Gateway Privacy Notice

1. Who we are

Auto Finance Technology Ltd, trading as AFT Group, company number 15121835, registered office Unity House, Bird Hall Lane, Stockport SK3 0UX. ICO registration ZB593422. We are the controller of the personal data processed in AFT Gateway. Our Data Protection Officer is Racheal Campbell, racheal@autofintech.co.uk.

2. What Gateway is

AFT Gateway is a service for completing, signing and storing documents between AFT Group and its counterparties, and for requesting access to AFT Group's assurance documentation. It is a separate service from AFT Group's platforms (motorsales.ai, motorverify.ai, DriverVerify, Motoring.Today). Gateway does not connect to those platforms and does not hold customer, applicant or vehicle data from any of them. Those platforms have their own privacy notices.

3. What we collect

• Account data: first name, last name, work email address, mobile number, job title, organisation name and type, role in Gateway.
• Organisation data: company name, registration number, registered address, and the organisation type you select.
• Documents: the documents you complete, sign or upload, including any personal data you enter into them (for example names and positions of signatories, contact details on forms).
• Signing records: signature images or typed signatures, the time, the email address used, and the single-use code verification, compiled into a completion certificate.
• Usage and security logs: sign-in events, single-use codes issued and used, IP address, device and browser type, pages, documents viewed, downloads, and assurance access requests and approvals.
• Correspondence: messages you send us through Gateway or in connection with it.

We do not collect special category data. Do not upload documents containing it.

4. Why we process it and our lawful basis

We do not use Gateway data for marketing, profiling or automated decision-making.

5. Who receives it

• Supabase Inc. — database, authentication and file storage, hosted in Ireland (EEA).
• Resend Inc. — delivery of single-use codes and Gateway notification emails (United States, under the UK Addendum to the EU Standard Contractual Clauses / IDTA).
• AFT Group staff who administer Gateway, countersign documents and assess assurance requests.
• The other party to a document — when you sign or upload a document, the other party to it sees the information it contains.
• Regulators, courts or law enforcement where required by law.

We do not sell personal data or share it with third parties for their own marketing.

6. Where it is held

Gateway data is stored in Ireland, within the European Economic Area, which the UK has recognised as providing adequate protection. Email delivery involves a transfer to the United States under appropriate safeguards (section 5).

7. How long we keep it

• Account and organisation data: for the duration of your organisation's relationship with AFT Group, then 12 months.
• Signed documents, completion certificates and signing records: six years after the document expires or terminates.
• Uploaded documents that were not signed: 12 months after upload.
• Usage and security logs: 12 months; signing and assurance access logs: six years.
• Correspondence: three years.

8. Your rights

You have the right to access your personal data, to have it corrected, to ask for it to be erased or restricted, to object to processing based on legitimate interests, and to data portability where applicable. Note that signed documents are contractual records and will normally be retained. To exercise any right, contact the DPO. You can complain to the Information Commissioner's Office ( ico.org.uk), though we would ask you to contact us first.

9. Security

Single-use codes replace passwords. Data is encrypted in transit (TLS 1.2+) and at rest. Access by AFT staff is role-based and logged. Uploaded files are scanned. Every document event is recorded in an audit log.

10. Changes

We will post any changes here and, for material changes, notify you by email or in Gateway.