Privacy Policy

1. Who We Are

The data controller responsible for your personal data is WMA Vehicle Hire and Sales Limited, trading as WMA Motors, a company registered in England and Wales (Company No. 12086881). Our registered address is 70 Glebe Road, Bedlington, Northumberland, NE22 6JU.

WMA Vehicle Hire and Sales Limited (trading as WMA Motors) is authorised and regulated by the Financial Conduct Authority as a credit broker (Firm Reference Number 934177). We are registered with the Information Commissioner’s Office (ICO).

For any data protection queries, contact us at [email protected] or phone 01670 531777.

2. Data We Collect

We collect personal data when you use our website, contact us, visit our premises, or enter into any agreement with us. The categories of data we collect include:

Information You Provide

• Contact details: your name, phone number, email address, and postal address.
• Vehicle enquiry details: which vehicle you are interested in, your preferred ownership type (purchase, finance, rent-to-own, or short-term rental), and any message you send us.
• Finance application details: if you apply for vehicle finance, the information you provide in your application, which may include employment status, income, residential history, and bank details. These details are collected and held by us, and are submitted to our finance panel once we have checked the application over.
• Rental and hire agreement details: driving licence details, insurance information, identification documents, and emergency contact details required for rent-to-own and short-term rental agreements.
• Marketing preferences: whether you have opted in to receive marketing communications from us.

Information Collected Automatically

• Website analytics: with your consent, we collect data about how you use our website (pages visited, time on site, device type) via Google Analytics 4, delivered through Google Tag Manager.
• Advertising measurement: with your consent, Meta (Facebook/Instagram) Pixel and TikTok Pixel collect data to measure the effectiveness of our advertising campaigns.
• Attribution data: we record how you found us (e.g. which advertising campaign or referral source) so we can measure and improve our marketing.
• Chatbot conversations: if you use our online chat assistant, the conversation transcript is stored to help us respond to your enquiry and improve the service.
• Spam prevention: when you submit a form, we record a one-way hash of your IP address to detect and prevent automated spam submissions. We do not store your actual IP address.
• Cookies: essential cookies for website functionality, plus analytics and marketing cookies with your explicit consent. See the Cookies section below and our Cookie Policy for full details.

3. How and Why We Use Your Data

We only process your personal data when we have a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR). The table below sets out our purposes and the corresponding lawful basis:

Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your rights. You can request details of these assessments by contacting us.

4. Finance Applications

WMA Vehicle Hire and Sales Limited (trading as WMA Motors) is authorised and regulated by the Financial Conduct Authority (FRN 934177) as a credit broker, not a lender. When you apply for vehicle finance through our website or in person:

• Your application is submitted directly to us and held by us. No credit search is carried out at the point you complete our form.
• Our online application asks for your name, date of birth and contact details on the first screen, and saves them at that point so you can pick the form back up if you are interrupted. If you start an application and never submit it, it is not sent to anyone, and we use those details only to contact you about the application you began. We delete applications that are never submitted after 30 days.
• We review your application for completeness and then submit it to our panel. We do not decide whether you are accepted, and we do not set the rate you are offered.
• Our panel currently comprises Blue Motor Finance and First Response Finance, which are lenders, and Q-Finance, which is a credit broker rather than a lender. Where your application is submitted to Q-Finance, they may share it with specialist lenders on their own panel in order to find you a finance agreement. Which of these receives your application depends on the product and terms you are applying for and on your circumstances.
• Each lender decides for itself how to assess your application. Some carry out a preliminary soft search (a quotation search), which is visible only to you and does not affect your credit score. Others carry out a full credit search, which will be recorded on your credit file. That choice is the lender’s, not ours.
• We do not charge you a fee for arranging finance. If a lender approves your application and you proceed, we may receive a commission from them. This does not affect the rate you are offered or the price you pay.
• We are required by the FCA to retain records of regulated finance activity for a minimum of six years.

5. Who We Share Your Data With

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We share data with the following categories of recipients, only as necessary for the purposes described above:

• Finance lenders: your finance application details are shared with the lenders on our panel (currently Blue Motor Finance and First Response Finance) to assess your application.
• Q-Finance: a credit broker, not a lender, through whom we access a wider panel of specialist lenders. Where your application is submitted to them, they may share it with lenders on their own panel in order to find you a finance agreement.
• Payment processing (GoCardless Ltd): rental reservation fees, deposits, and weekly payments are processed via GoCardless Pay by Bank (Open Banking). GoCardless processes your name, bank account details (via your bank’s authorisation flow — we never see your full account number), and payment amounts. See the GoCardless Privacy Policy.
• Website hosting (Hetzner Online GmbH): our website is hosted on servers in Germany. Hetzner acts as a data processor.
• Content delivery (Cloudflare Inc): provides CDN, DNS, and security services for our website.
• Email delivery (Resend Inc): enquiry confirmations and notifications are delivered via Resend.
• Telecommunications (Telnyx LLC): provides SMS, voice call tracking, and WhatsApp messaging services.
• Google (Google Analytics 4, Google Tag Manager, Google Ads): with your consent, website usage and advertising data is processed by Google.
• Meta Platforms (Facebook Pixel, Instagram, Conversions API): with your consent, advertising measurement data is processed by Meta.
• TikTok (ByteDance): with your consent, advertising measurement data is processed by TikTok.
• Vehicle listing platforms: vehicle details (not personal data) are published to platforms such as eBay Motors, Motors.co.uk, Google Shopping, and Meta Catalogue to advertise our stock.
• AI chatbot (OpenRouter): if you use our chat assistant, your conversation is processed by OpenRouter to generate responses. No personal data is retained by OpenRouter beyond the session.
• Professional advisors: our accountant and, where necessary, legal advisors may access records containing personal data for the purposes of providing professional services to us.

6. International Data Transfers

Some of our third-party service providers are based outside the UK. Where personal data is transferred internationally, we ensure appropriate safeguards are in place:

• Google (US): certified under the UK Extension to the EU-US Data Privacy Framework.
• Meta Platforms (US): certified under the UK Extension to the EU-US Data Privacy Framework.
• Cloudflare (US): certified under the UK Extension to the EU-US Data Privacy Framework.
• TikTok/ByteDance (Singapore): transfers are covered by Standard Contractual Clauses (SCCs) approved by the ICO.
• Resend (US): transfers are covered by Standard Contractual Clauses (SCCs).
• Telnyx (US): transfers are covered by Standard Contractual Clauses (SCCs).
• OpenRouter (US): transfers are covered by Standard Contractual Clauses (SCCs).
• Hetzner (Germany): the UK recognises the EU/EEA as providing adequate data protection. No additional safeguards are required.

7. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purpose it was collected, or as required by law. Our retention periods are:

After the retention period expires, data is securely deleted or anonymised. You can request earlier deletion at any time (subject to legal obligations that require us to retain certain records).

8. Your Rights

Under UK GDPR, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete your personal data (right to be forgotten), subject to legal retention requirements.
• Restriction: ask us to limit how we process your data in certain circumstances.
• Objection: object to processing based on legitimate interest. We will stop unless we can demonstrate compelling legitimate grounds.
• Data portability: receive your data in a structured, machine-readable format where processing is based on consent or contract.
• Withdraw consent: where we process data based on your consent (e.g. analytics cookies, marketing communications), you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
• Not be subject to automated decision-making: we do not make any decisions about you based solely on automated processing.

To exercise any of these rights, contact us at [email protected] or write to us at 70 Glebe Road, Bedlington, Northumberland, NE22 6JU. We will respond within one calendar month of receiving your request.

9. Data Protection Complaints

If you believe we have not handled your personal data correctly, you have the right to complain directly to us. To make a data protection complaint:

1. Contact us at [email protected] with details of your concern.
2. We will acknowledge your complaint within 30 days.
3. We will investigate and provide you with a full response, including any actions taken, within 3 months.

If you remain unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

10. Data Security

We take the security of your personal data seriously. Measures we have in place include:

• Our website is encrypted using HTTPS (TLS) for all data in transit.
• Access to customer records is restricted to authorised staff only.
• Our database is hosted on a dedicated server with access controls and automated encrypted backups.
• We do not store full payment card details. Card payments are processed by our card terminal provider.
• IP addresses submitted with enquiry forms are stored as one-way hashes, not in their original form.

Unfortunately, the transmission of information via the internet is not completely secure. Although we take all reasonable steps to protect your personal data, we cannot guarantee the security of data transmitted to or from us and any such transmission is at your own risk.

11. Cookies

Our use of cookies complies with the Privacy and Electronic Communications Regulations 2003 (PECR) as amended. When you first visit our website, a consent banner asks you to accept or reject non-essential cookies. No analytics or marketing cookies are set until you give explicit, informed consent.

Third-Party Cookies

Where a Codeweavers finance calculator is shown on a vehicle page or our finance page, the widget may set its own cookies to function correctly. These are governed by the Codeweavers Privacy Policy.

Managing Your Preferences

You can change your cookie preferences at any time by clicking the “Cookies” link in our website footer to visit the Cookie Policy page, where you can manage your preferences. You can also clear your browser cookies and revisit the site to see the consent banner again. We retain a record of your consent choice as evidence of valid consent under PECR.

12. Children’s Data

Our website and services are not directed at children under 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected such data, we will delete it promptly.

13. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The “last updated” date at the top of this page will be revised accordingly. For significant changes that materially affect how we use your data, we will take reasonable steps to notify you (for example, by placing a prominent notice on our website).

Contact Us

If you have any questions about this privacy policy or how we handle your data, you can reach us at: