Faff-free Privacy Notice
We’re removing the faff from changing and managing cars, and we also want to make our legal documents a cinch for anyone to understand. If you have any doubts or suggestions regarding any of them, please contact us and we’ll do our best to help.
If you decide to give us your personal data, including when you create an account and purchase a car from us, then the idea of this Privacy Notice is to help you understand what data we have, how we use it, where it goes, and your rights to decide what happens with it. We will use personal data about you only for the reasons that you provided it, and in line with all applicable laws and what’s explained in this Privacy Notice.
This Privacy Notice may change from time to time, for example because of developments in technology, our business, or the law, so please check back when you visit cinch for the most current information. If we have your e-mail address, we may also notify you of any changes via e-mail.
Last updated: 8 September 2023
1. Who is the data controller of your data?
A “data controller” is the organisation that decides on the purposes and ways that your personal data is processed (or, in other words, used). cinch’s website and services are provided by, and these decisions are made by:
Cinch Cars Limited of
18 Bartley Wood Business Park
When we share personal data with third parties (see Section 5 below), they may become a data controller in respect of their own processing activities. We recommend you read their privacy notices as these will apply to their use of your personal data. We can’t take any responsibility for what’s in those notices though.
2. Why do we process personal data? What data do we process? And what is our lawful basis for that processing?
The types of data we process and the reasons for which we process it depends on how you’re using cinch. We are required to have a ‘lawful basis’ that we rely on to use your data in the ways we describe below, and we’ve stated what this is under each section.
If you choose to download and install the cinch app, you’ll be able to create an account, browse and purchase a car, and apply for finance in the same way as if you visit the cinch website. We’ll collect and use your personal information for the same purposes explained in this Privacy Notice.
Device level permissions are needed when the app is installed, in order to access file storage to upload documents for finance applications.
To create an account we’ll need:
- your name
- e-mail address
- a password.
Other than that, you aren’t obliged to provide any more personal data, but in addition to the above, you are able to enter the following:
- Your phone number
- Your marketing preferences
You can also save favourites to your account. As part of this function, we will keep you informed if the car's price changes or if the car is no longer available.
We may use your personal information to send you marketing by post, by phone, by email and by SMS message. You will always be in full control of any marketing we provide to you.
Lawful basis: We will only use your personal information for marketing purposes if we have your consent or a legitimate interest, depending on how and when we have collected your details (for example via a third party such as our event sponsorship partners, or when you create an account with cinch).
Where we provide newsletters, marketing communications or other offers or information, we’ll use your data to tailor and send these to you, until you change or cancel your marketing preferences.
Lawful basis: where we have a lawful basis to provide you with newsletters, marketing communications or other offers or information from us, we rely on our legitimate interests where we tailor those communications to suit your preferences – we do this so that we can provide you with communications and offers that are relevant to you.
We’ll analyse captured data and share certain personal data with third parties to expand our knowledge of customer categories, use and habits though matching the data we collect with other databases. Allowing us to create a more personalised experience for different customer segments and improve cinch.
Lawful basis: where we have a lawful basis to provide you with marketing, we rely on our legitimate interests to share the data we collect such as name, postcode, address and telephone number with credit agencies and customer matching databases. This enables us to understand our customers better and improve cinch in line with customer expectations.
If you receive any marketing communications from cinch and don’t wish to receive such information in future, then please log in to your account to change your preferences, call us or email us at DPO-Office@cinch.co.uk. You will also have the opportunity to opt out of future communications whenever cinch sends you any such material, using the instructions provided.
When you find a car that you would like to buy from cinch, we’ll need the following information from you to enter into the contract of sale with you, process the payment and arrange delivery or collection (as applicable) and to pick up your part exchange car if applicable.:
- Mobile phone number
- E-mail address
- Current address (we’ll ask for your proof of address upon delivery or collection too by asking for a photocard UK driving licence or other form of ID accepted by us)
- Payment details
If the registered keeper of the part exchange car is not you then we will also need this information from the registered keeper and this Privacy Notice will apply to our use of their data as well.
