Privacy Policy

Last updated: 20 July 2026

This policy explains what personal information Xfinity Motors collects, why we collect it, who we share it with and how long we keep it. It applies to this website and to our dealership operations.

Information we collect

Information you give us. When you submit an enquiry, request a valuation, apply for finance or subscribe to our newsletter, you provide us with information such as your name, email address, telephone number and any details you include in your message. If you proceed towards a purchase we will also collect identification documents, driving licence details, proof of address and — where finance is involved — employment and income information.

We are the data controller for this information. Xfinity Motors Ltd is registered with the Information Commissioner's Office.

Information collected automatically. Our servers record the pages you request, the approximate time of the request, the referring page and technical details about your browser and device. We store a salted, irreversible hash of your IP address rather than the address itself, which lets us apply rate limits and detect abuse without retaining a direct identifier.

Information from third parties. For a vehicle you are buying or part-exchanging we obtain history and outstanding-finance data from automotive data providers such as HPI, and MOT history from the DVSA. For finance applications, lenders return decision data to us. We do not buy marketing lists.

Why we use it

We use your information to respond to enquiries, arrange test drives, prepare and complete a sale, meet our legal obligations around identity verification and anti-money-laundering, provide warranty and aftersales support, and — where you have asked for it — send you marketing about stock that matches your interests.

Our lawful bases under the UK GDPR are: performance of a contract, for anything necessary to sell or service a vehicle; legal obligation, for identity, tax and financial-crime requirements; consent, for marketing email and for non-essential cookies; and legitimate interests, for fraud prevention, security and improving the site, where we have carried out a balancing test and concluded those interests are not overridden by your rights.

Who we share it with

We share personal information with: finance providers and insurers, where you have asked us to arrange a product; vehicle history and identity-verification providers; the DVLA, for change of keeper and road tax; transport contractors, where we are delivering a vehicle; manufacturers, for warranty registration and recall notices; our IT, hosting and email suppliers acting under contract; and regulators, law enforcement or professional advisers where we are legally required or entitled to do so.

We do not sell personal information, and we do not share it with third parties for their own marketing.

International transfers

Some of our suppliers process data outside the UK. Where they do, transfers rely on UK adequacy regulations or, failing that, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. We complete a transfer risk assessment of the destination's legal regime before the transfer begins.

How long we keep it

Enquiries that do not lead to a sale are deleted after 24 months. Sales records, including identity documents, are retained for six years from the end of the accounting period in which the sale completed, as required by HMRC and anti-money-laundering rules. Marketing subscriptions are kept until you unsubscribe and for a short suppression period afterwards so that we do not contact you again by mistake. Aggregated, non-identifying analytics are kept indefinitely.

Your rights

You may ask us for a copy of the personal information we hold about you; ask us to correct it if it is wrong; ask us to delete it, where we have no continuing legal reason to keep it; object to processing based on legitimate interests; ask us to restrict processing while a dispute is resolved; and ask for a portable copy of information you provided to us. You may withdraw consent to marketing at any time, either through the unsubscribe link in any email or by contacting us.

To exercise any of these rights, email privacy@xfinitymotors.co.uk. We will respond within one month and will not charge a fee unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, but you do not have to.

Security

Data in transit is protected with TLS. Passwords for panel accounts are stored as Argon2id hashes and are never recoverable. Access to customer records is restricted to staff who need it and is logged. No system is perfectly secure, but we will report a qualifying breach to the ICO within 72 hours and notify you without undue delay where it is likely to result in a high risk to your rights.

Children

This site is not directed at children under 13 and we do not knowingly collect their information.

Changes

If we change this policy materially we will update the date above and, where the change affects how we use information you have already given us, notify you directly.

Contact

Xfinity Motors Ltd, 118 Southwark Street, London SE1 0SW. Email: xfinitymotors@hotmail.com