Version 2026-08-09 · Last updated 8 August 2026
Privacy Policy
What personal information we process, why, on what lawful basis and who receives it.
1. Who we are
The controller for RoadLux services operated by Road Lux Ltd is ROAD LUX LTD, trading as RoadLux.
Company number: 08837891. VAT registration number: 406 5589 81.
Controller details
- Registered office: Kamp House, 124 Middleton Road, Morden, England, SM4 6RW.
- Privacy and data-protection email: support@roadlux.uk.
- ICO registration: pending. Road Lux Ltd will register with the Information Commissioner’s Office before launch where required by applicable UK data protection law, and this policy will be updated with the registration number once issued.
ICO guidance requires organisations to identify themselves and explain purposes, lawful bases, recipients and other required privacy information.
2. Information we collect
Depending upon how customers use RoadLux, we may process:
Identity and contact information
- name
- telephone
- customer/account ID
Account information
- login/authentication information
- account status
- preferences
- account activity
- RoadLux does not store plaintext passwords.
Vehicle information
- registration
- make
- model
- derivative
- year
- colour
- fuel
- transmission
- body style
- mileage
- MOT/tax information
- other relevant vehicle data
Vehicle History Check information
- registrations searched
- report information
- provider results
- report reference
- report timestamp
- purchase
- credit used
- promotions
- report ownership
Booking information
- selected service
- appointment
- location/postcode
- vehicle
- customer notes
- booking status
RoadLux+ information
- plan
- membership status
- subscription information
- renewal
- cancellation
- benefits
- savings
- credits/rewards
Payment information
- amount
- currency
- transaction reference
- payment status
- refunds
- subscription/payment history
- Payment card information may be processed directly by the payment provider.
We Buy Your Car
- registration
- mileage
- condition
- mechanical issues
- cosmetic damage
- warning lights
- service history
- keys
- V5C information
- finance status
- photos
- notes
- offers
- acceptance/decline
Accident information (where necessary)
- accident details
- vehicle damage
- incident date/location
- parties
- insurers
- claim/reference information
- correspondence
- recovery
- storage
- repair information
- photographs
- signed authorities
Uploaded content
- photographs
- documents
- forms
- notes
- supporting evidence
Communications
- emails
- messages
- enquiries
- complaints
- support correspondence
Technical information (where applicable)
- IP address
- device/browser information
- session/security information
- app/web activity
- consent records
- cookie/storage-access information
3. How information is obtained
RoadLux may receive information:
- directly from customers
- through customer accounts
- through bookings/forms
- from vehicle-data providers
- from payment providers
- from insurers/representatives where appropriate
- from relevant service providers
- from publicly/officially available vehicle sources where applicable
Where personal information is obtained from another source, applicable transparency requirements are followed. ICO guidance says additional information can be required about categories and sources when data was not obtained directly from the individual.
4. Why we process information
Purposes may include:
- account creation
- authentication
- providing services
- processing bookings
- Vehicle History Checks
- saving reports
- managing credits
- processing payments
- managing RoadLux+
- reminders
- customer support
- We Buy Your Car
- accident-related services
- recovery/storage/repairs
- communicating with authorised relevant parties
- preventing fraud
- securing RoadLux
- complaints
- accounting
- legal compliance
- appropriate service improvement
5. Lawful bases
Depending upon the processing activity, RoadLux may rely on:
Contract
- Where processing is necessary to provide a requested service or take steps requested before entering a contract.
Legal obligation
- Where RoadLux must process information to comply with law.
Legitimate interests
- security
- fraud prevention
- service administration
- business management
- appropriate service improvement
- provided those interests are not overridden by individual rights
Consent
- Where consent is the appropriate or required basis.
The actual lawful basis is mapped to the actual processing activity.
6. Special category information
RoadLux does not unnecessarily collect special-category information.
Where special-category personal data is genuinely required, such as relevant health information in an accident-related matter, RoadLux identifies and documents an appropriate Article 6 lawful basis and Article 9 condition where required.
7. Who information may be shared with
Where necessary and lawful, RoadLux may share relevant information with categories including:
- payment processors
- vehicle-data providers
- hosting/database providers
- authentication providers
- communications providers
- insurers where authorised/appropriate
- recovery providers
- repairers
- engineers
- vehicle providers
- parts suppliers
- professional advisers
- IT/security providers
- regulators
- courts
- law enforcement where legally required
Current providers
- Hosting, database and authentication: Supabase.
- Payments: Stripe.
- Vehicle data: Check Car Details API Services and the Driver & Vehicle Standards Agency (DVSA) MOT History API.
- AI assistance: OpenAI.
- Push notifications: Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM), where applicable.
- Email: the RoadLux configured email provider (Supabase Auth email delivery for account emails).
- SMS: none currently used.
- Analytics: none currently used.
- Customer support: RoadLux in-app messaging and email.
This list is kept current. If a provider is added or replaced, this policy is updated.
8. Data minimisation
RoadLux collects information reasonably necessary for the relevant purpose. Information is not collected simply because it might be useful someday.
9. Retention
Personal information is not retained indefinitely without reason. Retention considers:
- service purpose
- contractual requirements
- legal obligations
- accounting/tax requirements
- limitation/dispute periods
- fraud/security
- product promises
Retention schedule
- Customer accounts: retained while the account is active and for up to 7 years after closure where required for legal, accounting or dispute-resolution purposes.
- Vehicle History Check reports and purchased credits: 7 years, so customers can access previous purchases and for audit purposes.
- Booking records: 7 years.
- Air conditioning service records, invoices and repair records: 7 years.
- Accident management files, repair documentation, recovery records and signed authority forms: 7 years after the claim is concluded, or longer where required for ongoing legal proceedings.
- We Buy Your Car enquiries: 12 months if no purchase proceeds, otherwise 7 years after completion of the transaction.
- Payment records: 7 years for accounting and tax compliance. Payment card details are not stored by RoadLux and are processed by Stripe.
- Customer support communications: 3 years after the enquiry is closed.
- Server logs and security logs: up to 12 months.
- Marketing preferences: until consent is withdrawn, or 2 years after the last interaction.
- Cookie consent records: 2 years.
Where litigation, fraud investigations or legal obligations require longer retention, RoadLux may retain relevant records until those matters are concluded.
10. Security
RoadLux uses appropriate technical and organisational measures and enforces access controls server-side and database-side.
Customers cannot access another customer’s:
- account
- reports
- bookings
- vehicles
- payments
- photos
- sale requests
- accident information
- documents
Admin access is appropriately restricted. Raw provider responses are not publicly exposed.
11. International transfers
Where providers process personal information outside the UK, RoadLux uses an appropriate transfer mechanism or safeguard where required.
Some providers may process personal information outside the UK. Where personal data is transferred internationally, RoadLux relies on an appropriate lawful transfer mechanism, including the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision where applicable.
12. Marketing
Electronic marketing complies with applicable data-protection and direct-marketing requirements. Appropriate opt-out/unsubscribe mechanisms are provided.
Operational messages concerning an existing booking, purchase, report, account, security issue, subscription, accident service or offer are not necessarily marketing.
13. Customer rights
Depending upon the circumstances, individuals may have rights including:
- access
- correction
- deletion
- restriction
- objection
- portability
- withdrawal of consent where consent is relied upon
Not every right applies in every circumstance. Customers may also complain to the Information Commissioner’s Office.
14. Photos and documents
Customers retain ownership of content they upload.
Customers grant RoadLux permission to process and store it as reasonably necessary for the requested service and applicable legitimate and legal purposes.
Where necessary, RoadLux may share relevant content with providers involved in supplying the requested service.
Uploading a photograph for a service does not automatically grant RoadLux unrestricted advertising or social-media rights. Separate permission is obtained where required for marketing use.
15. Privacy information at collection
Privacy information is available at the point personal information is collected, using appropriate layered or just-in-time notices where helpful.
ICO guidance states that privacy information generally needs to be provided when personal data is collected directly.