Legal
Privacy policy
Status: draft, pending legal review. The items marked below are not yet confirmed.
We use your details to answer your enquiry, to arrange and run a hire, and — only if you tick the box — to email you occasionally afterwards. We do not sell your data. No payment or card detail is taken anywhere on this website. You can ask us at any time to show you what we hold, correct it or delete it.
This policy is still being confirmed
Everything below describes what this website and our systems genuinely do today, and it is checkable. What is not settled is the formal detail a solicitor signs off: the registered legal entity, our ICO registration, the exact retention periods and the governing law. Those appear below as marked gaps rather than as numbers we made up. If you need a definitive answer on any of them before you enquire, email [email protected] and ask.
Who is responsible for your data?
Performance & Prestige is the data controller for everything described on this page. The registered legal entity behind the trading name, its company number and its registered office are being confirmed before launch and will be printed here. Owner to confirm
Our registration with the Information Commissioner’s Office is being completed before launch. We are not printing a registration number until it exists. Owner to confirm
For anything about your data, email [email protected] and put “data protection” in the subject line.
What do you collect about me?
Three different moments, and they are worth keeping apart. Sending an enquiry asks very little. Going ahead with a hire asks for a great deal more, because a car cannot be insured for a driver nobody has checked. And a website records some things whoever you are.
When you send an enquiry
Six things, across four steps, with contact details last. Nothing is sent until you press the button on the final step.
- Your name, email address and phone number
- Step four of the form. The name and email are required, because we cannot answer an enquiry we cannot reply to. The phone number is optional.
- Your dates
- The chip you tapped — this weekend, next weekend, a month or more — and the exact from and to dates where you picked them. We work out the number of days from those two dates.
- The car or category, and the driver’s age band
- Which vehicle or which kind of vehicle you are asking about, whether it is one of ours or one we source, and the driver’s age band. The age band is there to check the insurance minimum for that car before you plan around it, not to profile you.
- A delivery postcode, and anything you tell us about the address
- The postcode you want the car brought to, plus any note you add — a gate code, a hotel, a terminal, a time that suits. Whatever you type in that box is what we hold.
- Whether you want marketing email
- One checkbox, unticked when the page loads, and not needed to get an answer. Leaving it alone changes nothing about how we handle your enquiry.
- How you reached the page you enquired from
- The page URL and path, the site that referred you, and any campaign tags or advertising click identifiers that were in the address you arrived on (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid, and the Meta _fbp and _fbc cookie values where they are present on your device). This tells us which pages actually earn enquiries.
You do not have to give us any of it, but we cannot answer an enquiry without a name, an email address and some idea of what you want and when.
When a hire goes ahead
None of this is needed to get a quote. It is the hire application, which comes after we have confirmed a car and a price with you, and it exists because a car cannot be insured for a driver nobody has checked. The criteria it is checking against are on driver requirements.
- Who you are
- Your full name, date of birth, email address and phone number, and whether you are hiring personally or through a company. Where it is a company hire we also ask for the company name, its number and your role in it.
- Where you live
- Your address, how long you have lived there, and a previous address where that is under three years. Three years is the standard look-back an insurer applies.
- Your driving licence
- The licence number, the type of licence, the date you first held it, and the number of penalty points you declare.
- A DVLA check code
- A free code you generate on gov.uk, valid for 21 days, which lets us see the endorsements and disqualifications recorded against your licence. The section below on criminal offence data is about this. It is the most sensitive thing we ask for.
- Three insurance declarations
- Motoring convictions in the last five years, accidents or claims in the last five years, and whether insurance has ever been refused, cancelled or had special terms applied. Each is a yes or no, with a detail box that appears only on a yes. These are the questions every motor insurer asks, and a car cannot be insured without them.
- Any additional driver
- The same licence details for anybody else who will drive, because an unnamed driver is not insured. Nobody can be added at the kerbside.
- The hire itself
- The car, the dates, and the delivery and collection addresses in full — not just the postcode this time.
- The documents
- Driving licence — front, Driving licence — back, Proof of address, Second photo ID. Uploaded as files, up to 5 MB each, as PDF, JPG, JPEG, PNG, HEIC, HEIF. We ask for a second photographic identity document because insurers require one on high-value hire, and it is the one thing that settles identity outright.
- Your electronic signature and the boxes you ticked
- Your typed name as an electronic signature, with the date and time. We store the exact wording of every statement you agreed to alongside it, so what you signed up to is a matter of record rather than of memory.
