Privacy policy
Last updated: 9 August 2026
This policy explains what personal data Carluvo Ltd collects, why we collect it, how long we keep it and what rights you have under the UK GDPR and Data Protection Act 2018.
Draft for review. This document is a working draft prepared during site build. It should be reviewed by a solicitor and checked against current ICO and FCA guidance before the site goes live.
Who we are
Carluvo Ltd (“we”, “us”) is the data controller for the personal data described in this policy. We are registered in England & Wales, company number 00000000, at Unit 4, Riverside Trade Park, London, SE10 0AA. You can reach us at [email protected] or 020 4577 0000.
What data we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Name, phone number, email address | To reply to your enquiry, arrange a viewing, or contact you when we find a car matching your request | Legitimate interests / steps prior to a contract |
| Your car requirements (make, model, budget, preferences) | To search for and offer you suitable vehicles | Legitimate interests |
| Part exchange details (registration, mileage, condition) | To produce a valuation for your vehicle | Steps prior to a contract |
| Chat transcripts with Luvo, our AI assistant | To answer your questions and pass your requirements to our buying team | Legitimate interests |
| Anonymous usage analytics (pages viewed, device type, referrer) | To understand how the site is used and improve it | Consent |
Analytics and cookies
We use our own first-party analytics rather than a third-party advertising tracker. Analytics only run after you accept them in the cookie banner. We record the pages visited, an anonymous randomly generated session identifier, the referring site, UTM campaign tags where present, and a broad device category (mobile, tablet or desktop).
We do not store your IP address, we do not attempt to identify individual visitors, and we do not share analytics data with advertising networks. Full details of every cookie and browser storage item are in our cookie policy.
Luvo, our AI assistant
Luvo is powered by a large language model provided by Anthropic. When you chat with Luvo, the messages you send are transmitted to Anthropic's API in order to generate a response. Please do not share payment card details, passwords or other sensitive information in the chat. Transcripts are stored on our systems so our team can follow up on your enquiry, and are deleted on the same schedule as other enquiry data.
Who we share data with
We share personal data only where necessary, with:
- Anthropic — processes chat messages to generate Luvo's replies.
- Meta Platforms — delivers WhatsApp notifications of your enquiry to our sales team.
- Resend — delivers email notifications of your enquiry to our sales team.
- Finance providers — only if you ask us to introduce you, and only with your agreement at the time.
- HPI and vehicle data providers — to check vehicle history. This concerns the vehicle rather than you.
We never sell your personal data, and we do not share it for third-party marketing.
How long we keep it
- Enquiries that don't lead to a purchase: 24 months, then deleted.
- Purchase records: 6 years, as required for tax, warranty and consumer-rights purposes.
- Chat transcripts: 24 months.
- Analytics events: 26 months, in anonymous form throughout.
Your rights
Under UK data protection law you have the right to:
- access a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased (the “right to be forgotten”);
- restrict or object to how we process your data;
- receive your data in a portable format;
- withdraw consent at any time, where processing is based on consent.
To exercise any of these, email [email protected]. We will respond within one month. You can withdraw analytics consent at any time by clearing your browser storage for this site, which resets the cookie banner.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security and changes
Data is stored on access-controlled servers within the UK or EEA, transmitted over encrypted connections, and accessible only to staff who need it. We may update this policy as our services change; the “last updated” date at the top shows when it last changed.