Get app

User privacy notice

(last updated 2 April 2025)

www.cazoo.co.uk, including any apps (Site), is operated by Motors.co.uk Limited (We, Us or Our). We have owned the Cazoo brand since 27 June 2024.

To provide you with the full range of our services, We need to collect and process certain personal data about you. This user privacy notice (Notice) outlines how we handle such data and your related rights.

This Notice applies to all visitors and users (collectively referred to as “users” in this Notice) of the Site, regardless of how they access and make use of our services, as well as any partner websites linking to this Notice or Our Cookie Policy. It also covers Our social media channels and anyone reaching out to Us through any communication method, including social media, phone, SMS, WhatsApp, email, letters or in person.

We may update this Notice periodically to reflect changes in the personal data we handle or for other operational, legal, or regulatory reasons. We recommend reviewing this Notice regularly to stay informed about our handling of personal data. The date at the top of this Notice indicates when it was last updated.

As a platform based in the United Kingdom (UK) for buying and selling vehicles, the Site is intended for UK residents, and this Notice aligns with UK law.

This Notice should be read in conjunction with Our Cookie Policy, which details how the Site uses cookies, web beacons and similar technologies.

1. Are You Obliged to Provide Your Personal Data to Us?

Some personal data is required when entering into a contract with Us. Other personal data is optional, but may be needed to fully use Our services.

2. What Personal Data Do We Collect?

We collect your personal data when you use Our services, register for, or update, your account, complete a web form, engage in discussions with us or interact with us in any other way. Additionally, we may gather personal data from third-party sources.

Here is a summary of the personal data We collect:

2.1 Personal data We collect when you use Our services, including registering and updating, your account

Personal data you provide

  • Data collected when you an express an interest in our services: When you express an interest in selling or buying a vehicle e.g. complete a web form, We collect your full name, email address and telephone number.
  • Data collected when you register or update your account: When you register for a user account We collect your full name and email address, along with your address and telephone number, if provided.
  • Data collected for contracting and identity verification: If you are a dealer looking to contract with Us, We will collect the necessary data required for your contract, including your company details and VAT number. Our third-party partners may also collect your date of birth and other personal data from a driver’s license or passport (e.g. photograph) for identity verification purposes, including monitoring for fraud or suspicious activity. - Such third-party providers store the data, which we access or request only if issues arise, to perform additional manual checks before deciding whether to proceed with the contract.
  • Data shared through messaging tools: Data that you share through Our free-form messaging tools. - These tools are provided by third-party providers who may use humans or artificial intelligence (AI) to monitor or moderate the chats.
  • Financial data: If you are a dealer looking to contract with Us, We collect financial data, namely bank account, or credit or debit card information, for payment purposes as required for your contract. - This data is securely shared with our third-party payment providers who store it. We only store bank account details, which are hashed, and access to this date is restricted by practical and policy limitations.
  • Demographic and preference data: In some cases, We collect your age, gender, interests and preferences.
  • Additional data provided by you: You may also provide additional data through free-form methods, such as optional information fields on web forms or by contacting Us via our contact form, phone or letter for enquiries, customer service or any other reason related to Our services.

Automatically collected personal data

  • Data collected from your actions: Data linked to your account when you take certain actions while using Our services, such as contacting a dealer to enquire about or purchase a vehicle.
  • Other interaction data: Data about your interactions with Our services, such as your advertising and communication preferences.
  • Device and connection data: Data about your computer and connection, including your IP address, browser history, language settings, and weblog details. Additionally, when combined with other data, we may also collect usage statistics, traffic data, referral URLs, ad data, and access times.

2.2 Personal data We collect using cookies

When you use Our services, We and Our third-party partners in advertising, analytics and social media may use cookies (including web beacons and similar technologies) to collect personal data.

The personal data We collect includes:

  • Browsing activity: Pages you visit, how often and how long you stay, links you click and other interactions with Our services, including emails.
  • Ad interactions: Ads you have seen, when and where they appeared, how often they were shown and whether you clicked or made a purchase.
  • Device details: Model, operating system and version, browser type and settings, device ID, advertisement ID and cookie related data e.g. cookie ID.
  • IP address: The IP address used to access Our services.
  • Location data: Your device’s location, if enabled. - Please note that most mobile devices allow you to manage or disable location services for all applications through the settings menu.

For more details on how We use cookies and your related rights, see Our Cookie Policy.

2.3 Personal data We collect from third-party sources

We may collect personal data about you from third parties, as allowed by law. In particular, this includes:

  • Credit agencies: Data from credit agencies, such as credit reports or credit checks, as part of our Know Your Client (KYC) procedures.
  • Data providers: Data from data providers e.g. demographic, interest-based and online advertising related data.

We combine or link the personal data we collect from you with data from these third parties.

When We receive personal data from third parties, We take steps to ensure it was collected with your consent (where required) and that the third-party is allowed to share it with Us.

2.4 Personal data We collect from social networks

You may have the option to sign in or link your account using social networks, such as Facebook. When you do, these networks may share certain data with Us. You can control what We access through your social network’s privacy settings.

We may also use social network plug-ins. If you click a link from a plug-in, you choose to connect with that social network.

3. How Do We Use Personal Data and What Legal Basis Do We Rely On?

Under data protection laws, We need a legal basis to process your personal data. Below are the legal bases We rely on.

  1. Contract - To fulfil Our obligations under a contract with you or to take steps before entering into a contract.
  2. Consent - You have given clear and informed consent for the processing of your date for one or more specific purposes, such as sharing your details with a third party e.g. vehicle enquiries or receiving marketing communications.
  3. Legal Obligation - To comply with legal requirements, such as cooperating with law enforcement.
  4. Legitimate Interest - To serve Our legitimate interests or those of third parties, provided these interests are not overridden by your rights and freedoms. For example, We can process data for business purposes, like improving Our services, fraud prevention or ensuring the security of Our services.

We may also share your personal data with third parties for these purposes.

Below is a summary of how We process your personal data, including the types of recipients We share it with, categorised by legal basis.

3.1 Contract processing

  • Contract: Managing data related to you or your company for the purpose of entering into, including signing, contracts.

  • Service delivery: Enabling requests e.g. vehicle viewings, test drives or purchases; facilitating transactions between users; providing features like account management; and ensuring the proper functionality of Our services. - As part of Our services, We will send you marketing communications based on your account settings.

  • Communication and support: Resolving account issues, arbitration of disputes and addressing other customer service inquiries. We may contact you via email, phone, SMS, push notifications or post for these purposes.

  • Location-based services: Using general location data (e.g. post code) to offer location-based services, like radius searches and other content personalised on your general location.

  • Enforcement: Upholding our Terms of Use, legal or contractual obligations applicable to dealers, this User Privacy Notice and other relevant policies, such as Our Cookie Policy.

When necessary for the purposes outlined above, We share your personal data with:

  • Other users
  • Third-party service providers, including payment providers, credit agencies and electronic signature software providers
  • External operators of websites, apps, and related services and tools

3.2 Consent processing

  • Personalisation and improvement of ads: Personalising, measuring and improving Our ads, as well as third-party ads, on both the Site and partner websites.

  • Marketing communications: Marketing communications via phone, email or SMS (unless such communications are permitted without your consent under law)

  • Location data processing: Location data processing to provide location-based services.

  • Use of personal data for specific services: Use of data you have provided to allow us or third parties, such as are partner websites, to enable or make certain services available to you.

When necessary for the purposes outlined above, We share your personal data with:

  1. Third-party service providers, such a financial services or advertising providers.

Where you have given consent for Us and others to process your personal data, you may withdraw your consent at any time. Information on how to withdraw your consent can be found in the section “Exercising Your Rights and Managing Your Preferences”.

3.3 Legal obligation processing

  • Legal proceedings: Participating in legal proceedings (including judicial proceedings).

  • Preventing illegal activities: Preventing, detecting and addressing illegal activities.

  • Security of services: Ensuring the security of Our services.

  • Legal retention requirements: Retaining and storing your data to meet legal retention requirements (see the section “How Long Do We Keep Your Personal Data?” for more details).

When necessary for the purposes outlined above, We share your personal data with:

  1. Law enforcement agencies, courts, government bodies or public authorities, including intergovernmental or supranational organisations
  2. Third-party service providers
  3. Parties involved in legal proceedings, including other users, especially when responding to legal or court orders, or similar requests

3.4 Legitimate interests processing

We process your personal data when necessary to pursue Our legitimate interests or those of a third party, unless your rights and freedoms outweigh these interests.

  • Audit logs: Maintaining logs of communications between users on the Site to assist with dispute resolution, customer service, quality monitoring and demonstrating the value of Our services.
  • *Disputes and legal proceedings: Participating in disputes and legal proceedings, including the assertion and defence of legal claim, particularly for the prosecution of unlawful activities or breaches of contract, including those involving users.
  • *Protection of third-party interests: Safeguarding the legitimate interests of third parties in disputes.
  • *Unlawful activities and security: Preventing, detecting, mitigating and investigating fraud, data breaches and other unlawful activities, including the assessment of corresponding risks (e.g. through the use of CAPTCHAs or two-factor authentication).
  • *Information security: Monitoring and improving the information security of Our services.

