1. Controller and contact
DriveGT Holdings Ltd. is the controller for the DriveGT platform processing described here. Registered in England and Wales, company number 17297798. Registered office: 30 Churchill Pl, Canary Wharf Estate, London, England, E14 5RE. Our named privacy contact is Nikolaos Koukis. Privacy questions, complaints and rights requests: info@drivegt.com.
An app store, payment provider or another member may separately determine how it processes information you give it. The store's named application distributor and the DriveGT platform operator are not necessarily the same entity; see the current store listing and applicable software licence.
2. Sources and information needed to provide the service
We receive information from you, your use of the service, members interacting with you, payment/email/push providers and permitted public automotive sources. This includes tags, reports, conversations and offers concerning your account. We do not treat publicly accessible information as exempt from privacy obligations.
An account requires the identity, contact, credential and membership information requested in the registration/payment flow. Without required information we may be unable to create or verify an account, process payment or provide a requested feature. Optional photographs, biographies, posting, notification permissions and marketing choices are not all conditions of membership.
3. Account and membership information
- Name, username, email, securely hashed password, country, account/business type and any business name supplied.
- Profile photo, cover photo, garage subtitle/bio, account status, verification and policy-acceptance information where recorded.
- Plan, payment amount/currency, order/provider references, activation/expiry dates, billing country, invoices, receipts and limited payment metadata. Stripe handles payment credentials; DriveGT does not store full card numbers.
- Wingman invitations, referral relationships, redemption and follow information when you use those features.
4. Garage, car and configuration information
We store the car details you enter or confirm: year, make, generation/model/trim, body and powertrain, originality, condition, mileage, ownership status/history, modifications, documentation statements, market, offer/sale settings, media and valuation inputs/outputs. Data about a car can become personal data when linked to an identifiable owner.
The configurator stores suggested factory-option data separately from your Fitted, Not Fitted and Not Sure declarations. Shared exact-car catalogs and generated option illustrations can be reused across members; another member does not receive your fitted answers merely by selecting the same car.
Search prompts, requested corrections, AI operation records and generated reference/cinematic assets may also be stored to provide the feature, reuse completed results and investigate failures. Photographs, video, captions and original files may contain people, number plates, location information or embedded metadata. Avoid submitting information that is unnecessary or that you have no right to share.
5. Moments, messages, offers and engagement
Member Moments include captions, uploaded photos/video, selected audience, user/car tags, edits, replies, respects, saves, reports and mutes. The service stores the relationship and permissions needed to deliver that content to eligible readers.
Messages, attachments, contact requests, offers/counter-offers and their status/history are processed to deliver the conversation and apply contact, membership and anti-abuse rules. These services are not represented as end-to-end encrypted. Do not share passwords, unnecessary identity documents or bank credentials.
Follow, block, view, respect, save, share and notification events support member features, activity summaries and abuse investigation. A view/offer notification can reveal the interacting member to the relevant recipient; an external guest view is not a named guest identity. Different features have different visibility rules.
6. Technical, support and communication data
Technical data can include IP address, user agent, device/browser type, app version where reported, session and installation identifiers, request path/time/status, coarse country/region, security events, errors and performance records. Country selected in your account or for a valuation is distinct from approximate location inferred from IP.
Optional push uses a subscription/device token and installation information. Camera, microphone, photo selection and any device location permission depend on your device and the feature requested. Refusing an optional permission can prevent that feature. A cookie preference is not itself permission to use precise device location.
Support includes what you submit, the issue and relevant account/payment information. Transactional email records may include recipient, template, provider reference, delivery, bounce/complaint and recorded open/link events. Such telemetry is not reliable proof that a person read an email; privacy protections and automated scanners can affect it.
7. Purposes and lawful bases
- Contract/requested service: account access, purchased membership, billing delivery, your chosen garage/car settings, configuration and valuation tools, requested posts/media, messages/offers and related service notifications.
- Legitimate interests: proportionate security, fraud and abuse prevention, troubleshooting, permitted operational reporting, moderation, handling complaints and protecting legal claims. We balance those interests against your rights; legitimate interests is not a substitute for consent where consent is required.
- Legal obligation: necessary tax/accounting evidence, legally required records, valid regulatory or court requirements and applicable privacy/safety duties.
- Consent where required: optional storage/access technologies, advertising measurement or audience matching and electronic marketing. A request to use a feature and acceptance of the Terms are not blanket marketing consent.
We use the basis appropriate to the specific purpose. You can ask us to explain the basis and information used for a particular operation. We do not use contract necessity to justify unrelated advertising.
8. What visitors and other members can see
Permitted public garage/car pages can be viewed by signed-out visitors and reached through links, search engines, discovery or permitted features. Depending on the settings and content you provide, the page can display your username, first name, country, profile/cover image, subtitle, full bio and eligible car details/media. The platform is not a promise that every garage is members-only.
Garage, car, valuation, offer and Moments controls are separate. A visible car can show Value Private when the viewer lacks valuation access. Temporary price masking on your own screen does not change another person's permission. Public garage profile responses exclude surnames and email addresses; the owner can still access their own account details for editing, and authorized staff can process necessary private records. Information you include yourself in a public username, bio, caption, photo or document can disclose your identity or contact details.
Changing settings cannot retrieve lawful copies someone already made. Sharing a link does not itself bypass current server permissions. Check the audience of the content and any information embedded in its media before sharing.
9. Moments audiences and private engagement
Moments is currently available to eligible desktop members, with Only Me, Followers and Moments Members audiences. It is not a signed-out public feed. Followers must also retain Moments access; blocks and current post permissions continue to apply.
The author and the authorized Architect administrator can see who respected or saved a Moment; other members do not receive those names/counts. Respect and Save are therefore not anonymous to the publisher. Relevant notifications can identify the actor to that publisher. Tags notify permitted recipients and do not make the tagged person's private garage/car public.
Replies to member Moments use private messaging. Supported replies to editorial/system Moments are visible within the eligible Moments audience. Administration may access relevant content and reports for moderation and support; Only Me describes the member audience, not a promise that platform administration can never process it.
An expired author's existing Moment may remain visible under its original audience, while the expired account loses paid editing/feed access. Contact support for a privacy/deletion request regardless of membership.
10. AI inputs, outputs and shared knowledge
Requested AI operations can send car descriptions, configuration/condition/market inputs, prompts and, for cinematic generation, the selected image to AI providers. Some operations can consult search sources; not every option or specification is verified against live manufacturer evidence. The AI & Valuation Policy explains accuracy limitations.
Google Gemini is used for current search, option, image, valuation and editorial operations. Other configured AI tools can support particular or fallback operations, including OpenAI. Provider involvement depends on the operation; public automotive source lookup is distinct from uploading your private media.
Completed generic catalog knowledge/reference illustrations can be retained and reused without carrying forward member-specific fitted answers. Your original photo is not published to other members merely because a catalog is shared. We retain operation metadata as necessary for delivery, reuse, cost/reliability checks and complaints.
Do not submit sensitive or unnecessary personal information in AI inputs. Provider processing can include safety/abuse checks, temporary retention and international processing under the applicable service terms. This notice does not promise zero provider retention or establish consent to train models on your private content.
11. Personalization, ranking and administrative reporting
Discovery and recommendations can use current access, recency, category, country variety, saved preferences, car data, estimated value and recorded interactions. Rankings can rotate; they are not endorsements or verified investment recommendations.
Authorized administration can inspect operational account, visit, login/logout, successful action, preference, moderation and billing records to operate and secure the service. Metadata activity reporting is distinct from the contents of a private message and from public member statistics.
Car valuation and feed ordering are automated informational outputs, not a decision granting credit, insurance, employment or another legally significant personal entitlement. Account/payment/security controls can also be automated. If a restriction appears wrong or materially affects you, contact info@drivegt.com for investigation rather than assuming an AI estimate verifies the decision.
12. Cookies, analytics and advertising
The Cookie Policy explains device storage, essential session/security controls, functional choices, Google Analytics, Meta Pixel and campaign-attribution technologies, including current control limitations. The mobile browser implementation currently treats visits as Accept All automatically, and the current controls do not fully prevent optional browser and server measurement. This describes existing processing; it does not establish that a visitor has given valid advertising consent. Notification permission and acceptance of the Terms are separate.
Campaign measurement can involve landing/page events, registration and membership purchase events, amount/currency, click/attribution IDs, IP and user agent. DriveGT's server conversion payloads exclude email addresses, email hashes, first/last names and business names. Meta measurement can still include a hashed internal account ID and country alongside click/browser identifiers and client IP/user agent. LinkedIn conversion matching uses a captured LinkedIn ad-click identifier; without one, the conversion is skipped. Remaining identifiers can still be personal data and this is not anonymous measurement.
We do not upload lists of our members' email addresses to Meta to create customer-list audiences. Removing contact-matching fields from new conversion payloads does not automatically recall information previously transmitted or erase a provider's independent records; applicable rights and retention rules continue to apply.
Meta and LinkedIn can combine event data with their own information for matching, measurement and advertising under their terms. We do not disclose private message bodies, Only Me Moments or private fitted-equipment answers as ordinary ad-conversion fields. Clicking an external ad or store link also exposes you to that service's own privacy choices.
DriveGT may feature publicly visible cars on our official Facebook and Instagram pages. We exclude cars hidden by their owners from new promotional posts, and do not publish members' full names or email addresses in those posts. Private valuations, messages, documents, Only Me Moments and private equipment answers are not included. Public visibility is not a general release for another person's likeness or media rights; any necessary additional permission must be obtained.
You can ask info@drivegt.com to remove a car from a DriveGT-controlled promotional post. Changing a car's visibility stops eligibility for new promotional use but cannot automatically recall independent copies or reshares on an external service. Advertising/audience matching can count as sharing or targeted advertising under some local laws; applicable objection/opt-out rights remain available. Contact info@drivegt.com about an applicable opt-out or rights request.
13. Email, push and service communications
Account verification, password recovery, purchase/invoice, membership and necessary security communications are distinct from marketing. Optional activity/editorial/event alerts follow available account preferences and device permissions. Turning off optional alerts does not stop an essential recovery email you request.
Postmark provides transactional email delivery, with a configured Google mail fallback where used. Delivery and payment-link records help us diagnose failed registration/payment journeys. Push uses the relevant browser/operating-system delivery service, including Firebase Cloud Messaging and Apple delivery infrastructure where applicable.
Where electronic marketing requires consent or another legally permitted route, we use that route and provide a way to opt out. You can object to direct marketing at any time. A global push permission does not itself consent to marketing emails or external advertising.
14. Recipients and service providers
- The people you choose to contact or the permitted audience of your garage, car or Moment, under the relevant access rules.
- Stripe for payments, payment security and related billing evidence; wallet/store operators for the separate services you use.
- Hosting, network/security and operational infrastructure, including the configured server/edge providers, for delivering and protecting the platform and storing media.
- Google/Gemini and configured AI providers such as OpenAI for the particular requested AI operation; publicly queried automotive sources where relevant.
- Postmark and the configured mail transport for service emails; Firebase/Apple/browser push infrastructure for permitted notifications.
- Google Analytics, Meta and LinkedIn for the permitted measurement/advertising purposes described above.
- Authorized staff and professional legal/accounting advisers where necessary, and authorities in response to valid legal requirements or necessary safety/fraud reports.
Providers have different roles: some act on our instructions, while payment, advertising and store operators can also be controllers for their own purposes. We limit disclosures to the relevant purpose. Ask info@drivegt.com for provider/transfer details relevant to your data.
15. International processing
Infrastructure, AI, email, payment, analytics, advertising and push providers can process information outside your country and outside the UK/EEA, including in the United States and other countries where the relevant provider operates. A selected car market or UK company address does not mean all processing occurs in that country.
A restricted transfer requires an applicable lawful mechanism, such as an adequacy decision or approved contractual safeguards with any required UK Addendum/IDTA and supplementary measures. The appropriate mechanism depends on the provider, entity, country and operation; it is not simply equivalent security or a promise that all destinations are adequate.
Contact info@drivegt.com for the transfer mechanism and a copy or description of relevant safeguards, subject to necessary redaction. Local rights and regulator complaint routes remain available.
16. Retention, removal and expiry
Account, car and membership records are kept for providing the service while the account remains, subject to deletion requests and lawful retention needs. An expired paid membership is not an automatic deletion instruction. Incomplete unpaid self-service registration accounts normally expire after 30 days; related audit, payment-attempt and communication evidence can have a separate justified retention period.
Removing a Moment makes the post unavailable through ordinary feed/media permissions, but the current deletion mechanism can retain underlying records/files pending lawful cleanup or a reviewed erasure request. Unclaimed Moment uploads older than 24 hours are eligible for scheduled cleanup. Removal from a page is not a promise of immediate physical erasure of every copy.
Billing/accounting evidence is kept for applicable tax/accounting requirements, generally at least six years from the end of the relevant UK company financial year, or longer where a specific legal investigation/claim requires it. This does not justify retaining all unrelated profile/media data for the same period.
Security, moderation, support, messages, offer and diagnostic records are retained according to their continuing operational purpose, dispute/claim period and legal obligations. Data should be restricted, minimized or removed when that justification ends. Backup/provider copies and other members' lawful copies can persist separately; ask about the category and status relevant to a deletion request.
These are retention criteria, not a claim that every category already has a single automated deletion timer. We do not promise account deletion erases third-party payment records, independent recipient copies or all historical backups immediately.
17. Security and administrative access
The service uses hashed passwords, encrypted connections, access controls, session checks and permissions for restricted content. Authorized staff may access relevant data to operate, support or investigate the service. These controls reduce risk but do not guarantee absolute security or end-to-end encryption.
Protect credentials and devices, check recipients and avoid unnecessary sensitive uploads. Report suspected unauthorized access or exposed data privately to info@drivegt.com with a description and redacted evidence. Do not send passwords, access tokens or full payment credentials.
18. Your rights and objections
Depending on applicable law and the processing basis, you can request access, correction, erasure, restriction, portability, information about processing, and objection to legitimate-interest processing. You can withdraw consent for the relevant purpose without affecting processing lawfully undertaken before withdrawal. Statutory exceptions and necessary identity checks can apply.
You have the right to object to direct marketing at any time, including related profiling. Contact info@drivegt.com and identify the purpose you want stopped. A refusal of optional marketing does not remove essential membership/security communications or prevent a necessary billing record.
Request account/data deletion through the routes on Security & Data Deletion or email info@drivegt.com. You do not need to renew to make a rights request. We ask only for proportionate evidence needed to locate the data or verify authority; do not send sensitive documents unless requested through an appropriate channel.
UK/EEA rights requests are normally handled within one month, subject to lawful extensions or other applicable rules which we explain. Where local law provides additional opt-out, access, correction, deletion or appeal rights, state your location and request so we can apply the relevant rules. We do not retaliate for exercising a lawful privacy right.
19. Privacy complaints and regulators
Email info@drivegt.com with Privacy Complaint in the subject, the affected account/data, concern and requested remedy. We investigate, keep you appropriately informed and provide a response without unjustified delay. Where UK complaints requirements apply, a complaint is acknowledged within 30 days; this is separate from the deadline for a data-rights request.
You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or to the relevant supervisory authority, including the authority in your EEA country of residence, work or the alleged infringement. Contacting us does not waive your right to complain to a regulator or seek a judicial remedy.
20. Children and changes to this notice
Member services are for people aged 18 or over. Do not create an account for a child. If you believe we hold personal information about a child in circumstances that require investigation or removal, contact info@drivegt.com. A store download rating is not permission to create an under-18 membership.
We update this notice when actual features, providers, purposes or legal requirements change. The date identifies this revision; material changes require the appropriate notice. A policy update does not itself supply consent for a new optional purpose. Contact info@drivegt.com for questions or an accessible copy.