Faff-free Privacy Policy & Cookie Policy

We’re removing the faff from changing and managing cars, and we also want to make our legal documents a cinch for anyone to understand. If you have any doubts or suggestions regarding any of them, please contact us and we’ll do our best to help.

We don’t ask for any personal data from you in order to browse cars on cinch. However, when you’re browsing, we’ll use cookies that collect information about your preferences (including information you give to us to help improve your search results) and information about your computer or device. For more information about our use of cookies, please see our Cookie Policy at the end of this policy.

If you decide to give us your personal data, including when you create an account, purchase a car from us, or ask to be put in touch with one of our approved dealers, then the idea of this Privacy Policy is to help you understand fully what data we have, how we use it, where it goes, and your rights to decide what happens with it. We will use personal data about you only for the reasons that you provided it, and in line with all applicable laws and what’s explained in this Privacy Policy.

This Privacy Policy may change from time to time, for example because of developments in technology, our business, or the law, so please check back when you visit cinch for the most current information. If we have your e-mail address, we may also notify you of any changes via e-mail.

This Privacy Policy is primarily aimed at cinch users. If you want to apply for a position with cinch, please see our separate candidates privacy notice.

1. Who is the data controller of your data?

A “data controller” is the organisation that decides on the purposes and ways that your personal data is processed (or, in other words, used). cinch’s website and services are provided by, and these decisions are made by:
Cinch Cars Limited of
Headway House
Crosby Way
Farnham GU9 7XG, UK
Email: DPO-Office@cinch.co.uk

When we share personal data with third parties (see Section 4 below), they may become a data controller in respect of their own processing activities. We recommend you read their privacy notices as these will apply to their use of your personal data. We can’t take any responsibility for what’s in those notices though.

2. Why do we process personal data? What data do we process? And what is our lawful basis for that processing?

The types of data we process and the reasons for which we process it depends on how you’re using cinch. We are required to have a ‘lawful basis’ that we rely on to use your data in the ways we describe below, and we’ve stated what this is under each section.

  • Improving your search results: you aren’t obliged to provide any personal data when you’re browsing cinch, but in order to improve the matches of the cars we’ll show you, you are able to enter some or all of the following:

    • Postcode (to filter the search results to nearby dealers)
    • People or pets that might travel with you in your car (number, approximate ages and height, and approximate size of your pet)
    • Frequency and types of journey you usually make (e.g. short local trips or longer journeys, city or motorway driving)
    • Must-haves (e.g. fuel economy, safety, boot space etc.)
    • Budget levels you are considering
    • Relevant hobbies and interests (to understand whether you need a car that could hold a bike, skis or a surfboard for example)
    • Whether you would like to exchange your current car and whether you plan to borrow any money to buy the car

    Lawful basis: our legitimate interests in providing you with a useful search function to assist you with finding the right car for your needs from our database of 1,000s of used cars.

  • Creating and managing your cinch account: to create an account we’ll need your e-mail address and a password. Other than that, you aren’t obliged to provide any more personal data, but in addition to the above, you are able to enter the following:

    • Your name
    • Your e-mail address
    • Your phone numbers
    • Your current address

    You can also save recommendations to your account.

    Lawful basis: performance of a contract (namely, our Terms of Use) and our legitimate interests in creating a personalised cinch profile for you, to allow you to manage your account, store your favourite search results and view your order history.

  • Selling a car to you: when you find a car that you would like to buy from cinch, we’ll need the following information from you to enter into the contract of sale with you, process the payment and arrange delivery (and to pick up your part exchange car if applicable):

    • Name
    • Mobile phone number
    • E-mail address
    • Current address (we’ll ask for your proof of address upon delivery too by asking for a photocard UK driving licence or other form of ID accepted by us)
    • Payment details
    • If you’re part exchanging your car, we’ll need information about that car – some of the documents relating to the car will contain your personal information (e.g. the V5, service records)

    Lawful basis: performance of a contract (namely, our Car Purchase Terms and Conditions).