What the application does not ask for
Your income, your employer, your bank statements or your credit file. A finance application asks for those because a lender is underwriting you. We are hiring you a car, so the only things the decision turns on are identity, licence validity and insurability, and asking for anything beyond that would be collecting data we have no right to.
There is also no credit check. Nothing we do leaves a mark on your credit file.
What is collected automatically
- Hosting and security logs
- The site runs on Cloudflare Pages. Cloudflare logs the request — your IP address, your browser and device type, the page requested and the time — to serve the page and to protect it from attack. That happens on every website; it is not something we switch on.
- The anti-spam check on the form
- The final step of the enquiry form runs Cloudflare Turnstile, which looks at signals from your browser to decide whether you are a person. Your IP address is sent to Cloudflare as part of that check. It runs on the form only, and only on the last step.
- Measurement, if you allow it
- Nothing measures your visit until you say yes. If you accept analytics or marketing cookies, the tools listed in the cookie table below record how the site is used.
Why do you use it, and what allows you to?
UK data protection law requires a lawful basis for every use of personal data. Ours, purpose by purpose. Where the basis is consent you can withdraw it at any time, and nothing else on this list stops working when you do.
| What for | What we use | Lawful basis |
|---|---|---|
| Answering your enquiry and quoting a hire | Name, contact details, dates, vehicle, age band, delivery postcode. | Taking steps at your request before entering into a contract, and our legitimate interest in running a hire business. |
| Sending you the acknowledgement, and telling you what happens next | Name and email address. | The same. This is a service message about an enquiry you sent us, so it does not depend on the marketing box, and unticking that box does not stop it. |
| Confirming a car we do not own with the supplying partner | The dates, the vehicle, the delivery area, the driver’s age band — and your contact details only where the partner needs them to complete the hire. | Taking steps at your request before entering into a contract. We tell you who the partner is before anything is agreed. |
| Checking a driver against the insurance conditions for a car | Age, date of birth, licence number and history, DVLA check result. | Performing the hire contract, and complying with our legal obligation to hire only to a driver the vehicle is insured for. The endorsements part is criminal offence data and is dealt with separately below. |
| Preparing, delivering and collecting the car, and handling anything that happens during the hire | Everything on the hire agreement, plus condition photographs at handover and collection. | Performing the hire contract. |
| Insurance claims, damage, fines, tolls and penalty charges | Your details, the hire record, and what happened. | Performing the contract, our legal obligations, and our legitimate interest in recovering what we are owed. Where a penalty is issued we are legally required to name the driver. |
| Processing a hire application | Everything on the application form, including the documents and the electronic signature. | Taking steps at your request before entering into a contract, and then performing it. The three insurance declarations are dealt with separately below. |
| Marketing email | Name, email address, and the segmentation attributes listed in the section on marketing. | Your consent, given by ticking the box, and withdrawable at any time without affecting anything else. |
| One follow-up when an enquiry goes unanswered | Name, email address and what you enquired about. | Your consent where you gave it. Otherwise the soft opt-in in regulation 22 of the Privacy and Electronic Communications Regulations, together with our legitimate interest in not leaving an enquiry unanswered. Explained in full under marketing below, and one click stops it. |
| Measuring the website and our advertising | The cookies in the table below, and the campaign tags stored with your enquiry. | Your consent for the cookies. Nothing non-essential runs before you give it. |
| Preventing spam, fraud and abuse of the form | IP address and browser signals, through Cloudflare Turnstile. | Our legitimate interest in keeping the form usable, and in not sending confirmation emails to addresses a bot supplied. |
| Keeping records we are required to keep | Hire agreements, invoices and the correspondence attached to them. | Our legal obligations, including tax record-keeping. |
The bases in the right-hand column are our position and are with a solicitor for confirmation. They are not placeholders — they describe how the site is actually built, which is why the acknowledgement email goes out whether or not you tick the marketing box, and why the marketing list is the one thing that genuinely does not.
What happens to my licence, my DVLA check and my passport?
These are the most sensitive things we hold, and they are treated separately from everything else. A DVLA check code shows the endorsements and disqualifications on your licence, which UK law classes as criminal offence data. We ask for it because the insurer sets conditions we cannot verify any other way, we use it for that and nothing else, and it is never used for marketing or shared with anyone who does not need it.
What we do with it
- We check it against the conditions for one car. The result we need is whether that driver can be insured on that vehicle. We do not build a driving record, score you, or keep a watch list.
- Documents are attached to your hire record. Licence and identity images are uploaded straight into our CRM against the application they belong to. Not an inbox, not a phone, not a shared drive.
- Nothing sensitive is ever put in an email. The internal alert that tells us an application has arrived carries a name, a car and a link. No document, no licence number, no DVLA check code, no date of birth, no address and no declaration detail. Email forwards, it sits in inboxes for years, and it cannot be redacted afterwards, so it is the wrong place for any of it.
- Access is limited to the people who run hires. Exactly who can open them, and the controls on that, are being written down before launch and will be stated here. Owner to confirm
- They are deleted, not archived. The deletion period for licence images, identity documents and DVLA check results, and the routine that carries it out, are being set before launch and will be stated here as a specific period rather than as “no longer than necessary”. Owner to confirm
- We do not ask for more than the check needs. We do not ask for medical information, and nothing on our forms asks about health, ethnicity, religion, politics, trade union membership, sex life or sexual orientation.
If you would rather show a document than send one, say so. We would rather check a licence in person at handover than hold a copy of it any longer than we have to.
How long do you keep it?
Only as long as there is a reason to, and then it goes. Four different clocks, because an enquiry that went nowhere and a hire that produced an insurance claim are not the same thing.
- Enquiries that did not become a hire
- A period is being set before launch and will be stated here. Owner to confirm
- Customers and hire records
- A period is being set before launch and will be stated here. Some of it is not ours to choose: records that support a tax return have to be kept for as long as HMRC requires, and a record connected to an insurance claim is kept while the claim is live. Owner to confirm
- Licence images, identity documents and DVLA checks
- The shortest of the four, and it is being set before launch. Owner to confirm
- Marketing contacts
- Until you unsubscribe, and then we keep the fact that you unsubscribed so we do not email you again by accident. The period after that is being set before launch. Owner to confirm
You do not have to wait for any of those clocks. Ask us to delete your data and we will, unless we are legally required to keep a specific record — in which case we will tell you which one and why.
Who else sees it?
We do not sell your data and we do not pass it to anyone for their own marketing. It reaches four kinds of recipient and no others.
The systems we run on
These process data on our instructions, under contract. This list is the software this site actually calls, not a generic list of everything a company might use.
- Cloudflare
- Hosts the website (Cloudflare Pages), runs the code that receives your enquiry, and provides the Turnstile anti-spam check on the form.
- Processes data in: United States, with a global network. Requests from the UK are normally served from within the UK or the EU.
- Airtable
- Our CRM. Your enquiry is written here, and this is where a hire record and any documents attached to it are held.
- Processes data in: United States.
- Brevo
- Sends your acknowledgement email and our internal notification, and holds the marketing list where you have opted in.
- Processes data in: European Union (France).
- Google · only after you consent
- Tag Manager and Analytics, and advertising measurement. Loads only under Consent Mode v2 with everything non-essential denied until you accept, and records nothing to your device before then.
- Processes data in: United States and the European Union.
- Microsoft · only after you consent
- Clarity, which records how pages are used so we can see where people get stuck. The tag is not loaded at all unless the analytics flag is already in your consent cookie.
- Processes data in: United States and the European Union.
A partner supplying a car we do not own
101 of the 112 cars in our catalogue are badged “we can source”, which means a vetted partner supplies them rather than us. To confirm one of those we have to tell the partner what you want and when. We tell you who they are before anything is agreed, and we pass your contact details only where they are needed to complete the hire. How the fleet and sourced split works.
Insurers, and the people who deal with an incident
If a car is damaged, stolen or involved in an incident, the details go to the insurer and to whoever is handling the recovery or the repair. Where a penalty charge, toll or speeding notice is issued against a vehicle during your hire, we are legally required to tell the issuing authority who was driving.
Professional advisers and the authorities
Our accountant and, where we need one, our solicitor. And the police or another authority where the law requires it or where we need to establish or defend a legal claim.
Does my data leave the UK?
Some of it does. Our CRM and our hosting are provided by companies based in the United States, and our email platform is based in France. That is normal for a business of this size, but you are entitled to know it rather than to find it in a footnote.
UK law allows a transfer outside the UK only where the data stays protected to UK standards — through an adequacy decision covering the destination, or through a contract such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses.
