1. Who We Are
The data controller responsible for your personal data is WMA Vehicle Hire and Sales Limited, trading as WMA Motors, a company registered in England and Wales (Company No. 12086881). Our registered address is 70 Glebe Road, Bedlington, Northumberland, NE22 6JU.
WMA Vehicle Hire and Sales Limited (trading as WMA Motors) is authorised and regulated by the Financial Conduct Authority as a credit broker (Firm Reference Number 934177). We are registered with the Information Commissioner’s Office (ICO).
For any data protection queries, contact us at [email protected] or phone 01670 531777.
2. Data We Collect
We collect personal data when you use our website, contact us, visit our premises, or enter into any agreement with us. The categories of data we collect include:
Information You Provide
- Contact details: your name, phone number, email address, and postal address.
- Vehicle enquiry details: which vehicle you are interested in, your preferred ownership type (purchase, finance, rent-to-own, or short-term rental), and any message you send us.
- Finance application details: if you apply for vehicle finance, the information you provide in your application, which may include employment status, income, residential history, and bank details. These details are collected and processed by our finance platform provider, Codeweavers Ltd, on behalf of our lender panel.
- Rental and hire agreement details: driving licence details, insurance information, identification documents, and emergency contact details required for rent-to-own and short-term rental agreements.
- Marketing preferences: whether you have opted in to receive marketing communications from us.
Information Collected Automatically
- Website analytics: with your consent, we collect data about how you use our website (pages visited, time on site, device type) via Google Analytics 4, delivered through Google Tag Manager.
- Advertising measurement: with your consent, Meta (Facebook/Instagram) Pixel and TikTok Pixel collect data to measure the effectiveness of our advertising campaigns.
- Attribution data: we record how you found us (e.g. which advertising campaign or referral source) so we can measure and improve our marketing.
- Chatbot conversations: if you use our online chat assistant, the conversation transcript is stored to help us respond to your enquiry and improve the service.
- Spam prevention: when you submit a form, we record a one-way hash of your IP address to detect and prevent automated spam submissions. We do not store your actual IP address.
- Cookies: essential cookies for website functionality, plus analytics and marketing cookies with your explicit consent. See the Cookies section below and our Cookie Policy for full details.
3. How and Why We Use Your Data
We only process your personal data when we have a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR). The table below sets out our purposes and the corresponding lawful basis:
| Purpose | Lawful basis |
|---|
| Processing vehicle enquiries, arranging viewings, and contacting you about vehicles | Performance of a contract (Art. 6(1)(b)) |
| Arranging vehicle finance through our panel of lenders via Codeweavers | Performance of a contract |
| Administering rent-to-own agreements (payments, mileage, vehicle condition) | Performance of a contract |
| Administering short-term rental agreements (hire period, returns, deposits) | Performance of a contract |
| Verifying your driving licence, insurance, and identity for rental agreements | Performance of a contract; Legal obligation |
| Responding to enquiries via our contact form, chatbot, phone, or email | Legitimate interest (responding to customer communications) |
| Sending updates related to your enquiry or agreement (e.g. payment reminders, MOT reminders) | Legitimate interest (helping you stay informed about your vehicle) |
| Keeping financial records for tax and accounting purposes (HMRC) | Legal obligation |
| FCA record-keeping for regulated finance applications | Legal obligation |
| Fraud prevention and automated spam filtering on forms | Legitimate interest (protecting our business and customers) |
| Website analytics (Google Analytics 4) | Consent |
| Advertising measurement (Meta Pixel, TikTok Pixel, Google Ads) | Consent |
| Sending marketing communications (email, SMS) | Consent |
Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your rights. You can request details of these assessments by contacting us.
4. Finance Applications
WMA Vehicle Hire and Sales Limited (trading as WMA Motors) is authorised and regulated by the Financial Conduct Authority (FRN 934177) as a credit broker, not a lender. When you apply for vehicle finance through our website or in person:
- Your application is processed by Codeweavers Ltd, our finance platform provider, which submits it to our panel of lenders.
- Our lender panel currently includes Blue Motor Finance and First Response Finance. The specific lender who receives your application will depend on the product and terms you are applying for.
- Lenders may perform credit checks as part of assessing your application. A soft search (quotation search) does not affect your credit score; a full credit check is carried out only if you proceed with an application.
