Privacy Policy

01. Introduction and Identity of the Data Controller

This Privacy Policy explains how Athfluence Limited ("Supercar Living", "we", "us", "our") collects, uses, stores, shares, and protects your personal data when you access or use the Supercar Living platform at supercarliving.com and associated subdomains (the "Platform").

Athfluence Limited is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Registered details: Athfluence Limited, Company Number 16356766, 4 Harvest Way, Sleaford, Lincolnshire, NG34 7WE.

All privacy-related correspondence must be directed to: sclagent@supercarliving.com

This Policy applies to all users of the Platform, including Members (Free, Club, and Black tier), Partners (hotel operators, estate agents, specialist service providers, and all other registered partner types), and Guests browsing without an account. Separate provisions within this Policy are identified where they apply specifically to Members or Partners.

By using the Platform, registering an account, or submitting any content, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Policy, you must not use the Platform.

02. What Personal Data We Collect

2.1 Member Registration and Account Data

When you register as a Member, we collect:

• Full name and email address
• Phone number (optional at registration)
• Membership tier selected (Free, Club, or Black)
• How you heard about Supercar Living
• Password (stored in hashed form only - we never store plaintext passwords)

2.2 Membership and Billing Data

For paid memberships (Club and Black), we collect and process:

• Membership tier, billing period, and subscription status
• Stripe customer ID and subscription ID (references to your payment records held by Stripe - we do not store full card details on our systems)
• Membership intent records created during the sign-up flow
• Payment confirmation and status records

2.3 Fleet Manager and Vehicle Data

If you use the Fleet Manager (My Garage) feature, we collect:

• Vehicle registration numbers, make, model, year, colour, and fuel type
• MOT expiry dates, tax status and due dates, and insurance expiry dates
• Service history, maintenance records, and tyre change history you choose to record
• DVLA data retrieved via the DVLA Vehicle Enquiry API in connection with registered vehicles (MOT status, tax status, vehicle details)
• Photographs of vehicles you upload to your garage profile
• Garage privacy settings (public, members only, or private)

Vehicle registration data is used to query the DVLA Vehicle Enquiry API on a nightly basis to keep MOT and tax status current for vehicles you have registered. This data is processed under our legitimate interests in providing accurate alert information to you.

2.4 Member-Submitted Content

When you submit content to the Platform, we collect the content itself and associated metadata, including:

• Hotel, restaurant, car park, and route submissions - name, location, description, and any supporting information you provide
• Drive reports - route, vehicle used, photographs, narrative, and ratings
• Community posts and questions (The Ask) - question text, category, and any responses
• Car listings submitted to the Buy and Sell section - vehicle details, asking price, description, and contact preferences
• Property listings - address, property details, photographs, and contact information
• Your membership tier at the time of submission (used to attribute content correctly)

2.5 Alert and Preference Data

We collect and store your stated preferences for Supercar Alerts, including:

• Alert categories, regions, and features of interest
• Alert frequency preference (instant, daily, or weekly)
• Alert toggle settings for MOT, tax, insurance, and service reminders per vehicle

2.6 Lifestyle Enquiry Data

When you submit a Lifestyle service enquiry (Club or Black tier), we collect:

• Your name, email address, phone number, and membership tier
• The category of service requested and your preferred contact time and urgency level
• Category-specific form data you provide - for example, property details for a conveyancing enquiry, or finance requirements for a vehicle finance enquiry
• Any additional notes you include with your submission

2.7 Partner Registration and Account Data

When a business registers as a Partner, we collect:

• Business name, registered email address, contact name, and phone number
• Companies House registration number and the data returned by the Companies House REST API (company status, registered address, SIC codes, incorporation date)
• Business address, website, and description
• Partner type and, where applicable, service categories
• Membership benefit or offer provided to Supercar Living members
• How they heard about Supercar Living
• Application date, approval date, and account status
• Stripe customer ID for paid Partner tier billing
• Login session tokens (stored temporarily for Partner authentication)

2.8 Usage and Technical Data

We automatically collect certain technical and usage data when you use the Platform, including:

• Pages visited, search queries, and interactions with Platform features
• Listing click events - when you click a website link or reveal a perks code on a listing (recorded with your membership tier and a timestamp)
• IP address, browser type and version, operating system, and device type
• Referral source and session duration
• Cookie data (see Section 9)

2.9 Contact and Enquiry Data

If you contact us via the contact form or by email, we collect your name, email address, phone number (if provided), subject, and message content. Contact submissions are stored and tracked for response management purposes.

2.10 Sensitive Data

We do not intentionally collect any special category personal data (as defined by UK GDPR Article 9), including data relating to health, ethnicity, religion, or biometric data. Please do not include such information in any submission, enquiry, or community post. If we inadvertently receive special category data, we will delete it promptly.

03. How We Use Your Personal Data

We use your personal data only for the purposes set out below and only to the extent necessary for those purposes.

3.1 To Provide and Manage Your Membership

• Creating and maintaining your Member account
• Processing membership sign-up, tier upgrades, and subscription billing
• Displaying your Garage profile and community contributions to other Members (subject to your privacy settings)
• Applying access controls across the Platform based on your membership tier

3.2 To Operate the Fleet Manager

• Storing and displaying your vehicle records
• Querying the DVLA Vehicle Enquiry API nightly to keep MOT and tax status current for vehicles you have registered
• Generating and sending automated Garage Alert emails when MOT, tax, insurance, or service dates are approaching or overdue
• Displaying MOT, tax, and insurance status on your dashboard

3.3 To Deliver Supercar Alerts

• Sending new listing alerts matching your stated category, region, and feature preferences
• Managing alert frequency in accordance with your stated preference (instant, daily, or weekly)

3.4 To Manage Member-Submitted Content

• Reviewing, moderating, and publishing submissions (hotels, routes, car parks, properties, drive reports, community posts)
• Attributing published content to your Member profile
• Sending follow-up communications in connection with your submissions

3.5 To Route Lifestyle Enquiries

• Passing your enquiry data (name, contact details, and enquiry specifics) to the relevant Lifestyle Partner
• Tracking enquiry status and managing SLA compliance
• Sending you a confirmation of your enquiry

3.6 To Operate the Partner Programme

• Verifying Partner businesses against the Companies House REST API
• Creating and managing Partner accounts and dashboards
• Notifying Partners of listing enquiries, perk code interactions, and dashboard activity
• Processing Partner subscription payments via Stripe
• Conducting listing follow-up communications with Partners

3.7 For Platform Operations and Improvement

• Monitoring Platform usage and performance
• Identifying and resolving technical issues
• Conducting analytics to understand how the Platform is used and to improve it
• Fraud detection and security monitoring

3.8 To Comply With Legal Obligations

• Retaining records as required by applicable law
• Responding to lawful requests from regulatory authorities or law enforcement
• Maintaining records required for tax and accounting purposes

04. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

4.1 Contract (Article 6(1)(b))

Processing necessary to perform our contract with you, including: providing and managing your membership account, operating the Fleet Manager, processing billing and subscription management, routing Lifestyle enquiries, and managing Partner accounts and listings.

4.2 Legitimate Interests (Article 6(1)(f))

Processing necessary for our legitimate interests (or those of a third party), provided those interests are not overridden by your rights. This includes: operating and improving the Platform, fraud prevention and security, sending service communications and listing follow-up emails, operating the Garage Alert system, querying the DVLA API to keep vehicle data current, conducting usage analytics, and communicating with Partners about their listings.

Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms.

4.3 Consent (Article 6(1)(a))

Where you have given explicit consent, for example for marketing communications or for the use of non-essential cookies. You may withdraw consent at any time by contacting sclagent@supercarliving.com or by adjusting your cookie preferences. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

4.4 Legal Obligation (Article 6(1)(c))

Processing required to comply with a legal obligation, including responding to lawful requests from regulatory bodies, courts, or law enforcement, and retaining records required by tax or company law.

05. Data Sharing and Third Parties

We do not sell your personal data. We share personal data only in the following circumstances and only to the extent necessary for the stated purpose.

5.1 Lifestyle Partners

When you submit a Lifestyle service enquiry (available to Club and Black Members), we share the information you provide in that enquiry - including your name, contact details, and enquiry specifics - with the relevant Lifestyle Partner to enable them to respond. Lifestyle Partners receive only the data necessary to handle your specific enquiry. They are required to treat your data in accordance with applicable data protection law and may not use it for any purpose other than responding to your enquiry.

5.2 Payment Processors

We use Stripe, Inc. to process membership and Partner subscription payments. When you make a payment, Stripe collects and processes your payment card information directly. We receive and store Stripe customer IDs and subscription IDs as references. Stripe processes your payment data under its own privacy policy (available at stripe.com/privacy) and as a data processor on our behalf. Stripe is certified to PCI DSS standards.

5.3 Third-Party API Services

The Platform integrates with the following third-party APIs, which may process limited personal or vehicle data:

• Companies House REST API - used to verify Partner businesses. We submit a Companies House number and receive company status data in return.
• DVLA Vehicle Enquiry API - used to check MOT and tax status for vehicles registered in your Fleet Manager. We submit a vehicle registration number and receive vehicle status data. This API is operated by the Driver and Vehicle Licensing Agency (DVLA), an executive agency of the UK Department for Transport.
• Postcodes.io - used to convert postcodes to geographic coordinates for property and listing distance calculations. No personal data is submitted beyond a postcode.

5.4 Infrastructure and Platform Providers

The Platform is built on and hosted by Base44. Base44 acts as a data processor on our behalf and processes data only in accordance with our instructions. We have ensured that appropriate data processing terms are in place.

5.5 Legal Disclosure

We may disclose personal data where required to do so by applicable law, court order, or at the request of a competent regulatory authority or law enforcement agency. Where legally permitted, we will notify you of such a disclosure.

5.6 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of the assets of Athfluence Limited, personal data held by us may be transferred to the acquiring entity as part of that transaction. We will notify you of any such transfer and any resulting change to this Privacy Policy before it takes effect.

5.7 Other Members

Certain content you submit - including drive reports, community posts, questions, garage profile details, and car listings - may be visible to other Members, subject to your privacy settings. Your email address is never displayed to other Members. You control the visibility of your garage profile (public, members only, or private) through your account settings. Car listing contact details are shared only in accordance with your stated contact preferences.

06. International Data Transfers

We are a UK-based platform and process personal data primarily within the United Kingdom. Some of our third-party service providers (including Stripe, Inc., which is headquartered in the United States) may process data outside the UK.

Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place in accordance with UK GDPR, including reliance on adequacy regulations, standard contractual clauses approved by the UK Information Commissioner's Office (ICO), or other lawful transfer mechanisms.

If you would like further information about the safeguards we have in place for international transfers, please contact us at sclagent@supercarliving.com.

07. Data Retention

We retain your personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable law.

7.1 Member Data

We retain Member account data for the duration of your membership. If you close your account, we will delete or anonymise your personal data within 90 days, except where we are required to retain it for legal, regulatory, tax, or audit purposes.

7.2 Partner Data

We retain Partner account data for the duration of the Partner relationship. Following closure or termination of a Partner account, we retain records necessary for legal, financial, and dispute resolution purposes for a period of up to 7 years, in line with standard accounting and legal retention requirements.

7.3 Vehicle and Fleet Manager Data

Vehicle data held in your Fleet Manager is retained for the duration of your account and deleted within 90 days of account closure, subject to the exceptions above.

7.4 Submitted Content

Content you submit that has been published on the Platform (drive reports, routes, community posts) may be retained in anonymised or attributed form after account closure, unless you specifically request its deletion. We will consider deletion requests on a case-by-case basis, balancing your right to erasure against our legitimate interest in maintaining the integrity and continuity of Platform content.

7.5 Lifestyle Enquiry Data

Lifestyle enquiry records are retained for a period of 2 years from the date of submission, to enable follow-up, dispute resolution, and service improvement.

7.6 Contact and Correspondence Data

Contact form submissions and email correspondence are retained for a period of 3 years from the date of last contact, or longer where the correspondence relates to an ongoing matter.

7.7 Usage and Technical Data

Aggregated usage analytics data is retained indefinitely in anonymised form. Individual usage logs (including IP address and session data) are retained for a maximum of 12 months.

08. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights in respect of your personal data. We will respond to all valid requests within one calendar month.

8.1 Right of Access

You have the right to request a copy of the personal data we hold about you (a Subject Access Request). We will provide this free of charge within one month of receiving a valid request.

8.2 Right to Rectification

You have the right to request that we correct any inaccurate personal data we hold about you, or complete any incomplete data. Many data fields can be corrected directly through your account settings.

8.3 Right to Erasure

You have the right to request that we delete your personal data in certain circumstances, including where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other lawful basis for processing. This right is not absolute and may be limited where we have a legal obligation to retain the data.

8.4 Right to Restriction of Processing

You have the right to request that we restrict processing of your personal data in certain circumstances, for example while the accuracy of your data is being verified, or while we are assessing an objection you have raised.

8.5 Right to Data Portability

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to request that we transmit that data to another controller where technically feasible.

8.6 Right to Object

You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis for processing. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for the establishment, exercise, or defence of legal claims.

8.7 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

8.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe your personal data has been processed in a manner that does not comply with UK GDPR. The ICO can be contacted at ico.org.uk or by calling 0303 123 1113.

To exercise any of the rights above, please contact us at sclagent@supercarliving.com. We may need to verify your identity before processing your request.

09. Cookies and Tracking Technologies

The Platform uses cookies and similar tracking technologies to operate correctly and to understand how it is used. A cookie is a small file placed on your device when you visit a website.

9.1 Essential Cookies

Essential cookies are strictly necessary for the Platform to function. They enable core features such as session management, authentication, and security controls. Essential cookies cannot be disabled without preventing the Platform from operating correctly. We do not require your consent to place essential cookies.

9.2 Analytical Cookies

We use analytical cookies to understand how visitors interact with the Platform - for example, which pages are visited most frequently and where users encounter difficulties. This data is used in aggregate to improve the Platform and is not used to identify individual users. Analytical cookies are placed only with your consent.

9.3 Partner Authentication

The Partner portal uses a separate authentication system based on localStorage session tokens to maintain Partner login state. This is entirely separate from Member authentication and does not use HTTP cookies.

9.4 Managing Cookie Preferences

You can manage and withdraw consent for non-essential cookies at any time by adjusting your browser settings or using the cookie preference controls on the Platform. Disabling analytical cookies will not prevent you from using the Platform.

For a full list of cookies used on the Platform and their purposes, please contact us at sclagent@supercarliving.com.

10. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration.

Security measures in place include:

• Passwords are stored in hashed form and are never stored or transmitted in plaintext
• Partner session tokens are stored with expiry dates and validated on each request
• Payment processing is handled entirely by Stripe, Inc., which is certified to PCI DSS standards - we do not store full payment card details on our systems
• Access to production data is restricted to authorised personnel only
• The Platform is built on infrastructure maintained by Base44, which implements platform-level security controls
• Row-level security rules are applied to Member data entities to ensure Members can only access their own records

No method of transmission over the internet or electronic storage is completely secure. While we take all reasonable steps to protect your personal data, we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where required by law.

If you become aware of any actual or suspected security vulnerability or data breach involving the Platform, please notify us immediately at sclagent@supercarliving.com.

11. Children's Privacy

The Platform is not directed at children under the age of 18 and we do not knowingly collect personal data from anyone under that age. If we become aware that we have inadvertently collected personal data from a child under 18, we will take steps to delete it promptly.

If you believe a child under 18 has provided us with personal data without parental consent, please contact us immediately at sclagent@supercarliving.com.

12. Automated Decision-Making and Profiling

We do not carry out any automated decision-making that produces legal or similarly significant effects on individuals, as defined by UK GDPR Article 22.

Supercar Living Scores (SCL Scores), including the Car Ready Score for properties and hotel suitability assessments, are generated using defined criteria and assumptions applied to listing data. These scores are indicative assessments intended to assist users in comparing listings and do not constitute automated decisions about any individual. They do not affect your rights, access, or legal position in any way.

Garage Alerts are generated automatically based on vehicle data you have entered and MOT and tax status data retrieved from the DVLA API. These alerts are informational notifications only and do not constitute automated decisions about you.

13. Links to Third-Party Sites

The Platform contains links to third-party websites, including Partner websites, Lifestyle Partner sites, and external booking or information pages. This Privacy Policy applies only to the Supercar Living Platform. We are not responsible for the privacy practices of any third-party website, and we encourage you to read the privacy policy of any site you visit via a link from our Platform.

The inclusion of a link to a third-party site does not constitute our endorsement of that site or its privacy practices.

14. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or Platform features. Where changes are material, we will notify registered Members by email to the address held on file before the changes take effect. The "Last updated" date at the top of this Policy will always reflect when it was last revised.

We recommend that you review this Policy periodically. The current version is always available at supercarliving.com/privacy. Continued use of the Platform following the effective date of any updated Policy constitutes your acceptance of the revised terms.

15. Contact and Data Subject Requests

All privacy-related enquiries, data subject rights requests, and correspondence regarding this Privacy Policy must be directed to:

Supercar Living, Athfluence Limited, 4 Harvest Way, Sleaford, Lincolnshire, NG34 7WE. Company Number: 16356766. Email: sclagent@supercarliving.com

We aim to acknowledge all privacy-related correspondence within 2 working days and to respond substantively within one calendar month, as required by UK GDPR. Where a request is complex or we receive a high volume of requests, we may extend this period by a further two months, in which case we will notify you within the first month.

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF