Privacy notice

GetMotors (“we”, “us”) operates the software a dealership uses to manage its website, stock and leads. We are the data controller for the account and staff information described here.

We are not the controller for the enquiries, buyer details and stock records a dealership puts into the service. The dealership is the controller of that information, and we process it for them under our Data Processing Agreement. If you are a car buyer, the privacy notice on the dealership’s website explains what that dealership does with your information.

A dealership gives us the name, work email address and role of each person it invites to its account. We also keep sign-in records and session details, and the security settings on the account, such as whether two-factor authentication is on.

We use this to create accounts, apply the owner, manager and sales permissions, send service email such as lead alerts and the daily digest, and keep the platform secure. Our lawful bases are performing our contract with the dealership and our legitimate interest in securing the service. We do not use staff details for advertising.

When a dealership connects an eBay seller account, eBay sends us an OAuth grant. Our connection record holds the eBay user id, the stable identifier for the seller account; the eBay username shown to the dealership; the OAuth access token and refresh token; the scopes the dealership granted; and the expiry time of each token.

Those tokens are the credential that lets GetMotors call eBay’s APIs on that dealership’s instruction — to list and maintain its vehicle stock — when the eBay channel is in use. We process the connection to perform our contract with the dealership. We do not use the tokens for another dealership or for anything the dealership has not authorised.

The dealership can revoke our access from its eBay account at any time. eBay then stops issuing tokens, the connection shows as needing to be reconnected, and stock sync stops.

Security. Both tokens are encrypted before they are stored, using AES-256-GCM. The encryption key is held in the platform’s server configuration, outside the database and its backups, so a copy of the database alone does not yield a usable token. Our code decrypts a token only where it needs to call eBay, and the admin screen shows the connection and its expiry dates, never the tokens themselves. Access to the platform is limited to the people who run it, and each dealership’s staff see only what their role allows.

Retention and deletion. Disconnecting the eBay channel deletes the stored connection, including both tokens and the eBay identity, immediately; reconnecting means authorising again. If an eBay account is closed, or its owner asks eBay to delete their data, eBay sends us an account-deletion notice. We match it on the eBay user id and delete the stored connection automatically, across every dealership that holds one. Otherwise we keep the connection until the dealership disconnects it or the dealership’s account is deleted.

Staff account records are kept while the account is open and removed when it is deleted, apart from records we must keep for tax or to resolve a dispute.

Sharing. We do not sell personal data and we do not share it for advertising. For the information described in this notice, we share it only with the providers needed to run the service — our hosting and database provider, our email delivery provider, and Stripe when a dealership pays us — each acting for us under contract and only on our instructions. We also send the necessary information to eBay when we make an API call on the dealership’s behalf. We may disclose information if the law requires it or to protect the service from abuse.

Cookies. This website sets no cookies and loads no analytics, advertising or third-party scripts. The dealer admin at app.getmotors.co.uk sets an essential session cookie so a signed-in member stays signed in, and a short-lived state cookie when an eBay connection is started, to check that eBay’s callback belongs to that attempt. Neither is used for tracking.

Under the UK GDPR you can ask for a copy of your personal data, have it corrected, ask us to erase it, restrict or object to how we use it, and ask for it in a portable format. Where we rely on consent, you can withdraw it at any time. Email hello@getmotors.co.uk and we will respond within one month, or tell you if the law allows us longer. We may ask you to prove your identity. If your request concerns information a dealership controls, such as a buyer enquiry, contact the dealership first — we will help them respond.

You can complain to us at the same address, or to the Information Commissioner’s Office (ICO), the UK regulator: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

We will update this page if the way we handle personal data changes, and change the effective date when we do.