Privacy Policy

Last updated: 11 October 2026

This Privacy Policy explains how ScrapTrak (“we”, “us”, “our”) collects and uses your personal information when you visit scraptrak.co.uk (“Website”), request a quote, book a collection, contact us, or otherwise interact with us. It also describes your UK GDPR rights and how to exercise them. Please read it together with our Cookie Policy.

1) Who we are (data controller)

ScrapTrak
Dundas Spur, Hilsea, Portsmouth, PO3 5NX, United Kingdom
Phone: 0333 050 0500
Email: privacy@scraptrak.co.uk

For data protection purposes we act as the data controller for the activities described in this policy (unless stated otherwise).

2) What we collect

We collect and process the following categories of personal data (depending on your interactions with us):

  • Contact & identity: name, phone number, email address, postal address, photo ID details (at/near collection as required by UK scrap regulations).
  • Vehicle information: registration (VRM), make/model, mileage (optional), condition notes (e.g., non-runner), access notes (e.g., height limits, locked brakes), photos you provide.
  • Booking & transaction: preferred dates/times, collection address, payment confirmations (not full card/bank credentials—see “Payments” below), quotes, invoices.
  • Technical/usage: IP address, device and browser information, pages viewed, referring URLs, cookie preferences (see Cookie Policy).
  • Communications: emails, form submissions, calls/notes necessary to provide service and customer support.

3) Where we get your data

  • Directly from you via our quote/booking forms, contact form, phone, or email.
  • Automatically from your device when you use the Website (cookies/analytics—see Cookie Policy).
  • From third parties you use to communicate with us (e.g., email providers) or where you have publicly shared details relevant to fulfilling our contract (rare).

4) How we use your data & lawful bases

Purpose Lawful basis (UK GDPR)
Provide quotes, manage bookings, collect vehicles, process payments, issue paperwork (e.g., CoD) Contract (Art. 6(1)(b))
ID and compliance checks (e.g., scrap metal regulations, DVLA notification) Legal obligation (Art. 6(1)(c))
Customer support, service improvements, preventing misuse/fraud Legitimate interests (Art. 6(1)(f))
Analytics, optional marketing communications, non-essential cookies Consent (Art. 6(1)(a)) — where required by PECR
Record-keeping, tax and accounting Legal obligation (Art. 6(1)(c))

If we ever need to process your data for a new purpose, we’ll explain the lawful basis and your choices first.

5) Payments

We pay customers by instant bank transfer (Faster Payments) at collection. We do not store your full banking credentials; we only retain what’s necessary to confirm payment and comply with accounting obligations.

6) Who we share your data with

We share personal data only when necessary, with appropriate safeguards:

  • Authorised Treatment Facilities (ATFs) and logistics partners — to depollute/process vehicles and complete collections (including issuing Certificates of Destruction where applicable).
  • DVLA / regulatory bodies — to complete required notifications and comply with law.
  • Service providers — website hosting, security/anti-spam, email, analytics, form and consent tools, customer support platforms, accountants.
  • Professional advisers — legal or accountancy advice if required.
  • Law enforcement or regulators — where legally required.

We do not sell your personal data.

7) International transfers

Some service providers may process data outside the UK/EEA. Where this occurs, we rely on adequacy regulations (e.g., UK/EEA adequacy decisions) or put in place appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (as applicable), plus additional measures where necessary.

8) How long we keep your data

  • Quote enquiries & routine correspondence: up to 24 months from last meaningful contact.
  • Booking/collection records & compliance (including ID checks): typically 3–6 years after the financial year in which the job completed (to meet legal/accounting obligations).
  • Invoices & payment confirmations: 6 years (UK tax requirements).
  • Cookie preferences: as per your consent settings (see Cookie Policy).

We may retain data longer if needed for legal claims, audits or regulatory requests. When no longer needed, data is securely deleted or anonymised.

9) Security

We use reasonable technical and organisational measures to protect your information (e.g., TLS encryption in transit, role-based access, least-privilege controls, logging). No system can be 100% secure; we continuously review and improve our safeguards.

10) Your rights

Under UK data protection law, you have the right to:

  • Access the personal data we hold about you.
  • Rectification of inaccurate or incomplete data.
  • Erasure (“right to be forgotten”) where applicable.
  • Restriction of processing in certain circumstances.
  • Data portability where technically feasible and lawful.
  • Object to processing based on legitimate interests or to direct marketing.
  • Withdraw consent at any time for processing that relies on consent (this won’t affect prior lawful processing).

To exercise your rights, email privacy@scraptrak.co.uk. We may need to verify your identity. We aim to respond within one month.

11) Marketing choices

We only send electronic marketing where permitted by law (consent or soft opt-in, as applicable). You can opt out at any time by using the unsubscribe link in our messages or contacting privacy@scraptrak.co.uk.

12) Cookies & analytics

We use cookies to operate and improve the Website and, where consented, for analytics/advertising. See our Cookie Policy for details and to manage your preferences.

Quote form security

We use Cloudflare Turnstile to help protect our quote form from automated misuse. Cloudflare processes security information such as your IP address, browser information and the website you are visiting to perform this check and improve its bot detection. Read Cloudflare’s Turnstile Privacy Addendum for details. If the check cannot load, you can call 03330 500 500 for a quote.

Optional quote form statistics

If you choose to allow them, we record which steps of the quote form you reach, loading times and form errors so we can find and fix problems. These statistics are kept by ScrapTrak for 30 days and do not include what you type into the form. You can decline them without affecting your quote.

13) Children’s data

Our services are for adults. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps.

14) Automated decision-making

We do not carry out decisions based solely on automated processing that produce legal or similarly significant effects about you.

15) Complaints

If you have concerns about how we handle your data, please contact us first at privacy@scraptrak.co.uk and we’ll do our best to resolve them. You also have the right to complain to the UK Information Commissioner’s Office (ICO):

ICO website: ico.org.uk/make-a-complaint • Tel: 0303 123 1113

16) Changes to this policy

We may update this Privacy Policy to reflect changes in our processing, the Website, or legal requirements. The “Last updated” date shows when the most recent changes were made. Significant changes will be highlighted on this page and/or notified to you where appropriate.

This policy is intended to meet UK GDPR and PECR transparency requirements for ScrapTrak’s activities in the UK.