Putting the written processing agreement in place with each provider named above, and recording which safeguard each one relies on, is on the list of things to complete before launch. We would rather say that here than imply it is already done. Owner to confirm
Will you email me?
We will send you one acknowledgement when you enquire, and then whatever the conversation needs. That is a service message about something you asked us for, and it is not marketing.
Beyond that, only if you ticked the box. The box is unticked when the page loads, it is not needed to get an answer, and leaving it alone costs you nothing. If you do tick it we add you to our list in Brevo, along with a few attributes so we do not send you something irrelevant: your first and last name, whether the car you asked about is one of ours, roughly when you wanted it, the category and vehicle, the driver age band and the delivery postcode.
One nudge if your enquiry goes quiet
If you enquire about a car and nobody here has followed it up a few days later, our system sends you one email about that hire. One, never repeated, and only while nobody has picked up your enquiry. The moment a person does, it is cancelled.
You get it either because you ticked the marketing box, or because you asked us about hiring a specific car and this is a message about that same hire. The second route is the soft opt-in in regulation 22 of the Privacy and Electronic Communications Regulations, which allows a message about our own similar service to somebody who was in the middle of negotiating one with us, provided they were given a simple way to refuse at the point we took their address and in every message since. Both of those are true here, and the nudge markets nothing except the hire you already asked about.
If you would rather it did not happen at all, say so in your enquiry, or use the unsubscribe link. Either one stops it.
Stopping it
Every marketing email carries a one-click unsubscribe that works immediately, in the message and in the mail headers, so your email client can do it for you. One click switches you off everywhere: your consent is turned off on every record we hold for that address and you are suppressed at our email provider too. A half-applied unsubscribe is worse than none, because it looks handled.
The unsubscribe link never carries your email address. It carries an opaque record reference and a signature, because unsubscribe links end up in server logs and mail-scanner reports, and an address in a web address is a quiet leak. Unsubscribing deletes nothing else: your enquiry, your quote and your booking are untouched.
You can also just reply and ask, or email [email protected]. Opting out of marketing does not stop us replying about a hire.
How is it protected?
The site is served over HTTPS, so what you type into the form is encrypted in transit. The enquiry goes straight from the form into our CRM rather than sitting in a mailbox as the only copy. Access to the CRM is restricted to the people who run hires. Card details are never entered on this website, so there are none here to protect.
No transfer over the internet is ever completely secure, and anyone who tells you otherwise is selling something. If something does go wrong and it is likely to put your rights at risk, we will tell you, and we will report it to the Information Commissioner’s Office where the law requires it.
What are my rights, and who do I ask?
UK data protection law gives you rights over your personal data. They apply now, whether or not this policy is finalised, and using one costs nothing.
- See it. Ask for a copy of what we hold about you.
- Correct it. Have anything wrong put right, or anything incomplete completed.
- Delete it. Have it erased, where we have no overriding reason to keep it.
- Restrict it. Have us pause using it while something is in dispute.
- Object to it. Object to processing we do on the basis of our legitimate interests, and to direct marketing at any time, which is an absolute right.
- Take it with you. Have the data you gave us sent to you, or to somebody else, in a machine-readable form.
- Withdraw consent. Untick what you ticked, without affecting anything we did before you withdrew it.
Email [email protected] and say what you would like us to do. We will respond within one month, which is the period the law allows us. We may ask you to confirm who you are first, because handing your data to somebody claiming to be you would be the worse outcome.
If you are not happy with how we handle it
Tell us first if you can — it is usually quicker. But you have the right to complain to the UK data protection regulator at any point, and you do not need our permission or our involvement to do it.
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113
Anything else?
Children
This is a service for adults. Every car we hire carries a minimum driver age well above 18, and we do not knowingly collect data from children.
Automated decisions
We do not make decisions about you by machine. A person reads every enquiry and a person decides every hire, including every decision about whether a driver meets the criteria for a car.
Changes to this policy
We update this policy when what we do changes, and the date at the top changes with it. This version is a draft pending legal review; the approved version will carry a real publication date rather than a build date.
The other documents
- Website terms
Using this website
- Rental terms
The terms of the hire itself
- Complaints
How to raise something with us
-
Change what we may use, at any time
Tell us the dates. We’ll confirm the car.
Send us the dates and a delivery postcode — that is all we need to start. Someone here will come back to you with what is genuinely available and the full cost, deposit, excess and mileage included.
Request a carA person confirms every booking · No payment taken online · Brought to your door