarding your personal data or to exercise your rights under the UK GDPR, you may contact me at support+britain@carvertical.com.

3. HOW DO WE RECEIVE YOUR PERSONAL DATA?

3.1. We receive your Personal Data:

  1. 3.1.1. directly from you when you provide your Personal Data to us. For example, when you register on the Platform, use the Platform and its services, make a payment, communicate with us by email or telephone, etc;

  2. 3.1.2. when we collect Personal Data during your use of the Platform or social media channels. For example, we may record your order history, visits to the platform, IP address, service preferences, and the URL links you open;

  3. 3.1.3. when we receive Personal Data from third parties, such as payment institutions regarding transactions, service providers who identify you as a contact person, or other external sources.

3.2. When you provide Personal Data about yourself or third parties (such as employees, agents, friends, or colleagues), you are responsible for ensuring that the information is accurate, complete, and up to date. You must also ensure you have a lawful basis - such as consent or a contractual necessity - to share that data with us. In some cases, we may ask you to confirm your right to provide this information.

4. WHAT PERSONAL DATA DO WE PROCESS ABOUT YOU?

4.1. We process your Personal Data for the following purposes and under the following conditions:

Purposes of Processing

Processed Personal Data

Retention Period

Legal basis

Creating and using an account; ordering and receiving services (carVertical reports, etc.).

The following data is required to create and use your account and to order and receive services: Email address, Facebook, Apple ID, Google account details (if you log in via these accounts), encrypted account passwords.

If you voluntarily provide (with your consent): Name, surname, phone number, represented person (if representing a company or other person), and your relationship with that person.

Other data: Date of account use, date of service provision (carVertical report), information on services ordered/used and changes to them, purchase history, and service credit balance.

When you purchase a report without a pre-existing account, we automatically create one for you to temporarily store your purchased report and related transaction information.

Account data is retained for the duration of the account use and for 7 years after the last login.

Service purchase data is retained for 7 years from the date of transaction or last account login to comply with UK tax and limitation laws.

Consent-based data retained until the consent expires or is withdrawn by you.

The processing is necessary for the conclusion and performance of the contract (Article 6(1)(b) of the UK GDPR).

Legitimate interests to ensure the quality of account operations, service provision, and proper administration of orders (Article 6(1)(f) of the UK GDPR).

Consent of the data subject (Article 6(1)(a) of the UK GDPR).

Managing payments for services.

The following data is required for payment confirmation: Payment amount, date, partial payment card number (last 4 digits), payer’s email address, payer’s IP address. Payer’s name, surname, address, if provided by the payer.

The data shall be retained in accordance with the legislation governing financial transactions and accounting and, where no time limits are specified, for 10 years from the date of payment.

The processing is necessary for the conclusion and performance of the contract (Article 6(1)(b) of the UK GDPR).

The processing is necessary for compliance with a legal obligation to which the controller is subject, specifically regarding UK financial and tax accounting (Article 6(1)(c) of the UK GDPR).

Providing carVertical reports.

The report shall contain the following data (summarised): Vehicle VIN; licence plate number, technical, registration, import/export, use and ownership restrictions, theft data, servicing information, mileage, warranties, details of damages (accidents, other damage), including photographs.

The data is retained for 30 days from the date of purchase of the report.

The processing is necessary for the conclusion and performance of the contract (Article 6(1)(b) of the UK GDPR).

The legitimate interests of the controller or a third party to provide and obtain data-based information on the condition of the vehicle, to help prevent fraud in the purchase of second-hand vehicles and to protect the interest of road users in the safe operation of vehicles on the road (Article 6(1)(f) of the UK GDPR). Further details are set out in the Privacy Notice on the processing of vehicle data.

Quality assurance, communication about services, and reminders about pending orders.

Email address, VIN of the checked vehicle, subject and content of the communication (message, reply), data needed to address quality issues.

If you provide (with your consent): name, surname, phone number, country, position, person represented, etc.

If communicating via social media channels: Publicly visible information associated with your profile.

The data is stored for the duration of the communication and up to 2 years after the end of the communication (last message).

Consent-based data retained until your consent is withdrawn or expires.

The legitimate interests of the controller to provide information and to ensure the quality of the service, to remind the customer of pending orders and to assist the customer in completing them (Article 6(1)(f) of the UK GDPR). 

Consent of the data subject (Article 6(1)(a) of the GDPR).

Platform administration, development, security, and fraud prevention.

IP address, device information, data collected by cookies, analytical data (visits, views, searches, links clicked and the date and time of these clicks), URL links to the Platform, information on data modification, deletion.

Platform data is stored as stated in the Cookie Policy and, if not included in the cookie information, for up to 2 years after collection. 

Where data is processed on the basis of consent, until the consent expires or is withdrawn.

Logs are kept from 14 days to 2 years.

Consent of the data subject (Article 6(1)(a) of the UK GDPR);

The legitimate interests of the controller in ensuring the smooth functioning, development and security of the Platform (Article 6(1)(f) of the UK GDPR).

Managing interactions on social media channels. 

Username, comments and shares on the post, information about clicks on “like” and “follow”, information about reactions to entries, photo, details of the message and the reply to the message (time of receipt, content, attachments), rating information, and any other information you provide.

Information on social accounts is stored in accordance with the terms and conditions and retention policies set by the owners of the social networks.

Consent of the data subject (Article 6(1)(a) of the UK GDPR).

Conducting direct marketing campaigns for businesses and consumers, sending news (for more, see Section 5 of the Privacy Policy).

Name, surname, phone number, news preferences, service usage data for the provision of better quality news (location, language), data collected via advertising cookies. 

Other data: Information on news readership, URL links to the Platform, information on the list of news recipients.

Where the user has an account, the data will be stored for the period of use of the account and for 7 years from the last access to the account or until the consent is withdrawn.

Where the user does not have a registered account, the data shall be kept for no longer than until the consent is withdrawn.

Consent of the data subject (Article 6(1)(a) of the UK GDPR);

The legitimate interest of the data controller in informing its users about similar goods and/or services (Article 6(1)(f) UK GDPR);

The legitimate interests of the controller to manage the mailing lists of news recipients, to analyse aggregated marketing results, to resolve problems related to the provision of news (Article 6(1)(f) of the UK GDPR).

Conducting quality surveys to improve services and performance.

Email address, phone number, specific information requested in the survey/questionnaire, comments, ratings, and service preferences.

The data will be kept for the duration of the survey and for 2 years after the end of the survey.

Where the processing is based on consent, until the consent expires or is withdrawn.

The legitimate interest of the controller to analyse and use the aggregated quality results as a basis for organising its activities (Article 6(1)(f) of the UK GDPR).

Consent of the data subject (Article 6(1)(a) of the UK GDPR).

Organising promotional competitions, games, and campaigns (for more, see Sub-sections 5.8-5.9. of the Privacy Policy).

Name, surname, email address, phone number, data specifically requested in the contest/promotion form, social media handle (if used for entry), messages shared regarding the campaign, details of winners, and participant lists.

During the period of the game, promotion, contest and for 2 years after the end of the game, promotion, contest, 

Where the processing is based on consent, until the consent expires or is withdrawn.

Consent of the data subject (Article 6(1)(a) of the UK GDPR).

Publishing and managing reviews on carVertical’s activities.

The name, surname, email address of the person submitting the review, the content of the review, the date on which the review was submitted, and the details of the social media account, including a photo if the review is submitted via Social Networking.

Reviews are stored until they are cancelled.

Consent of the data subject (Article 6(1)(a) of the UK GDPR).

Public awareness of carVertical’s activities.

Personal data, photos, videos, excerpts from training content in publications and other presentation content.

The data shall be retained for 5 years after collection.

Where the processing is based on consent, until the consent expires or is withdrawn.

Publicly available data (in publications, etc.) are processed until the end of their public publication.

Consent of the data subject (Article 6(1)(a) of the UK GDPR).

The legitimate interests of the controller in ensuring accurate, smooth and efficient communication (Article 6(1)(f) of the UK GDPR).

Resolving disputes and claims.

Email address, content of the complaint/claim/ proceeding, information related to the dispute/claim; 

Other data provided by the person: name, surname, phone number, address, job title, person represented (if you represent a company or another person), relationship with the person represented.

During the pendency of the dispute and for 7 years after the end of the pendency of the dispute (or, in the case of a judicial dispute, after the final judgment has become final). 

Requests and correspondence from data subjects shall be kept for 2  years after the end of the processing of the request.

The processing is necessary for compliance with a legal obligation imposed on the controller (Article 6(1)(c) of the UK GDPR).

Legitimate interests of the controller or of a third party to assert claims or defend their rights (Article 6(1)(f) of the UK GDPR).

Analysis of the use of services.

Email address, IP address, order history, payment history, use of discounts, quantity and aggregate geographical distribution of services ordered, attributes used to select services, quality of service, date and country of user registration, time spent on the Platform, sections browsed, location from which accessed.

Where the user has an account, the data is stored for the duration of the use of the account and for 7 years after the last login to the account. 

Where the user does not have a registered account, the data shall be kept for no longer than until the consent is withdrawn.

The legitimate interests of the controller to improve and enhance the efficiency of its activities on the basis of data based on analysis (Article 6(1)(f) of the UK GDPR).

4.2. In some cases, we may use the contacts you have provided to send you messages or call you in connection with the order or provision of our services, for example, to inform you of confirmation of an order for the services, changes to the provision of the services, reminders of incomplete orders sent to your email address when you have not completed an order, and etc. Such communications are necessary for the proper provision of our services and are not considered promotional communications.

4.3. We process some of your Personal Data only with your consent. We observe the following rules for how data is processed on the basis of consent:

  1. 4.3.1. You are not obliged to provide Personal Data; for example, if you are required to fill in a form, you may not fill in the optional fields, or if consent is given by ticking the relevant box, you may not tick it. In case you provide data in optional fields on your own, provide us with more data than is necessary to answer our questions, and communicate with us on our social accounts, we consider that the provision of such data constitutes, at the same time, your consent to the processing of such data.

  2. 4.3.2. You have the right to withdraw your consent to the processing of your Personal Data at any time when it is processed on the basis of consent. Where we process your Personal Data on the basis of your consent, we will retain such data until you withdraw your consent. You can withdraw your consent by changing your account settings (if the data is processed in your account), by clicking on the relevant links (if provided) or by emailing us at support+britain@carvertical.com. We will endeavour to implement your request to withdraw consent as soon as possible after we receive it, but in some cases, this may take a reasonable amount of time due to the operation of our systems. Withdrawing your consent to some processing may result in a reduction in the scope of services available to you.

  3. 4.3.3. Even if you withdraw your consent, we may keep a record of when consent was given and withdrawn in order to demonstrate our compliance with the data protection rules where necessary.

4.4. You have the right to amend and update the information we hold about you. In some cases, it is necessary for us to have accurate up-to-date information relating to you and we may ask you to confirm that the information we hold about you is correct.

4.5. When providing services, we may sometimes use automated decision-making based on the processing of data, for example, to ascertain your needs in relation to the service and your compliance with the service requirements. Automated decision-making means the processing of personal data using, for example, software code or an algorithm, an artificial intelligence solution that does not require human intervention. We regularly review the automated decision-making methods we use to ensure that they are fair, effective and impartial. You can object to the results of an automated decision; in which case your situation will be assessed by one of our experts.

5. NEWS AND DIRECT MARKETING

5.1. We may send information about our and/or our group companies’ activities, services (direct marketing communications) to your email address and/or telephone number, call you if you have given us your consent to receive such information from us or if you or an organisation you represent is a client of ours. We may also ask you to help us assess the quality of our performance and service.

5.2. To provide you with bespoke newsletters, we may personalise direct marketing communications using information about your use of our services. The personalisation solutions we use are only intended to improve your experience and if you do not agree on receiving our newsletters, you will not lose your right to use our services and you will receive the same quality of service.

5.3. When we send out newsletters, we may collect information about the individuals who receive them, such as which message they have opened, what links they have clicked on, etc. This information is collected in order to provide you with more relevant and tailored newsletters.

5.4. Your contact details may be passed on to our partners/data processors who provide us with newsletters or quality assessment services. We may also pass on your contact details to other group companies for the purpose of providing you with their offers and news, if such transfer of data meets the requirements of the legal acts.

5.5. If you no longer wish to receive direct marketing, you can cancel them in the manner specified in the electronic communications (for example, by clicking on the “unsubscribe” link in the newsletter, etc.) or by sending us a notification by email to support+britain@carvertical.com.

5.6. If you withdraw your consent, we will endeavour to stop sending you newsletters immediately, but this may take some time. As our news campaigns are planned in advance, you may still receive our newsletters one more time even after withdrawing your consent.

5.7. Withdrawal of consent does not automatically oblige us to destroy your Personal Data or to provide you with information about our processing of your Personal Data, and you should make a separate request for these actions.

5.8. Participation in our games, promotions or competitions is optional. However, in order to participate in a game, promotion or competition, you will be required to provide the information we have specified, including Personal Data. If the terms of the game require you to provide Personal Data of another person (friend, colleague), you must duly inform that person and obtain his/her consent before providing the data. We will run the games, promotions or competitions and process Personal Data in accordance with the rules set out for the specific game, promotion or competition. You have the right to withdraw your consent to the processing and use of Personal Data for this purpose at any time. If you withdraw your consent, you will no longer participate in the game, promotion or competition.

5.9. We have the right to contact the participants of the game, promotion or competition and announce the winners on the Platform, social media channels and other information channels specified by us. We may use a software application based on automated decision making to process the registration of a game, promotion or competition and/or to determine winners. This will be notified in the rules of the game, promotion or competition or will be evident from the links we provide. In this case, if you do not wish to be subject to automated decision making, you will not be able to participate in the game, promotion or competition.

6. SOCIAL MEDIA CHANNELS

6.1. We can post information about our activities, services offered, changes to services, and other news on social media channels. We may also organise surveys, games, competitions, promotional campaigns, share advertisements and discount codes on the social media channels.

6.2. It is important to remember that users of social media channels are subject not only to this Privacy Policy, but also to the privacy policies, rules and terms of use of the operators of the social networks on which the social media accounts are located. When you interact with us on the social media channels and provide certain information (for example, by messaging us and commenting on our posts), we may see public information about your profile (name, image, email, etc.) depending on the privacy settings you have chosen. This information (for example, a comment you have made) may also be visible to other visitors to a particular social media account, depending on the privacy settings you have chosen.

7. HOW DO WE USE YOUR PERSONAL DATA AND WHAT PRINCIPLES DO WE FOLLOW?

7.1. We respect your privacy and only collect as well as process Personal Data that is necessary to achieve our stated purposes for processing Personal Data.

7.2. In processing your Personal Data, we will:

  1. 7.2.1. comply with the requirements of applicable and valid legislation, including the UK GDPR;

  2. 7.2.2. process your Personal Data in a lawful, fair and transparent manner;

  3. 7.2.3. collect your Personal Data for specified, clearly defined and legitimate purposes and do not process it in a way that is incompatible with those purposes, except to the extent permitted by law;

  4. 7.2.4. take all reasonable steps to ensure that Personal Data which is not accurate or complete in relation to the purposes for which it is processed is promptly rectified, supplemented, its processing is suspended or it is destroyed;

  5. 7.2.5. keep them in a form which permits your identification for no longer than is necessary for the purposes for which the Personal Data is processed;

  6. 7.2.6. do not provide Personal Data to third parties and will not disclose it other than as set out in the Privacy Policy or applicable law;

  7. 7.2.7. ensure that your Personal Data is processed securely, by ensuring technical and organisational security measures, and by limiting access to your Personal Data to those of our employees who need such access for the purposes of their job functions.

8. TO WHOM AND WHEN DO WE TRANSFER YOUR PERSONAL DATA?

8.1. We may transfer your Personal Data to processors or recipients who assist us in the performance of our activities:

  1. 8.1.1. accounting and order management software providers;

  2. 8.1.2. providers of IT, cloud hosting, Platform management and telecommunications services;

  3. 8.1.3. providers of advertising, marketing and news distribution services;

  4. 8.1.4. providers of office applications and data storage, management, exchange services;

  5. 8.1.5. payment administration service providers;

  6. 8.1.6. customer support tools providers;

  7. 8.1.7. payment fraud prevention decisions providers.

8.2. To enable us to publish content on social media channels, we can provide data to the following social networking platform operators: Meta Platforms (Facebook, Instagram); LinkedIn; TikTok; Google/YouTube. As we utilize the shared infrastructure of our partner network, please refer to the privacy policies of these platforms for details on their data processing. Transfers to these entities outside the UK are governed by the UK Addendum to the Standard Contractual Clauses or the UK-US Data Bridge.or interactions on the social media channels we act as a Joint Controller alongside the social network operators (e.g., Meta Platforms Ireland Ltd for Facebook/Instagram) and our partner company, cV Group, UAB. While we manage inquiries regarding our UK services, the social network operators are primarily responsible for the technical data processing and the exercise of your rights regarding the platform's infrastructure. We recommend you review the privacy policies of the respective platforms (Facebook, Instagram, LinkedIn, YouTube, TikTok) to understand how they handle your data.

8.3. We may provide data to law enforcement and pre-trial investigation authorities, courts and other dispute resolution authorities, other persons performing functions assigned by law, in accordance with the procedure provided by the legislation of England and Wales or other applicable UK legislation. We provide these entities with information that is required by law or specified by the entities themselves.

8.4. We may also transfer data to:

  1. 8.4.1. companies which are related to us and, where there is a legal basis, to other data controllers or joint data controllers, e.g. carVertival OÜ (Estonia), cV Group, UAB (Lithuania);

  2. 8.4.2. if necessary, to companies that would buy or acquire our business or engage in joint activities or other forms of cooperation with us, as well as to companies established by us.

8.5. We primarily process data within the UK and the EEA. If we transfer your data to a country outside the UK, we ensure it is protected by one of the following safeguards:

  1. 8.5.1. The UK Government has recognized the country (including all EEA members) as providing an adequate level of data protection;

  2. 8.5.2. We use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses;

  3. 8.5.3. For transfers to certified organizations in the United States is used UK-US Data Bridge;

  4. 8.5.4. In limited circumstances, where you have provided explicit consent for the transfer.

9. WHAT RIGHTS DO YOU HAVE?

9.1. As a data subject, you have the following rights in relation to your Personal Data:

  1. 9.1.1. to have access to your Personal Data, i.e., to receive a notice confirming whether we are processing your Personal Data and, if we are, to request access to the data processed and the information relating to it;

  2. 9.1.2. to ask us to correct inaccurate or incorrect information we use or to supplement information where it is incomplete;

  3. 9.1.3. to ask us to erase information we hold about you where there is a basis for erasure;

  4. 9.1.4. to request us to restrict the processing of the information we hold about you where you contest the accuracy of the data or object to the processing of the data, you object to the erasure of your data which is unlawfully processed, or you need the data in order to assert, exercise, or defend legal claims;

  5. 9.1.5. to object to the use of your data where we process your data for our and/or third parties legitimate interests;

  6. 9.1.6. to request us to transfer/receive data that you have provided to us under a contract or consent and that we process by automated means in a commonly used electronic format;

  7. 9.1.7. to object to the application to you of a fully automated decision, including profiling, where such a decision may have legal consequences or a similar significant effect on you;

  8. 9.1.8. to withdraw the consents, you have given us to use information about you where we are using the data on the basis of your consent;

  9. 9.1.9. lodge a complaint with the relevant data protection supervisory authority.

9.2. If you wish to exercise any of your rights set out above, you may contact us by email at support+britain@carvertical.com. In order to better understand your request, we may ask you to fill in the relevant request form, ask you to provide a request signed with an advanced or qualified electronic signature, send the request by post or visit us.

9.3. For security reasons, in some cases we will only be able to process your request after verifying your identity. We may therefore ask you to prove your identity, for example by providing an identity document or other information.

9.4. You can exercise some of your rights as a data subject by changing your account settings on the Platform or deleting your account yourself. By changing your settings or deleting your account, you may lose some or all of the information contained in your account.

9.5. We may refuse to exercise your rights other than to object to the processing of your Personal Data where it is processed on the basis of consent, including consent for direct marketing, where we are not permitted to comply with your request under the UK GDPR.

9.6. We do not normally charge any fee for exercising your rights. However, the law allows us to charge a reasonable fee or to refuse to comply with your request if it is manifestly unfounded or excessive.

9.7. Upon receipt of your request or instruction regarding the processing of your Personal Data, we will provide you with a response within no later than 1 month from the date of the request and will carry out the actions specified in the request or inform you why we refuse to do so. If necessary, the time limit may be extended by a further 2 months, depending on the complexity and number of requests. In this case, we will inform you of the extension within 1 month of receipt of the request.

9.8. If Personal Data is erased at your request, we may retain copies of the information as necessary to protect our legitimate interests and those of others, to comply with obligations of public authorities, to resolve disputes, to identify disturbances or to comply with agreements.

10. HOW DO WE PROTECT YOUR PERSONAL DATA?

10.1. Your Personal Data is processed responsibly and securely and is protected against loss, unauthorised use and alteration. We have put in place physical and technical measures (such as access control, data sharing restrictions, encryption, updating of systems, use of passwords, virus or malware protection, data protection documentation, etc.) to protect the information We collect from accidental or unlawful destruction, damage, alteration, loss, disclosure, as well as any other unauthorized processing. Our employees are under a written obligation not to disclose or distribute your Personal Data to any unauthorized third party.

10.2. The security measures for Personal Data shall be determined taking into account the risks involved in the processing of Personal Data. For more on data security, see here.

11. COOKIES AND OTHER TRACKING TECHNOLOGIES

11.1. A cookie is a small text file stored on your browser or device (PC, tablet, mobile phone). For more information about the cookies We use and the conditions of their use, please see our Cookie Policy.

12. CONTACT US AND COMPLAINTS

12.1. If you have any questions, comments or complaints about how we collect, use and store information about you, or if you wish to exercise your rights as a data subject, you may contact us at support+britain@carvertical.com.

12.2. If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; helpline: 0303 123 1113; www.ico.org.uk.

13. FINAL PROVISIONS

13.1. We have the right to update or change this Privacy Policy at any time. Such updated or amended Privacy Policy will be effective upon its posting on the Platform. In the event of material changes to the Privacy Policy, we will provide you with additional notice by email, if you have provided us with such an email address.

Date of last update: 18 February, 2026