Privacy Policy | AutoPlan Warranty

1. Who we are

Autoplan Limited, a company registered in England and Wales (company number 17370754), with registered office at 86-90 Paul Street, London, England, EC2A 4NE, is the data controller for personal data collected through this website and our warranty services ("we", "us", "our").

We are a UK company. This notice is written for the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations (PECR).

If you have any questions about how we use your personal data, please contact our Data Protection contact at privacy@auto-plan.co.uk.

2. What personal data we collect

We collect the following categories of personal data:

Identity data: first name, last name
Contact data: email address, telephone number, postal address
Vehicle data: registration number, make, model, year, mileage
Financial data: payment card details (processed and stored by our payment processor — we do not store full card numbers)
Transaction data: warranty purchase history, claim records, repair invoices
Technical data: IP address, browser type, device type, pages visited, cookies (see section 8)
Communications data: records of emails, phone calls, and enquiries you send to us

3. How we collect your data

Directly from you when you request a quote, purchase a warranty, submit a claim, or contact us
Through strictly necessary website or portal storage, and through Google Analytics only if you choose to accept analytics cookies
From third parties, such as vehicle history providers, where relevant to underwriting

4. Why we use your data and our lawful basis

Purpose	Lawful basis (UK GDPR Art. 6)
To provide and administer your warranty policy	Performance of a contract (Art. 6(1)(b))
To process payments and refunds	Performance of a contract (Art. 6(1)(b))
To handle warranty claims	Performance of a contract (Art. 6(1)(b))
To send service communications (policy documents, renewal reminders, claim updates)	Performance of a contract (Art. 6(1)(b))
To comply with legal and regulatory obligations	Legal obligation (Art. 6(1)(c))
To send marketing communications (with your consent)	Consent (Art. 6(1)(a))
To improve our services and website	Legitimate interests (Art. 6(1)(f)) — we ensure these do not override your rights
To detect and prevent fraud or misuse	Legitimate interests (Art. 6(1)(f))

5. Who we share your data with

We share personal data only where necessary with service providers acting on our instructions, and with the following categories of recipient:

Hosting and application infrastructure providers — to host the website, application and data securely
Telephony providers — to handle inbound or outbound calls and voicemail where you contact us by telephone
Email service providers — to deliver transactional emails, including policy documents and claim updates
Analytics providers — Google Analytics, only where you have given cookie consent. It processes online identifiers and website-usage information to produce aggregate reports.
Vehicle-information providers — where needed to verify vehicle details in connection with a quote, warranty or claim
Legal and regulatory bodies — where required by law (e.g. HMRC, ICO, courts)
Professional advisers — solicitors, accountants, insurers who are bound by confidentiality obligations

We do not sell your personal data to any third party.

6. International transfers

Some service providers may process personal data outside the UK. Where a restricted transfer is needed, we use a lawful UK transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with any transfer-risk assessment and supplementary measures required by UK law.

7. How long we keep your data

Warranty and claim records: 7 years from the end of the policy, to satisfy potential legal claims and HMRC requirements
Enquiry and contact records: 2 years from last contact if no policy was purchased
Technical/analytics data: 26 months (Google Analytics default retention)
Marketing consent records: Until you withdraw consent, then 1 year thereafter

8. Cookies

We use cookies and similar technologies on this website and portal. Under PECR, we seek your consent before setting optional analytics cookies.

Strictly necessary storage

The customer and staff portals use secure session cookies for sign-in and security. The public website uses the first-party autoplan_cookie_consent cookie and matching local storage record for up to 12 months to remember your cookie choice. This storage does not contain your enquiry, policy or payment details.

Basis: Legitimate interests / strictly necessary

Analytics cookies

If you accept, Google Analytics may set analytics cookies and process online identifiers plus information such as pages visited, time on site and device type. We do not use analytics for advertising or personalised advertising.

Basis: Consent — only set after you accept via our cookie banner

You can change your cookie preference at any time using the cookie settings link in our website footer, or by clearing cookies and site storage in your browser. You can also remove analytics cookies through your browser settings.

9. Your rights under UK GDPR

You have the following rights regarding your personal data:

Right of access (SAR): to receive a copy of the data we hold about you
Right to rectification: to correct inaccurate or incomplete data
Right to erasure ("right to be forgotten"): to request deletion where there is no overriding legal reason to retain it
Right to restriction: to limit how we process your data in certain circumstances
Right to data portability: to receive your data in a structured, machine-readable format
Right to object: to object to processing based on legitimate interests or for direct marketing
Rights related to automated decision-making: we do not carry out automated decision-making or profiling that produces legal or similarly significant effects

To exercise any of these rights, contact us at privacy@auto-plan.co.uk or write to us at 86-90 Paul Street, London, England, EC2A 4NE. We normally respond within one calendar month. Where UK GDPR allows an extension for a complex or numerous request, we will tell you within the initial month.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. These include encrypted data transmission (TLS), access controls, and regular security reviews.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "last updated" date at the top of this page. Significant changes will be communicated to active customers by email.

12. Contact us

For any data protection enquiries, to exercise your rights, or to report a concern, please contact:

Autoplan Limited

86-90 Paul Street, London, England, EC2A 4NE

Email: privacy@auto-plan.co.uk

General enquiries: info@auto-plan.co.uk

If you want to raise a complaint about our service, please read our Complaints Procedure.