Terms

iVendi Privacy Policy

Last Updated: 8th April 2026

Version: 4

Data Controller: iVendi Limited

ICO Registration Number: Z2032942

1. Our Roles: Who is in charge of your Data?

iVendi Limited ("iVendi", "we", "us", or "our") is a leading provider of vehicle retail and finance technology. We specialise in creating a seamless journey for people looking to buy and finance vehicles.

We do not sell vehicles or provide or arrange finance ourselves. Instead, we provide the software platforms that allow Motor Dealers (“Dealers”), Online Marketplaces (“Marketplaces”) and Finance Partners to interact with you. Whether you are searching for a vehicle on an Online Marketplace, using a finance calculator on a Dealer’s website, or sitting in a showroom applying for a loan, our technology is likely powering that experience.

Because our technology connects so many different companies, our legal responsibility for your data changes depending on which part of the journey you are on.

• Data Controller: The "boss" of the data. They make the final decisions on why and how your information is used.

• Data Processor: The "service provider." We handle the data only on the Controller's specific instructions to make the technology work.

Who are the Finance Partners? Depending on the Dealer or Marketplace Provider you are dealing with, Finance Partners include the Lenders and/or Brokers who process your application. Note: In many cases, the Dealer also acts as the Broker. Each of these parties acts as an independent "boss" (Data Controller) of your information.

2. Information we collect & why

We categorise the data we collect based on your journey. We collect information such as:

A. Website visitors & enquiries (iVendi.com)

• Data processed: Name, contact details, company information, survey responses, and technical usage data (e.g., IP address).

• Purpose: To respond to your enquiries, improve our services via feedback, and ensure the security and performance of our website.
• Legal basis: Legitimate Interests. We process this data to manage our business relationship with you and maintain a functional, secure online platform.

B. Job applicants

• Data processed: Professional information such as your CV, employment history, and contact details via LinkedIn.
• Support & accessibility: We may ask if you require any "reasonable adjustments" for your interview (such as help with access or specific communication needs).
• Special category & criminal data: For successful candidates, we process "Right to Work" documents (passports/visas) and perform basic criminal record (DBS) checks where required for the role.
• Legal basis:
  
  • Legal Obligation: To verify your right to work in the UK and to meet our duties under the Equality Act.
  • Legitimate Interests: To evaluate candidates and ensure a fair, inclusive recruitment process.

If you are a current iVendi employee or have recently been hired, please contact the HR Team to receive our internal Employee Privacy Notice, which covers how we handle your data during your employment.

C. Media interaction

• What happens: We use YouTube to host helpful videos on our website.
• Data processed: If you watch a video, YouTube may collect some basic info (like your IP address) through their player.
• Our role: We provide the video to be helpful, but YouTube is the "boss" (Controller) of the data they collect while the video is playing.
• Legal basis: Legitimate Interests (providing useful content).

D. NewVehicle account holders

• What is this? A secure, universal profile that stays with you as you visit different Dealers or Marketplaces who choose to use our software.
• Our role as Controller (The login): iVendi is the Data Controller for your account profile itself. This is limited to your login credentials and account settings.
  • Direct Login: We store your email and password.
  • Social Sign-In: If you Sign in with Google, they are an independent Controller for your credentials. We only control basic info (name/email) to set up your profile.
• The Dealer’s role as Controller: While you enter your details within your NewVehicle profile, iVendi acts only as a Data Processor for the specific personal and financial information you provide (such as your income, address history, and employment).
  • Who is the boss? The Dealer you are currently dealing with is the Data Controller for this information.
  • Privacy Between Dealers: Your data is kept in private compartments. This means one Dealer cannot see or access any applications or financial data you have submitted to a different Dealer.
• Managing your account: You can log in and delete your profile at any time. However, deleting your iVendi profile only removes your login credentials; it will not delete the financial application data already held by the Dealer or Finance Partner.
• The "Point of Transfer": Once you click "Submit" on a finance application, that specific data is transferred to the Dealer and their Finance Partners. They become the independent Controllers for that record.
• Legal basis: Contractual Requirement (to provide the unified account service you signed up for).

E. Finance tool/enquiry users

Our tools provide a seamless journey where you may start a query/eligibility check/application on a website and complete it in a showroom.

• The process: Our software may perform a "soft" credit search to check eligibility. If you proceed, your detailed data is passed to a Finance Partner (Lender or Broker).
• Data processed: This includes identification (name, DOB, address), financial data (income/commitments), and credit search results (eligibility scores).
• Hard searches: Any "hard" credit search is performed by the Lender on their own systems, not by iVendi.
• Data portability: If you start a journey on a Dealer's website, that data will be available to that specific Dealer in their showroom tool to help you complete the journey.
• Legal basis: As a Processor, we handle this based on the Data Controller’s instructions (Contractual Necessity). The Dealer (who may also be a Broker), Marketplace, and Finance Partners are all independent Controllers; you should check their policies for how they manage your financial profile.
  
