Auto eDocs Ltd
Your information, explained plainly
Privacy at a glance
We do not sell personal information. We use it to provide, secure and improve Auto eDocs and to respond to you.
We do not receive your full payment-card details. Stripe processes card information on its secure checkout service.
Dealerships control their deal-file information. Auto eDocs processes uploaded dealership data on their instructions.
Optional measurement is your choice. Application Insights browser analytics and the Google Ads tag stay off unless you allow the relevant category.
1. Who we are and when this notice applies
Auto eDocs Ltd ("Auto eDocs", "we", "us" or "our") provides Deal File, document-management, workflow and automotive compliance software for UK vehicle dealerships. We are a company registered in England and Wales under company number 12242357. Our registered office is 13 Brambles Close, Ash, Aldershot, England, GU12 6NY.
This notice applies when you visit our public website, contact us, request a demonstration, register for or use Auto eDocs, manage a subscription, receive service communications, or interact with an integration through which information is supplied to us. It should be read alongside our Terms and Conditions and any contract or data-processing agreement agreed with your dealership or organisation.
You can contact us about privacy at sales@autoedocs.com (please use the subject "Privacy") or at the registered-office address above. Existing customers can also contact support@autoedocs.com.
2. When we are a controller and when we are a processor
We are a controller when we decide why and how personal information is used for our own business activities. This includes website enquiries, demo requests, account administration, billing records, security logs, service communications and our relationship with dealership contacts.
A dealership or dealer group is normally the controller of personal information contained in the deal files, documents and records that it uploads to Auto eDocs. For that information, Auto eDocs acts as a processor and uses it only on the dealership's documented instructions, subject to our contract and data-processing terms. If your question concerns information in a dealership's deal file, you should usually contact that dealership first. We will assist the dealership in responding where required.
Some partner or integration arrangements have separate privacy and data-sharing terms. Those terms take priority where they give you more specific information about that processing.
3. The information we use and where it comes from
Depending on how you interact with us, we may use:
- Contact and business information, such as your name, work email address, telephone number, dealership or company, job role and preferred contact method.
- Enquiry information, including the subject and content of a message, a demo request, support correspondence and the page from which an enquiry was sent.
- Account information, such as username, email address, account and dealership associations, roles, permissions, confirmation status and authentication settings.
- Subscription and transaction information, such as the package selected, Stripe customer or subscription reference, payment status, invoice details and billing contact. Payment-card details are entered into Stripe's service and are not made available to us in full.
- Technical, security and usage information, such as IP address, approximate location derived from IP, browser and device type, operating system, referring page, requested URLs, dates and times, application events, diagnostic information and security-verification results.
- Communication preferences, including whether you want to receive optional marketing and your cookie choice.
- Dealership service data, including information, documents and audit records uploaded or created by authorised users. This may contain customer, vehicle, transaction and compliance information selected by the dealership.
We normally obtain information directly from you or from your employer or dealership. We may also receive it from a dealer group, an authorised integration partner, Stripe, a security provider, or another user who invites you to a dealership account. Website and security information is generated automatically when you use the service.
Please do not provide special-category information or criminal-offence information to us unless it is genuinely required for an authorised dealership purpose and your organisation has confirmed that it has an appropriate lawful basis and safeguards.
4. How and why we use personal information
| Purpose | Information commonly used | Lawful basis when we are controller |
|---|---|---|
| Respond to enquiries, arrange demonstrations and discuss registration or packages | Contact, business, enquiry and communication information | Steps requested before a contract; and our legitimate interest in responding to business enquiries and developing customer relationships |
| Create and administer accounts and provide the service | Account, contact, dealership, role, authentication and service-use information | Performance of a contract where you contract personally; otherwise our legitimate interests in fulfilling our contract with your organisation and administering authorised users |
| Manage subscriptions, payments, invoices and financial records | Billing contact, package, transaction status and Stripe references | Contract, legitimate interests in administering business payments, and legal obligations relating to tax, accounting and record keeping |
| Secure the website and service, verify users, prevent spam and fraud, investigate incidents and enforce our terms | Account, authentication, IP, device, log, diagnostic and human-verification information | Our legitimate interests in protecting users, information and systems; and legal obligations to maintain appropriate security |
| Provide support, maintain reliability and improve the service | Support correspondence, application events, diagnostics and proportionate usage information | Contract and our legitimate interests in operating, troubleshooting and improving Auto eDocs |
| Send important service, security and account messages | Name, account and business contact details | Contract, legal obligation and our legitimate interests in keeping users informed about the service |
| Send optional marketing or measure Google Ads conversions | Business contact preferences or consented advertising identifiers and interaction data | Consent where required by data-protection or electronic-communications law; in limited business-marketing circumstances, legitimate interests subject to your right to object |
| Establish, exercise or defend legal claims and respond to regulators or authorities | Relevant account, transaction, communication, log and service information | Legal obligation and our legitimate interests in protecting our legal rights and demonstrating compliance |
Where we rely on legitimate interests, those interests include running and improving a secure B2B software service, supporting authorised users, answering relevant business enquiries, protecting our legal rights and preventing misuse. We consider the necessity and proportionality of the use and balance it against the rights and reasonable expectations of the people concerned.
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal. Service and security messages are not marketing and may still be sent where they are necessary to provide or protect your account.
5. Who we share information with
We share only what is reasonably necessary with:
- Microsoft Azure and Application Insights for cloud hosting, service operation, diagnostics, security and reliability. Browser-based Application Insights analytics loads only when you allow service analytics; server-side security and operational logs do not depend on that choice.
- Cloudflare for Turnstile human verification and related website-security services. Turnstile assesses browser and device signals to distinguish people from automated traffic; Cloudflare states that it does not read form entries or user communications through Turnstile.
- HubSpot when you open or submit our embedded demo-request form, so the request can be delivered to and managed by our team.
- Stripe for subscription checkout, payment processing, invoicing and payment-status administration. Stripe receives payment-card information directly and maintains its own records under its privacy terms.
- Google for optional Google Ads conversion measurement where you consent and to deliver the Poppins and Roboto fonts used by the public website. Font requests disclose ordinary connection information such as IP address and browser details but do not enable the optional Google Ads tag.
- CleanTalk where enabled to help detect automated or abusive registration attempts.
- Communications, support and professional-service providers, such as email delivery, IT support, legal, accounting, insurance and audit advisers, where they need the information to provide services to us.
- Authorities, regulators, courts or other parties where disclosure is required by law, necessary to protect rights or security, or needed to establish, exercise or defend legal claims.
- A buyer, investor or successor if we restructure, sell or transfer all or part of our business, subject to appropriate confidentiality and data-protection safeguards.
Our providers are required by contract to protect information and use it only for the agreed services, except where a provider acts as an independent controller for a defined activity (for example Stripe's own legal payment records or Google's consented advertising services). We do not sell personal information and we do not share it with unrelated third parties for their own direct marketing.
6. International transfers
We and our providers aim to store and process information in the United Kingdom or European Economic Area where practical. Some named providers operate globally, so information may be accessed from or transferred to other countries.
Where UK personal information is transferred to a country that is not covered by UK adequacy regulations, we use an appropriate safeguard such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism. We also assess supplementary technical and organisational measures where appropriate. Contact us if you want more information about the safeguard relevant to a particular transfer.
7. How long we keep information
We keep personal information only for as long as needed for the purpose described, including to meet contractual, legal, accounting, security and dispute-resolution requirements. The criteria include the nature and sensitivity of the information, the risk of harm, the period of our relationship, the instructions of the relevant dealership and applicable limitation or statutory record-keeping periods.
- Enquiries and demo requests are reviewed after the enquiry has been answered and kept only while reasonably needed for follow-up, relationship management or a relevant business record.
- Account and subscription records are kept during the customer relationship and afterwards only for applicable contractual, security, tax, accounting and legal periods. Statutory accounting records are normally retained for six years.
- Dealership service data is retained and deleted in accordance with the dealership's instructions and our contract. Following cancellation, service data is accessible in read-only format for 60 days from the date of cancellation, subject to the agreed terms and our backup-deletion cycle.
- Security and diagnostic logs are kept for a proportionate operational period based on their purpose, risk and configured retention settings, then deleted or anonymised.
- Cookie and similar-technology durations are set out in section 11 below.
We may retain anonymised information that can no longer identify a person.
8. Your data-protection rights
Depending on the circumstances and lawful basis, you may have the right to:
- be informed about how your personal information is used;
- request access to your personal information and a copy of it;
- ask us to correct inaccurate or incomplete information;
- ask us to erase information in certain circumstances;
- ask us to restrict how information is used in certain circumstances;
- receive information you provided in a structured, commonly used, machine-readable format and ask for it to be transferred where the right to portability applies;
- withdraw consent at any time where consent is the basis for processing; and
- complain to the Information Commissioner's Office.
Your right to object
You have the right to object to processing based on legitimate interests. You also have an absolute right to object to direct marketing. Tell us if you want us to stop using your information for marketing, or use the unsubscribe option in the message.
To exercise a right, email sales@autoedocs.com with the subject "Privacy request". We may need to verify your identity and clarify the request. Rights are not absolute, and we will explain if an exemption applies. We normally respond within one month. There is usually no fee, although the law allows a reasonable fee or refusal in limited cases.
If Auto eDocs holds the information only as a processor for a dealership, we will direct the request to that dealership or assist it in responding.
9. Security
We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure or access. These include access controls, authentication protections, encryption where appropriate, monitoring, backups, supplier controls and procedures for managing security incidents. No internet service can guarantee absolute security, so users must also protect their credentials and notify us promptly of suspected unauthorised access.
10. Automated decisions and children
Security providers may automatically assess technical signals to identify spam, bots, fraud or abuse. Auto eDocs does not currently use website visitor or account information to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
Auto eDocs is a business service for vehicle dealerships and is not directed at children. People under 18 should not register for an account or submit information through the public website.
11. Cookies and similar technologies
Cookies are small text files stored by your browser. Similar technologies include local storage, scripts and tags that can store or access information on a device. We use necessary technologies to operate and secure the website and account service. We also offer separate optional categories for service analytics and Google Ads conversion measurement. Optional technology is not loaded until you choose to allow the relevant category.
Necessary cookies and technologies
| Name or provider | Purpose | Typical duration |
|---|---|---|
AutoEdocs.CookiePreferences |
Remembers whether you chose necessary cookies only or allowed either optional measurement category. | 6 months |
.AspNetCore.Antiforgery.* |
Protects forms and requests against cross-site request forgery. | Session |
.AspNetCore.Identity.Application and temporary identity/correlation cookies |
Authenticates registered users and protects sign-in, external sign-in and account-recovery flows. | Normally up to 60 minutes of inactivity; temporary sign-in cookies expire sooner |
.AspNetCore.Session |
Maintains the application session and security-related state. | Normally up to 60 minutes of inactivity |
Branding |
Displays the correct authorised partner branding where a branded route is requested. | Browser session |
Cloudflare Turnstile and challenge storage (which may include cf_clearance if pre-clearance is enabled) |
Prevents automated submissions, spam and abuse on protected forms. Turnstile processes browser and device signals necessary for the security check. | Challenge/session duration or the configured Cloudflare challenge-passage period, where issued |
HubSpot form/CDN security storage, including __cf_bm, __cfuvid or __cfruid where issued |
Delivers and protects the embedded demo-request form when you choose to open and use it. | Usually 30 minutes or the browser session, depending on the item |
Optional service analytics
| Name or provider | Purpose | Typical duration |
|---|---|---|
Microsoft Application Insights ai_session, ai_user and related browser storage |
Helps us measure browser sessions, diagnose faults, understand performance and improve reliability. This is not used for advertising. | ai_session: about 30 minutes; ai_user: up to 1 year; temporary diagnostic storage is cleared according to SDK settings |
Optional advertising measurement
| Name or provider | Purpose | Typical duration |
|---|---|---|
Google Ads _gcl_* cookies and _gcl_ls local storage |
Records advertising-click information so an action on our public website can be attributed to an Auto eDocs advert. We configure the tag for measurement, not personalised advertising. | Up to 90 days, subject to Google and browser controls |
How to control cookies
When the notice appears, "Necessary cookies only" is as easy to select as "Allow all measurement". "Choose cookies" lets you enable service analytics and advertising measurement independently. Necessary cookies cannot be switched off through our control because the requested website, sign-in or security function may not work without them. You can revisit your decision at any time using the button below or the "Cookie settings" link in the footer.
You can also block or delete cookies and local storage using your browser settings. Doing so may sign you out, remove your preference or prevent protected forms from working. If you follow a link to Stripe Checkout or another external website, that organisation controls the technologies used on its own service and its privacy notice applies.
12. Questions and complaints
Please contact us first if you have a privacy question or concern so that we can investigate and try to resolve it. Email sales@autoedocs.com with the subject "Privacy", or write to Auto eDocs Ltd, 13 Brambles Close, Ash, Aldershot, England, GU12 6NY.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. Visit ico.org.uk/make-a-complaint, telephone 0303 123 1113, or write to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
13. Changes to this notice
We review this notice and our use of cookies and similar technologies periodically. We will publish updates on this page and change the "Last updated" date. If a change materially affects how we use information or a choice you previously made, we will provide a more prominent notice or request fresh consent where required.
