Legal

Privacy policy

Status: draft, pending legal review. The items marked below are not yet confirmed.

We use your details to answer your enquiry, to arrange and run a lease, and — only if you tick the box — to email you occasionally afterwards. Your enquiry is passed to our leasing partner Motova so they can quote for it, and they pay us a fee if it becomes a booking. Nobody buys your details for their own marketing. No payment or card detail is taken anywhere on this website. You can ask us at any time to show you what we hold, correct it or delete it.

This policy is still being confirmed

Everything below describes what this website and our systems genuinely do today, and it is checkable. What is not settled is the formal detail a solicitor signs off: the registered legal entity, our ICO registration, the exact retention periods and the governing law. Those appear below as marked gaps rather than as numbers we made up. If you need a definitive answer on any of them before you enquire, email [email protected] and ask.

Who is responsible for your data?

Performance & Prestige is the data controller for everything described on this page. The registered legal entity behind the trading name, its company number and its registered office are being confirmed and will be printed here as soon as they are. Owner to confirm

Our registration with the Information Commissioner’s Office is in progress. We are not printing a registration number until it exists. Owner to confirm

For anything about your data, email [email protected] and put “data protection” in the subject line.

What do you collect about me?

Three different moments, and they are worth keeping apart. Sending an enquiry asks very little. Going ahead with a hire asks for a great deal more, because a car cannot be insured for a driver nobody has checked. And a website records some things whoever you are.

When you send an enquiry

Four steps, or five if you are enquiring as a business, with your contact details on the last one. Nothing is sent until you press the button on that final step.

How long you want the car for: The length you typed into the one open field — the form asks how long and takes the answer in your own words rather than a band off a list — plus an ideal start date if you gave one. The start date is optional. The term is what the quote is built on, and every agreement runs on a 3-month minimum term.
The car or category, and the driver’s age band: Which vehicle or which kind of vehicle you are asking about, whether it is one of ours or one we source, a second choice where you named one, and the age band of the main driver. The age band is there to check the insurance minimum for that car before you plan around it, not to profile you.
What you are working to: budget and mileage: A monthly budget band and the mileage you expect, each picked from a list or typed in where the list did not fit. They decide which cars are worth putting in front of you, so an answer built on the wrong one wastes your time as much as ours.
How you would describe your credit: One band, declared by you: good, fair, poor, CCJ or defaults, unsure, or prefer not to say. We run no search at the enquiry stage. Every agreement we write runs on a 3-month minimum term and is underwritten by a funder, so the band tells us which funder to go to first. “Prefer not to say” is a real answer and it costs you nothing.
Your name, email address and mobile number: Step four of the form, and all three are required. We confirm a quote by phone as well as by email, which is why the number is not optional — it is there to answer your enquiry, not to put you on a calling list.
Your town or city: Not your full address. A town is all we need to work out how far the car is coming and what delivery costs, and the exact address is settled on the call once there is something to deliver.
Whether you want marketing email: One checkbox, unticked when the page loads, and not needed to get an answer. Leaving it alone changes nothing about how we handle your enquiry.
If you enquire as a business: The business form adds one step before the contact details: the company name, what the car is for, whether you want an account with us, and your role there. The role is optional. Each one changes who replies and what the first reply has to contain.
How you reached the page you enquired from: The page URL and path, the site that referred you, and any campaign tags or advertising click identifiers that were in the address you arrived on (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid, and the Meta _fbp and _fbc cookie values where they are present on your device). This tells us which pages actually earn enquiries.

You do not have to give us any of it, but we cannot answer an enquiry without a name, an email address and some idea of what you want and when.

When a hire goes ahead

None of this is needed to get a quote. It is the hire application, which comes after we have confirmed a car and a price with you, and it exists because a car cannot be insured for a driver nobody has checked. The criteria it is checking against are on driver requirements.

