Privacy Policy
Last updated: 12 June 2026
This Privacy Notice for Bobi.car Limited ("we", "us", or "our") describes how and why we collect, store, use, and share ("process") your personal information when you use our services ("Services"), including when you:
- Visit our website at https://bobi.car, or any website of ours that links to this Privacy Notice
- Search for a vehicle, create an account, or use our tools to find a car
- Check whether you are eligible for car finance, ask for a quote, or apply for finance through us
- Engage with us in any other related way, including sales, marketing, or events
Questions or concerns? Reading this notice will help you understand your privacy rights and choices. We are responsible for deciding how your personal information is processed. If you have any questions, or you want to exercise any of your rights, contact us at privacy@bobi.car. If you do not agree with our policies and practices, please do not use our Services.
Summary of key points
This summary gives you the headlines. You can find the full detail in the section referenced after each point, or in the table of contents below.
What personal information do we process? We process the information you give us (such as your name, contact details, and — if you apply for finance — your identity, address, employment, and income details), information we collect automatically when you use the site, and information we receive back from third parties such as our finance partner and credit reference agencies. See Section 1.
Do we process sensitive ("special category") information? Not as a rule. Your credit and financial information is ordinary personal data, not special-category data. We would only process special-category data — for example, health or vulnerability information — if it came up as part of an affordability or additional-support assessment, and then only where the law allows. See Section 1.
Do we collect information from third parties? Yes. If you use our finance journey, we receive information back from our finance partner (Evolution Funding Limited, trading as My Car Credit) and from credit reference agencies — for example, your eligibility result and indicative rate. See Section 1 and Section 4.
What is our legal basis? We only process your information when we have a valid lawful basis to do so. We set out the basis for each purpose in the table in Section 3.
Who do we share it with? Service providers who help us run the Services, car dealers when you ask to be connected to one, and — for finance — our FCA principal, our finance partner, the panel lenders, and credit reference agencies. See Section 4 and Section 5.
Do we make automated decisions about you? Yes. If you check your finance eligibility, the decision about whether you are eligible and the rate shown is made automatically by computer, without a person reviewing it. You have the right to ask a person to review that decision. See Section 7.
How long do we keep it? As long as we need it for the purpose we collected it for, then we delete or anonymise it. Finance records are kept longer to meet our regulatory obligations. See Section 8.
What are your rights? You can ask for access, correction, erasure, restriction, or portability, and you can object to certain processing. You can also withdraw consent and complain to the ICO. See Section 9 and Section 11.
Table of contents
- What information do we collect?
- How do we use your information?
- Our lawful bases for using your information
- Our car finance service, and how we share your information
- Who else we share your information with
- International transfers of your information
- Automated decisions about your finance eligibility
- How long we keep your information
- Your privacy rights
- Who controls your data (joint controllers)
- How to exercise your rights
- Cookies and tracking technologies
- Artificial intelligence in our Services
- How we keep your information safe
- Children's information
- Updates to this notice
- How to contact us
1. What information do we collect?
In short: We collect information you give us, information we collect automatically, and — if you use our finance journey — information we receive back from our finance partner and credit reference agencies.
Information you give us
When you register, search for a car, contact us, or apply for finance, we collect the personal information you provide. Depending on what you do, this may include:
- Account and contact details: name, email address, phone number, username, password, contact preferences, profile picture
- Vehicle, search, and activity information: the cars and models you view, save, or enquire about, your preferences, the pages you visit while signed in, and your conversations with our AI assistant — all linked to your account. We only build this activity history for signed-in account holders who have an account with us, not for anonymous visitors.
- Finance application information (only if you use our finance journey): identity details, date of birth, current and previous addresses (address history), employment status and history, income and outgoings (affordability), and details of the vehicle and finance you are looking for
You may also choose to register using a social media account (such as Facebook, Google, or X). If you do, we receive certain profile information from that provider — see Section 13 and the "social logins" note below.
All personal information you give us must be true, complete, and accurate, and you must tell us if anything changes.
Information we collect automatically
When you visit or use the site, we automatically collect certain technical information. This does not by itself reveal your identity, but may include your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, approximate location, and information about how and when you use the Services. We collect this mainly to keep the Services secure and working, and for analytics and reporting. We do this through standard server logs and similar technical means, not through tracking cookies (see Section 12).
Information we receive from third parties
This is new in this version, and it matters: if you use our finance journey, we do receive information about you from third parties. Specifically, we receive back from Evolution Funding Limited (trading as My Car Credit), the panel lenders they work with, and credit reference agencies:
- your eligibility result (whether you are likely to be accepted)
- an indicative rate or APR band and quote information
- credit-search information returned as part of the eligibility check
- application status updates as your application progresses
We explain how this works, and who these parties are, in Section 4.
Special category (sensitive) information
Most of what we process — including your credit and financial information — is ordinary personal data. It is not "special category" data under the UK GDPR. Special category data means things like health, racial or ethnic origin, religious beliefs, sexual orientation, biometric, or genetic data.
The one exception: if, as part of an affordability or additional-support assessment, you tell us (or we otherwise process) information about your health or a vulnerability, that would be special category data. Where that happens, we only process it where the law specifically allows — usually with your explicit consent, or where it is necessary to protect your vital interests or for reasons of substantial public interest. We do not ask for this information as a matter of course.
2. How do we use your information?
In short: We use your information to run our marketplace, connect you with dealers, provide our finance journey, keep the Services secure, comply with the law, and — with your consent — market to you.
We process your personal information for the following purposes. The lawful basis for each is set out in the table in Section 3.
- To create and manage your account and keep it working
- To operate our automotive marketplace and connect you with dealers — when you enquire about a vehicle or ask for dealer contact, we share your details with the relevant dealer so they can help you
- To provide our car finance service — to check your eligibility, obtain a quote, submit an application, and hand you over to the lender (see Section 4)
- To respond to your enquiries and provide support
- To send you service and administrative messages — such as changes to our terms, or updates about your account or application
- To request feedback about your use of the Services
- To send you marketing — only in line with your preferences, and you can opt out at any time
- To personalise your experience when you are signed in — using your account activity and preferences to show you relevant vehicles and offers
- To understand how the Services are used so we can improve them
- To keep the Services secure and prevent fraud — including detecting fraudulent listings and protecting you and other users from scams
- To comply with our legal and regulatory obligations — including our obligations as an Appointed Representative in the credit-broking journey
3. Our lawful bases for using your information
In short: The law (UK GDPR Article 6) says we must have a valid "lawful basis" for each thing we do with your information. The table below maps each purpose to its basis. Where we rely on legitimate interests, we name the interest. Where we rely on consent, you can withdraw it at any time.
| What we do (purpose) | Lawful basis | What this means for you |
|---|---|---|
| Create and run your account, and operate the marketplace | Contract — Article 6(1)(b). Processing is necessary to provide the service you have asked for. | If you do not provide the information needed for your account, we may not be able to provide that part of the service. |
| Connect you with a dealer when you enquire about a vehicle — we pass your contact details to the relevant dealer so they can respond to your enquiry | Legitimate interests — Article 6(1)(f). The interest of you, the dealer, and us in connecting buyers with sellers so your enquiry can be answered. This is the standard basis used across car marketplaces. | You can object at any time and ask us to stop sharing your details with dealers (see Section 9), though this may limit our ability to help you buy a car. |
| Check your finance eligibility, obtain a quote, and submit a finance application on your instruction | Contract / steps prior to a contract — Article 6(1)(b). Processing is necessary to take the steps you have asked for before any finance agreement is entered into. | Providing this information is necessary to assess and submit a finance application. If you do not provide it, we cannot check your eligibility or apply on your behalf (see Section 4). |
| Carry out the credit search with credit reference agencies as part of the eligibility check and application | Legitimate interests — Article 6(1)(f). Our interest, and the lender's, in assessing creditworthiness responsibly and meeting regulatory lending requirements. | We have weighed this against your rights. A soft search at the eligibility stage does not affect your credit score (see Section 4). |
| Detect and prevent fraud; keep the Services and your account secure; investigate misuse | Legitimate interests — Article 6(1)(f). Our interest in protecting our users, our platform, and the public from fraud and abuse. | This is a normal and expected part of running a secure online service. |
| Analyse usage and improve the Services | Legitimate interests — Article 6(1)(f). Our interest in understanding and improving the Services. | We use aggregated and technical data; you can object (see Section 9). |
| Personalise your experience when you are signed in — show you relevant vehicles and offers based on your account activity and preferences | Legitimate interests — Article 6(1)(f). Our interest in making your signed-in experience useful and relevant. | This applies only to signed-in account holders, not anonymous visitors. You can object at any time (see Section 9). |
| Send you marketing | Consent — Article 6(1)(a). | You choose whether to receive this, and you can withdraw consent / unsubscribe at any time, with no effect on the service. |
| Comply with legal and regulatory obligations (e.g. record-keeping for the regulated finance journey) | Legal obligation — Article 6(1)(c), and our legitimate interests in meeting our obligations as an Appointed Representative. | We keep certain finance records for defined periods (see Section 8). |
We hold a Legitimate Interests Assessment behind each use of Article 6(1)(f) and can provide a summary on request.
If we ever process special category data (the health/vulnerability exception in Section 1), we rely on an additional Article 9 condition — normally your explicit consent, your vital interests, or substantial public interest.
4. Our car finance service, and how we share your information
In short: When you use our finance journey, we are a credit broker, not a lender. We act as an Appointed Representative of our FCA principal. We share your details with our finance partner, the panel lenders, and credit reference agencies to check your eligibility and process your application, and we receive information back from them.
Who we are in the finance journey
Bobi.car Limited is an Appointed Representative of Automotive Compliance Limited ("ACL"), which is authorised and regulated by the Financial Conduct Authority (FCA). ACL's Firm Reference Number is 497010. ACL is our FCA principal and is responsible for overseeing our regulated credit-broking activity.
We are a credit broker, not a lender. We do not give advice or make recommendations — it is your choice whether to take any finance offered. For the full detail of who we are, how we are paid, and what to do if something goes wrong, please see our Initial Disclosure Document and Status Disclosure, which appear during the finance journey.
Who we introduce you to
We introduce you to one finance partner: Evolution Funding Limited, trading as My Car Credit ("MCC") (FCA Firm Reference Number 823324). MCC works with a panel of lenders and can arrange Hire Purchase (HP) and Personal Contract Purchase (PCP). When you submit a full application, you are handed over to My Car Credit / the chosen lender, and My Car Credit's own privacy notice then also applies to how they use your information. See My Car Credit's privacy notice at evolutionfunding.com/public/privacy-notice/.
The information we share, and who with
To check your eligibility, obtain a quote, and process an application, we share the information you give us with:
- Evolution Funding Limited (trading as My Car Credit) — to run the eligibility check, generate a quote, and submit your application
- The panel lenders that My Car Credit works with — to assess and (if you proceed) provide your finance
- Credit reference agencies — to carry out the credit search. The agencies used are Experian, Equifax, and TransUnion (TransUnion was formerly Callcredit)
- Automotive Compliance Limited — our FCA principal, for regulatory oversight, quality assurance, and complaint handling
The information we receive back
As set out in Section 1, the same parties send information back to us — your eligibility result, an indicative rate/APR band, credit-search information, and application status updates (delivered to us electronically). The source of this information is Evolution Funding / My Car Credit, the panel lenders, and the credit reference agencies named above.
Soft search vs hard search
There are two types of credit search, and we are clear about which happens when:
- Eligibility stage — a "soft search". When you check your eligibility, a soft search is carried out. A soft search does not affect your credit score and is not visible to other lenders on your credit file. It lets you see whether you are likely to be accepted, and an indicative rate, without any impact.
- Full application — a "hard search". If you decide to proceed to a full finance application, a hard search is carried out. A hard search is recorded on your credit file and can be seen by other lenders.
Your information and the credit reference agencies
When a credit reference agency receives a search from us or the lender, they may keep a record of it. The credit reference agencies may also use your information in the ways described in the Credit Reference Agency Information Notice (CRAIN) — an industry-standard explanation of how the agencies use credit data — available from each agency: Experian (experian.co.uk/crain), Equifax (equifax.co.uk/crain), and TransUnion (callcredit.co.uk/crain).
