Privacy Policy

1. About this policy

This policy explains how Auto Finance Technology Ltd ("AFT", "we", "us", "our") collects, uses, shares and protects personal data.

It covers:

• the aftgroup.co.uk website;
• our group-level corporate activity, including dealings with partners, suppliers, investors and prospective customers; and
• our product platforms: motorsales.ai, motorverify.ai, driververify.ai and Motoring.Today (together, the "Platforms"); and
• the telephony and communications services we supply to dealers, including call handling, call recording, transcription and voicemail.

We are registered in England and Wales under company number 15121835. Our registered office is Unity House, Bird Hall Lane, Stockport, Cheshire, SK3 0UX, United Kingdom. We are registered with the Information Commissioner's Office under reference ZB593422.

If you are a consumer who has applied for vehicle finance through a dealer, broker or lender that uses our technology, please read section 3 carefully — in most cases that organisation, not AFT, decides how your data is used, and its own privacy notice will apply to you.

2. Contacting us

For any privacy question, or to exercise your rights under section 11:

• Email: support@autofintech.co.uk
• Post: Data Protection Officer, Auto Finance Technology Ltd, Unity House, Bird Hall Lane, Stockport, Cheshire, SK3 0UX, United Kingdom

We have formally appointed a Data Protection Officer under Article 37 of the UK GDPR. You can contact them using the details above.

3. Our role: controller and processor

Under the UK GDPR, the "controller" decides why and how personal data is used. A "processor" acts on a controller's instructions. Our role changes depending on whose data it is.

We are the controller for:

• visitors to aftgroup.co.uk and users of our contact, demo-request and enquiry forms;
• users of live chat on our websites;
• staff, contractors, and representatives of our dealer, lender, broker, marketplace and technology-partner customers;
• representatives of our suppliers, partners, investors and prospective customers;
• job applicants and recruitment contacts.

We are a processor for:

• personal data relating to consumers that our customers upload to, or generate within, the Platforms — including finance applicants, vehicle enquirers, identity-verification subjects and driver records; and
• call recordings, call transcripts, voicemail messages and call metadata generated through the telephony services we supply to dealers.

For that consumer data, the dealer, broker, lender or marketplace using the Platform is the controller. They determine what data is collected, why, how long it is kept and who it is shared with. We handle it only on their documented instructions under a written data processing agreement.

What this means for you as a consumer: if you want to access, correct or delete your data, or object to how it is used, please contact the dealer, broker or lender you dealt with. If you contact us instead, we will pass your request to them without undue delay and tell you we have done so. We cannot act on it ourselves unless they instruct us to.

4. Personal data we collect as controller

4.1 Website visitors

We do not run analytics, advertising or tracking cookies on aftgroup.co.uk. See section 6.

4.2 Customer, partner and supplier contacts

Name, job title, business contact details, correspondence, contract and account records, billing and payment details, records of meetings and support interactions, and platform access credentials and audit logs.

4.3 Prospective customers

Business contact details and company information obtained from you directly, from your public website, or from reputable business-data providers and professional networks.

4.4 Job applicants

Your CV and application, contact details, employment and education history, right-to-work information, references and interview notes.

4.5 Telephony and call data

Where you call, or are called by, a dealer using our telephony service, we process the telephone numbers involved, the date, time and duration of the call, the call routing and outcome, any voicemail you leave, an audio recording of the call and a written transcript generated from that recording.

We provide this service as a processor for the dealer. The dealer decides whether calls are recorded and transcribed, why, and how long the records are kept, and the dealer is responsible for telling you that the call is recorded and for establishing a lawful basis for it. If you want a recording or transcript of your call, or want it deleted, contact the dealer you called.

Transcription is performed by automated speech-recognition services engaged by us as sub-processors under written contract.

4.6 Special category data

We do not seek special category data (such as health data or biometric data) in our controller-side activity. Where biometric data is processed within the DriverVerify.ai or MotorVerify.ai Platforms, we do so as a processor on our customer's instructions, and it is that customer's responsibility to establish an appropriate lawful basis and Article 9 condition.

5. Why we use your data, and our lawful bases

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights. You can ask us for a summary of that assessment, and you can object at any time (section 11).