Who you are: Your full name, date of birth, email address and phone number, and whether you are hiring personally or through a company. Where it is a company hire we also ask for the company name, its number and your role in it.
Where you live: Your address, how long you have lived there, and a previous address where that is under three years. Three years is the standard look-back an insurer applies.
Your driving licence: The licence number, the type of licence, the date you first held it, and the number of penalty points you declare.
A DVLA check code: A free code you generate on gov.uk, valid for 21 days, which lets us see the endorsements and disqualifications recorded against your licence. The section below on criminal offence data is about this. It is the most sensitive thing we ask for.
Three insurance declarations: Motoring convictions in the last five years, accidents or claims in the last five years, and whether insurance has ever been refused, cancelled or had special terms applied. Each is a yes or no, with a detail box that appears only on a yes. These are the questions every motor insurer asks, and a car cannot be insured without them.
Any additional driver: The same licence details for anybody else who will drive, because an unnamed driver is not insured. Nobody can be added at the kerbside.
The hire itself: The car, the dates, and the delivery and collection addresses in full — not just the town this time.
The documents: Driving licence — front, Driving licence — back, Proof of address, Second photo ID. Uploaded as files, up to 5 MB each, as PDF, JPG, JPEG, PNG, HEIC, HEIF. We ask for a second photographic identity document because insurers require one on high-value hire, and it is the one thing that settles identity outright.
Your electronic signature and the boxes you ticked: Your typed name as an electronic signature, with the date and time. We store the exact wording of every statement you agreed to alongside it, so what you signed up to is a matter of record rather than of memory.

What the application does not ask for

Your income, your employer, your bank statements or your credit file. A finance application asks for those because a lender is underwriting you. We are hiring you a car, so the only things the decision turns on are identity, licence validity and insurability, and asking for anything beyond that would be collecting data we have no right to.

What is collected automatically

Hosting and security logs: The site runs on Cloudflare Pages. Cloudflare logs the request — your IP address, your browser and device type, the page requested and the time — to serve the page and to protect it from attack. That happens on every website; it is not something we switch on.
The anti-spam check on the form: The final step of the enquiry form runs Cloudflare Turnstile, which looks at signals from your browser to decide whether you are a person. Your IP address is sent to Cloudflare as part of that check. It runs on the form only, and only on the last step.
Measurement, if you allow it: Nothing measures your visit until you say yes. If you accept analytics or marketing cookies, the tools listed in the cookie table below record how the site is used.

Why do you use it, and what allows you to?

UK data protection law requires a lawful basis for every use of personal data. Ours, purpose by purpose. Where the basis is consent you can withdraw it at any time, and nothing else on this list stops working when you do.

Purpose, the personal data used for it, and the lawful basis relied on
What for	What we use	Lawful basis
Answering your enquiry and quoting a hire	Name, email address, mobile number, the term you want and any start date, the vehicle or category, the driver’s age band, the budget and mileage bands, the credit band you declared, and your town.	Taking steps at your request before entering into a contract, and our legitimate interest in running a hire business.
Sending you the acknowledgement, and telling you what happens next	Name and email address.	The same. This is a service message about an enquiry you sent us, so it does not depend on the marketing box, and unticking that box does not stop it.
Confirming a car we do not own with the supplying partner	The term, the vehicle, the delivery area, the driver’s age band — and your contact details only where the partner needs them to complete the hire.	Taking steps at your request before entering into a contract. We tell you who the partner is before anything is agreed.
Checking a driver against the insurance conditions for a car	Age, date of birth, licence number and history, DVLA check result.	Performing the hire contract, and complying with our legal obligation to hire only to a driver the vehicle is insured for. The endorsements part is criminal offence data and is dealt with separately below.
Preparing, delivering and collecting the car, and handling anything that happens during the hire	Everything on the hire agreement, plus condition photographs at handover and collection.	Performing the hire contract.
Insurance claims, damage, fines, tolls and penalty charges	Your details, the hire record, and what happened.	Performing the contract, our legal obligations, and our legitimate interest in recovering what we are owed. Where a penalty is issued we are legally required to name the driver.
Processing a hire application	Everything on the application form, including the documents and the electronic signature.	Taking steps at your request before entering into a contract, and then performing it. The three insurance declarations are dealt with separately below.
Marketing email	Name, email address, and the segmentation attributes listed in the section on marketing.	Your consent, given by ticking the box, and withdrawable at any time without affecting anything else.
Following up an enquiry that has gone quiet	Name, email address and what you enquired about.	Your consent where you gave it. Otherwise the soft opt-in in regulation 22 of the Privacy and Electronic Communications Regulations, together with our legitimate interest in not leaving an enquiry unanswered. Explained in full under marketing below, and one click stops it.
Measuring the website and our advertising	The cookies in the table below, and the campaign tags stored with your enquiry.	Your consent for the cookies. Nothing non-essential runs before you give it.
Preventing spam, fraud and abuse of the form	IP address and browser signals, through Cloudflare Turnstile.	Our legitimate interest in keeping the form usable, and in not sending confirmation emails to addresses a bot supplied.
Keeping records we are required to keep	Hire agreements, invoices and the correspondence attached to them.	Our legal obligations, including tax record-keeping.

The bases in the right-hand column are our position and are with a solicitor for confirmation. They are not placeholders — they describe how the site is actually built, which is why the acknowledgement email goes out whether or not you tick the marketing box, and why the marketing list is the one thing that genuinely does not.

What happens to my licence, my DVLA check and my passport?

These are the most sensitive things we hold, and they are treated separately from everything else. A DVLA check code shows the endorsements and disqualifications on your licence, which UK law classes as criminal offence data. We ask for it because the insurer sets conditions we cannot verify any other way, we use it for that and nothing else, and it is never used for marketing or shared with anyone who does not need it.

What we do with it

We check it against the conditions for one car. The result we need is whether that driver can be insured on that vehicle. We do not build a driving record, score you, or keep a watch list.
Documents are attached to your hire record. Licence and identity images are uploaded straight into our CRM against the application they belong to. Not an inbox, not a phone, not a shared drive.
Nothing sensitive is ever put in an email. The internal alert that tells us an application has arrived carries a name, a car and a link. No document, no licence number, no DVLA check code, no date of birth, no address and no declaration detail. Email forwards, it sits in inboxes for years, and it cannot be redacted afterwards, so it is the wrong place for any of it.
Access is limited to the people who run hires. Exactly who can open them, and the controls on that, are being written down and will be stated here. Owner to confirm
They are deleted, not archived. The deletion period for licence images, identity documents and DVLA check results, and the routine that carries it out, are being set and will be stated here as a specific period rather than as “no longer than necessary”. Owner to confirm
We do not ask for more than the check needs. We do not ask for medical information, and nothing on our forms asks about health, ethnicity, religion, politics, trade union membership, sex life or sexual orientation.

If you would rather show a document than send one, say so. We would rather check a licence in person at handover than hold a copy of it any longer than we have to.

How long do you keep it?

Only as long as there is a reason to, and then it goes. Four different clocks, because an enquiry that went nowhere and a hire that produced an insurance claim are not the same thing.

Enquiries that did not become a hire: A period is being set and will be stated here. Owner to confirm
Customers and hire records: A period is being set and will be stated here. Some of it is not ours to choose: records that support a tax return have to be kept for as long as HMRC requires, and a record connected to an insurance claim is kept while the claim is live. Owner to confirm
Licence images, identity documents and DVLA checks: The shortest of the four, and it is being set. Owner to confirm
Marketing contacts: Until you unsubscribe, and then we keep the fact that you unsubscribed so we do not email you again by accident. The period after that is being set. Owner to confirm

You do not have to wait for any of those clocks. Ask us to delete your data and we will, unless we are legally required to keep a specific record — in which case we will tell you which one and why.

Who else sees it?

Nobody buys your details for their own marketing, and we never pass them to a list, a broker network or an advertiser. Your enquiry does go to one named leasing partner so they can quote for it, and they pay us a fee if it becomes a booking — that is set out in full below. Beyond them, it reaches four kinds of recipient and no others.

The leasing partner your enquiry goes to

When you send an enquiry, your name, email address and mobile number are passed to Motova, a vehicle leasing company, so that they can contact you and quote. Your enquiry details go with them — the car or category you asked about, the term, the budget band, the mileage you expect, your driver age band, your delivery town and, where you gave one, your credit standing.

They receive it as a controller in their own right, which means they answer to you directly for what they do with it and they must give you their own privacy information. They pay us a fee when an enquiry becomes a booking. We are told this before you send the form, on the form itself.

Our lawful basis is legitimate interests: you asked for a quote on a vehicle, and passing the enquiry to the company that can supply it is how the request is answered. If you would rather we did not, say so in the enquiry or email us and we will handle it without passing it on — though we may not be able to quote.

The transfer is made through AceLeads, a lead-management platform operated by HDCH Limited, which routes the enquiry and holds the record of what was shared and when.

The systems we run on

These process data on our instructions, under contract. This list is the software this site actually calls, not a generic list of everything a company might use.

Cloudflare: Hosts the website (Cloudflare Pages), runs the code that receives your enquiry, and provides the Turnstile anti-spam check on the form.; Processes data in: United States, with a global network. Requests from the UK are normally served from within the UK or the EU.
Airtable: Our CRM. Your enquiry is written here, and this is where a hire record and any documents attached to it are held.; Processes data in: United States.
Brevo: Sends your acknowledgement email and our internal notification, and holds the marketing list where you have opted in.; Processes data in: European Union (France).
Google · only after you consent: Tag Manager and Analytics, and advertising measurement. Loads only under Consent Mode v2 with everything non-essential denied until you accept, and records nothing to your device before then.; Processes data in: United States and the European Union.
Microsoft · only after you consent: Clarity, which records how pages are used so we can see where people get stuck. The tag is not loaded at all unless the analytics flag is already in your consent cookie.; Processes data in: United States and the European Union.

A partner supplying a car we do not own

105 of the 116 cars in our catalogue are badged “we can source”, which means a vetted partner supplies them rather than us. To confirm one of those we have to tell the partner what you want and when. We tell you who they are before anything is agreed, and we pass your contact details only where they are needed to complete the hire. How the fleet and sourced split works.

Insurers, and the people who deal with an incident

If a car is damaged, stolen or involved in an incident, the details go to the insurer and to whoever is handling the recovery or the repair. Where a penalty charge, toll or speeding notice is issued against a vehicle during your hire, we are legally required to tell the issuing authority who was driving.

Professional advisers and the authorities

Our accountant and, where we need one, our solicitor. And the police or another authority where the law requires it or where we need to establish or defend a legal claim.

Does my data leave the UK?

Some of it does. Our CRM and our hosting are provided by companies based in the United States, and our email platform is based in France. That is normal for a business of this size, but you are entitled to know it rather than to find it in a footnote.

UK law allows a transfer outside the UK only where the data stays protected to UK standards — through an adequacy decision covering the destination, or through a contract such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses.

Putting the written processing agreement in place with each provider named above, and recording which safeguard each one relies on, is still outstanding. We would rather say that here than imply it is already done. Owner to confirm

What cookies do you use?

Non-essential cookies stay switched off until you say yes. Nothing is granted by scrolling, by dismissing the notice or by the passage of time. Refusing is one click on the first panel, sitting beside accepting and carrying exactly the same weight, and the granular toggles start switched off with nothing pre-ticked.

Every cookie this website sets: name, who sets it, its group, what it does and how long it lasts
Cookie	Set by	Group	What it does	How long
cookie_consent	First party	Essential	Records the cookie choice you made, so the notice is not shown again and your refusal is not quietly forgotten on the next page.	180 days
Cloudflare Turnstile	Third party (Cloudflare)	Essential	Runs the bot check on the last step of the enquiry form. Set only when you reach that step.	Session or short-lived, set by Cloudflare
_ga, _ga_*	First party, set by Google Analytics	Analytics	Google Analytics. Distinguishes visitors so we can count them and see which pages help. Set only after you accept analytics.	Up to 2 years, set by Google
_clck, _clsk	First party, set by Microsoft Clarity	Analytics	Microsoft Clarity. Links page views into one session so we can see where a journey breaks down. The tag is not loaded at all without your consent.	Up to 1 year, set by Microsoft
_fbp, _fbc	First party, set by Meta advertising tags	Marketing	Advertising measurement. Where these are present on your device the enquiry form reads them and stores them with your enquiry, so we can tell which advertising produced it.	Up to 90 days, set by Meta

Durations on the third-party cookies are the provider’s own defaults. We do not control them and they can change, so treat them as the provider’s figure rather than ours. Your cookie choice itself is stored in a first-party cookie, which is why a refusal is remembered and you are not asked again on the next page.

Two things stored in your browser that are not cookies

The rules that cover cookies cover anything stored on your device, so these belong here even though neither is a cookie and neither is shared with anybody.

Your saved cars. When you save a car, your browser stores the web address of that car and nothing else. No price, no personal detail, and it never leaves your device. It stays until you clear it or clear your browser data.
A part-filled form. If you start an enquiry or an application and do not finish, your answers are kept in the tab so you do not lose them when you look something up. They die when you close the tab. Uploaded documents are never stored in the browser at all.

Both exist only to do the thing you just asked the page to do, which is why neither waits on the cookie notice.

Change your cookie choices

Withdrawing consent is as easy as giving it. This opens the same panel you saw when you arrived, with your current choice already reflected. Turning something off also clears the cookies it had already set.

Will you email me?

We will send you one acknowledgement when you enquire, and then whatever the conversation needs. That is a service message about something you asked us for, and it is not marketing.

Beyond that, only if you ticked the box. The box is unticked when the page loads, it is not needed to get an answer, and leaving it alone costs you nothing.

Two things are worth keeping apart here, because they are not the same. A contact record is created for you at Brevo whichever way you leave that box, because that is where your acknowledgement is sent from, and it carries a short set of attributes so that a later message cannot be irrelevant: your first and last name, whether you ticked the box, whether the car you asked about is one of ours, the term you wanted, the category and the vehicle, the driver age band, your town, and — on a business enquiry — the company name, your role and what the car is for. What the tick decides is the marketing list. Only a ticked box puts you on it.

