Privacy Policy

Last updated: 8 July 2026

1. About this policy

This policy explains how Motoring.Today (“we”, “us”, “our”) collects, uses, shares and protects your personal data when you use our website and services, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Motoring.Today is a UK vehicle marketplace. We help you search for cars, compare vehicles, view vehicle history, request illustrative finance figures, enquire with dealers, and — where you choose to — apply for motor finance through our finance partner. This policy covers all of those activities.

Please read this policy alongside our Website Terms of Use.

2. Who we are — the data controller

The Motoring.Today platform is operated by AFT Ltd on behalf of Motor Genius Group Ltd. For the personal data described in this policy, the data controller is Motor Genius Group Ltd (company number 15121835), for which AFT Ltd acts as platform operator. VAT registration number 476 9784 14.

If you have any question about this policy or about how your personal data is handled, or if you wish to exercise any of your rights, you can contact us by email at james@autofintech.co.uk. We will treat any request seriously and respond within the timeframes required by law.

3. The personal data we collect, and where it comes from

Information you give us directly

• Account information. If you create an account or sign in (including via a magic link or a third-party sign-in such as Google or Apple), we process your email address and any display name, and we maintain your account and preference settings.
• Saved cars and comparisons. When you save a vehicle or add vehicles to a comparison, we store those choices against your account (or, before you sign in, against your device — see “behavioural data” below).
• Dealer enquiries. When you enquire about a vehicle or a dealer, we process the details you submit so that the enquiry can be handled.
• Finance applications. If you choose to apply for motor finance, you provide information such as your name, email address, mobile number and the vehicle registration you are applying against. This is described more fully in section 5.
• Communication preferences. Whether you have opted in to marketing or new-match email alerts, and when.

Information we generate or look up about a vehicle

When a vehicle registration (VRM) is looked up, we retrieve official vehicle data from the DVLA Vehicle Enquiry Service (for example tax status, MOT status, make, year, engine size, CO2 emissions, fuel type and colour) and MOT history from the DVSA MOT History API (for example test dates and results, recorded mileage readings, advisories and defects, and outstanding recall information). We may also enrich vehicle records using third-party vehicle-data and VIN services. This data relates to the vehicle; it becomes personal data where it is connected to you (for example a vehicle you are enquiring about or applying to finance).

Information generated when you contact a dealer by phone

If you use our call-back or click-to-call feature, we place a telephone call that connects you to the dealer. To do this we process your telephone number to dial the call. For an instant call your number is stored only as a one-way cryptographic hash; for a scheduled call-back your number is held encrypted and is deleted once the call has been placed. Calls may be recorded and transcribed for quality, training, dispute-resolution and service-improvement purposes; call records and transcripts are retained as described in section 10.

Information we collect automatically about your use of the site

• Device and behavioural data. When you visit, we create a first-party device identifier, stored in a first-party cookie and in your browser’s local storage for up to one year. We use it to record how the site is used — for example pages viewed, searches run, vehicles saved or compared, enquiries and messages to our on-site assistant, scroll depth, session start and end, device type, viewport size, referring page and time-zone offset. Automated crawlers and server-side rendering are excluded from this capture.
• Preference and profiling data. We derive a preference profile from your saved cars, searches and browsing — an affinity profile covering, for example, the makes, models, body styles, fuel types, price and monthly-payment ranges, and geographic areas you show interest in, together with an indicative buying stage. This is described more fully in section 6.
• Marketing and attribution cookies. When you arrive from a marketing link, we capture marketing parameters (such as utm_source, utm_medium and utm_campaign, and click identifiers such as gclid and fbclid), the referring site and the landing page, and store them in first-party cookies for up to one year, so that we can understand which campaigns bring visitors to the site and attribute activity such as a finance application to its original source.

When you sign in or apply for finance, we may connect activity previously recorded against your device identifier to your account so that your experience is continuous.

4. How we use your data, and our lawful bases

Under the UK GDPR we must have a lawful basis for each use of your personal data. Our uses and bases are as follows.

• To provide the marketplace and your account — showing listings, saving cars, running comparisons, and operating sign-in. Lawful basis: performance of a contract with you, and our legitimate interests in operating the service.
• To handle dealer enquiries and connect you to dealers (including placing voice calls). Lawful basis: performance of a contract / taking steps at your request, and our legitimate interests.
• To retrieve and display vehicle data (DVLA, MOT, VIN and vehicle enrichment) so you can make an informed decision. Lawful basis: our legitimate interests in providing accurate vehicle information, and performance of a contract.
• To facilitate a finance application where you choose to apply, including passing you to our finance partner. Lawful basis: taking steps at your request prior to entering a contract, and our legitimate interests.
• To understand behaviour, build preference profiles and provide recommendations. Lawful basis: your consent for non-essential analytics and profiling where required (see section 7), and otherwise our legitimate interests in improving and personalising the service.
• To send you marketing and new-match email alerts. Lawful basis: your consent (opt-in), which you can withdraw at any time (see section 11).
• To measure marketing performance and attribution. Lawful basis: your consent for non-essential marketing cookies where required, and our legitimate interests.
• To record and transcribe calls, take payments from dealers, prevent fraud, keep our services secure, and keep business records. Lawful basis: our legitimate interests, and compliance with our legal obligations.
• To comply with law and to establish, exercise or defend legal claims. Lawful basis: legal obligation and legitimate interests.

Where we rely on legitimate interests, we have considered your rights and interests and are satisfied that our processing is proportionate. You may ask us for more detail, or object, using the contact details in section 2.

5. Motor finance applications

If you choose to apply for finance from a vehicle page, we open a finance application journey provided by our finance partner that introduces you to lenders. In that journey you provide personal and financial details directly to the finance partner and, through them, to lenders.

The finance application itself is created by the finance partner and the lenders you are introduced to; those parties act as controllers of the data you submit to them for the purposes of assessing and providing credit, and their own privacy notices will apply. We receive limited information back — for example that an application exists, its reference and status, the vehicle registration, and basic contact details — which we use to service your relationship with us, to attribute the application to its marketing source, and to maintain your account.

So that the intelligence from your earlier anonymous browsing (for example vehicles you viewed) can be associated with the account created for your application, we record a short-lived link between your device identifier and the vehicle you are applying against at the moment the finance journey opens. This link is used once and then marked as used. Our role in finance is that of a credit intermediary (broker) that introduces you to lenders; we are not a lender and we do not make lending decisions.

6. Behavioural profiling, preferences and recommendations

We build a profile of your likely vehicle preferences from your activity on the site (your saved cars, searches, browsing and messages to our on-site assistant). This profile is recency-weighted — more recent activity counts for more — and covers attributes such as preferred makes, models, body styles, fuel types, transmission, colour, price and monthly-payment ranges, geographic focus, and an indicative buying stage. We use it to tailor what we show you, to power recommendations, and — internally, and where permitted — to group audiences for relevance.

We want to be transparent about this (as required by Articles 13 and 14 of the UK GDPR). Importantly, this profiling does not produce decisions that have a legal or similarly significant effect on you and that are taken solely by automated means. It is used to make the marketplace more relevant, not to decide whether you are offered credit or any other significant outcome; a person remains involved in any decision that would materially affect you (consistent with Article 22 of the UK GDPR). Lending decisions are made by lenders under their own processes, not by our profiling. You can object to this profiling, or ask us not to use it for marketing, at any time using the contact details in section 2.

7. Cookies, similar technologies and PECR

We use cookies and similar first-party storage (including your browser’s local storage). Some are strictly necessary to run the site and remember your session and choices. Others are non-essential, in particular the behavioural / analytics identifier used for behavioural capture and profiling, and the marketing / attribution cookies used to measure campaigns and attribute activity.

Under the Privacy and Electronic Communications Regulations (PECR), non-essential cookies and identifiers require your consent. We use non-essential cookies and identifiers only where you have given your consent, or otherwise on the basis described in section 4. Where a consent mechanism applies, you can change or withdraw your choice at any time through it or through your browser settings; withdrawing consent will not affect the lawfulness of any processing carried out before you withdrew it, and it will not stop the strictly necessary cookies that keep the site working.

8. Who we share your data with

We do not sell your personal data. We share it with the following categories of recipient, who act either as our processors (handling data on our instructions) or, where indicated, as independent controllers.

• Hosting and platform infrastructure — our application hosting and managed database provider, who store and process data on our behalf.
• Vehicle data providers — the DVLA (Vehicle Enquiry Service) and the DVSA (MOT History API) for official vehicle data looked up by registration; our marketplace vehicle-listing data provider; and vehicle-data / VIN enrichment providers.
• Our finance partner and lenders — where you choose to apply for finance (see section 5); these parties act as controllers for the credit application.
• Payment provider — our card-payment and billing processor, principally used to take payments from dealers (business customers).
• Telephony provider — our voice provider, used to place and record calls that connect you to a dealer.
• Email provider — our transactional and marketing email provider, used to send account, enquiry and (where you have opted in) marketing and new-match emails.
• Advertising and analytics platforms — including Google (for maps and marketing/attribution) and Meta. Where we build marketing audiences from customer data, contact details such as your email address are cryptographically hashed before being shared, any such export is triggered manually by an administrator rather than automatically, and it is subject to internal sign-off and your opt-in before any real customer data is used.
• Professional advisers, and authorities — such as our accountants, auditors and legal advisers, and regulators or law-enforcement bodies where we are required to share data.

We require our processors to protect your data and to act only on our instructions.

9. International transfers

Our services are operated primarily for the UK. Some of our providers may process data outside the UK. Where personal data is transferred outside the UK, we rely on an adequacy decision (a UK adequacy regulation) where one applies to the destination country, or otherwise on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures needed to protect your data. You can ask us for more information about the safeguards in place.

10. How long we keep your data

We keep personal data only for as long as we need it for the purposes described in this policy, after which we delete it or irreversibly anonymise it. In deciding how long to keep data we consider the amount and sensitivity of the data, the potential for harm from unauthorised use, the purposes we process it for and whether we can achieve them by other means, and our legal, accounting and regulatory obligations.

In practice this means, for example, that account data is kept for as long as your account is active and for a reasonable period afterwards; behavioural and analytics event data is kept for a limited period and then pruned or aggregated; call recordings and transcripts are kept only for as long as needed for the purposes in section 3 and to meet our legal obligations; the plaintext of a scheduled call-back number is deleted once the call has been placed; and financial and transaction records are kept for the periods required by tax and accounting law. We are formalising the specific retention periods for each category of data and will keep this section updated.

11. Your rights

Under the UK GDPR you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data in certain circumstances;
• ask us to restrict our processing in certain circumstances;
• object to processing based on our legitimate interests, and to object at any time to processing for direct marketing;
• request portability of certain data you provided to us, in a structured, commonly used, machine-readable format; and
• withdraw consent at any time where we rely on consent (for example for non-essential cookies or marketing), without affecting processing carried out before withdrawal.

You will not usually have to pay to exercise these rights. To make a request, contact us at james@autofintech.co.uk. We may need to verify your identity before acting. We will respond within one month, which we may extend by up to two further months where a request is complex; we will tell you if that happens.

12. Complaints

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or by calling their helpline. We would, however, appreciate the chance to address your concerns before you approach the ICO.

13. Children

Our services are intended for users aged 18 and over (a finance application requires you to be at least 18). The site is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our services or in the law. When we do, we will change the “Last updated” date above, and where changes are significant we will take reasonable steps to bring them to your attention.

15. Contact us

For any privacy question, or to exercise your rights, contact Motor Genius Group Ltd (operator: AFT Ltd), Motoring.Today, by email at james@autofintech.co.uk.