Privacy Policy

1. Who We Are

1.1. ITIRR Ltd (“ITIRR”, “we”, “us”, “our”) operates the Platform at itirr.com. ITIRR is a company registered in England & Wales (Company No. 17057177, registered address 167-169 Great Portland Street, London, England, W1W 5PF). ITIRR is a separate legal entity.

1.2. For the purposes of UK GDPR and the Data Protection Act 2018, ITIRR is the data controller for personal data collected through the Platform.

1.3. We are registered with the Information Commissioner’s Office (ICO) under registration number ZC129410.

1.4. The best way to contact us about privacy is legal@itirr.com.

1.5. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have. It is written in plain English on purpose — legal concepts are explained where they appear.

2. What Personal Data We Collect

2.1. Account data (all users). Your name, email address, username, password (stored only as a secure hash — we never hold your plaintext password), and optional phone number.

2.2. Identity verification. When you verify your identity through Stripe Identity, Stripe receives the photograph of your driving licence or passport and, where relevant, a selfie video. ITIRR does not receive or store these images. Stripe returns to us only a verification outcome (verified or not verified) and the date of verification. We store only that outcome — no document images and no biometric data.

2.3. Renter Booking data. When you book a vehicle we collect: the pickup and return dates; the vehicle booked; the total amount paid; whether you chose collection or delivery; and, if delivery, the delivery address.

2.4. DVLA check code (Renters). After payment, you submit a DVLA check code together with the last 8 digits of your driving licence number. We hold these temporarily so the Provider can view them and delete them automatically from our database as soon as the Provider accepts or declines the Booking. We do not query the DVLA ourselves and we do not see the information the DVLA reveals to the Provider.

2.5. Eligibility confirmation. At checkout you tick a single box confirming you meet the Provider’s stated eligibility rules (minimum age, penalty points limit, excluded endorsement categories). We record only a simple yes/no against the Booking — we do not collect any specific details about your penalty points, endorsements, or driving history.

2.6. Provider business data. For Providers we also collect: business type (limited company or sole trader); for limited companies, the Companies House number and the details returned by the Companies House API; trading name and business address; and bank/payout details (handled by Stripe Connect, not stored by ITIRR). We also record your Stripe Connect account identifier.

2.7. Vehicle listing data (Providers). Make, model, year, registration, colour, MOT and tax status (from the DVLA’s public vehicle enquiry API), photographs, specifications, pricing, delivery rules, cancellation policy, and the requirements you set for drivers.

2.8. Insurance declaration records (Providers). When you list a vehicle, and again when you accept each Booking, you make a declaration that a valid specialist hire policy is in force and covers the Renter for the rental dates. We record the declaration, its timestamp, and the IP it was made from. We do not collect or store insurance documents, policy numbers, insurer names, or any other insurance data.

2.9. Vehicle condition reports. At check-in and check-out, Providers and Renters submit photographs of the vehicle, the odometer reading, the fuel level, and written notes. These are stored against the Booking.

2.10. Messages. Message content sent between Renters and Providers through the Platform. All messages are logged. Phone numbers and email addresses in messages are automatically masked.

2.11. Damage claim data. If a Provider reports damage, we store the photographs, written description, amount claimed, and any response from the Renter.

2.12. Reviews. Ratings, titles, comments, and optional sub-ratings left after a completed Booking.

2.13. Payment data. Stripe processes all payments and deposits. Stripe stores your card details — we never receive or store the full card number. We receive only transaction references, amounts, and status.

2.14. Technical data. IP address, browser and device type, operating system, pages visited, time and date of visits, referring URL, and cookie identifiers. IP addresses are used for security, abuse prevention, rate limiting, and the audit record for insurance declarations.

2.15. What we never store. Photographs of driving licences or passports; biometric or facial data; endorsement codes, penalty points, or driving history; DVLA check codes beyond the short window needed to pass them to the Provider; full payment card numbers; or insurance policy documents.

3. Why We Collect Your Data and the Lawful Basis for Each Purpose

3.1. Under UK GDPR we must have a lawful basis for each purpose. This table explains what we do and why.

(a) Running the Platform and fulfilling your Booking. Account creation, identity verification, processing Bookings, taking payments, paying out to Providers, sending booking confirmations and status updates. Lawful basis: Contract (Article 6(1)(b) UK GDPR).

(b) Passing your DVLA check code to the Provider. So the Provider can verify your driving record with the DVLA before accepting the Booking. Lawful basis: Contract (Article 6(1)(b) UK GDPR) — this step is necessary to provide the service you asked for.

(c) Recording the Provider’s insurance declaration. To evidence that the Provider has confirmed insurance cover for each Booking. Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR) — our interest in a safe marketplace and a reliable audit trail.

(d) Security, fraud prevention, and abuse prevention. Rate limiting, logging, IP checks, account suspension. Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR).

(e) Dispute resolution and damage claims. Storing condition reports, damage evidence, and message history. Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR) and legal claims (Article 9(2)(f) where relevant).

(f) Legal and tax compliance. Retaining records for HMRC, anti-money laundering, and responding to law enforcement. Lawful basis: Legal obligation (Article 6(1)(c) UK GDPR).

(g) Platform improvement. Understanding how the Platform is used (through internal, aggregated reporting only — see section 10 on cookies). Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR).

(h) Marketing (newsletter and promotional emails). Only where you have opted in. Lawful basis: Consent (Article 6(1)(a) UK GDPR). You can unsubscribe at any time using the link in any marketing email.

4. Article 10 UK GDPR — Driving Licence Data as Criminal Offence Data

4.1. Article 10 UK GDPR places special restrictions on the processing of personal data relating to criminal convictions and offences. UK driving endorsements (including penalty points) generally fall within this category.

4.2. ITIRR’s position is straightforward: we do not query the DVLA, we do not receive any data back from the DVLA, and we do not store endorsement codes, penalty points, or conviction data. We pass a DVLA check code from the Renter to the Provider and then delete it. The Provider uses the code on the DVLA website directly.

4.3. What we retain after the check is a simple pass/fail outcome that the Provider records on the Booking — no underlying endorsement or conviction data.

4.4. The Renter’s driving licence details that are verified during identity verification are held by Stripe Identity as our processor, not by ITIRR. We receive only a verified/not verified outcome.

4.5. The endorsement group categories and penalty point thresholds shown on listings are Provider-set informational labels describing the Provider’s own requirements — they are not derived from, and do not contain, any Renter’s personal data.

4.6. Providers who look up a driving record on the DVLA website using a check code are independently responsible for their Article 10 compliance. Our Terms of Service require them to handle that data lawfully.

5. Who We Share Your Data With

5.1. We only share personal data with third parties where necessary and lawful. Our third-party service providers and the data they receive are:

(a) Stripe (Stripe Payments UK Ltd / Stripe, Inc.) — payment processor. Processes card details, deposits, refunds, and Provider payouts through Stripe Connect. Stripe is authorised by the FCA under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011. Privacy policy: stripe.com/privacy.

(b) Stripe Identity — identity verification. Receives your identity document and selfie video during verification and returns only a verified/not verified outcome to us. Stripe Identity acts as our data processor under a data processing agreement.

(c) Resend (Resend.com) — transactional email delivery. Receives your email address and the content of emails we send you (booking confirmations, status updates, magic-link sign-in emails, receipts). Resend acts as our data processor.

(d) Supabase (Supabase Inc.) — managed PostgreSQL database and file storage (EU region). Stores account data, Booking records, messages, condition report photographs, damage photographs, and other Platform content. Supabase acts as our data processor. Data is encrypted at rest.

(e) Vercel (Vercel Inc.) — hosting and edge delivery. Processes requests and may log IP addresses and request metadata. Vercel acts as our data processor.

(f) Upstash (Upstash, Inc.) — managed Redis used only for rate limiting. Temporarily stores a hashed identifier and request count. Upstash acts as our data processor.

(g) Google Maps Platform (Google Ireland Ltd) — used for postcode geocoding (converting postcodes to approximate map coordinates) and displaying map previews. No personal profile data or tracking cookies are used for this purpose.

(h) Companies House (public register) — when a Provider onboards as a limited company we look up their company number against the public Companies House API to confirm the business exists and to pre-fill business details. We do not send personal data to Companies House; we receive public company information back.

(i) Vehicle Providers. When you book a vehicle, we pass to the Provider: your first name; your DVLA check code (deleted immediately after they accept or decline); the last 8 digits of your driving licence (deleted at the same time); your pickup and return dates; whether you chose collection or delivery; and, if delivery, the delivery address. We do not share your email, phone number, home address, date of birth, or payment details. After Confirmation, the Provider’s business or trading name may become visible to you.

(j) Law enforcement and regulators. We may disclose personal data if required by law, court order, or a properly authorised regulator, or where we reasonably believe disclosure is necessary to prevent fraud, protect safety, or comply with a legal obligation.

5.2. We do not sell, rent, or trade your personal data for marketing or commercial purposes.

6. International Data Transfers

6.1. Our hosting and core data storage (Vercel, Supabase) use EU and UK regions wherever possible. Some service providers may transfer data outside the UK.

6.2. Where personal data is transferred outside the UK, we rely on one of:

(a) a UK adequacy decision for the destination country;

(b) the UK International Data Transfer Agreement (IDTA); or

(c) the EU Standard Contractual Clauses with the UK Addendum.

6.3. You can request details of the safeguards in place for a specific transfer by emailing legal@itirr.com.

7. How Long We Keep Your Data

7.1. We keep personal data only for as long as we need it, or for as long as the law requires.

(a) Active accounts. Kept while your account is active, plus 30 days after closure in case you reactivate.

(b) Closed-account core records. Name, email, and transaction history retained for 6 years after closure to meet HMRC tax record requirements and the Limitation Act 1980.