  

F. Incidental sensitive information

Sometimes, you might share sensitive information with a Dealer or Marketplace through our tools—for example, by using an AI-powered Chatbot, clicking a "Call Dealer" button, or typing into an "Enquire" free-text box.

• What this includes: You might choose to mention "Special Category" data (like health or disabilities) while chatting or messaging a dealer.
• Our policy: We don’t ask for this sensitive info in these tools, and we encourage you not to share it unless it's strictly necessary for your enquiry.
• Our role: Because our AI and communication tools simply "pass the message" to the Dealer or Broker, we act as a Data Processor for this information.
• Legal basis:
  • Health data: Processed under Substantial Public Interest (to ensure the Dealer can meet their "Vulnerable Customer" and equality obligations).
  • Criminal data: While our current finance tools do not specifically request criminal conviction data, if you choose to disclose this via a message tool, we process it under Regulatory Requirements to ensure the Dealer can meet their legal and insurance obligations.

We do not sell your data. To provide our services, we use a range of highly secure, vetted third-party providers (known as Sub-Processors). These companies only handle your data based on our strict instructions and are not allowed to use it for their own purposes.

• Secure Hosting: We use industry-leading cloud infrastructure (such as AWS) to store your data safely.
• Business Operations: We use platforms like HubSpot to manage our business communications and customer support.
• Identity & Credit Services: To help the Dealer or Finance Partner verify who you are and check your eligibility, we connect to services like Experian.
• Communications: We use specialised providers to power features like the "Call Dealer" button or the SMS notifications that keep you updated on your application.
  
  

International Transfers

Sometimes we need to move data to other countries to use specific tools. When we do this, we ensure your data is protected using one of the following methods:

• Adequacy Decisions: We transfer data to countries that the UK government has officially recognised as having "adequate" data protection laws (this includes all countries in the EEA/EU).
• Standard Contractual Clauses (SCCs) & UK IDTA: For countries without an adequacy decision (such as the USA), we use specially approved legal contracts. These force the receiver of the data to protect it to the same high standards we use in the UK.
• The Data Privacy Framework: We may also rely on specific UK-US "Data Bridge" arrangements for certified providers based in the United States.

4. How Long We Keep Your Data

• Your Secure Finance Profile: We keep your account active for as long as you want to use it. You can log in and delete your profile at any time.
  • Note: Deleting your iVendi profile does not automatically delete finance applications you have already sent. The Motor Dealer or Finance Partner will still hold their own copy to meet their legal duties.
• Finance & Eligibility Data (Quotes): For most dealers, we store "soft" quotes and eligibility checks for up to 12 months before they are removed from our systems.
• Full Finance Applications: Where you have submitted a formal application, we typically store this data for 12 years on behalf of the Dealer or Finance Partner. This aligns with industry standards for handling long-term financial queries and regulatory requirements.
• Job Applications: We keep CVs and application details for 12 months.
• General Enquiries: We keep general messages and enquiries for up to 2 years.

Under the UK GDPR, you have the following rights for data where iVendi is the Controller:

• Right of Access: You can ask for a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to fix any mistakes or complete missing info.
• Right to Erasure: You can ask us to delete your data (e.g., closing your account).
• Right to Restriction of Processing: You can ask us to limit how we use your data.
• Right to Object to Processing: You can object to us using your data if we are relying on "Legitimate Interests."
• Right to Data Portability: You can ask us to move your data to another organization.
• Right to Withdraw Consent: If you signed up for marketing, you can opt-out at any time.

Note on using Finance Tools: Because we are only the Processor for any personal data in these tools, you must contact the Motor Dealer, Broker, or Lender directly to exercise your rights.

Note on Automated Decisions: Our tools help lenders decide if you are eligible for finance. You have the right to request a human review of an automated result, to express your point of view, and to contest the decision. To do this, please contact the Dealer or Marketplace Provider and Finance Partner.

Exercise your rights

Under the UK GDPR, you have several rights regarding your data. Please note: iVendi can only fulfil these requests for the data we control (such as your Secure Finance Profile or our website).

How to reach us: Email dpo@ivendi.com. We will acknowledge your request immediately and provide a full response within one month.

For External Journeys: If you wish to access, fix, or delete data within a finance application, credit search, or marketplace enquiry, you must contact the Motor Dealer, Marketplace Provider, or relevant Finance Partner directly. As the Data Controller for that journey, only they have the authority to manage those specific records.

Making a Complaint

To ensure your complaint is handled by the right "boss" (Controller), please follow these steps:

For iVendi Issues: If your complaint is about your NewVehicle account, our website, or how we personally handle your data, please contact our DPO at the email above.

For All Other Issues: If your complaint relates to a finance application, a credit search, a specific vehicle enquiry, or how a marketplace handles your data, please contact the Dealer, Marketplace Provider, or Finance Partner directly.

Escalating to the ICO

If we (or the relevant Controller) cannot resolve your issue, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Website: www.ico.org.uk

Note: Under the Data (Use and Access) Act 2026, the ICO typically requires you to have completed the internal complaints process with the relevant company before they will investigate.

More from iVendi