UK GDPR & Data Protection Notice

1. Overview & Data Controller

CogFocus Auto provides dealer management and invoicing software for independent UK motor retailers. In accordance with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), this notice outlines how customer data is processed during vehicle acquisitions, test drives, and sales.

2. Legal Basis for Processing

We process customer personal data (such as Name, Address, Contact Telephone, Email, and Driving Licence details) based on:

• Contractual Necessity: Execution of vehicle purchase invoices, delivery agreements, and payment collection.
• Legal Obligations: HM Revenue & Customs (HMRC) VAT invoice record-keeping (minimum 6 years) and Driver and Vehicle Licensing Agency (DVLA) V5C registered keeper transfers.
• Legitimate Interest: Warranty administration, safety recall notifications, and fraud prevention.

3. Data Retention & Security

Customer records, invoice PDFs, and vehicle purchase contracts are stored using encrypted storage and role-based access controls. Records are retained strictly in compliance with HMRC statutory limitation requirements.

4. Individual Rights

Under UK GDPR, customers have the right to access, rectify, or request erasure of personal data (subject to statutory financial and vehicle registration retention obligations).