(c) Identity verification outcome. Retained for the life of the account. Deleted within 30 days of account closure unless needed for a live dispute or claim.

(d) DVLA check codes and the last 8 digits of a licence. Deleted from our database automatically at the moment the Provider accepts or declines the Booking.

(e) Insurance declaration records (Providers). Retained for 6 years to support any dispute relating to a Booking.

(f) Messages. Retained for 6 years after the associated Booking is completed.

(g) Vehicle condition reports and damage evidence. Retained for 6 years after the associated Booking is completed to support potential legal proceedings under the Limitation Act 1980.

(h) Payment records. Retained for 6 years in line with HMRC requirements.

(i) Reviews. Retained while the listing remains on the Platform and for 6 years after the Booking the review relates to.

(j) Server logs and rate-limiting data. Short-lived, generally deleted or anonymised within 30 days.

8. Your Rights Under UK GDPR

8.1. Under UK GDPR and the Data Protection Act 2018 you have the following rights:

(a) Access (Article 15). Ask for a copy of the personal data we hold about you.

(b) Rectification (Article 16). Ask us to correct inaccurate or incomplete data.

(c) Erasure (Article 17). Ask us to delete your data, subject to legal retention requirements (for example, tax records).

(d) Restriction (Article 18). Ask us to limit how we process your data in certain circumstances (for example, while we check accuracy).

(e) Portability (Article 20). Ask for a copy of data you provided in a structured, machine-readable format (such as CSV or JSON).

(f) Object (Article 21). Object to processing based on legitimate interests. Where you object we will stop unless we can show compelling grounds to continue.

(g) Withdraw consent. Where we rely on consent you can withdraw it at any time. This does not affect processing that happened before withdrawal.

(h) Not be subject to automated decision-making (Article 22). We do not make decisions about you using automated processing alone that have a legal or similarly significant effect.

8.2. To use any of these rights, email legal@itirr.com. We will respond within one calendar month. We may ask you to verify your identity before we act.

8.3. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

8.4. We would appreciate the chance to put things right first, so please contact us before you go to the ICO.

9. How We Protect Your Data

9.1. We take appropriate technical and organisational measures to keep your data safe, including:

(a) Encryption in transit. All traffic to the Platform uses TLS.

(b) Encryption at rest. Data stored in Supabase is encrypted at rest.

(c) Authentication. NextAuth with JWT sessions and industry-standard password hashing. Sign-in uses email and password; email verification is performed via a magic link.

(d) Rate limiting. Sensitive routes (sign-in, payment, messaging, bookings) are rate-limited via Upstash Redis to prevent abuse.

(e) Payment isolation. Card details are handled only by Stripe (PCI DSS Level 1). We never see full card numbers.

(f) Access controls. Internal access to personal data is role-based and restricted to authorised staff. Admin-level access is logged.

(g) Logging and monitoring. Application logs, audit logs for reviews and vendor responses, and cron job logs support security reviews and incident response.

9.2. If a personal data breach is likely to pose a high risk to your rights and freedoms, we will notify you and the ICO within 72 hours as required by Article 33 UK GDPR.

10. Cookies

10.1. Essential cookies. We use essential cookies for authentication (NextAuth session cookie), CSRF protection, and session state. These cookies are strictly necessary to run the Platform and cannot be switched off.

10.2. Analytics cookies. We do not currently use third-party web analytics (such as Google Analytics, PostHog, or Plausible) on the Platform. If that changes we will update this policy and, where required, ask for your consent before any non-essential tracking is set.

10.3. Marketing cookies. None in use. If this changes we will update this policy and obtain your consent.

10.4. Internal analytics. Providers and administrators can see aggregated performance information (bookings, earnings, review counts) in their own dashboards. This is drawn from your own account data — it is not third-party tracking.

10.5. You can manage cookies through your browser settings. Disabling essential cookies will stop you from signing in.

11. Children’s Privacy

11.1. The Platform is not intended for use by children. You must be at least 17 years old to book a vehicle (subject to the Provider’s higher age requirements, if any), and at least 18 years old to register as a Provider. We do not knowingly collect personal data from children.

11.2. If you believe a child has provided personal data to the Platform, please contact legal@itirr.com and we will delete it promptly.

12. Third-Party Links

12.1. The Platform may link to third-party websites (for example, the DVLA website or Stripe support pages). We are not responsible for the privacy practices of those sites. Please read their privacy policies.

13. Changes to This Policy

13.1. We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or the law.

13.2. We will email registered users at least 30 days before material changes take effect.

13.3. The latest version is always available at itirr.com/privacy.

14. How to Contact Us

14.1. For privacy-related questions, data subject access requests, or to use any of your UK GDPR rights, email legal@itirr.com.

14.2. General enquiries: hello@itirr.com.

14.3. Security concerns: security@itirr.com.

14.4. ITIRR Ltd, registered in England & Wales. Company No. 17057177. Registered address: 167-169 Great Portland Street, London, England, W1W 5PF. ICO registration: ZC129410.