- We may receive a commission or fee from the lender for arranging your finance. This does not affect the price you pay.
- We are required by the FCA to retain records of regulated finance activity for a minimum of six years.
For full details of how Codeweavers processes your data, see the Codeweavers Privacy Policy.
5. Who We Share Your Data With
We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We share data with the following categories of recipients, only as necessary for the purposes described above:
- Codeweavers Ltd: processes finance applications and provides finance calculator tools on our website.
- Finance lenders: your finance application details are shared with lenders on our panel (currently Blue Motor Finance and First Response Finance) to assess your application.
- Payment processing (GoCardless Ltd): rental reservation fees, deposits, and weekly payments are processed via GoCardless Pay by Bank (Open Banking). GoCardless processes your name, bank account details (via your bank’s authorisation flow — we never see your full account number), and payment amounts. See the GoCardless Privacy Policy.
- Website hosting (Hetzner Online GmbH): our website is hosted on servers in Germany. Hetzner acts as a data processor.
- Content delivery (Cloudflare Inc): provides CDN, DNS, and security services for our website.
- Email delivery (Resend Inc): enquiry confirmations and notifications are delivered via Resend.
- Telecommunications (Telnyx LLC): provides SMS, voice call tracking, and WhatsApp messaging services.
- Google (Google Analytics 4, Google Tag Manager, Google Ads): with your consent, website usage and advertising data is processed by Google.
- Meta Platforms (Facebook Pixel, Instagram, Conversions API): with your consent, advertising measurement data is processed by Meta.
- TikTok (ByteDance): with your consent, advertising measurement data is processed by TikTok.
- Vehicle listing platforms: vehicle details (not personal data) are published to platforms such as eBay Motors, Motors.co.uk, Google Shopping, and Meta Catalogue to advertise our stock.
- AI chatbot (OpenRouter): if you use our chat assistant, your conversation is processed by OpenRouter to generate responses. No personal data is retained by OpenRouter beyond the session.
- Professional advisors: our accountant and, where necessary, legal advisors may access records containing personal data for the purposes of providing professional services to us.
6. International Data Transfers
Some of our third-party service providers are based outside the UK. Where personal data is transferred internationally, we ensure appropriate safeguards are in place:
- Google (US): certified under the UK Extension to the EU-US Data Privacy Framework.
- Meta Platforms (US): certified under the UK Extension to the EU-US Data Privacy Framework.
- Cloudflare (US): certified under the UK Extension to the EU-US Data Privacy Framework.
- TikTok/ByteDance (Singapore): transfers are covered by Standard Contractual Clauses (SCCs) approved by the ICO.
- Resend (US): transfers are covered by Standard Contractual Clauses (SCCs).
- Telnyx (US): transfers are covered by Standard Contractual Clauses (SCCs).
- OpenRouter (US): transfers are covered by Standard Contractual Clauses (SCCs).
- Hetzner (Germany): the UK recognises the EU/EEA as providing adequate data protection. No additional safeguards are required.
7. How Long We Keep Your Data
We retain personal data only for as long as necessary for the purpose it was collected, or as required by law. Our retention periods are:
| Data category | Retention period | Reason |
|---|
| Vehicle sale records and invoices | 6 years from completion | HMRC requirements; Limitation Act 1980 |
| Finance application records | 6 years from decision | FCA record-keeping (CONC 4.5) |
| Rental and hire agreement records | 6 years from agreement end | Contract; HMRC requirements |
| Enquiry and lead submissions | 6 months (then anonymised) | Legitimate interest; anonymised records retained for reporting |
| Chatbot conversations | 12 months | Legitimate interest |
| Cookie consent records | 12 months | Evidence of valid consent under PECR |
| Analytics data (Google Analytics) | 14 months | GA4 default retention setting |
After the retention period expires, data is securely deleted or anonymised. You can request earlier deletion at any time (subject to legal obligations that require us to retain certain records).
8. Your Rights
Under UK GDPR, you have the following rights:
- Access: request a copy of the personal data we hold about you.
- Rectification: ask us to correct inaccurate or incomplete data.
- Erasure: ask us to delete your personal data (right to be forgotten), subject to legal retention requirements.
- Restriction: ask us to limit how we process your data in certain circumstances.
