Privacy notice

1. Who we are

ShowCar ("ShowCar", "we", "us") operates the ShowCar website and is responsible for the personal data processed through the service. For privacy or data-protection questions, contact info@showcar.uk.

This notice describes the data handling built into the current ShowCar website. It should be read with our GDPR & Data Protection Policy, Cookie Notice and Marketing & Communications Policy.

2. Information we collect

Account and contact information

When you create or manage an account, ShowCar can store your full name, email address, country, city/town, region, account preferences, password hash, login timestamps, account status, role, points, referral information, and the date and version of the Terms & Conditions accepted at signup.

Car and public-profile information

Information you choose to add to a car profile can include profile name, make, model, variant, year, photographs, profile/background images, descriptions, build-diary entries, social-media links, sponsors, sponsorship opportunities, event attendance and public profile appearance/visibility settings. Information on a published public profile can be viewed worldwide.

Community activity

We process likes, saved profiles, points activity, referrals, QR/NFC tags and scans, event attendance, account-sharing invitations/memberships and other actions needed to operate ShowCar features.

Location information

ShowCar stores the country and city/town you select, together with the region and city-centre latitude/longitude supplied by the location catalogue for aggregated administration reporting. ShowCar does not ask the browser or phone for precise GPS location for the signup map.

For QR/NFC scans and advertising statistics, the server may also receive broad network/location values made available by the hosting/network layer, such as country, region or city. If these are unavailable, limited account location information may be used. This is not device GPS tracking.

Security and sign-in information

To protect accounts, ShowCar records login attempts using hashed email/IP values, account identifiers where available, browser family, device type, failed-login counts, lockout information and password-reset/security events. The anti-bot controls also use session/form timing and hidden form checks. Passwords are stored as password hashes, not readable passwords.

If you select "Remember me", ShowCar stores a secure one-time rotating login token for up to 90 days and a coarse device hash based on browser, operating system and device class. Signing out, a password reset, certain security locks or a later password login on another device can revoke the remembered login.

Analytics information

Optional usage analytics only run when analytics consent is enabled. ShowCar then records a 30-day first-party analytics identifier and coarse information such as browser family, operating system, device class, language, timezone, screen-size group, page path, event type and referring host. Public profile views and outgoing social/sponsor link clicks are also measured only when analytics consent is present.

The Google tag uses Consent Mode with analytics and advertising storage denied by default. Google Analytics page-view measurement and analytics cookies are enabled only after analytics consent. Google may then receive ordinary browser/device and request information. ShowCar does not intentionally send account names or email addresses to Google Analytics through this tag.

Advertising information

ShowCar displays advertising to help fund the service. Ad selection can use the car make/model being viewed and broad country/region information. Signed-in user ID may be recorded with ad impressions/clicks. A visitor identifier is only stored for advertising measurement where advertising consent is enabled. ShowCar does not use browser fingerprinting or precise GPS for advertising.

Messages, enquiries and reports

If you contact ShowCar, submit an advertising enquiry, send a sponsorship enquiry or report a profile, we process the details you provide so the request can be handled. A profile report requires full name, email, telephone number, contact address, reason and a detailed explanation. Reports are private and are sent to ShowCar administrators rather than displayed to the profile owner.

3. Why we use your information

Purpose	Typical lawful basis
Create and run accounts, profiles, QR/NFC tags, likes, saves, events, points and requested features.	Performance of our service/contract and legitimate interests in operating ShowCar.
Secure accounts, prevent abuse, investigate failures and maintain audit records.	Legitimate interests in security, fraud/abuse prevention and service integrity; legal obligation where applicable.
Send verification, password-reset, security, account, points, like, sponsorship and other service notifications.	Performance of the service and legitimate interests. Security/account messages may be sent even where optional marketing is off.
Send optional ShowCar news, event recommendations or advertiser offers.	Consent, where required by UK GDPR/PECR.
Coarse usage analytics and consent-controlled visitor measurement.	Consent.
Show relevant advertising using declared vehicle/broad location context.	Legitimate interests in funding and operating the free service; consent is used for non-essential visitor identifiers used for measurement.
Respond to contact messages, advertising leads, sponsorship enquiries and profile reports.	Legitimate interests and, where relevant, steps requested by you.

Where we rely on legitimate interests, those interests include operating and funding the service, protecting users and systems, measuring basic service performance and handling requests/complaints. You can object where the law gives you that right.

4. Public information and sharing

Published car profiles are intentionally public and may be accessed, shared or indexed from anywhere in the world. Only publish information you are comfortable making public.

We may share or make data available to:

• ShowCar administrators, where access is needed to operate, moderate, secure or support the service.
• IONOS and technical hosting/email infrastructure, where necessary to host the site, database and deliver SMTP email.
• OpenStreetMap tile services when an authorised administrator opens the signup-location map. The map provider receives ordinary connection information from the administrator's browser; ShowCar does not send user names or email addresses to the map tile service.
• Google Analytics, using Consent Mode with storage denied by default and measurement enabled after analytics consent, to measure page popularity and general website usage.
• External websites you choose to open, such as social networks, sponsor sites, ticket providers or advertiser destinations. Those services receive the normal connection/request information generated by your browser and operate under their own privacy terms.
• Authorities or professional advisers where disclosure is required by law or reasonably necessary to protect legal rights, users or the service.

ShowCar does not sell personal data.

5. International access and transfers

Because public profiles are available on the internet, public profile content can be viewed internationally. Our hosting and service providers may also process information in the countries where they lawfully operate. Where data-protection law requires safeguards for an international transfer, we will use an appropriate lawful mechanism.

6. How long we keep information

The current system automatically expires some items: password-reset links expire after 30 minutes, email-verification links after 24 hours, remembered-login tokens after up to 90 days, the optional analytics cookie after 30 days, the referral cookie after 30 days and the consent cookie after one year.

Account/profile data is retained while the account is active. The account-deletion process removes the user account, cars, uploaded images and a wide range of linked records from the live ShowCar service. Some anonymous or non-user-linked operational records may not be capable of being tied back to a deleted account.

The current application does not apply one fixed automatic expiry period to every operational record, such as all security logs, moderation reports or admin audit data. These records are kept only while reasonably needed for the purpose for which they were collected, security, dispute handling or legal obligations, and may be removed through account deletion or administrative maintenance.

7. Your choices and rights

Depending on the circumstances, UK data-protection law may give you rights to:

• ask for access to your personal data;
• correct inaccurate or incomplete information;
• ask for deletion of your data;
• restrict or object to certain processing;
• receive certain data in a portable format;
• withdraw consent at any time where processing relies on consent; and
• complain to the UK Information Commissioner's Office (ICO).

You can update many account/profile details directly in ShowCar, change cookie choices through Cookie Settings, change email/marketing choices through Marketing & Notifications, and permanently delete your account from the account area.

For a data-rights request, contact info@showcar.uk. We may need to verify your identity before acting on a request.

8. Children and sensitive information

The current ShowCar registration form does not ask for date of birth. Please do not submit unnecessary special-category or highly sensitive personal information in free-text fields, profile content, reports or enquiries. If you believe a child's personal data has been provided inappropriately, contact us.

9. Automated security decisions

ShowCar automatically applies temporary sign-in rate limits and account lockouts after repeated failed login attempts. These are security controls and are not used to make decisions producing legal or similarly significant effects about you. ShowCar does not use solely automated profiling to make such decisions.

10. Changes to this notice

We may update this notice when ShowCar features or data handling change. The date at the top shows the current version.