GDPR & Data Protection Policy

1. Scope

This policy explains how ShowCar applies UK data-protection principles to the personal data handled by the ShowCar website. It covers account holders, visitors, people scanning QR/NFC tags, people making enquiries or reports, advertisers/event providers and administrators.

2. Data-protection principles

ShowCar aims to process personal data in line with the UK GDPR and Data Protection Act 2018 principles: lawfully, fairly and transparently; for specified purposes; using no more data than is needed; keeping information accurate where practical; retaining it no longer than necessary; and protecting it with appropriate security controls.

3. Controller and contact

ShowCar is the controller for personal data processed through this service. Data-protection enquiries and rights requests should be sent to info@showcar.uk.

4. Data processed by the service

The current service processes account/contact details, declared location, car/profile content and images, community activity, QR/NFC scan records, points/referrals, login/security records, consent records, optional analytics, ad impression/click statistics, sponsor/advertising enquiries, profile reports, admin audit records and email-delivery information. Full detail is set out in the Privacy Notice.

5. Lawful bases

• Contract/service delivery: where processing is needed to create an account and provide the features requested by the user.
• Legitimate interests: for service operation, security, abuse prevention, moderation, support, contextual advertising and basic business administration, where those interests are not overridden by individual rights.
• Consent: for optional analytics and optional direct marketing, and for non-essential identifiers used for optional measurement/personalisation where applicable.
• Legal obligation: where records or disclosure are required by applicable law.

6. Privacy by design and minimisation

ShowCar avoids requesting precise GPS for the signup-location map, does not use browser fingerprinting for analytics/advertising, and uses coarse browser/device categories. IP addresses used for security/audit purposes are generally stored as one-way hashes rather than plain IP addresses. Passwords are stored as password hashes.

Optional analytics does not start unless analytics consent has been recorded. Optional visitor identifiers for advertising measurement are only recorded where advertising consent is present.

7. Security measures

Current application controls include password hashing, CSRF protection, page-level anti-bot checks, login rate limiting, escalating temporary account lockouts, one-use password-reset tokens, email verification, secure/HTTP-only remembered-login cookies, role-based admin access, administrator audit logging and authenticated SMTP for site emails.

No internet service can guarantee absolute security. Suspected security incidents should be reported promptly to info@showcar.uk.

8. Access and administration

Administrative access is limited by application roles. Administrators can access data needed for support, moderation, analytics, advertising, events, reporting, user administration and security. Administrative actions can be written to an audit log together with a hashed IP value.

9. Data-subject rights

Where applicable, individuals can request access, correction, erasure, restriction, portability or objection, and can withdraw consent at any time without affecting processing that was lawful before withdrawal. Requests can be made to info@showcar.uk.

Users can also edit many details directly, manage cookie choices, change marketing/notification settings and initiate permanent account deletion from within ShowCar.

10. Account deletion and erasure

The self-delete and administrator-delete processes are designed to remove the account, user-owned cars, images and linked live-service records. The deletion code also removes or clears many user references in security, analytics, consent, advertising, report, event and audit tables. Physical uploaded files associated with the account/cars are removed from the uploads area where file permissions allow.

Deletion may not remove information that must lawfully be retained, information that has been independently supplied by another person, or anonymous records that can no longer be linked to the deleted user.

11. Retention

Short-lived security credentials have defined expiry periods, including 30-minute password-reset tokens, 24-hour verification links and up to 90-day remembered-login tokens. Other operational data is retained only while required for the service, security, moderation, reporting, dispute handling or legal requirements. The current code does not impose one universal automatic expiry period on every operational table.

12. Data breaches

If ShowCar becomes aware of a personal-data breach, it will assess the nature, scope and likely risk, take reasonable containment/remediation steps and make any notification to the ICO or affected individuals required by applicable law.

13. Processors and international processing

ShowCar uses external infrastructure such as hosting and SMTP email services. Public profile content is intentionally accessible internationally. Where a service provider processes personal data outside the UK in circumstances requiring safeguards, an appropriate lawful transfer mechanism should be used.

14. Marketing and cookies

Optional marketing and electronic communications are governed by the Marketing & Communications Policy. Cookies and similar storage are described in the Cookie Notice. Users can change optional cookie choices at any time in Cookie Settings.

15. Complaints

Please contact us first at info@showcar.uk so we can investigate. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.