  • Helping to arrange financing for your purchase of a car: if you indicate that you would like to purchase a car using our finance option (which is arranged via our third party finance broker), we’ll need to collect the following information from you which we will provide to our third party finance broker:

    • Title
    • Full name (including middle names)
    • Gender
    • Date of birth
    • Marital status
    • Nationality
    • Previous addresses if less than 3 years at current address
    • Employment type and history
    • Employer address
    • Time with employer
    • Mobile phone number
    • Residential status
    • Driving licence type
    • Outgoings (including monthly mortgage/rent and other general outgoings)
    • Gross annual income
    • Type of proof of income
    • Bank account number and sort code
    • Number of years you have held that bank account

    We collect this information on behalf of our third party finance broker, and you can view their privacy notice here for information about how they use your data – their lawful bases apply to their use of your data. Our third party finance broker will also share your data with lenders considering your finance application. You should note in particular that our third party finance broker, or the lender that is considering your finance application, will carry out credit and identity checks on you, and will supply your personal data to credit reference agencies (CRAs) who will in turn give them information about you. CRAs will supply to them both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information. When CRAs receive a search from them, the CRA will place a search footprint on your credit file that may be seen by other lenders. Our third party finance broker or lender do this to assess your creditworthiness and product suitability, to check your identity, manage your account, trace and recover debts and prevent criminal activity. They will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations. Your data will also be linked to the data of your spouse, any joint applicants or other financial associates. The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at www.equifax.co.uk/crain, www.experian.co.uk/crain and https://www.transunion.co.uk/legal/consumer-centre#pc-credit-reference (please note that the Credit Reference Agency Information Notice or ‘CRAIN’ is the same for each of the CRAs).

    Our third party finance broker will tell us your application ID number and will keep us up to date with the progress and outcome of your finance application so that we can enter into the contract of sale with you at the appropriate time.

  • Having dealers answer your enquiries: if you’re interested in one of the cars that a dealer has advertised on cinch, then you may call them using the phone numbers provided or e-mail them directly through the our site. You may also ask for a callback, or to be contacted by e-mail or text message: we’ll need to provide the dealer with your relevant details so that they can do this. Please note that some dealers may record calls and keep records of those calls for their own purposes – the dealer will be able to provide you with more information about their call recording procedures.

    Lawful basis: performance of a contract (namely, our Terms of Use) and our legitimate interests in ensuring that we can connect you with dealers, and the legitimate interests of those dealers to respond to your enquiries.

  • Providing customer service: if you contact us with a query or complaint, then we will collect and process your details and keep records of our interactions with you (e.g. calls, e-mails, chat sessions, letters), as needed to investigate and provide you an answer or resolution. Please note we may record calls and keep records of them and the contents of e-mails.

    Lawful basis: performance of a contract (namely, our Terms of Use) and our legitimate interests in ensuring that we are able to answer or resolve any queries or complaints properly and efficiently. We also rely on our legitimate interests when recording calls and the contents of e-mails and chat sessions in order to ensure that your enquiries are properly dealt with and to improve our or our dealers’ services.

  • Running promotions, contests or prize draws: if you enter a promotion, contest, or prize draw then we will collect and process your details in order to manage your entry. We may at the same time give you the opportunity of signing up for an account or opting in to receiving our newsletter but will only use your data for that purpose if you choose to do so.

    Lawful basis: your consent.

  • Sending newsletters/offers: if you subscribe to newsletters or other offers or information from us then we’ll use your data to tailor and send these to you, until you change or cancel your subscription or contact preferences.

    Lawful basis: your consent to receive newsletters or other offers or information from us, and our legitimate interests where we tailor those communications to suit your preferences – we do this so that we can provide you with communications and offers that are relevant to you.

  • Market research, surveys and testimonials: we might contact you from time to time to provide feedback on our services.

    Lawful basis: our legitimate interest in order to continually improve the products and services that we offer.

  • Service communications: we may need to contact you in relation to service-related issues, e.g. forgotten account details, technical issues with the service, updates to our terms and conditions, or other non-promotional messages.

    Lawful basis: our legitimate interests in ensuring that you can continue to use cinch and are aware of our current policies and procedures.

  • Quality control: we will keep a record of all calls (or other requests you make for contact from a dealer) so we can follow up and check that you got a good service, investigate any issues, and ensure that our bills to dealers for our services are correct. We also provide these records to the relevant dealer if they don’t already have their own record.

    Lawful basis: our legitimate interests in ensuring that your enquiries are properly dealt with, that our billing to dealers for our services is correct, and to improve our or our dealers’ services.

  • Improving cinch: we’ll analyse which pages or parts of the website get the most views or attention, and how our users arrive here, so that we can improve. This may include collecting details about your device and network, such as browser version, IP addresses, operating system details, and screen size. This may also involve the use of cookies or similar technologies as explained in our Cookie Policy at the end of this policy.

    Lawful basis: our legitimate interests in maintaining and optimising our website and improving it where necessary or as identified by trends in the user data we analyse, including for security purposes and to protect your information. It’s important for us to understand how people use cinch so that we can improve and ensure our users receive a good service.

  • Complying with our legal obligations: we’ll use your data to assist any public authority or criminal investigation body, for activities relating to the prevention, detection and investigation of crime, for compliance with our legal and regulatory responsibilities, to identify you when you contact us, to comply with a request from you in connection with the exercise of your rights under data protection laws, and to verify the accuracy of data we hold about you.

    Lawful basis: compliance with a legal obligation.

“Special categories” of data: Under data protection laws, certain “special categories” of personal data are subject to additional protections – this includes data relating to health. We don’t ask you for this data or intentionally collect it, however if you disclose to us that you have a disability (physical or mental) we might disclose this information to our third party finance broker who may tell the relevant lender. This is to make sure we are complying with our legal and regulatory obligations and to evidence that we’ve taken appropriate steps to protect you in the case of a legal claim.

cinch does not intend to collect or process any other special categories of personal data e.g. those revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data or biometric data, or data concerning anyone’s sex life or sexual orientation.

3. How long does cinch keep your data for?

cinch doesn’t keep your personal data for any longer than necessary. If you have signed up for an account with cinch, then you will be able to access it and we will keep your personal data within it until you change it or cancel your account.

If you buy a car from cinch, then we will keep data relating to the sale of a car, including your application for finance if you make one, for as long as it is necessary for us to comply with our legal obligations.

If you make an enquiry in relation to a car being sold by an approved dealer, then we will keep data relating to that enquiry for as long as necessary to send invoices to dealers, understand whether your contacts with dealers were satisfactory, and resolve any outstanding questions.

If we need to keep your data longer for tax, accounting, reporting, regulatory or legal reasons then we will use it only for those purposes and for a period that is reasonably necessary to comply with the laws and policies that apply to us and to be in a position to deal with any legal or regulatory claims.

After these periods we anonymise data (so it does not contain any personal data and cannot be traced back to you) to use it for research or statistical purposes and improving our website and services.

4. Does cinch provide your personal data to any third parties?

If you indicate that you are interested in a car advertised by an approved dealer on our website, then depending on the contact method you choose, we may provide your contact details and other relevant details relating to your car search and account to the relevant dealer so that they can respond to your enquiry and understand your needs.

If you indicate that you would like to purchase a car from cinch using our finance option, we’ll disclose certain personal data referred to in Section 2 to our third party finance broker, who will in turn share your data with lenders and CRAs to consider your finance application. Please see the privacy notice of our third party finance broker here for more information about how they, and the lenders, will use your data.

When your order is ready for delivery, we’ll share your name, address and contact details with our third party delivery service provider so that they can get your car to you. Our delivery service provider will carry out the checks explained in our Car Purchase Terms and Conditions on you, your ordered car and your part exchange car (if applicable) on delivery. This information will be shared with us so that we can manage the ongoing relationship with you.

We use a third party warranty provider to provide a 90-day warranty with breakdown assistance for the Car at no additional cost to you in relation to cars purchased from cinch. When you purchase a car from us, unless you opt out of the warranty, we’ll pass your details to the warranty provider to set up the contract between you and them. They will contact you with information in relation to the 90-day warranty product, including details of the product, relevant documentation and their privacy notice.