Is providing this information required?
Providing your finance application information is not a statutory requirement, but it is necessary to take the steps you have asked for — namely, to assess your eligibility and submit a finance application. If you do not provide it, we will not be able to check your eligibility or apply on your behalf. We never sell your data.
5. Who else we share your information with
In short: Outside the finance journey, we share information with service providers who help us run the Services, with dealers you ask to be connected to, and in a few specific situations such as a business sale or a legal requirement.
Service providers
We share information with third-party vendors, service providers, and contractors who perform services for us and need access to do so. We have contracts in place that require them to protect your information, use it only on our instructions, and not share it with anyone else. The categories of service provider we use include:
- Cloud computing and hosting services
- Data analytics services
- Account registration and authentication services
- Payment processing services
Car dealers and automotive partners
When you enquire about a specific vehicle or ask to be connected to a dealer, we share your contact details (name, email, phone) and relevant preferences with the relevant dealer so they can help you. We require dealers to use your information only to respond to your enquiry, to protect it in line with data protection law, not to use it for unrelated marketing without your separate consent, and to delete it when it is no longer needed for your enquiry. You can opt out of future dealer sharing by contacting privacy@bobi.car, though this may affect our ability to help you buy a car.
Other situations
- Business transfers — we may share or transfer your information in connection with a merger, sale of company assets, financing, or acquisition.
- Legal compliance and protection — we may share your information where necessary to comply with the law, respond to legal process, protect our rights, property, and safety, or those of our users and the public, or investigate potential breaches of our terms.
6. International transfers of your information
In short: We keep your information in the UK and EEA wherever we can. The main exception is some AI features, provided by AI service providers that may process data in the United States, under approved safeguards.
We host and process your information in the UK and the European Economic Area (EEA) wherever we can. The main exception is some of the AI features in our Services, which are provided by third-party AI service providers (such as OpenAI, Anthropic, and Google) that may process data in the United States; a small number of other providers (such as analytics) may also process data outside the UK. Wherever information is transferred outside the UK, we rely on appropriate safeguards under Article 46 of the UK GDPR — in practice the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses — and you can request a copy by emailing privacy@bobi.car.
7. Automated decisions about your finance eligibility
In short: If you check your finance eligibility, the decision about whether you are eligible — and the indicative rate you are shown — is made solely by automated means, without a person reviewing it. This is allowed because it is necessary to take the steps you have asked for before a finance agreement. You have the right to ask a person to review the decision, to express your point of view, and to contest it.
What we decide automatically
When you check your finance eligibility, our finance partner's systems use the information you provide (such as your identity, address history, employment, income, and the finance you are looking for), together with information from credit reference agencies, to automatically assess whether you are likely to be accepted and to calculate an indicative rate or APR band. This decision is made solely by automated processing — no member of staff reviews it before you see the result.
This is a decision with a similarly significant effect on you, because it affects whether and on what terms you may be offered car finance. UK GDPR Article 22 therefore applies, and we are required to tell you about it clearly.
The logic involved, in plain terms
The assessment looks at how well your circumstances match a lender's lending criteria. It considers things like your credit history and credit score (from the credit reference agencies), your affordability (your income and outgoings relative to the finance you want), the consistency of the information you have provided (such as your address and employment history), and the details of the finance and vehicle. Based on how these factors score against the lender's pre-set criteria, the system returns an eligibility outcome and an indicative rate band. Generally, a stronger credit profile and clearer affordability lead to a higher likelihood of acceptance and a more favourable indicative rate.
Important: an eligibility result is not the same as a final lending decision or a guarantee of finance. Being shown as eligible does not mean an application will be approved — affordability and the lender's full checks still apply at the application stage.
Why we are allowed to do this
We rely on the Article 22 exception that the automated decision is necessary for taking steps, at your request, prior to entering into a contract (the finance agreement). We only carry out this automated check because you have asked us to check your eligibility.
Your rights over this decision
You have the right to:
- Ask for a person to review the decision ("human intervention")
- Express your point of view about the decision
- Contest the decision and ask us to reconsider it
To do any of these, contact privacy@bobi.car and tell us you want a human review of your finance eligibility decision. We will arrange for a person to look at it.
8. How long we keep your information
In short: We keep your information only as long as we need it for the purpose we collected it, unless the law requires us to keep it longer. Finance records are kept longer for regulatory reasons.
We keep your personal information for as long as necessary for the purposes set out in this notice, unless a longer retention period is required or permitted by law (for example, tax, accounting, or regulatory requirements). When we no longer have a legitimate need to process it, we delete or anonymise it, or — if that is not immediately possible (for example, because it is in a backup) — we securely store and isolate it until deletion is possible.
Specific periods:
- Account information — for as long as you have an account with us, and then deleted or anonymised, subject to the exceptions below.
- Enquiry and marketing information — your contact details, the vehicles and finance options you have looked at, and your marketing preferences. We keep this so we can stay in touch and show you relevant vehicles and offers, for up to 3 years from your last interaction with us, and each time you engage with us that period restarts. You can opt out of marketing, or ask us to delete this information, at any time.
- Finance eligibility, quote, and application records — we keep records relating to the regulated finance journey for 6 years (in line with FCA record-keeping expectations and the limitation period for finance agreements), because we are required to keep adequate records of regulated credit-broking activity. We keep your detailed credit-search information only as long as we need it for this purpose, not for marketing.
If we keep some information after you close your account, it is only what we need to prevent fraud, resolve disputes, assist investigations, enforce our terms, or comply with our legal and regulatory obligations.
9. Your privacy rights
In short: You have rights over your personal information. You can exercise them at any time, free of charge in most cases, by contacting privacy@bobi.car.
Under the UK GDPR you have the following rights. Which ones apply in a given situation depends on the lawful basis we are relying on (see Section 3).
- The right to be informed — through notices like this one.
- The right of access — to ask for a copy of the personal information we hold about you.
- The right to rectification — to have inaccurate information corrected and incomplete information completed.
- The right to erasure — to ask us to delete your personal information in certain circumstances.
- The right to restrict processing — to ask us to limit how we use your information in certain circumstances.
- The right to data portability — where we process your information by automated means based on consent or contract, to receive it in a structured, commonly used, machine-readable format, or have it sent to another organisation.
- The right to withdraw consent — where we rely on consent (for example, marketing), you can withdraw it at any time. This does not affect processing carried out before you withdrew it. Withdrawing marketing consent will not affect the service.
Your right to object
You have the right to object to our processing of your personal information. Where we process your information for direct marketing, you can object at any time and we will stop. Where we rely on legitimate interests (see Section 3), you can object on grounds relating to your particular situation, and we will stop unless we have compelling legitimate grounds that override your interests, or we need to process for legal claims.
To object, or to exercise any other right, contact privacy@bobi.car.
Opting out of dealer sharing and marketing
- Dealer sharing — you can ask us to stop sharing your details with dealers by contacting privacy@bobi.car. This may limit our ability to help you buy a car.
- Marketing — you can unsubscribe at any time using the link in any marketing email, or by contacting privacy@bobi.car. We may still send you service messages necessary to administer your account.
Your right to complain to the ICO
If you have a concern about how we handle your personal information, we would like the chance to put it right — please contact privacy@bobi.car first. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at any time:
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
10. Who controls your data
In short: For the finance part of the journey, more than one organisation is involved, and each is responsible for its own use of your information. We are not "joint controllers" — each party is a separate controller for its own part.
When you use our finance journey, each of these parties acts as a separate (independent) data controller for its own part of the processing:
- Bobi.car Limited — for operating the marketplace and the eligibility/application journey, as a credit broker and Appointed Representative.
- Evolution Funding Limited, trading as My Car Credit — for running the eligibility, quoting, lending, and application processing. Evolution Funding is the controller for the information it holds, and its own privacy notice (see Section 4) explains how it uses your information.
- Automotive Compliance Limited — our FCA principal, for overseeing our regulated credit-broking activity.
When we pass your information to Evolution Funding, we do so under a data-sharing agreement, and they then process it as a separate controller under their own privacy notice. We only share your information with parties we are satisfied will handle it responsibly and in line with data protection law.
You can contact privacy@bobi.car about anything relating to the information we hold, and we will help direct any request to the right party.
11. How to exercise your rights
In short: Email privacy@bobi.car, or use your account settings, and we will respond in line with data protection law.
The easiest way to exercise any of your rights is to email privacy@bobi.car. You can also review or update much of your information directly in your account settings, and you can ask us to deactivate or delete your account.
We will respond to your request within the time limits set by data protection law (usually one month). We may need to verify your identity before we act, to protect your information. There is normally no charge, though we may charge a reasonable fee or refuse a request that is clearly unfounded or excessive — and we will explain if so.
12. Cookies and tracking technologies
In short: We have chosen not to use cookies or similar tracking technologies, so there is no cookie banner on our site and we do not track you across other websites. If that changes, we will update this notice and ask for your consent where the law requires it.
We have made a deliberate decision not to use cookies, web beacons, pixels, or similar tracking technologies at this time. That means you will not see a cookie consent banner on our site, and we do not build advertising profiles or track your activity across other websites.
We still collect some basic technical information to keep the site secure and working, and to understand how it is used (see Section 1), but we do this without placing tracking cookies on your device.
If we introduce cookies or similar technologies in the future, we will update this notice first and, where the law requires it, ask for your consent through a clear banner before any non-essential cookies are set.
13. Artificial intelligence in our Services
In short: Some features use AI to help you find a car. We provide these through third-party AI providers, including OpenAI.
We offer features powered by artificial intelligence and machine learning ("AI Products") — for example, AI-assisted car recommendations, intelligent search and filtering, and matching your requirements to available vehicles. We provide these through third-party AI service providers (such as OpenAI, Anthropic, and Google). Your input and the relevant personal information are shared with and processed by these providers to deliver the feature (see Section 6 on international transfers). All such processing is handled in line with this notice and our agreements with those providers.
Social logins: if you register or log in using a social media account (Facebook, Google, X, or similar), we receive certain profile information — typically your name, email address, and profile picture. We use it only as described in this notice. We do not control how your social media provider processes your information, so please review their privacy notice too.
14. How we keep your information safe
In short: We use appropriate technical and organisational measures to protect your information, but no online service can be guaranteed 100% secure.
We have put in place appropriate and reasonable technical and organisational security measures to protect the personal information we process. However, no transmission over the internet or method of storage is completely secure, so we cannot guarantee absolute security. Transmission of information to and from the Services is at your own risk, and you should only use the Services in a secure environment.
We require our dealer partners and service providers to put in place appropriate security measures and to use your information only for the purposes for which it was shared, and we review these arrangements to maintain compliance.
15. Children's information
In short: Our Services are not for children under 18.
We do not knowingly collect or market to children under 18, and we do not knowingly sell their personal information. By using the Services, you confirm you are at least 18, or that you are the parent or guardian of a minor and consent to their use. If we learn we have collected information from someone under 18, we will deactivate the account and take reasonable steps to delete the data. If you believe we hold any such data, contact privacy@bobi.car.
16. Updates to this notice
In short: We may update this notice, and we will change the "last updated" date when we do.
We may update this Privacy Notice from time to time. The updated version is indicated by a revised "last updated" date at the top. If we make material changes, we will notify you, for example by posting a prominent notice or contacting you directly. We encourage you to review it regularly.
17. How to contact us
In short: Email privacy@bobi.car, or write to us at the address below.
If you have questions or comments about this notice, or you want to exercise your rights, you can reach us at:
Bobi.car Limited
Data Protection — privacy@bobi.car
124–128 City Road, London EC1V 2NX, United Kingdom
Registered in England & Wales, company number 15966931
We are registered with the Information Commissioner's Office (ICO) and pay the data protection fee. No statutory Data Protection Officer is appointed; data protection matters are handled by our data protection contact at privacy@bobi.car.
For our role in the regulated finance journey, Bobi.car Limited is an Appointed Representative of Automotive Compliance Limited (FCA FRN 497010), authorised and regulated by the Financial Conduct Authority.