If your enquiry goes quiet

The step after an enquiry is the hire application, and if it has not been done our system sends up to three emails about that enquiry and then stops for good: one about four hours after you sent it, a second two days later, and a last one five days after the enquiry. All three are about the car you asked us for, they are sent between 8am and 8pm, and the third says in its opening line that it is the last.

Any one of these stops the sequence where it stands: completing the hire application, which is the thing the emails are asking for; unsubscribing; the third having already gone; the enquiry moving out of the live part of our pipeline, whether that is closed, not proceeding or already out on hire; or our having no permission to email you. Completing the application or unsubscribing stops it against every enquiry we hold for your address, not just the one that set it off.

You get them either because you ticked the marketing box, or because you asked us about leasing a specific car and they are about that same enquiry. The second route is the soft opt-in in regulation 22 of the Privacy and Electronic Communications Regulations, which allows a message about our own similar service to somebody who was in the middle of negotiating one with us. Every one of them carries a one-click unsubscribe, in the message and in the mail headers, and none of them markets anything except the car you already asked about.

If you would rather none of them happened, one click on the unsubscribe in the first stops the rest, and emailing us at any point — including before the first one is due — switches the whole sequence off.

Stopping it

Every marketing email carries a one-click unsubscribe that works immediately, in the message and in the mail headers, so your email client can do it for you. One click switches you off everywhere: your consent is turned off on every record we hold for that address and you are suppressed at our email provider too. A half-applied unsubscribe is worse than none, because it looks handled.

The unsubscribe link never carries your email address. It carries an opaque record reference and a signature, because unsubscribe links end up in server logs and mail-scanner reports, and an address in a web address is a quiet leak. Unsubscribing deletes nothing else: your enquiry, your quote and your booking are untouched.

You can also just reply and ask, or email [email protected]. Opting out of marketing does not stop us replying about a hire.

How is it protected?

The site is served over HTTPS, so what you type into the form is encrypted in transit. The enquiry goes straight from the form into our CRM rather than sitting in a mailbox as the only copy. Access to the CRM is restricted to the people who run hires. Card details are never entered on this website, so there are none here to protect.

No transfer over the internet is ever completely secure, and anyone who tells you otherwise is selling something. If something does go wrong and it is likely to put your rights at risk, we will tell you, and we will report it to the Information Commissioner’s Office where the law requires it.

What are my rights, and who do I ask?

UK data protection law gives you rights over your personal data. They apply now, whether or not this policy is finalised, and using one costs nothing.

See it. Ask for a copy of what we hold about you.
Correct it. Have anything wrong put right, or anything incomplete completed.
Delete it. Have it erased, where we have no overriding reason to keep it.
Restrict it. Have us pause using it while something is in dispute.
Object to it. Object to processing we do on the basis of our legitimate interests, and to direct marketing at any time, which is an absolute right.
Take it with you. Have the data you gave us sent to you, or to somebody else, in a machine-readable form.
Withdraw consent. Untick what you ticked, without affecting anything we did before you withdrew it.

Email [email protected] and say what you would like us to do. We will respond within one month, which is the period the law allows us. We may ask you to confirm who you are first, because handing your data to somebody claiming to be you would be the worse outcome.

If you are not happy with how we handle it

Tell us first if you can — it is usually quicker. But you have the right to complain to the UK data protection regulator at any point, and you do not need our permission or our involvement to do it.

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Helpline 0303 123 1113

Make a complaint at ico.org.uk

Anything else?

Children

This is a service for adults. Every car we hire carries a minimum driver age well above 18, and we do not knowingly collect data from children.

Automated decisions

We do not make decisions about you by machine. A person reads every enquiry and a person decides every hire, including every decision about whether a driver meets the criteria for a car.

Changes to this policy

We update this policy when what we do changes, and the date at the top changes with it. This version is a draft pending legal review; the approved version will carry a real publication date rather than a build date.

The other documents

Website terms
Using this website
Lease terms
The terms of the lease itself
Complaints
How to raise something with us
Change what we may use, at any time

Tell us the car and how long. We’ll confirm the figure.

The car you want, roughly how long, and the town you are in — that is all we need to start. Someone here comes back with the monthly figure and the whole cost, initial payment, deposit, excess and mileage included.

Enquire now

A person confirms every booking · No payment taken online · Delivery or collection, your choice