What we do with your details

There is one place on this site where you can give us personal data: the enquiry form on the contact page, and the same form on the home page. The service pages for vehicle sourcing and vehicle shipping link to it rather than carry it.

From it we receive your name, your email address, which service you are asking about, and the message you write. Everything else is optional: your telephone number, the vehicle or brief, origin country, destination country, timeframe and a budget band. Leave them blank and the enquiry still reaches us. The form also records which page you sent it from.

We also record the IP address and browser user-agent the submission arrived with. Both are for abuse prevention alone — rate limiting and spam filtering — and are not used to profile you or recognise you later. We do not ask for identity documents or payment details through this website.

The purpose is narrow: to answer you, and to do the work if you instruct us — reading the brief, checking the route or the market, and preparing a proposal.

Our lawful basis for handling an enquiry is Article 6(1)(b) of the UK GDPR and the EU GDPR: steps taken at your request before entering into a contract. You asked us about work we might do for you, so answering is part of that step rather than a separate interest of ours.

Keeping the record afterwards, and the file-keeping around a commission, rests on legitimate interests, Article 6(1)(f), weighed against your own interests. The form carries one tick-box, unticked by default, confirming you are content for us to reply. It is a confirmation, not the lawful basis; there is no marketing list behind it and nothing to unsubscribe from. We do not sell or rent personal data, and pass nothing to anyone for their own marketing. Three processors, named below, act only on our instructions.

Three suppliers handle enquiry data on our behalf, as processors under Article 28. Vercel hosts this website. Supabase provides the database each enquiry is stored in. Resend delivers the notification email and any acknowledgement sent back to you. That is the whole list: no CRM, no advertising network, no analytics vendor, no chat widget. If it changes, this page is updated first.

All three are United States companies running infrastructure in several regions, so data may be processed outside the UK and the European Economic Area. As at 2026 the safeguards recognised for UK transfers are the ICO International Data Transfer Agreement, or its Addendum to the European Commission Standard Contractual Clauses. For EEA transfers it is those Clauses. The EU-US Data Privacy Framework, and its UK extension, covers transfers to US organisations certified under it. We rely on the transfer terms our suppliers publish; the ICO and the Commission decide which remain valid, and their positions have changed before.

An enquiry that does not become work is kept for 24 months from the last message between us, then deleted. A search or a shipping decision can sit unresolved for months, so a shorter period would delete a conversation that is still live.

Where an enquiry becomes a commission, the file is kept for six years after the engagement ends. That reflects two things. As at 2026, limitation periods for contract claims in England and Wales run to six years. HMRC and US Customs and Border Protection each set retention periods for import and export documentation, and those run to years rather than months; the exact period depends on the record.

The IP address and user-agent are kept for 12 months. Deletion is from the live database; encrypted backups roll off on their own cycle, so a record can persist briefly before it is overwritten.

Under the UK GDPR and the EU GDPR you may request access to a copy of what we hold; rectification of anything wrong, such as a misspelled name; erasure of the enquiry, which we carry out unless we are required to keep it; and restriction, where we hold the data but stop using it while an accuracy dispute is settled.

You may also object to our keeping the record on legitimate interests, in which case we stop unless we can show compelling grounds that override your interests. Portability applies as well: the details you gave us, returned in a structured, machine-readable file. We reply within one month and charge nothing in ordinary cases, though we may confirm your identity first.

If you are unhappy with the outcome, you can complain to a supervisory authority: in the United Kingdom the Information Commissioner's Office; in the European Union the data protection authority where you live, where you work, or where the matter arose.

As at September 2026 this site sets no advertising cookies and no analytics cookies. There is no analytics tag, no advertising pixel and no third-party embed that follows you elsewhere. That is also why there is no consent banner. As at 2026 the UK Privacy and Electronic Communications Regulations, enforced by the ICO, require consent for non-essential storage on your device. The EU ePrivacy rules take the same approach. There is nothing here to consent to.

Nothing is kept in your browser either. What you type stays in the page until you send it or navigate away, and the spam check simply measures how long the form was open before it was submitted. If we ever add analytics, this page is updated first, and anything non-essential is put to you beforehand.

Write through the contact page, marked for the attention of data protection, or use the email address and telephone number in the footer. Say which right you are exercising and give us enough to find the record — the email address you used and roughly when you wrote is usually enough.

We have not appointed a Data Protection Officer. As at 2026 the ICO requires one only for public authorities, for large-scale systematic monitoring, or for large-scale special-category processing, and none of those describes this firm. Requests go to the person who would have answered your enquiry. Our terms sit alongside this policy; how it works sets out the engagement, and about explains who you are dealing with.