From time to time we may provide additional services on our website. So for example, if we offered a servicing or valeting option, and you indicated you were interested then, again depending on the contact method you choose, we would need to provide your contact details to the service provider.

cinch also works with other organisations that provide services such as IT and data processing or other professional advisors. These include:

  • providers of IT-related services (e.g. data storage, website development, live chat, hosting, management, or maintenance);
  • payment processing services;
  • other data processing companies that provide us with services such as call and e-mail tracking and recording, management of PR and customer communications, sending e-mails or texts, or processing of information or newsletters;
  • companies in our group or affiliated companies that provide us with additional technical infrastructure or services;
  • data analysis providers (e.g. measuring which webpages or advertisements are of most interest); or
  • accounting, legal, insurance or banking service providers.

These organisations process personal data on our behalf, but our contracts with them oblige them to meet data protection standards as strict as the ones that apply to us, and not to use your data for any other purpose.

Where these third parties are not based in the UK, the EU, or other countries that are officially regarded as having adequate data protection laws, then this will be done only on the basis of legal safeguards aimed at ensuring that your data is kept as secure as under applicable UK laws. Please contact us for more information about the safeguards we have in place.

Other circumstances where cinch may need to disclose your personal data to third parties could be: (i) where required by law, stock exchange rules, or any governmental authority, police force, court or regulator; (ii) to enforce or apply the terms of our contracts or to protect the rights, property or safety of our customers; or (iii) in connection with a sale, merger or restructuring of our business or company.

5. What about other websites?

cinch’s aim is to become a point of support in all phases of changing or managing your car and so we will often provide links to other websites offering relevant services or information.

From time to time we may also provide links relating to other services that are relevant to changing and managing your car.

If you visit these sites, you should review their privacy notices, cookie policies, and terms of use, as cinch doesn’t control the ways they collect or use personal data, which may be different from ours as explained here.

6. What are your rights in relation to your personal data?

cinch is committed to ensuring that you can easily exercise your legal rights over your personal data under the laws that apply to us.

You are entitled to ask at any time:

  1. for access to a copy of the personal data that cinch holds about you;
  2. to have any incorrect personal data about you corrected (remember that you can update some of your data in your account);
  3. for data about you to be erased (also referred to as the “right to be forgotten”) or if that is not possible (e.g. because the law requires us to keep data for longer) to have processing restricted;
  4. to object to particular processing (e.g. for marketing purposes or where we rely on legitimate interests);
  5. to contest a decision made about you based on automated processing (although cinch does not use any automated processing); and
  6. to receive an electronic copy of data you provided to us, for provision to a different service provider (also referred to as “data portability”).

You are also able to withdraw any consent given by you in the past. If you withdraw your consent, any processing of the data that took place before you do so will still be legal.

If you receive any marketing information from cinch and don’t wish to receive such information in future, then please login to your account to change your preferences, or email us at DPO-Office@cinch.co.uk. You will also have the opportunity to opt out of future communications whenever cinch sends you any such material.

cinch can always be contacted at the addresses in Section 1 to resolve any issues or doubts you may have in relation to processing of your data, or exercising your legal rights. If you believe that your rights have not been respected then you are also entitled to complain to the UK Information Commissioner (www.ico.org.uk) (or outside the UK, the Supervisory Authority in your country) to ask them for a decision.

7. Do you have to provide your personal data to cinch?

cinch is free to use and you aren’t required to sign up for an account or enter any other data if you don’t want to. If you would like to purchase a car from us, then there’s certain information we need from you to make that happen – if we don’t have this information, we can’t enter into a contract of sale with you.

Some of the cookies we use are ‘strictly necessary’ meaning that they are necessary to make certain parts of the website work – please see our Cookie Policy at the end of this policy for more information.

8. Where does cinch store your data?

We operate within the UK. Some of our third party service providers may process personal data on our behalf in locations outside of the UK or EEA. When they do, we will ensure that appropriate safeguards are in place for that transfer and storage as required by applicable law. This is because some countries outside of the UK or EEA do not have adequate data protection laws equivalent to those in the UK and EEA. If you would like more information about the safeguards we have in place, please contact our DPO office using the details in Section 1.