Privacy notice

Who we are

UCSM (Used Car Stock Manager) provides stock, advertising, valuation and buying software to motor dealers. This notice explains how we collect, use and protect personal data, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

UCSM is run by UCSM LTD, a company registered in England and Wales (company number 17521542), whose registered office is 203 West Street, Fareham, Hampshire, PO16 0EN.

For anything in this notice, contact us at hello@ucsm.co.uk.

Two roles: controller and processor

We act as a data controller for the personal data of the people who deal with us directly: dealer staff who use UCSM, prospective customers who enquire about it, and our suppliers.

We act as a data processorfor the personal data that dealers put into UCSM about their own customers, for example the details attached to a sales enquiry or a part-exchange appraisal. That data belongs to the dealer, who is the controller. We process it only on the dealer's instructions, under our agreement with them, and we do not use it for our own purposes. If you are a dealer's customer and want to exercise your rights over that data, please contact the dealer.

What we collect as a controller

• Account details for dealer users: name, work email address, role, and the sign-in records needed to keep the account secure.
• Notification preferences, such as a device registered for push alerts or a Pushover user key, where a user chooses to switch these on.
• Enquiries and correspondence: what you send us by email or through the site, and our replies.
• Billing details for the dealership: business name, address, VAT number and the contact named on invoices.
• Technical data such as IP address, browser type and the pages visited, collected in server logs to keep the service running and secure.

What dealers put into UCSM

Depending on the modules a dealer uses, UCSM may hold on their behalf: sales enquiries received through advertising channels (name, contact details and message), part-exchange and purchase records (seller name and contact details, vehicle registration), and staff names against key-tracker and workshop entries. Vehicle data such as registration numbers, MOT history and valuations relates to vehicles rather than people, but may identify a person where a vehicle is linked to a named customer.

Why we use it and our lawful basis

• To provide the service to dealers under our contract with them (performance of a contract).
• To keep accounts secure, prevent misuse and investigate faults (legitimate interests).
• To respond to enquiries and manage our relationship with dealers and suppliers (legitimate interests, or steps prior to entering a contract).
• To invoice and keep accounting records (legal obligation).
• To send service notifications a user has opted into, such as new-lead or end-of-day alerts (consent, which can be withdrawn at any time in Settings).

We do not sell personal data and we do not use it for automated decisions with legal effect on individuals.

Who we share it with

We use a small number of suppliers to run UCSM. Each processes data only on our instructions:

• Hosting and database providers, located in the European Union.
• An email delivery provider for sign-in emails, invoices and digests.
• A push-notification provider, only for users who switch alerts on.
• Accounting software for our own invoicing records.

Where a dealer connects UCSM to a third-party platform such as AutoTrader, a vehicle data provider or a DMS, data flows to and from that platform under the dealer's own agreement with it. We may also disclose data where the law requires it.

International transfers

Our systems are hosted in the UK and the European Union. Where a supplier processes data outside the UK, we rely on the UK adequacy regulations or the International Data Transfer Agreement to protect it.

How long we keep it

• Dealer user accounts: for as long as the account is active, then deleted within 90 days of closure.
• Data held for a dealer: for the life of the dealer's agreement with us, then returned or deleted on their instruction.
• Invoices and accounting records: six years after the end of the financial year, as required by HMRC.
• Server logs: up to 30 days.
• Enquiries: up to two years after our last contact.

Security

Data is encrypted in transit and at rest. Access to the service is by individual login with role-based permissions, and access to each dealer's data is restricted to that dealer's users. Third-party credentials that dealers give us are stored encrypted.

Cookies

UCSM sets only the cookies needed to keep you signed in and to protect the session. We do not use advertising or tracking cookies.

Your rights

Under the UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where there is no good reason for us to keep it;
• restrict or object to our processing;
• receive a copy of data you gave us in a portable form;
• withdraw consent at any time where we rely on it.

To exercise any of these, email hello@ucsm.co.uk. We will respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, though we would welcome the chance to resolve any concern first.

Changes to this notice

We may update this notice from time to time. The date at the top shows when it last changed, and material changes will be notified to dealer users in the app.