Privacy policy

Privacy Policy — Northline Ltd
Last updated: 2 February 2026

Northline Ltd (“Northline”, “we”, “us”, “our”) is committed to protecting your personal data and being transparent about how we use it. This Privacy Policy explains how we collect, use, share and protect personal data when you interact with us—whether you visit our website, enquire about a vehicle, buy or sell a vehicle, request delivery, take a test drive, request finance introductions, or contact us for any reason.

This policy is written to reflect our obligations under the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and relevant privacy rules including the Privacy and Electronic Communications Regulations (“PECR”).

1. Who we are (Data Controller)

Northline Ltd
Company number: 16695670
Registered office: 43 Kings Road, Doncaster, DN1 2LU
Trading address: Unit 12, Leigh Street, Sheffield, S9 2PR
Email: chris@northlinecars.com
Telephone: 0114 312 1237

For privacy enquiries and to exercise your rights (see Section 14), contact us using the details above. We do not currently appoint a Data Protection Officer; privacy enquiries are handled via the contact details above.

2. Scope

This Privacy Policy covers personal data processed by Northline Ltd in connection with:

  • Vehicle sales (B2C) and trade/business sales (B2B)

  • Vehicle purchasing and part-exchanges

  • Distance sales and delivery/collection

  • Test drives

  • Finance introductions and warranty products (where requested)

  • Website enquiries and marketing

  • CCTV and call recording

Our website: www.northlinecars.com

3. Personal data we collect

We collect personal data directly from you, from your devices when you use our website, and from third parties where appropriate.

3.1 Data you provide to us

  • Identity and contact data: name, address, email, phone number

  • Enquiry data: details of the vehicle(s) you’re interested in, budget, preferences, timings

  • Transaction data: invoices, order details, part-exchange details, delivery/collection information, communications and instructions

  • Payment data: bank account details used for bank transfers, payment references, and related records

  • Test drive data: driving licence details (and where necessary proof of address), and insurance-related information needed to administer a test drive under our trade policy

  • Customer communications: emails, messages, web form submissions, and call recordings (see Section 9)

3.2 Website and device data

  • IP address, browser type, device identifiers

  • Website activity (pages viewed, timestamps, referral source)

  • Cookie identifiers and analytics/advertising data (see Section 8)

3.3 CCTV

  • CCTV footage and still images when you visit our premises (see Section 9)

3.4 Special category data
We do not normally need to collect or process “special category” personal data (e.g., health data, ethnicity, religion). If you choose to share such data, we will only use it where necessary and lawful.

4. Where we get personal data from (if not directly from you)

We may receive personal data from:

  • Jigsaw Finance (where you request finance introductions)

  • Warranty Solutions Group Ltd (where you request warranty products)

  • Motorcheck (where we carry out vehicle history/HPI-type checks)

  • Delivery/transport providers (where you request delivery/collection)

  • Professional advisers (accountants/solicitors/insurers)

  • Law enforcement, regulators, or courts (where required or permitted by law)

5. How we use your personal data (purposes and lawful bases)

UK GDPR requires a lawful basis for each purpose. We rely on one or more of the following:

  • Contract (to take steps at your request or to perform a contract with you)

  • Legal obligation (to comply with the law)

  • Legitimate interests (to run and protect our business, balanced against your rights)

  • Consent (where required, e.g., certain marketing and cookies)

5.1 Enquiries, quotes and customer service

  • Responding to enquiries, providing information and quotes, arranging viewings
    Lawful basis: Legitimate interests / Contract (pre-contract steps)

5.2 Vehicle sales and purchases (B2C and B2B)

  • Processing vehicle orders, distance sales, delivery/collection, and after-sales support

  • Handling part-exchanges and vehicle purchasing from customers/trade
    Lawful basis: Contract / Legitimate interests

5.3 Payments (bank transfer only)

  • Reconciling payments and refunds, preventing fraud, maintaining accounting records
    Lawful basis: Contract / Legal obligation / Legitimate interests

5.4 Test drives (trade policy)

  • Confirming driver eligibility, administering test drives, protecting vehicles and safety
    Lawful basis: Legitimate interests / Contract (pre-contract steps)

5.5 Finance introductions (where requested)

  • Sharing relevant details with our finance introduction partner so you can apply for finance
    Lawful basis: Contract (pre-contract steps) / Legitimate interests

Important: Any lender/finance provider you proceed with will provide their own privacy information. They may carry out credit checks and automated decision-making under their own responsibilities as controller.

5.6 Warranties (where requested)

  • Arranging warranty products and administering cover-related queries
    Lawful basis: Contract / Legitimate interests

5.7 Vehicle history checks

  • Carrying out provenance/identity/history checks on vehicles we sell or take in part-exchange
    Lawful basis: Legitimate interests (fraud prevention, vehicle due diligence)

5.8 Business operations and compliance

  • Accounting, record keeping, auditing, tax compliance, handling disputes/complaints
    Lawful basis: Legal obligation / Legitimate interests

5.9 Security and incident management

  • CCTV, call recording, detecting/preventing fraud, protecting staff/customers and our assets
    Lawful basis: Legitimate interests / Legal obligation (where applicable)

5.10 Marketing (where permitted)

  • Sending offers, stock updates, and relevant services communications
    Lawful basis: Consent and/or Legitimate interests (depending on channel and relationship)
    See Section 7 for details.

6. If you do not provide your personal data

If you choose not to provide certain information:

  • We may be unable to respond effectively to your enquiry

  • We may be unable to proceed with a sale, part-exchange, distance delivery, test drive, finance introduction, or warranty arrangement

  • We may be unable to meet legal record-keeping requirements

7. Marketing preferences

We may contact you with marketing about vehicles, stock updates, and services, subject to PECR and UK GDPR.

  • Email/SMS: we will only send marketing where we have your consent, or where the “soft opt-in” applies (typically where you are an existing customer, marketing is similar to what you bought/enquired about, and you were given a clear opt-out at collection).

  • Phone: we will respect opt-outs and relevant preference services.

  • Post: we may send postal marketing based on legitimate interests unless you opt out.

You can opt out at any time by:

  • using unsubscribe links (where provided),

  • telling us by email/phone,

  • updating your preferences when offered.

We keep a record of opt-outs so we can respect your preferences.

8. Cookies and website tools

Our website uses cookies and similar technologies. Some are essential for the site to function; others help us understand how the site is used and support advertising/retargeting (if enabled).

We will request consent for non-essential cookies where required by PECR. You can manage cookie settings via our cookie banner and/or your browser.

Tools we use (or may use)

  • Squarespace (website hosting/operation)

  • Google (e.g., Analytics/GA4, Tag Manager, Ads, Search Console)

  • Meta (e.g., Meta Pixel and advertising tools)

  • Hotjar (heatmaps/session analytics)

  • Microsoft (e.g., Clarity user experience analytics, and Microsoft 365—see Section 10)

  • Mailchimp or Klaviyo (email marketing, if used)

Where these tools involve non-essential cookies/identifiers, we will collect consent before they run.

9. CCTV and call recording

CCTV
We operate CCTV at our premises for security, safety, and incident investigation.
Lawful basis: Legitimate interests (crime prevention, safety, protecting assets)
Retention: CCTV is retained for 30 days unless required longer to investigate an incident, respond to a legal request, or establish/defend legal claims.

Call recording
We record calls for training, quality assurance, dispute handling, and fraud prevention.
Lawful basis: Legitimate interests / Contract / Legal obligation (where applicable)
Where feasible, we will provide call recording notices at the start of calls or by other appropriate means.

10. Who we share your personal data with

We do not sell your personal data.

We may share personal data with:

  • Finance introduction partners: Jigsaw Finance (when you request finance)

  • Warranty providers/underwriters: Warranty Solutions Group Ltd (when you request a warranty)

  • Vehicle history providers: Motorcheck (for HPI-type checks)

  • Delivery/transport providers (when you request delivery/collection)

  • Professional advisers (accountants, solicitors, insurers)

  • IT, email and document management providers (including Microsoft 365 under Microsoft)

  • Our CRM provider HubSpot

  • Regulators, law enforcement, courts, and government bodies where required or permitted by law

Where third parties process personal data on our behalf (as processors), we use contracts requiring appropriate security, confidentiality, and lawful processing.

11. International transfers

We do not intentionally transfer personal data outside the UK.

However, some service providers may have group companies, support teams, or infrastructure located outside the UK. If an international transfer occurs, we will ensure appropriate safeguards are used in line with UK GDPR (for example, adequacy regulations or approved contractual protections).

12. Data security

We use appropriate technical and organisational measures to protect personal data, which may include:

  • Access controls and authentication

  • Secure configuration of systems and devices

  • Staff confidentiality and training

  • Vendor due diligence and contractual controls

  • Data minimisation and retention controls

No method of transmission or storage is completely secure, but we take reasonable steps to protect personal data and improve our controls over time.

13. How long we keep your data (retention)

Unless a shorter period applies (such as CCTV), our standard retention period for customer and transaction records is 6 years. This typically includes:

  • Enquiries and communications

  • Sales/purchase records and invoices

  • Part-exchange records

  • Delivery/collection records

  • Finance introduction and warranty administration records (where applicable)

  • Call recordings (where relevant to the above purposes)

We may keep data longer where necessary to:

  • Comply with legal obligations

  • Resolve disputes and complaints

  • Establish, exercise, or defend legal claims

  • Prevent or detect fraud

CCTV: 30 days (see Section 9).

14. Your rights

You have rights under UK GDPR, including the right to:

  • Access your personal data

  • Rectify inaccurate personal data

  • Erase your personal data (in certain circumstances)

  • Restrict processing (in certain circumstances)

  • Data portability (in certain circumstances)

  • Object to processing based on legitimate interests (including certain marketing)

  • Withdraw consent at any time (where we rely on consent)

To exercise your rights, contact us at chris@northlinecars.com. We may need to verify your identity before responding.

Complaints
If you are unhappy with how we handle your data, please contact us first and we will try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office (ICO).

15. Automated decision-making

We do not generally make decisions about you based solely on automated processing that has legal or similarly significant effects.

If you apply for finance through a lender/finance provider, they may use automated decision-making (e.g., credit scoring) and will explain this in their own privacy information.

16. Children’s data

Our services are not directed at children and we do not knowingly collect personal data from children.

17. Third-party websites

Our website may include links to third-party sites or services. We are not responsible for the privacy practices of those third parties. Please review their privacy policies.

18. Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be published on our website and will apply from the “Last updated” date at the top of this document.