Privacy Policy
Last updated: 15 May 2026
1. Who We Are
The data controller responsible for your personal data is WMA Vehicle Hire and Sales Limited, trading as WMA Motors, a company registered in England and Wales (Company No. 12086881). Our registered address is 70 Glebe Road, Bedlington, Northumberland, NE22 6JU.
WMA Vehicle Hire and Sales Limited (trading as WMA Motors) is authorised and regulated by the Financial Conduct Authority as a credit broker (Firm Reference Number 934177). We are registered with the Information Commissioner’s Office (ICO).
For any data protection queries, contact us at [email protected] or phone 01670 531777.
2. Data We Collect
We collect personal data when you use our website, contact us, visit our premises, or enter into any agreement with us. The categories of data we collect include:
Information You Provide
- Contact details: your name, phone number, email address, and postal address.
- Vehicle enquiry details: which vehicle you are interested in, your preferred ownership type (purchase, finance, rent-to-own, or short-term rental), and any message you send us.
- Finance application details: if you apply for vehicle finance, the information you provide in your application, which may include employment status, income, residential history, and bank details. These details are collected and processed by our finance platform provider, Codeweavers Ltd, on behalf of our lender panel.
- Rental and hire agreement details: driving licence details, insurance information, identification documents, and emergency contact details required for rent-to-own and short-term rental agreements.
- Marketing preferences: whether you have opted in to receive marketing communications from us.
Information Collected Automatically
- Website analytics: with your consent, we collect data about how you use our website (pages visited, time on site, device type) via Google Analytics 4, delivered through Google Tag Manager.
- Advertising measurement: with your consent, Meta (Facebook/Instagram) Pixel and TikTok Pixel collect data to measure the effectiveness of our advertising campaigns.
- Attribution data: we record how you found us (e.g. which advertising campaign or referral source) so we can measure and improve our marketing.
- Chatbot conversations: if you use our online chat assistant, the conversation transcript is stored to help us respond to your enquiry and improve the service.
- Spam prevention: when you submit a form, we record a one-way hash of your IP address to detect and prevent automated spam submissions. We do not store your actual IP address.
- Cookies: essential cookies for website functionality, plus analytics and marketing cookies with your explicit consent. See the Cookies section below and our Cookie Policy for full details.
3. How and Why We Use Your Data
We only process your personal data when we have a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR). The table below sets out our purposes and the corresponding lawful basis:
| Purpose | Lawful basis |
|---|---|
| Processing vehicle enquiries, arranging viewings, and contacting you about vehicles | Performance of a contract (Art. 6(1)(b)) |
| Arranging vehicle finance through our panel of lenders via Codeweavers | Performance of a contract |
| Administering rent-to-own agreements (payments, mileage, vehicle condition) | Performance of a contract |
| Administering short-term rental agreements (hire period, returns, deposits) | Performance of a contract |
| Verifying your driving licence, insurance, and identity for rental agreements | Performance of a contract; Legal obligation |
| Responding to enquiries via our contact form, chatbot, phone, or email | Legitimate interest (responding to customer communications) |
| Sending updates related to your enquiry or agreement (e.g. payment reminders, MOT reminders) | Legitimate interest (helping you stay informed about your vehicle) |
| Keeping financial records for tax and accounting purposes (HMRC) | Legal obligation |
| FCA record-keeping for regulated finance applications | Legal obligation |
| Fraud prevention and automated spam filtering on forms | Legitimate interest (protecting our business and customers) |
| Website analytics (Google Analytics 4) | Consent |
| Advertising measurement (Meta Pixel, TikTok Pixel, Google Ads) | Consent |
| Sending marketing communications (email, SMS) | Consent |
Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your rights. You can request details of these assessments by contacting us.
4. Finance Applications
WMA Vehicle Hire and Sales Limited (trading as WMA Motors) is authorised and regulated by the Financial Conduct Authority (FRN 934177) as a credit broker, not a lender. When you apply for vehicle finance through our website or in person:
- Your application is processed by Codeweavers Ltd, our finance platform provider, which submits it to our panel of lenders.
- Our lender panel includes First Response Finance, Blue Motor Finance, Q Finance, Close Brothers, and other lenders. The specific lenders who receive your application will depend on the product and terms you are applying for.
- Lenders may perform credit checks as part of assessing your application. A soft search (quotation search) does not affect your credit score; a full credit check is carried out only if you proceed with an application.
- We may receive a commission or fee from the lender for arranging your finance. This does not affect the price you pay.