- Objection: object to processing based on legitimate interest. We will stop unless we can demonstrate compelling legitimate grounds.
- Data portability: receive your data in a structured, machine-readable format where processing is based on consent or contract.
- Withdraw consent: where we process data based on your consent (e.g. analytics cookies, marketing communications), you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
- Not be subject to automated decision-making: we do not make any decisions about you based solely on automated processing.
To exercise any of these rights, contact us at [email protected] or write to us at 70 Glebe Road, Bedlington, Northumberland, NE22 6JU. We will respond within one calendar month of receiving your request.
9. Data Protection Complaints
If you believe we have not handled your personal data correctly, you have the right to complain directly to us. To make a data protection complaint:
- Contact us at [email protected] with details of your concern.
- We will acknowledge your complaint within 30 days.
- We will investigate and provide you with a full response, including any actions taken, within 3 months.
If you remain unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
10. Data Security
We take the security of your personal data seriously. Measures we have in place include:
- Our website is encrypted using HTTPS (TLS) for all data in transit.
- Access to customer records is restricted to authorised staff only.
- Our database is hosted on a dedicated server with access controls and automated encrypted backups.
- We do not store full payment card details. Card payments are processed by our card terminal provider.
- IP addresses submitted with enquiry forms are stored as one-way hashes, not in their original form.
Unfortunately, the transmission of information via the internet is not completely secure. Although we take all reasonable steps to protect your personal data, we cannot guarantee the security of data transmitted to or from us and any such transmission is at your own risk.
11. Cookies
Our use of cookies complies with the Privacy and Electronic Communications Regulations 2003 (PECR) as amended. When you first visit our website, a consent banner asks you to accept or reject non-essential cookies. No analytics or marketing cookies are set until you give explicit, informed consent.
Necessary Cookies
Required for the website to function. Cannot be disabled.
| Cookie | Provider | Purpose | Duration |
|---|
| wma_consent | WMA Motors | Stores your cookie consent preferences. | 365 days |
| payload-token | WMA Motors (CMS) | Admin session authentication for the content management system. | Session |
Functional Cookies
Enable features like the chatbot and remembering how you found us.
| Cookie | Provider | Purpose | Duration |
|---|
| wma_attribution | WMA Motors | Records how you found us (campaign/referral) so we can improve our marketing. | 30 days |
| wma-chat-session | WMA Motors | Keeps your chatbot conversation linked to your browser tab. | Session |
Analytics Cookies
Help us understand how visitors use the site so we can improve it.
| Cookie | Provider | Purpose | Duration |
|---|
| _ga / _ga_* | Google Analytics (GA4) | Measures how visitors use the site (pages viewed, time on site) to help us improve. | 2 years |
| _gid | Google Analytics (GA4) | Distinguishes unique visitors for analytics reporting. | 24 hours |
Marketing Cookies
Used to measure advertising effectiveness on platforms like Facebook and TikTok.
| Cookie | Provider | Purpose | Duration |
|---|
| _fbp | Meta (Facebook) | Used by Meta to deliver and measure advertising across Facebook and Instagram. | 90 days |
| _fbc | Meta (Facebook) | Stores the Facebook click identifier for conversion attribution. | 90 days |
| _ttp | TikTok | Used by TikTok to deliver and measure advertising. | 13 months |
| _tt_enable_cookie | TikTok | Checks whether TikTok cookies are permitted. | 13 months |
| _gcl_aw | Google Ads | Stores Google Ads click information for conversion tracking. | 90 days |
| _gcl_dc | Google Ads | Stores Google Display Network click information for conversion tracking. | 90 days |
Third-Party Cookies
The Codeweavers finance calculator widget loaded on our vehicle pages and finance page may set its own cookies to function correctly. These are governed by the Codeweavers Privacy Policy.
Managing Your Preferences
You can change your cookie preferences at any time by clicking the “Cookies” link in our website footer to visit the Cookie Policy page, where you can manage your preferences. You can also clear your browser cookies and revisit the site to see the consent banner again. We retain a record of your consent choice as evidence of valid consent under PECR.
12. Children’s Data
Our website and services are not directed at children under 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected such data, we will delete it promptly.
13. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The “last updated” date at the top of this page will be revised accordingly. For significant changes that materially affect how we use your data, we will take reasonable steps to notify you (for example, by placing a prominent notice on our website).
