Privacy Policy

1. Data Controller

10th Bridge Consulting Ltd is the data controller for personal data processed through the Marque One platform. Contact: matt.price@10thbridge.com.

2. What Data We Collect

Account data: name, email address, password (hashed). Usage data: pages viewed, searches performed, listings saved, enquiries sent. Dealer data: business name, contact details, website, listing information. Dealer records about you: where you contact a dealer through Marque One, submit a buyer brief, or register interest in a car they sold, that dealer can keep a record of you — your name, the contact details you gave, and their own notes of your conversations and what you are looking for. Garage data: the cars you record in My Garage, including registration, purchase details, key dates, your notes, and any documents you upload against them. Technical data: IP address, browser type, device information, cookies.

3. How We Use Your Data

We use your data to provide and improve the platform, personalise your experience (taste profiles, recommendations), send notifications and alerts you've opted into, process dealer subscriptions and payments, generate AI-powered buying guides and market analysis, connect you with dealers who can supply the cars you are looking for, and comply with legal obligations.

4. Legal Basis (UK GDPR)

Contract: processing necessary to provide the service you registered for. Legitimate interests: analytics, fraud prevention, platform improvement. Consent: marketing emails, cookie preferences, AI-powered features. Legal obligation: tax records, regulatory compliance. Dealer records: where you approach a dealer or publish a buyer brief, we and the dealer rely on legitimate interests — you are seeking to buy a car and they are the party who can sell you one. You can object at any time (see section 6), and we will stop sharing your details with dealers and ask them to erase what they hold.

5. Data Retention

Account data is retained while your account is active and for 12 months after deletion. Usage analytics are retained for 24 months. Transaction records are retained for 7 years (tax obligations). Records a dealer keeps about you are retained while your account is active and are deleted when you close it or ask us to. Cars and documents in My Garage are kept until you remove them or close your account. You may request deletion at any time via your account settings.

6. Your Rights

Under UK GDPR you have the right to: access your personal data, rectify inaccurate data, erase your data ("right to be forgotten"), restrict processing, data portability, object to processing, and withdraw consent. To exercise these rights, contact matt.price@10thbridge.com.

7. Who Else Sees Your Data

Dealers on the platform. Dealers are separate businesses, and independent data controllers for what they hold about you. A dealer can see your name and the contact details you gave when you message them, when you submit a buyer brief marked as visible to the dealer network, or when you register interest in a car they previously sold — and they can record their own notes about those dealings. Dealers only ever see their own dealings with you: one dealer cannot see your conversations with another, or their notes about you. If you would rather a dealer did not hold a record of you, contact us and we will ask them to erase it.

My Garage. The cars you add to My Garage are private by default: nobody else sees a car, its documents or your notes about it. If you turn on "Open to offers" for a car, dealers you have already dealt with can see that car — its year and variant, alongside your name — when they are looking for one; turning it off again stops that. Separately, if you list a car for sale through us, that listing and your name are shown to every dealer on the platform until you withdraw it.

8. Third-Party Services

We use the following third-party services that process your data: Supabase (database hosting, EU), Stripe (payment processing, EU), Resend (transactional email, EU), Sentry (error monitoring, EU), Anthropic (AI features, US — data not used for training), Vercel (hosting, global edge). All providers maintain appropriate data protection agreements.

9. Cookies

We use essential cookies for authentication and session management. Optional analytics cookies help us understand how users interact with the platform. See our Cookie Policy for details.

10. Contact

For privacy-related enquiries or to exercise your data rights, contact the Data Protection Officer at matt.price@10thbridge.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.