How we handle personal data at DealerOS — straight, and in line with UK data protection law.
DealerOS ("DealerOS", "we", "us", "our") provides a multi-tenant CRM and dealer management platform for used-car dealerships in the United Kingdom, available at usedealeros.com.
For the purposes of UK data protection law — the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 — the data controller for this website and for DealerOS account data is:
It helps to separate two different things:
Name, business name, work email, phone number, role, and login credentials of the dealership staff who use DealerOS.
The records you enter or import into the platform — vehicles, valuations, leads, contacts, deals, reservations, invoices, accounts entries, messages and related documents. This may include personal data about your own customers and suppliers (see section 5).
Subscription plan, billing contact, and transaction records. Card payments are handled by our payment provider; we do not store full card numbers.
If you fill in a form on our website (for example to start a trial or book a demo) or email us, we collect the details you provide and our correspondence with you. Website enquiry forms are delivered to us by a third-party form service.
IP address, device and browser type, pages visited, and basic usage events, collected to keep the service secure and working. Some of this is collected via cookies (see section 6).
When you use DealerOS to run your forecourt, you may store personal data about your own customers, leads and contacts. For that data:
Our website and app use a small number of cookies and similar technologies: strictly necessary ones to make the site and sign-in work, and — where used — analytics to understand traffic. Non-essential cookies are only set where permitted. You can control cookies through your browser settings. Where we use an analytics or hosting provider, only the data needed to run and measure the service is shared.
We do not sell personal data. We share it only with service providers who help us run DealerOS, each under contract and only as needed. Our key sub-processors include:
We may also disclose data where required by law, to enforce our terms, or in connection with a business sale or reorganisation. Optional integrations you switch on (such as AutoTrader, Carwow, auction platforms, DVLA, Xero or Sage) involve sharing the relevant data with those services under their own terms and privacy policies.
We aim to keep data within the UK or European Economic Area. Where a provider processes data outside the UK/EEA, we rely on an appropriate safeguard — such as UK adequacy regulations or the International Data Transfer Agreement / Addendum — so your data stays protected.
We keep account and platform data for as long as your subscription is active and for a reasonable period afterwards. On request after termination we will delete or return your dealership data, except where we must retain certain records (for example for tax or legal reasons). Website enquiry and analytics data is kept only as long as needed for the purpose it was collected.
We use technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS), database-level tenant isolation, access controls and the principle of least privilege. No system is perfectly secure, but we work to protect your data and to notify you and the regulator of a notifiable breach where the law requires.
Under UK GDPR you have the right to: access your data; have inaccurate data corrected; have data erased; restrict or object to processing; data portability; and to withdraw consent where we rely on it. Where we act as a processor for a dealership, please direct requests to that dealership and we will assist them. To exercise a right against DealerOS as controller, email privacy@usedealeros.com. We will respond within the statutory time limit.
DealerOS is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.
We may update this policy from time to time. We will post the revised version here and update the "last updated" date; material changes affecting account holders will be notified directly.
Questions or requests: privacy@usedealeros.com. If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk — though we'd appreciate the chance to put things right first.