1. Who is responsible for your data
Courtesy Cars Group UK Ltd, trading as Courtesy Cars UK, is the data controller for the personal data described in this policy. We are registered in England and Wales under company number 17430389. Registered office and trading address: 44 Syon Lane, Isleworth, London TW7 5NQ.
For anything about your data — a question, a request, a concern — contact us on 020 7052 5403 or at info@courtesycars.net, or write to the address above marked “Data protection”. We aim to answer within five working days.
2. What we collect, and where it comes from
We collect only what a claim needs. Most of it comes directly from you when you report an accident, sign in to your portal, message us, call us or sign a document. Some comes from third parties involved in your claim.
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, date of birth, address, postcode, phone, email, preferred language | You |
| Accident details | Date, time, location (including GPS if you allow it), your account of what happened, police reference, witnesses | You |
| Your vehicle | Registration, make, model, colour, MOT and tax status, finance company, V5C, plate photo | You; DVLA/DVSA vehicle lookups |
| Other parties | The other driver’s name, contact details, registration, insurer and claim reference | You; insurers |
| Evidence | Photographs, dashcam footage, documents, engineer reports, estimates — each hashed and time-stamped on upload | You; repairers; engineers |
| Driving and licensing | Driving licence number, private hire (PCO) licence number and expiry, platform (Uber, Bolt, FREENOW) | You |
| Financial | Insurance policy and excess, loss-of-earnings evidence such as platform statements, and where relevant bank statements to show you could not afford a hire car yourself | You |
| Hire and handover | Delivery address, condition photos, mileage, fuel, signatures, delivery driver notes | You; our drivers |
| Communications | Calls (noted, and recorded where we tell you), WhatsApp, SMS, email, portal messages | You; insurers; partners |
| Signatures and audit | Typed or drawn signature, time, IP address, device, document hashes | You; our systems |
| Website use | Pages visited, device and browser type, essential cookies | Your browser |
Injury data
We ask one question — whether anyone was hurt — so we know to refer you to a solicitor. We do not collect medical details and we do not process injury claims. If you tell us about an injury, we record only the fact of it and whether you asked for a referral.
3. Why we use your data, and our lawful basis
Under the UK GDPR we must have a lawful basis for each use of your data. These are the uses and the bases we rely on:
| What we do | Lawful basis |
|---|---|
| Provide your replacement vehicle, manage the hire and run your claim | Contract — the hire agreement and authority you sign |
| Notify and correspond with the at-fault insurer, engineers, repairers, recovery and storage providers | Contract, and our legitimate interest in recovering the charges and your losses |
| Verify your identity, vehicle and licence; check the facts of the accident | Legitimate interest — preventing fraud and running an accurate claim; legal obligation where the law requires checks |
| Look up your vehicle from its registration | Contract — to match the right replacement and describe your car correctly |
| Keep a time-stamped audit trail of every action, document and signature | Legitimate interest — evidencing the claim and protecting both you and us; legal obligation for record keeping |
| Send you updates by WhatsApp, SMS, email and in your portal | Contract — keeping you informed is part of the service |
| Refer you to a specialist solicitor if anyone was hurt | Consent — we only pass your details on if you say yes |
| Deal with complaints, disputes and legal claims | Legitimate interest and legal obligation |
| Marketing to you about our services | Consent — only if you opt in, and you can opt out at any time |
| Improve this website and our service | Legitimate interest — using aggregated, non-identifying information wherever possible |
5. Vehicle registration lookups
When you type a registration into our accident report, we may send it to official government vehicle services — the DVSA MOT history service and the DVLA Vehicle Enquiry Service — to fill in the make, model, colour, fuel and MOT status for you. The lookup is done by our server, not your browser; the registration is the only data sent, and the result is stored on your claim so nobody has to type it again.
6. How long we keep your data
We keep claim records for six years after your claim closes. That is the limitation period for contract and most civil claims in England and Wales, and insurers, courts and regulators can ask for records within that time. After six years the file is deleted, unless a dispute is still open or the law requires longer.
| Data | How long |
|---|---|
| Claim file: agreements, evidence, chronology, correspondence, invoices | 6 years after the claim closes |
| Audit log of actions, signatures and document views | 6 years after the claim closes |
| Accident reports that never became a claim | 12 months, then deleted |
| Call notes and recordings | 6 years where part of a claim; otherwise 12 months |
| Marketing preferences | Until you withdraw consent or ask us to stop |
| Website analytics and essential cookies | See the cookie policy |
7. How we protect your data
Your data is stored on secure cloud infrastructure with encryption in transit and at rest, access controls tied to individual staff accounts, and an append-only audit log so changes can always be traced. Every uploaded file is hashed on arrival so it can be shown to be unaltered. Staff see only the data their role needs, and partners see only the cases assigned to them.
Some of our providers store data outside the UK. Where they do, the transfer is covered by the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision, so your data has equivalent protection.
No system is perfectly secure. If a breach ever put your rights at risk we would tell you and the Information Commissioner’s Office without undue delay, as the law requires.
8. Your rights
You have the following rights over your personal data. Most are free and we respond within one month; if a request is complex we will tell you and may take up to two further months.
- Access — ask for a copy of the personal data we hold about you. You can also request a copy of your file from your portal.
- Rectification — ask us to correct data that is inaccurate or incomplete. Note that your original account of the accident is locked as a matter of evidence; corrections are recorded as a separate statement alongside it.
- Erasure — ask us to delete your data where there is no longer a good reason to keep it. We cannot delete a live claim file, or records we must keep by law.
- Restriction — ask us to pause using your data while a dispute about it is resolved.
- Portability — receive the data you gave us in a machine-readable format.
- Objection — object to processing based on legitimate interests, and to direct marketing at any time.
- Consent — withdraw consent at any time where consent is the basis (for example the solicitor referral or marketing).
How to make a request
Call 020 7052 5403, email info@courtesycars.net, or use “Request a copy of my data” in your portal. We may need to confirm your identity first. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, but we would welcome the chance to put things right first.
9. Automated decisions
We do not make decisions about you by automated means alone. Where our systems flag something — for example a difference between two statements, or a deadline approaching — a member of staff reviews it and decides what happens next.
10. Children
Our services are for licensed drivers aged 17 and over. We do not knowingly collect data about children. If a child’s details appear in an accident report (for example as a passenger) we record only what the claim needs.
12. Changes to this policy
We review this policy at least once a year and whenever our services change. The date at the top of this page shows the current version. If a change would affect how we use data you have already given us, we will tell you directly.