Privacy Policy

1. Who We Are

AutoFreight Global Logistics Ltd ("AutoFreight", "we", "us", "our") is a company registered in England and Wales. Our registered office is at 5 Brayford Square, London, E1 0SG, United Kingdom.

We are the data controller for personal data processed through our website at autofreightglobal.co.uk and our vehicle shipping platform. For questions about how we handle your data, contact our Data Protection Officer at info@autofreightglobal.co.uk.

2. Personal Data We Collect

We collect personal data in the following categories:

2.1 Account & Identity Data

• Full name, email address, and password (hashed)
• Phone number
• Business name (where applicable)

2.2 Vehicle & Shipping Data

• Vehicle registration number
• Vehicle details retrieved from the DVLA (make, model, year, colour, engine size, fuel type)
• Vehicle location postcode and GPS coordinates (used for port matching)
• VIN (Vehicle Identification Number), where provided
• Destination port and country

2.3 Consignee & Delivery Data

• Consignee full name, address, city, postcode, and country
• This information is used to generate customs and delivery documentation

2.4 Payment Data

• Payment is processed by Stripe. We do not store card numbers or CVV codes on our servers.
• We retain transaction references, amounts, and payment status for accounting and legal purposes.

2.5 Technical & Usage Data

• IP address, browser type, operating system
• Pages visited, time on site, referring URLs
• Cookie identifiers (see Section 9)

2.6 Communications Data

• Messages sent via our contact form
• Email correspondence with our team

3. How We Use Your Personal Data

We use your personal data to:

• Create and manage your account
• Retrieve vehicle details from the DVLA on your behalf
• Generate shipping quotes and booking confirmations
• Produce customs documentation, delivery notes, and bills of lading
• Process payments securely via Stripe
• Provide real-time shipment tracking and status updates
• Respond to customer support enquiries
• Send transactional emails (booking confirmations, invoice receipts, tracking updates)
• Comply with UK export regulations, customs requirements, and anti-money-laundering obligations
• Detect and prevent fraud and unauthorised access
• Improve our platform through anonymised analytics

4. Legal Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

Purpose	Legal Basis
Fulfilling your shipping booking	Performance of a contract (Art. 6(1)(b))
Processing payment	Performance of a contract (Art. 6(1)(b))
Generating customs documentation	Legal obligation (Art. 6(1)(c))
Fraud prevention and security	Legitimate interests (Art. 6(1)(f))
Marketing emails (with consent)	Consent (Art. 6(1)(a))
Platform analytics (anonymised)	Legitimate interests (Art. 6(1)(f))

5. Sharing Your Personal Data

We share your data only where necessary with trusted third parties:

• Shipping lines and port agents — to arrange vessel booking and port handling at UK and destination ports
• Customs brokers and in-country agents — to prepare import documentation and facilitate clearance at African destination ports
• Stripe Inc. — our payment processor. Stripe's privacy policy: stripe.com/gb/privacy
• DVLA — we send your vehicle registration number to the DVLA API to retrieve vehicle data on your behalf
• Cloud infrastructure providers — our platform is hosted on secure cloud infrastructure. Providers are bound by data processing agreements
• Professional advisors — solicitors, accountants, and insurers where legally required
• Law enforcement or regulators — where required by UK law, court order, or regulatory obligation (e.g., HMRC, UK Border Force)

We do not sell your personal data to third parties.

6. International Data Transfers

To deliver shipments to African destinations, we share relevant consignee and vehicle data with our in-country partner agents. These transfers are made under appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the UK ICO
• Data processing agreements with each partner agent

Payment data is processed by Stripe, which maintains EU-US and UK-US data transfer frameworks.

7. Data Retention

We retain your personal data for the following periods:

• Account data — for the duration of your account plus 7 years after closure (for legal and accounting purposes)
• Shipping and customs records — 7 years (required by HMRC and UK export law)
• Payment records — 7 years (Companies Act / HMRC)
• Contact form enquiries — 2 years from last contact
• Marketing consent records — 3 years from last interaction

After retention periods expire, data is securely deleted or anonymised.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you (Subject Access Request)
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your data where there is no legitimate reason to continue processing it
• Right to restrict processing — request that we limit how we use your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Rights in relation to automated decision-making — we do not use solely automated decision-making that produces legal or significant effects

To exercise any of these rights, email us at info@autofreightglobal.co.uk with the subject line "Data Rights Request". We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk — Tel: 0303 123 1113.

9. Cookies

We use cookies and similar tracking technologies on our website. For full details of the cookies we use, their purpose, and how to manage them, please see our Cookie Policy.

10. Security

We implement appropriate technical and organisational security measures to protect your data, including:

• TLS/SSL encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Bcrypt hashing for passwords
• Role-based access controls limiting staff access to data on a need-to-know basis
• Regular security audits and vulnerability assessments

In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you and the ICO within 72 hours of becoming aware.

11. Children's Privacy

Our services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify registered users of material changes via email or a prominent notice on our platform. The "Last updated" date at the top of this page indicates when it was last revised. Continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact Us

For any questions, concerns, or requests related to this Privacy Policy or your personal data: