Noya Motor Group

Privacy Policy

Last updated: 13 June 2026

1. Who we are

Noya Motor Group ("we", "us") is the data controller for personal data collected through this website and our dealership operations. If you have any questions about how we use your data, please contact us by email or by post at our registered dealership address.

2. What data we collect

  • Identity & contact details: name, email, phone, postal address.
  • Vehicle enquiry details: which vehicles you ask about, your trade-in if any.
  • Finance / purchase records: deposit, balance, invoices, payment method.
  • Communications: emails, SMS and call notes between you and our team.
  • Website usage: server logs and basic analytics. We do not use third-party advertising cookies on this site.

3. Lawful basis

  • Contract: to handle enquiries, sales, finance, after-sales and warranty.
  • Legal obligation: to keep tax / VAT / HMRC records for 6 years, MOT and DVLA notifications, and consumer-rights records.
  • Legitimate interest: to follow up on enquiries you initiated, prevent fraud, and maintain accurate customer records.
  • Consent: only for optional marketing emails / SMS. You can opt out at any time using the unsubscribe link or by contacting us.

4. Who we share data with

  • DVLA & DVSA — vehicle status, MOT history, keeper changes.
  • AutoTrader and Motorway — to advertise vehicles and (where relevant) source stock.
  • Our finance and warranty partners — only when you proceed with finance or a warranty.
  • HMRC / our accountants — for tax and statutory reporting.
  • Infrastructure: Supabase (database & auth), Cloudflare (hosting), Resend / Mailgun (email), Twilio / Brevo (SMS).

5. How long we keep it

Sales, invoice and finance records are kept for 6 years after the transaction to meet HMRC requirements. Enquiry-only records (no purchase) are reviewed and deleted within 24 months of last contact. After erasure under UK GDPR Article 17, the customer record is anonymised in place — the linked invoice / finance ledger entries remain intact (without personal identifiers) for statutory purposes.

6. Your rights

You have the right to access, correct, erase (subject to the legal-retention point above), restrict, or port your data, and to object to processing. To exercise any of these rights, email us. We will respond within one month.

If you are unhappy with our response, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies

We use only strictly necessary cookies (sign-in session, CSRF). We do not use advertising or tracking cookies on this site.

8. Changes

We may update this policy from time to time. Material changes will be highlighted on the home page for 30 days.