*Where We do not have a legal obligation basis.

  • Identity and financial checks: Performing identity checks, creditworthiness assessments and verifying the accuracy of information.
  • User experience: Offering features that make transactions easier for users.
  • Service improvement: Analysing and improving Our services, including collecting feedback from users to identify and solve issues, enhancing product development and user experience.
  • Customer service monitoring: Analysing telephone conversations with customer service for quality improvement. - We record all customer service calls for quality and training purposes, transcribe, summarise or analyse them using AI, and store them. However, the original recordings are automatically deleted after three months.
  • Postal advertising: Sending advertisements by mail. - You will only be contacted by mail if you have chosen it as a preferred communication method in your account settings. You can change the communication settings in your account at any time.
  • Marketing and promotions: As allowed by law without your consent, for marketing analysis and promotional communications e.g. offering coupons, discounts, and special offers, as well as conducting opinion polls and surveys. - For details on how to opt out of direct marketing, please see the section “Exercising Your Rights and Managing Your Preferences”.
  • Content customisation: Customising page content to display relevant items or services based on your actions.
  • Email campaigns: Analysing the performance of Our email marketing campaigns e.g. through analysis of opening and click rates).
  • Partner programs: Offering partner and bonus programs.
  • Company acquisition: Preparing for and executing company mergers and acquisitions. - The merged entity or buyer will comply with this Notice. You will be notified if your data is processed for any new purposes.

When necessary for the purposes outlined above, We share your personal data with:

  1. Other users
  2. Third-party service providers
  3. Law enforcement agencies, courts, government bodies or public authorities, including intergovernmental or supranational organisations
  4. Parties involved in disputes or legal proceedings, especially when responding to legal or court orders, or similar requests.
  5. Credit agencies, as required by law
  6. Other parties in the context of a company merger and acquisition

You can find information about your right to object to processing based on legitimate interests, as well as how to exercise this right, in the sections “What are your rights as a data subject?” and “Exercising your rights and managing your preferences”.

4. Do We Use Automated Decision-Making or Profiling?

We may use automated decision-making or profiling. However, We will not make any decisions made based solely on automated processing, including profiling, if these decisions have legal effects or a significant impact on you, unless necessary for a contract, We have your consent or We are required by law.

You can find information on your right to object to decisions made solely through automated processing, including profiling, as well as how to exercise this right, in the sections “What are your rights as a data subject?” and “Exercising your rights and managing your preferences”.

5. Do We Disclose Your Personal Data?

We will not share your personal data with third parties, except as outlined in this Notice (see the section “How do We use personal data and what legal basis do We rely on?” for the specific purposes and circumstances under which We may disclose your data) or with your consent.

We will only disclose your personal data to third parties when We have proper safeguards in place to protect it, such as contracts and security measures. We will take all reasonable steps to ensure your data is handled securely and in line with this Notice, and law.

Please note that We are only responsible for use of your personal data by third parties where they act as Our data processors.

If you have queries or require more information on how third parties handle your personal date, please read their privacy policies or contact them.

6. Where Do We Store Your Personal Data?

We use technical and organisational security measures to minimise the risk of loss, unauthorised access, disclosure, or misuse of your personal data.

All personal data you provide to Us is stored within the UK or EEA, and is not transferred outside the UK or EEA unless specifically stated in this policy. If We transfer your data outside the UK or EEA, We will ensure appropriate safeguards are in place to protect it

7. How Long Do We Keep Your Personal Data?

We keep your personal data only as long as necessary to fulfil the purposes for which it was collected (see the section “How do We use personal data and what legal basis do We rely on?” for details). After that, We delete or anonymise your data unless We need to retain it.

Retention periods vary depending on factors such as:

  • Service necessity: Most data is retained to fulfil contracts, maintain and improve services, for security, and keep business and financial records.
  • Sensitive data: Special categories of personal data are typically kept for shorter periods.
  • Consent-based processing: If data is processed based on your consent, We retain it only as long as necessary to fulfil that consent.
  • Legal, contractual or other similar obligations: Some data must be stored due to legal, accounting or reporting requirements, or actual or anticipated disputes.
  • Unlawful activities: We may retain data to help prevent, detect, mitigate or investigate unlawful activities.

You may request the deletion of your data in certain circumstances. For more details, see the “Right to Erasure” or “Right to be Forgotten” in the section “What are your rights as a data subject?”.

In some instances, We may anonymise your data (so it can no longer be linked to you), allowing Us to use it indefinitely without further notice.

8. What Are Your Rights as a Data Subject?


You have the following rights regarding your personal data:

  • Right to be informed: You have the right to be informed about how your personal data is collected, used, stored and shared. We provide this information in this Notice.
  • Right to Access: You have the right to request a copy of the personal data We hold about you, including details on how it is processed, who it is shared with, how long it will be stored, and its source (if not collected directly from you). You can also request information about any automated decision-making, including profiling.
  • Right to Withdraw Consent: You have the right to withdraw your consent at any time, where consent is the legal basis for processing. Withdrawing consent will not affect the lawfulness of any processing carried out before you withdrew it. Once you withdraw consent, We will stop processing your data for the purposes you originally agreed to, unless We have another lawful basis for processing it.
  • Right to Object: You have the right to object to the processing of your data based on legitimate interests if your rights outweigh Our interests. We may continue processing if We have compelling legitimate grounds. If you object to marketing, We must stop processing your data immediately.
  • Rights Related to Automated Decision-Marking Profiling: You have the right to object to decisions made solely through automated processing, including profiling, if they have legal or significant effects on you. This right may not apply if the decision is necessary for a contract, authorised by law or based on your explicit consent. If an automated decision is made, you can request human intervention or challenge the decision.
  • Right to Rectification: You have the right to request correction of inaccurate personal data or completion of incomplete data.
  • Right to Erasure or “to be forgotten”: You have the right to request the deletion of your personal data, unless it is needed for legal obligations, public interest or legal claims.
  • Right to Restrict Processing: You have the right to request that We restrict processing of your data if you dispute the accuracy of the data, the processing is unlawful but you do not want the data deleted, We no longer need the data but you need it for legal claims or you have objected to processing and verification is pending. During restriction, We can store the data but not use it.
  • Right to Data Portability: You have the right to request a copy of your personal data in a structured, commonly used and machine-readable format, and transfer it to another controller. This applies only when processing is based on consent or contract and is carried out automatically.
  • Right Complain: You have the right to file a complaint with the Information Commissioner’s Office (ICO) in the UK if you believe your data rights have been violated.

9. Exercising Your Rights and Managing Your Preferences

To exercise your rights as a data subject by Contact Us. If a third party is involved in processing your personal data (as outlined in this Notice), We will forward your request to them.

If you no longer wish to receive marketing communications, you can opt out by clicking the unsubscribe link in any marketing email or Contact Us. If you have an account with Us, you can also update your marketing and notification preferences in your account settings. Please note, it may take a few days for changes to take effect.

For information on managing your cookie preferences, please see Our Cookie Policy.

Exercising your rights is usually free of charge. However, if a request is unreasonable or excessive, especially if it is repetitive, We may charge a fee (limited to Our actual costs) or refuse to process it, in accordance with law.

10. Other Important Information Regarding Personal Data

This section provides additional details on data protection when using Our services.

10.1 Your responsibilities over information you receive through the Site

If you, as a natural or legal person, public authority, agency or other body, correspond with another user and receive their personal data, you are independently responsible for processing that data as a controller and must comply with applicable data protection laws.

You may, among other things, only use this data for services and transactions related to Us, fraud prevention or other purposes explicitly agreed to by the user. Any other use violates Our Terms of Use.

10.2 Personal data relating to third parties

If you provide Us with another person’s personal data, you must have their consent or ensure the disclosure is legally permitted. You should also inform them about how We process their data, as outlined in this Notice.

11. Data Controller

For the purposes of this Notice, the data controller is Motors.co.uk Limited, registered in England and Wales, under company number 05975777, with its registered office at 27 Old Gloucester Street, London, WC1N 3AX.

Motors has owned the Cazoo brand since 27 June 2024.

12. Contact Us

If you have any questions about this Notice or the use of your personal data, you can contact Us:

  • By email: privacy@motors.co.uk
  • By post: Motors.co.uk Limited, 27 Old Gloucester Street, London, WC1N 3AX

13. Complaints

If you have a complaint about how your personal data has been handled by Us or any third parties mentioned in this Notice, please Contact Us first. Many data protection concerns can be quickly resolved directly with Us.

You also have the right to file a complaint with the ICO. For more information on how to do this, please see here. Please note, the ICO advises that you give the organisation you are dissatisfied with a chance to resolve the issue before escalating the complaint.