If you would like to receive an indication of your financial eligibility, you can choose to carry out a soft credit search (which is arranged via our third party broker, Evolution Funding). We’ll need to collect the following information from you which we will provide to Evolution Funding:
- Full name
- Date of birth
- Current address
- Previous addresses if less than 3 years at current address
Lawful basis: performance of a contract. To provide you with the requested information on your financial eligibility when looking to purchase a car with cinch. We collect this information on behalf of our third-party finance broker, Evolution Funding who carries out the eligibility check. You can view the privacy notice or information about how they use your data, including the section on "Conducting Credit Searches"
If you would like to purchase a car using our finance option (which is arranged via our third party finance broker, Evolution Funding), we’ll need to collect the following information from you which we will provide to Evolution Funding and, in some cases, Black Horse (a lender):
- Full name (including middle names)
- Date of birth
- Marital status
- Previous addresses if less than 3 years at current address
- Employment type and history
- Employer address
- Time with employer
- Mobile phone number
- Residential status
- Driving licence type
- Outgoings (including monthly mortgage/rent and other general outgoings)
- Gross annual income
- Type of proof of income
- Bank account number and sort code
- Number of years you have held that bank account
Lawful basis: We collect this information on behalf of our third party finance broker, Evolution Funding, and you can view their privacy notice for information about how they use your data. Our third party finance broker will also share your data with lenders considering your finance application. We may also share your data with Black Horse and you can view their privacy notice for information about how they use your data.
Credit Reference Agencies
You should note in particular that our third party finance broker, or the lender that is considering your finance application, will carry out credit and identity checks on you, and will supply your personal data to credit reference agencies (CRAs) who will in turn give them information about you.
CRAs will supply to them both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information. When CRAs receive a search from them, the CRA will place a search footprint on your credit file that may be seen by other lenders. Our third party finance broker or lender do this to assess your creditworthiness and product suitability, to check your identity, manage your account, trace and recover debts and prevent criminal activity.
They will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations. Your data will also be linked to the data of your spouse, any joint applicants or other financial associates. The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at Equifax, Experian and Transunion (please note that the Credit Reference Agency Information Notice or ‘CRAIN’ is the same for each of the CRAs).
Your lender will tell us your application ID number and will keep us up to date with the progress and outcome of your finance application so that we can enter into the contract of sale with you at the appropriate time.
Verifying your identity
If you choose to purchase a car using our finance option and your finance application is approved by Black Horse then before you can proceed with entering into the finance agreement, we are required to verify your identity on behalf of Black Horse. In order to do this, we will need to collect a “selfie” photograph of you and an image your identity document such as a driving licence. We will use a third party to carry out this identity check who will collect your photograph, document image as well as certain device and location identifiers such as an IP address in order to help correctly identify you and reduce fraud.
Lawful basis: compliance with the legal obligations regarding verification of identity imposed by anti-corruption laws, our legitimate interest in reducing fraud and the performance of a contract (namely your finance agreement with Black Horse).
During the term of your finance agreement, we may contact you to discuss finance options we believe may be relevant to you, including renewal, voluntary termination, balloon payments, early settlement and the options available at the end of a finance agreement. This is based on information we receive from your lender, relating to your outstanding balance or early settlement requests, where there is a lawful basis for them to share this data with us.
If you do not wish us to contact you in this way, please see Managing your marketing preferences to unsubscribe.
Lawful basis: Permission to provide marketing materials to you, which may be based on consent or legitimate interests, depending on how and when we have collected your details
When you purchase a car from cinch, a 90-day warranty for mechanical and electrical repairs to the Car is provided at no additional cost to you. This includes breakdown assistance related to (where the breakdown results from mechanical or electric defect). We may subcontract in part, or fully outsource, the administration and handling of claims under the 90-day warranty to a third party (Administrator). If you make a claim under our 90-day warranty, we’ll share your information and that of any other person required for the purpose of your claim with our Administrator, authorised repairers and/or our breakdown agent, as is necessary to provide these services to you, which may include:
- Contact number
- Car registration number
Please see the Data Protection section in the cinch 90 Day Warranty Terms and Conditions available here for more information.
Lawful basis: performance of a contract (namely our 90-Day Warranty Terms and Conditions)
When we communicate with you about the purchase of your car, or if you contact us with a query or complaint, then we will collect and process your details and keep records of our interactions with you (e.g. calls, e-mails, chat sessions, letters), as needed to investigate and provide you an answer or resolution. Please note we may record calls and keep records of them and the contents of e-mails.
If you enter a promotion, contest, or prize draw then we will collect and process your details in order to manage your entry. We may at the same time give you the opportunity of signing up for an account or opting in to receiving marketing communications but will only use your data for that purpose if you choose to do so.
Depending on the nature of the promotion we may ask you for data in order for you to make a claim or participate, including your name, address, email address, bank account and sort code and other follow up information in case of any queries.
Lawful basis: performance of a contract, namely our contractual obligations under the terms of the relevant promotion, contest or prize draw – we do this so that we can identify you, to correspond with you regarding the promotion, contest or prize draw, verify your claim is valid and to make any applicable payments or distribute prizes to you (if required).
We might contact you from time to time to provide feedback on our services.
Lawful basis: our legitimate interest in order to continually improve the products and services that we offer.
We may need to contact you in relation to service-related issues, e.g. forgotten account details, technical issues with the service, updates to our terms and conditions, or other non-promotional messages.
Lawful basis: our legitimate interests in ensuring that you can continue to use cinch and are aware of our current policies and procedures.
It’s important for us to understand how people use cinch so that we can improve and ensure our users receive a good service. We’ll analyse which pages or parts of the website get the most views or attention, and how our users arrive here, so that we can improve. This may include collecting details about your device and network, such as browser version, IP addresses, operating system details, and screen size.
Lawful basis: our legitimate interests in maintaining and optimising our website and improving it where necessary or as identified by trends in the user data we analyse, including for security purposes and to protect your information.
We’ll use your data to assist any public authority or criminal investigation body, for activities relating to the prevention, detection and investigation of crime, for compliance with our legal and regulatory responsibilities, to identify you when you contact us, to comply with a request from you in connection with the exercise of your rights under data protection laws, and to verify the accuracy of data we hold about you.
Lawful basis: compliance with a legal obligation.
Under data protection laws, certain “special categories” of personal data are subject to additional protections – this includes data relating to health. We don’t ask you for this data or intentionally collect it, however if you disclose to us that you have a disability (physical or mental) we might disclose this information to our third party finance broker who may tell the relevant lender. This is to make sure we are complying with our legal and regulatory obligations and to evidence that we’ve taken appropriate steps to protect you in the case of a legal claim.
cinch does not intend to collect or process any other special categories of personal data e.g. those revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data or biometric data, or data concerning anyone’s sex life or sexual orientation.
3. How long does cinch keep your data for?
cinch doesn’t keep your personal data for any longer than necessary. If you have signed up for an account with cinch, then you will be able to access it and we will keep your personal data within it until you change it or cancel your account.
If you buy a car from cinch, then we will keep data relating to the sale of a car, including your application for finance if you make one, for as long as it is necessary for us to comply with our legal obligations.
In relation to any promotions, contests or prize draws that you participate in, cinch will not keep your personal data for any longer than necessary to complete the promotion, contest or prize draw and pay and account for payments or distribute prizes, also allowing for a reasonable period for any queries or disputes to be raised and settled.
If we need to keep your data longer for tax, accounting, reporting, regulatory or legal reasons then we will use it only for those purposes and for a period that is reasonably necessary to comply with the laws and policies that apply to us and to be in a position to deal with any legal or regulatory claims.
After these periods we may anonymise data (so it does not contain any personal data and cannot be traced back to you) to use it for research or statistical purposes and improving our website and services.
4. Does cinch receive your personal data from any other third parties?
We also advertise our cars on other websites. Some of these sites allow customers to request contact from cinch, and collect customer details to pass to us for this purpose.
If we receive personal data in this way, we will only use it for the purposes of contacting customers about the car they are interested in, unless the customer agrees to receiving further contact from cinch or creates an account.
We also receive customer data from other affiliates and publishers. This allows us to track transactions to enable cashback to be paid in accordance with the Terms and Conditions of specific promotions, or where a customer referral has been received from a member of our affiliated publishing network.
5. Does cinch provide your personal data to any third parties?
If you would like to purchase a car from cinch using our finance option, we’ll disclose certain information to our third party finance broker, Evolution Funding, and, in some cases, Black Horse (a lender). See Section 2 for full details.
When your order is ready for delivery or collection, we’ll share your name, address and contact details with our third party delivery service provider so that they can get your car to you. Our delivery service provider will carry out the checks explained in our Car Purchase Terms and Conditions on you, your ordered car and your part exchange car (if applicable) on delivery or collection. This information will be shared with us so that we can manage the ongoing relationship with you.
We use a third party warranty provider to provide cinchCare. If you purchase cinchCare we’ll pass your details to the warranty provider to set up the contract between you and them. They will contact you with information in relation to cinchCare including details of the product, relevant documentation and the ongoing performance of the plan.
If you make a claim under our 90-day warranty then we’ll disclose certain information to our Administrator, authorised repairers and/or our breakdown agent, as is necessary. See Section 2 for full details.
From time to time we may provide additional services or products through cinch. Depending on the service or product, we may need to provide your contact details to the service provider, or confirm to the provider that you are a cinch customer.
cinch also works with other organisations that provide services such as IT and data processing or other professional advisors. These include:
providers of IT-related services (e.g. data storage, website development, live chat, hosting, management, security or maintenance);
payment processing services;
other data processing companies that provide us with services such as call and e-mail tracking and recording, management of PR and customer communications, sending e-mails or texts, or processing of information or newsletters;
organisations providing us with services relating to the management of promotions, contests and prize draws and fulfilment of payments and prizes;
companies in our group or affiliated companies that provide us with additional technical infrastructure or services;
data analysis providers (e.g. measuring which webpages or advertisements are of most interest);
advertising affiliates as part of our affiliate publishing network, to track referrals and transactions; and
accounting, legal, insurance or banking service providers.
These organisations process personal data on our behalf, but our contracts with them oblige them to meet data protection standards as strict as the ones that apply to us, and not to use your data for any other purpose.
Where these third parties are not based in the UK or other countries that are officially regarded as having adequate data protection laws, then this will be done only on the basis of legal safeguards aimed at ensuring that your data is kept as secure as under applicable UK laws. Please contact us for more information about the safeguards we have in place.
Other circumstances where cinch may need to disclose your personal data to third parties could be: (i) where permitted or required by law, to any police force, court, regulator or public body; (ii) to enforce or apply the terms of our contracts or to protect the rights, property or safety of our customers; or (iii) in connection with a sale, merger or restructuring of our business or company.
6. What are your rights in relation to your personal data?
cinch is committed to ensuring that you can easily exercise your legal rights over your personal data under the laws that apply to us.
You are entitled to ask at any time:
for access to a copy of the personal data that cinch holds about you;
to have any incorrect personal data about you corrected (remember that you can update some of your data in your account);
for data about you to be erased (also referred to as the “right to be forgotten”) or if that is not possible (e.g. because the law requires us to keep data for longer) to have processing restricted;
to object to particular processing (e.g. for marketing purposes or where we rely on legitimate interests);
to contest a decision made about you based on automated processing (although cinch does not use any automated processing); and
to receive an electronic copy of data you provided to us, for provision to a different service provider (also referred to as “data portability”).
You are also able to withdraw any consent given by you in the past. If you withdraw your consent, any processing of the data that took place before you do so will still be legal.
cinch can always be contacted using the details in Section 1 to resolve any issues or doubts you may have in relation to processing of your data, or exercising your legal rights. If you believe that your rights have not been respected then you are also entitled to complain to the UK Information Commissioner (www.ico.org.uk).
7. Do you have to provide your personal data to cinch?
To search our database of cars you aren’t required to sign up for an account or enter any other data if you don’t want to. If you would like to purchase a car from us, then there’s certain information we need from you to make that happen – if we don’t have this information, we can’t enter into a contract of sale with you.
8. Where does cinch store your data?
We operate within the UK. Some of our third party service providers may process personal data on our behalf in locations outside of the UK. When they do, we will ensure that appropriate safeguards are in place for that transfer and storage as required by applicable law. This is because some countries outside of the UK do not have data protection laws equivalent to those in the UK. If you would like more information about the safeguards we have in place, please contact our Data Protection Office using the details in Section 1.