Privacy Policy

1. Who we are

Classic And Retro Autos Limited restores, services and sells classic cars from our workshop in Witton Gilbert, County Durham. We are the controller of the personal information described here: we decide how it is used, and we are responsible for looking after it.

We are registered in England and Wales, company number 09746003. Our registered office is Unit 4 And 5 Langley Park North Industrial Estate, Witton Gilbert, Durham, England, DH7 6TX. We are registered with the Information Commissioner’s Office, registration number ZB131259. We have not appointed a data protection officer, so please contact us directly using the details in section 11.

2. Who this policy covers

This policy is for anyone who:

• visits this website
• contacts us by phone, email or the enquiry form on our Contact page
• brings a vehicle to us for work, an inspection or a restoration
• buys a vehicle from us
• has reviewed or recommended us on Google, Trustpilot or Facebook, where we show that review on this website

3. The information we collect

When you visit this website. The companies that host and supply this website automatically record technical information each time your browser asks for a page or its content: your IP address, the type of browser and device, and what was requested. We do not set cookies or use analytics or advertising tools, and we do not build profiles of visitors. Our Cookie Policy has the details.

When you contact us. Your name, email address and phone number, details of your vehicle, and whatever you tell us in your message or call. If you use the enquiry form, we receive what you type into it: your name, email address and message, plus your phone number and vehicle if you give them. When you send it, our website host also records your IP address and browser details with the message, and runs it through an automated spam filter.

When we work on your vehicle. Your name, address and contact details; your vehicle’s registration number, identification number and other details; the work you ask for and the work we do; photographs of the vehicle taken during the job; and our estimates, invoices and records of your payments.

When you buy a vehicle from us. Your name, address and contact details, which we need to complete the sale and to record you with the DVLA as the new keeper, and records of the sale and payment.

Reviews. We show some customer reviews on our home and About pages: the reviewer’s name, star rating and review, and the month it was written, copied from Google, Trustpilot or Facebook, where they were first published. A Facebook recommendation has no star rating. Each review shows the mark of the website it came from and, where that website gives the review an address of its own, links back to it.

We do not take payments through this website. When you pay us, we keep a record of the invoice and the payment.

4. What we use it for, and the law that allows it

• Replying to you and giving you a quote. When you ask about work or a vehicle, this is a step you have asked us to take before entering a contract. For other enquiries we rely on our legitimate interest in answering people who get in touch.
• Doing the work you ask for, selling you a vehicle, and arranging collection or delivery. This is necessary for our contract with you.
• Keeping invoices, accounts and tax records. The law requires us to.
• Telling the DVLA your name, your address and the date of sale when we sell you a vehicle, so that it is registered to you. The law requires us to.
• Dealing with complaints, questions about our work, and legal claims. We rely on our legitimate interest in running the business properly and being able to defend ourselves.
• Showing our work. We post photographs of cars in our workshop on this website and on our Facebook and Instagram pages. We rely on our legitimate interest in showing the quality of our work. If you would rather your car was not shown, tell us and we will remove it.
• Showing customer reviews on this website. We rely on our legitimate interest in showing what customers say about us. If you reviewed us and would like your review taken off this website, tell us and we will remove it.
• Running and protecting this website, through the technical records our suppliers keep. We rely on our legitimate interest in keeping the site working and secure.

We do not send marketing emails or texts, and we never sell or rent your information to anyone.

5. Who we share it with

• Our website host, based in the United States, which runs this website and keeps a copy of messages sent through the enquiry form.
• Our data storage provider, based in Singapore, which holds the content of this website and our list of enquiries, and records technical details of the requests made to it. Our data is stored in the UK.
• Our email provider, based in the United States, which stores emails you send us.
• The DVLA, when we sell you a vehicle.
• Our accountant, insurers and legal advisers, where they need it to do their work for us.
• Banks and payment providers that handle payments you make to us.
• HM Revenue & Customs, the police, courts or regulators, when the law requires it.

Our website host and data storage provider work for us under data processing terms that allow them to use your information only on our instructions and require them to keep it secure. If you would like to know which companies we use, ask us and we will tell you.

Other companies you deal with directly. If you buy a vehicle through one of our eBay listings, eBay collects and uses information under its own privacy notice. Some images on this website are delivered by other companies: vehicle photographs by eBay, other photographs by Unsplash and Shopify, and the logo beside our what3words address by what3words. When your browser loads one of those images, that company receives your IP address and browser details, and its own privacy notice applies.

6. Information that leaves the UK

Our data is stored in the UK, but some of the companies that handle your information for us are based outside it, so the law treats sharing it with them as an international transfer.

• Our website host (United States). The website’s technical records and the copies of enquiry-form messages it keeps are handled in the United States. We rely on UK regulations under Article 45A of the UK GDPR that approve transfers to US organisations certified to the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”). Our host states that it is certified. If that ever stops applying, its terms fall back to the EU standard contractual clauses with the UK Information Commissioner’s addendum.
• Our data storage provider (Singapore). Our data stays in the UK, but the provider and the companies it uses, including some in the United States, may access it to run and support the service. Parts of our pages are loaded from this provider, so it also receives your IP address and browser details when you browse. The safeguard we rely on is the EU standard contractual clauses with the UK Information Commissioner’s addendum, which form part of its terms.
• Our email provider (United States). Emails you send us may be stored and processed in the United States. Our provider states that it is certified to the UK Extension to the EU-US Data Privacy Framework, so the same UK-US data bridge applies.

You can ask us for a copy of these safeguards.

7. How long we keep it

• Enquiries that do not lead to any work or sale: 12 months after we last hear from you.
• Records of jobs, sales, invoices and payments, including job photographs: 6 years after the end of the financial year they belong to. Tax law requires us to keep business records that long, and it is also the period in which a claim about work or a sale can usually be brought.
• Reviews shown on this website: until the reviewer asks us to remove one, or we stop showing it.
• The website’s technical records: kept by our suppliers only as long as they need them to run the service, find faults and stop attacks. We do not keep copies.

8. Your rights

You have the right to:

• ask for a copy of the personal information we hold about you
• have anything inaccurate or incomplete corrected
• ask us to delete your information
• ask us to limit how we use it
• object to anything we do on the basis of our legitimate interests
• have information you gave us for a contract sent to you, or to another organisation, in a format a computer can read

Some of these rights depend on the circumstances. For example, we cannot delete records that the law requires us to keep. Asking is free in almost all cases.

We will reply within one month of receiving your request or, if we need to check who you are, of receiving what we asked for. If a request is complex, or you send us several, we may need up to two more months, and we will tell you why within the first month.

We do not make decisions about you by automated means alone.

9. Do you have to give us your information?

You do not have to contact us or give us anything. But we need a way to reply to you, and we cannot carry out work or sell you a vehicle without the details described above. When we sell you a vehicle, the law requires us to give the DVLA your name and address, so we cannot complete the sale without them.

10. Complaints

If you are unhappy with how we have handled your information, please tell us first. Email classicandretro@hotmail.com with “Data protection complaint” in the subject line, call us on 0191 3730086, or write to us at the address below. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection: ico.org.uk/make-a-complaint or 0303 123 1113.

11. Contact us

For any question about this policy or your information:

12. Changes to this policy

We will update this policy whenever the way we use personal information changes, and change the date at the top of the page when we do.