We’re removing the faff from changing and managing cars, and we also want to make our legal documents a cinch for anyone to understand. If you have any doubts or suggestions regarding any of them, please contact us and we’ll do our best to help.
1. Who is the data controller of your data?
A “data controller” is the organisation that decides on the purposes and ways that your personal data is processed (or, in other words, used). cinch’s website and services are provided by, and these decisions are made by:
Cinch Cars Limited of
Farnham GU9 7XG, UK
When we share personal data with third parties (see Section 4 below), they may become a data controller in respect of their own processing activities. We recommend you read their privacy notices as these will apply to their use of your personal data. We can’t take any responsibility for what’s in those notices though.
2. Why do we process personal data? What data do we process? And what is our lawful basis for that processing?
The types of data we process and the reasons for which we process it depends on how you’re using cinch. We are required to have a ‘lawful basis’ that we rely on to use your data in the ways we describe below, and we’ve stated what this is under each section.
- Improving your search results: you aren’t obliged to provide any personal data when you’re browsing cinch, but in order to improve the matches of the cars we’ll show you, you are able to enter some or all of the following:
- Postcode (to filter the search results to nearby dealers)
- People or pets that might travel with you in your car (number, approximate ages and height, and approximate size of your pet)
- Frequency and types of journey you usually make (e.g. short local trips or longer journeys, city or motorway driving)
- Must-haves (e.g. fuel economy, safety, boot space etc.)
- Budget levels you are considering
- Relevant hobbies and interests (to understand whether you need a car that could hold a bike, skis or a surfboard for example)
- Whether you would like to exchange your current car and whether you plan to borrow any money to buy the car
Lawful basis: our legitimate interests in providing you with a useful search function to assist you with finding the right car for your needs from our database of 1,000s of used cars.
- Creating and managing your cinch account: to create an account we’ll need your e-mail address and a password. Other than that, you aren’t obliged to provide any more personal data, but in addition to the above, you are able to enter the following:
- Your name
- Your e-mail address
- Your phone numbers
- Your current address
You can also save recommendations to your account.
- Mobile phone number
- E-mail address
- Current address (we’ll ask for your proof of address upon delivery or collection too by asking for a photocard UK driving
- licence or other form of ID accepted by us)
- Payment details
- If you’re part exchanging your car (or you are the registered keeper of that car), we’ll need information about that car – some
- of the documents relating to the car will contain your personal information (e.g. the V5, service records)
Lawful basis: performance of a contract (namely, our Car Purchase Terms and Conditions).
- Helping to arrange financing for your purchase of a car: if you indicate that you would like to purchase a car using our finance option (which is arranged via our third party finance broker, Evolution Funding), we’ll need to collect the following information from you which we will provide to Evolution Funding and, in some cases, Black Horse (a lender):
- Full name (including middle names)
- Date of birth
- Marital status
- Previous addresses if less than 3 years at current address
- Employment type and history
- Employer address
- Time with employer
- Mobile phone number
- Residential status
- Driving licence type
- Outgoings (including monthly mortgage/rent and other general outgoings)
- Gross annual income
- Type of proof of income
- Bank account number and sort code
- Number of years you have held that bank account
We collect this information on behalf of our third party finance broker, Evolution Funding, and you can view their privacy notice here for information about how they use your data – their lawful bases apply to their use of your data. Our third party finance broker will also share your data with lenders considering your finance application. We may also share your data with Black Horse and you can view their privacy notice here for information about how they use your data – their lawful bases apply to their use of your data. You should note in particular that our third party finance broker, or the lender that is considering your finance application, will carry out credit and identity checks on you, and will supply your personal data to credit reference agencies (CRAs) who will in turn give them information about you. CRAs will supply to them both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information. When CRAs receive a search from them, the CRA will place a search footprint on your credit file that may be seen by other lenders. Our third party finance broker or lender do this to assess your creditworthiness and product suitability, to check your identity, manage your account, trace and recover debts and prevent criminal activity. They will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations. Your data will also be linked to the data of your spouse, any joint applicants or other financial associates. The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at www.equifax.co.uk/crain, www.experian.co.uk/crain and https://www.transunion.co.uk/legal/consumer-centre#pc-credit-reference (please note that the Credit Reference Agency Information Notice or ‘CRAIN’ is the same for each of the CRAs).
Your lender will tell us your application ID number and will keep us up to date with the progress and outcome of your finance application so that we can enter into the contract of sale with you at the appropriate time.
- Verifying your identity: if you choose to purchase a car using our finance option and your finance application is approved by Black Horse then before you can proceed with entering into the finance agreement, we are required to verify your identity on behalf of Black Horse. In order to do this, we will need to collect a “selfie” photograph of you and an image your identity document such as a driving licence. We will use a third party to carry out this identity check who will collect your photograph, document image as well as certain device and location identifiers such as an IP address in order to help correctly identify you and reduce fraud].
Lawful basis: compliance with the legal obligations regarding verification of identity imposed by anti-corruption laws, our legitimate interest in reducing fraud and the performance of a contract (namely your finance agreement with Black Horse).
- Having dealers answer your enquiries: if you’re interested in one of the cars that a dealer has advertised on cinch, then you may call them using the phone numbers provided or e-mail them directly through our website. You may also ask for a callback, or to be contacted by e-mail or text message: we’ll need to provide the dealer with your relevant details so that they can do this. Please note that some dealers may record calls and keep records of those calls for their own purposes – the dealer will be able to provide you with more information about their call recording procedures.
- Providing customer service: if you contact us with a query or complaint, then we will collect and process your details and keep records of our interactions with you (e.g. calls, e-mails, chat sessions, letters), as needed to investigate and provide you an answer or resolution. Please note we may record calls and keep records of them and the contents of e-mails.
- Running promotions, contests or prize draws: if you enter a promotion, contest, or prize draw then we will collect and process your details in order to manage your entry. We may at the same time give you the opportunity of signing up for an account or opting in to receiving our newsletter but will only use your data for that purpose if you choose to do so.
Lawful basis: your consent.
- Sending newsletters/offers: if you subscribe to newsletters or other offers or information from us then we’ll use your data to tailor and send these to you, until you change or cancel your subscription or contact preferences.
Lawful basis: your consent to receive newsletters or other offers or information from us, and our legitimate interests where we tailor those communications to suit your preferences – we do this so that we can provide you with communications and offers that are relevant to you.
- Market research, surveys and testimonials: we might contact you from time to time to provide feedback on our services.
Lawful basis: our legitimate interest in order to continually improve the products and services that we offer.
- Service communications: we may need to contact you in relation to service-related issues, e.g. forgotten account details, technical issues with the service, updates to our terms and conditions, or other non-promotional messages.
Lawful basis: our legitimate interests in ensuring that you can continue to use cinch and are aware of our current policies and procedures.
- Quality control: we will keep a record of all calls (or other requests you make for contact from a dealer) so we can follow up and check that you got a good service, investigate any issues, and ensure that our bills to dealers for our services are correct. We also provide these records to the relevant dealer if they don’t already have their own record.
Lawful basis: our legitimate interests in ensuring that your enquiries are properly dealt with, that our billing to dealers for our services is correct, and to improve our or our dealers’ services.
Lawful basis: our legitimate interests in maintaining and optimising our website and improving it where necessary or as identified by trends in the user data we analyse, including for security purposes and to protect your information. It’s important for us to understand how people use cinch so that we can improve and ensure our users receive a good service.
- Complying with our legal obligations: we’ll use your data to assist any public authority or criminal investigation body, for activities relating to the prevention, detection and investigation of crime, for compliance with our legal and regulatory responsibilities, to identify you when you contact us, to comply with a request from you in connection with the exercise of your rights under data protection laws, and to verify the accuracy of data we hold about you.
Lawful basis: compliance with a legal obligation.
“Special categories” of data: Under data protection laws, certain “special categories” of personal data are subject to additional protections – this includes data relating to health. We don’t ask you for this data or intentionally collect it, however if you disclose to us that you have a disability (physical or mental) we might disclose this information to our third party finance broker who may tell the relevant lender. This is to make sure we are complying with our legal and regulatory obligations and to evidence that we’ve taken appropriate steps to protect you in the case of a legal claim.
cinch does not intend to collect or process any other special categories of personal data e.g. those revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data or biometric data, or data concerning anyone’s sex life or sexual orientation.