- We are required by the FCA to retain records of regulated finance activity for a minimum of six years.
For full details of how Codeweavers processes your data, see the Codeweavers Privacy Policy.
6. International Data Transfers
Some of our third-party service providers are based outside the UK. Where personal data is transferred internationally, we ensure appropriate safeguards are in place:
- Google (US): certified under the UK Extension to the EU-US Data Privacy Framework.
- Meta Platforms (US): certified under the UK Extension to the EU-US Data Privacy Framework.
- Cloudflare (US): certified under the UK Extension to the EU-US Data Privacy Framework.
- TikTok/ByteDance (Singapore): transfers are covered by Standard Contractual Clauses (SCCs) approved by the ICO.
- Resend (US): transfers are covered by Standard Contractual Clauses (SCCs).
- Telnyx (US): transfers are covered by Standard Contractual Clauses (SCCs).
- OpenRouter (US): transfers are covered by Standard Contractual Clauses (SCCs).
- Hetzner (Germany): the UK recognises the EU/EEA as providing adequate data protection. No additional safeguards are required.
7. How Long We Keep Your Data
We retain personal data only for as long as necessary for the purpose it was collected, or as required by law. Our retention periods are:
| Data category | Retention period | Reason |
|---|---|---|
| Vehicle sale records and invoices | 6 years from completion | HMRC requirements; Limitation Act 1980 |
| Finance application records | 6 years from decision | FCA record-keeping (CONC 4.5) |
| Rental and hire agreement records | 6 years from agreement end | Contract; HMRC requirements |
| Enquiry and lead submissions | 6 months (then anonymised) | Legitimate interest; anonymised records retained for reporting |
| Chatbot conversations | 12 months | Legitimate interest |
| Cookie consent records | 12 months | Evidence of valid consent under PECR |
| Analytics data (Google Analytics) | 14 months | GA4 default retention setting |
After the retention period expires, data is securely deleted or anonymised. You can request earlier deletion at any time (subject to legal obligations that require us to retain certain records).
8. Your Rights
Under UK GDPR, you have the following rights:
- Access: request a copy of the personal data we hold about you.
- Rectification: ask us to correct inaccurate or incomplete data.
- Erasure: ask us to delete your personal data (right to be forgotten), subject to legal retention requirements.
- Restriction: ask us to limit how we process your data in certain circumstances.
- Objection: object to processing based on legitimate interest. We will stop unless we can demonstrate compelling legitimate grounds.
- Data portability: receive your data in a structured, machine-readable format where processing is based on consent or contract.
- Withdraw consent: where we process data based on your consent (e.g. analytics cookies, marketing communications), you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
- Not be subject to automated decision-making: we do not make any decisions about you based solely on automated processing.
To exercise any of these rights, contact us at [email protected] or write to us at 70 Glebe Road, Bedlington, Northumberland, NE22 6JU. We will respond within one calendar month of receiving your request.
9. Data Protection Complaints
If you believe we have not handled your personal data correctly, you have the right to complain directly to us. To make a data protection complaint:
- Contact us at [email protected] with details of your concern.
- We will acknowledge your complaint within 30 days.
- We will investigate and provide you with a full response, including any actions taken, within 3 months.
If you remain unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
10. Data Security
We take the security of your personal data seriously. Measures we have in place include:
- Our website is encrypted using HTTPS (TLS) for all data in transit.
- Access to customer records is restricted to authorised staff only.
- Our database is hosted on a dedicated server with access controls and automated encrypted backups.
- We do not store full payment card details. Card payments are processed by our card terminal provider.
- IP addresses submitted with enquiry forms are stored as one-way hashes, not in their original form.
Unfortunately, the transmission of information via the internet is not completely secure. Although we take all reasonable steps to protect your personal data, we cannot guarantee the security of data transmitted to or from us and any such transmission is at your own risk.
12. Children’s Data
Our website and services are not directed at children under 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected such data, we will delete it promptly.
13. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The “last updated” date at the top of this page will be revised accordingly. For significant changes that materially affect how we use your data, we will take reasonable steps to notify you (for example, by placing a prominent notice on our website).
Contact Us
If you have any questions about this privacy policy or how we handle your data, you can reach us at:
Company: WMA Vehicle Hire and Sales Limited, trading as WMA Motors (Company No. 12086881)
Email: [email protected]
Phone: 01670 531777
Address: 70 Glebe Road, Bedlington, Northumberland, NE22 6JU
FCA Registration: FRN 934177 (credit broker)