Where we send marketing by electronic means to individuals or sole traders, we do so only with your consent, or on the soft opt-in basis permitted by the Privacy and Electronic Communications Regulations. Every marketing message contains an unsubscribe link, and you can opt out at any time at no cost.

6. Cookies and similar technologies

aftgroup.co.uk uses strictly necessary and functional cookies only. These are required for the site to work — for example, to maintain your session, remember your cookie choices and operate live chat.

We do not use analytics, advertising, profiling or third-party tracking cookies on this website, and we do not share website browsing data with advertising networks.

Our Platforms use their own cookies for authentication and service delivery; those are described in the relevant Platform's own notice.

You can block or delete cookies through your browser settings, but strictly necessary cookies cannot be disabled without affecting how the site functions.

7. Who we share data with

We share personal data with:

• Group companies within AFT Group, where needed to deliver services or administer the business.
• Service providers acting on our instructions, in these categories: cloud hosting and infrastructure; email and communications delivery; telephony, call recording and automated speech-to-text transcription; customer relationship management; payment processing; analytics and business intelligence; identity and document verification; vehicle and finance data providers; IT support and development; and professional advisers (legal, accounting, insurance).
• Our business customers, where the data relates to their own users or their own consumers.
• Lenders, brokers and finance providers, where a customer instructs us to route an application on their behalf.
• Regulators, law enforcement and courts, where we are legally required to do so.
• A buyer or successor, in the event of a merger, acquisition or restructuring of our business.

All service providers are bound by written contracts that restrict them to processing on our instructions and require appropriate security. A current list of our sub-processors is available on request — email us at the address in section 2.

We do not sell personal data.

8. International transfers

Personal data we hold is stored on infrastructure located in the United Kingdom and the European Economic Area.

Where we engage service providers outside the UK, or where a transfer of personal data to a country without a UK adequacy decision is necessary, we put in place one of the safeguards permitted under UK data protection law — normally the ICO's International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum — supported by a transfer risk assessment and additional technical and organisational measures such as encryption in transit and at rest, access controls and audit logging.

You can request a copy of the safeguards we rely on by contacting us at the address in section 2.

9. How long we keep data

Where we act as a processor, retention is determined by our customer as controller, and we delete or return the data on termination in accordance with our agreement with them, unless we are required by law to keep it.

We review data at the end of these periods and delete or anonymise it unless a legal, regulatory or contractual reason to keep it applies.

10. Security

We maintain technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access control, multi-factor authentication for administrative access, network segregation, logging and monitoring, vulnerability management, supplier due diligence, staff training and a documented incident response process.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the ICO within 72 hours where required, and notify you directly where the risk to you is high.

11. Your rights

Where we are the controller, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data in certain circumstances;
• restrict our processing in certain circumstances;
• object to processing based on legitimate interests, and to object to direct marketing at any time — we will always stop marketing on request;
• data portability — receive data you gave us in a structured, machine-readable format, where processing is based on consent or contract and is automated;
• withdraw consent at any time, where we rely on consent; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise any of these, contact us using the details in section 2. We will respond within one month. That period can be extended by up to two further months for complex requests, and we will tell you if that applies. We may ask you to verify your identity. There is no charge unless a request is manifestly unfounded or excessive.

Automated decision-making: AFT does not make solely automated decisions about individuals in its controller capacity. Automated scoring or decisioning that takes place within the Platforms is configured and controlled by the dealer, broker or lender concerned; direct your questions about it to them.

12. Complaints

If you are unhappy with how we have handled your data, please contact us first — we would like the chance to put it right.

You can also complain to the UK supervisory authority:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk

The ICO is the right route for any complaint about how your personal data has been handled. Separately, complaints about the telecommunications services we supply — as opposed to data protection — may be referred to our approved alternative dispute resolution provider, the Centre for Effective Dispute Resolution (CEDR), once our own complaints process is exhausted or eight weeks have passed. Details are in our telecoms terms and complaints procedure.

13. Children

Our websites and Platforms are business services and are not directed at children. We do not knowingly collect data from anyone under 18 in our controller capacity. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. The current version is always published at aftgroup.co.uk, with the date at the top. Where a change materially affects how we use your data, we will take reasonable steps to notify you directly.

Auto Finance Technology Ltd · aftgroup.co.uk