3. How long does cinch keep your data for?
cinch doesn’t keep your personal data for any longer than necessary. If you have signed up for an account with cinch, then you will be able to access it and we will keep your personal data within it until you change it or cancel your account.
If you buy a car from cinch, then we will keep data relating to the sale of a car, including your application for finance if you make one, for as long as it is necessary for us to comply with our legal obligations.
If you make an enquiry in relation to a car being sold by an approved dealer, then we will keep data relating to that enquiry for as long as necessary to send invoices to dealers, understand whether your contacts with dealers were satisfactory, and resolve any outstanding questions.
If we need to keep your data longer for tax, accounting, reporting, regulatory or legal reasons then we will use it only for those purposes and for a period that is reasonably necessary to comply with the laws and policies that apply to us and to be in a position to deal with any legal or regulatory claims.
After these periods we anonymise data (so it does not contain any personal data and cannot be traced back to you) to use it for research or statistical purposes and improving our website and services.
4. Does cinch provide your personal data to any third parties?
If you indicate that you are interested in a car advertised by an approved dealer on our website, then depending on the contact method you choose, we may provide your contact details and other relevant details relating to your car search and account to the relevant dealer so that they can respond to your enquiry and understand your needs.
If you indicate that you would like to purchase a car from cinch using our finance option, we’ll disclose certain personal data referred to in Section 2 to our third party finance broker, Evolution Funding, who will in turn share your data with lenders and CRAs to consider your finance application. Please see the privacy notice of our third party finance broker here for more information about how they, and the lenders, will use your data.
We may also share your data with Black Horse. Please see the privacy notice of Black Horse here for more information about how they will use your data. If you are approved for a finance agreement with Black Horse, we will use a third party provider to provide identification verification services who will collect certain data referred to in Section 2 on our behalf as part of the Black Horse application process. Please see the privacy notice of our identity verification service provider here for more details on how your data is collected and used.
When your order is ready for delivery or collection (as applicable), we’ll share your name, address and contact details with our third party delivery service provider so that they can get your car to you. Our delivery service provider will carry out the checks explained in our Car Purchase Terms and Conditions on you, your ordered car and your part exchange car (if applicable) on delivery or collection. This information will be shared with us so that we can manage the ongoing relationship with you.
We use a third party warranty provider to provide warranty and maintenance plans in relation to cars purchased from cinch, including cinchCare or, if you choose not to purchase cinchCare, a 90-day warranty with breakdown assistance for the Car at no additional cost to you. When you purchase a car from us, if you: (a) purchase cinchCare, or (b) if you choose not to purchase cinchCare and do not opt out of the 90-day warranty, we’ll pass your details to the warranty provider to set up the contract between you and them. They will contact you with information in relation to cinchCare or the 90-day warranty product (whichever is relevant to you), including details of the product, relevant documentation and the ongoing performance of the plan.
From time to time we may provide additional services on our website. So for example, if we offered a servicing or valeting option, and you indicated you were interested then, again depending on the contact method you choose, we would need to provide your contact details to the service provider.
cinch also works with other organisations that provide services such as IT and data processing or other professional advisors. These include:
- providers of IT-related services (e.g. data storage, website development, live chat, hosting, management, or maintenance);
- payment processing services;
- other data processing companies that provide us with services such as call and e-mail tracking and recording, management of PR and customer communications, sending e-mails or texts, or processing of information or newsletters;
- companies in our group or affiliated companies that provide us with additional technical infrastructure or services;
- data analysis providers (e.g. measuring which webpages or advertisements are of most interest); and
- accounting, legal, insurance or banking service providers.
These organisations process personal data on our behalf, but our contracts with them oblige them to meet data protection standards as strict as the ones that apply to us, and not to use your data for any other purpose.
Where these third parties are not based in the UK, the EU, or other countries that are officially regarded as having adequate data protection laws, then this will be done only on the basis of legal safeguards aimed at ensuring that your data is kept as secure as under applicable UK laws. Please contact us for more information about the safeguards we have in place.
Other circumstances where cinch may need to disclose your personal data to third parties could be: (i) where required by law, stock exchange rules, or any governmental authority, police force, court or regulator; (ii) to enforce or apply the terms of our contracts or to protect the rights, property or safety of our customers; or (iii) in connection with a sale, merger or restructuring of our business or company.
5. What about other websites?
cinch’s aim is to become a point of support in all phases of changing or managing your car and so we will often provide links to other websites offering relevant services or information.
From time to time we may also provide links relating to other services that are relevant to changing and managing your car.
6. What are your rights in relation to your personal data?
cinch is committed to ensuring that you can easily exercise your legal rights over your personal data under the laws that apply to us.
You are entitled to ask at any time:
- for access to a copy of the personal data that cinch holds about you;
- to have any incorrect personal data about you corrected (remember that you can update some of your data in your account);
- for data about you to be erased (also referred to as the “right to be forgotten”) or if that is not possible (e.g. because the law requires us to keep data for longer) to have processing restricted;
- to object to particular processing (e.g. for marketing purposes or where we rely on legitimate interests);
- to contest a decision made about you based on automated processing (although cinch does not use any automated processing); and
- to receive an electronic copy of data you provided to us, for provision to a different service provider (also referred to as “data portability”).
You are also able to withdraw any consent given by you in the past. If you withdraw your consent, any processing of the data that took place before you do so will still be legal.
If you receive any marketing information from cinch and don’t wish to receive such information in future, then please login to your account to change your preferences, or email us at DPO-Office@cinch.co.uk. You will also have the opportunity to opt out of future communications whenever cinch sends you any such material.
cinch can always be contacted at the addresses in Section 1 to resolve any issues or doubts you may have in relation to processing of your data, or exercising your legal rights. If you believe that your rights have not been respected then you are also entitled to complain to the UK Information Commissioner (www.ico.org.uk) (or outside the UK, the Supervisory Authority in your country) to ask them for a decision.
7. Do you have to provide your personal data to cinch?
cinch is free to use and you aren’t required to sign up for an account or enter any other data if you don’t want to. If you would like to purchase a car from us, then there’s certain information we need from you to make that happen – if we don’t have this information, we can’t enter into a contract of sale with you.
8. Where does cinch store your data?
We operate within the UK. Some of our third party service providers may process personal data on our behalf in locations outside of the UK or EEA. When they do, we will ensure that appropriate safeguards are in place for that transfer and storage as required by applicable law. This is because some countries outside of the UK or EEA do not have adequate data protection laws equivalent to those in the UK and EEA. If you would like more information about the safeguards we have in place, please contact our DPO office using the details in Section 1.
A cookie is a small file that our website may place on your device and which can be useful for recognising you as a returning visitor, saving settings and providing us with information about how the website is used. Some cookies are required so the site can work but other than those, you are not obliged to accept cookies, and you have the ability to accept, decline or delete cookies using the settings in your web browser or by clicking on the Cookie Settings button below.
www.allaboutcookies.org provides further information about cookies and also how to use settings to manage them on different type of devices.
cinch uses the following types of cookies:
“Strictly necessary cookies” – these are needed in order to enable you to move around the website and use all its features. Without these cookies, some features cannot be provided – for example, remembering previous actions or saved items, or keeping you logged in while browsing, or permitting communications through the website (e.g. online chat or calls).
“Analytical or Performance cookies” – these gather information about how cinch is used, for example, how many users visit different pages, how long they spend there, the items they click on, or how they arrived at cinch (e.g. from an advert or social media). These cookies are only used to monitor, test, and improve ease and speed of navigation, and analysing cinch’s marketing activities.
“Functional cookies” – These are used to recognise you when you return to our website. They enable information you enter to be saved for your next visit (such as your username or postcode), so that you don’t need to re-enter it and any personalised features are remembered.
“Targeting cookies” – these cookies are used to remember that you have visited cinch in the past and may enable cinch adverts or other adverts relevant to you to be shown to you on other sites you visit later. They are also used to limit the number of times you see an advertisement, or measure views, clicks and purchases.
Some cookies are provided to us by third parties who provide services to us. In particular, these cookies are used in order to record which car ads you have viewed and whether you have called, emailed or requested a contact from a dealer; and your interactions with our customer services e.g. by chat or email. These third parties use this information only to provide services to us – we don’t permit them to reuse the information for their own purposes or to provide it to their other clients.
Last updated: 29 April 2021
Copyright © cinch, first published in 2020, no copying or any other use is allowed