Privacy policy

Rapid Vehicle Solutions Ltd (“Rapid”, “we”, “us”) is the data controller for the personal information described in this policy.

• ·Company number: 09949124
• ·Registered address: Wellington Mill, Bolton Road, Blackburn, England, BB2 3PZ
• ·Email: info@rapidvehiclesolutions.com
• ·Telephone: 01493 236071
• ·ICO registration number: [TBC — registration number to be confirmed]

No decision about you is made by a computer. A submitted application does not advance itself: a member of staff reads it and records the decision, their name and the time against it. You are not subject to a decision based solely on automated processing, and we do not run credit checks ourselves.

We collect different things at different stages. Your National Insurance number and your bank details are asked for on the application form itself, because a funder needs both to reach a decision and to set up payment if you go ahead.

When you make an enquiry

• ·Your name, email address and telephone number.
• ·Whether the enquiry is personal or for a business.
• ·Anything you type into the message box.
• ·What you told us you are looking for: make, model, budget range, maximum security deposit, annual mileage and timescale.
• ·Whether you opted in to marketing, and the time you did so.
• ·The vehicle you were looking at, if you enquired from a vehicle page.

We do not track which advert or search brought you here. The database has columns for that, and they are left empty — the code that used to fill them is switched off and now deletes its own cookie instead. See our cookie policy.

When you open a My Rapid account

• ·Your email address and a password, which is stored only as an Argon2 hash — we cannot read it, and nobody here can tell you what it is.
• ·A record of sign-in attempts, used to rate-limit them and to stop an account being brute-forced.

When you become a customer

• ·Your name, email, telephone and address.
• ·For a business agreement, the company name and company number.
• ·Notes made by our staff about your enquiry or order.

When you apply for a lease

• ·The name, email and telephone you confirm on the form — stored as what you attested to on the day, rather than overwriting your account record.
• ·The vehicle, the term, and whether the agreement is rolling.
• ·Three years of address history, held as separate dated addresses rather than as a paragraph, because a funder needs continuous cover and a gap has to be visible.
• ·Your date of birth. We use it to confirm your identity and to check you are 18 or over — an agreement cannot lawfully be entered into by anyone younger.
• ·Your marital status and how many dependents you have. These are affordability questions, not personal curiosity: what a household is already committed to is what decides whether a monthly payment is sustainable for you.
• ·Your National Insurance number, encrypted before it is stored. Only the last few characters are kept readable, so we can confirm it with you without anyone having to display the whole number.
• ·Your direct debit details — see below.
• ·A reference beginning with RVS and the year, which stays the same if you are asked to change something and submit again.
• ·The decision, who made it, when, and — if declined — the reason you were given.

We do not ask for your gender. It plays no part in an affordability decision and no funder requires it, so there would be no purpose to hold it for.

If you apply through a business

We additionally collect, about the business rather than about you:

• ·The full registered business name and Companies House number. A funder lends to the registered entity, so it has to be identified exactly — the name over the door is frequently not the name on the register.
• ·The trading name, where you trade under a different one, so correspondence reaches you under the name you use.
• ·The director’s full name, so we know who is authorised to enter into the agreement on the company’s behalf.

Documents you upload

For a personal application, depending on the agreement and the funder, we may ask for a driving licence, proof of address, proof of income — 3 months of payslips or 3 months of bank statements — or an insurance policy.

For a business application we ask for a different set instead, not in addition: photo ID for the person applying, proof of the business address, a business bank statement, a tax document from HMRC or your council, and the lease or rental agreement for the premises. Each has an age limit, shown on the checklist, because a document from four years ago proves where a business used to be.

For each file we store the file itself, its name, its size and type, and a checksum so a re-upload of the same file can be recognised without anyone opening it.

These are held in a private bucket with public access disabled. There is no address that will serve one of these files. Every download is authorised on the server against the specific customer it belongs to, and is logged.

Your direct debit mandate

Collected on the application form. Nothing is taken from your account when you apply, and nothing is taken at all unless your application is approved and you decide to go ahead. The Direct Debit Guarantee is shown on the form and applies to every payment we collect.

The account holder name, sort code and account number are encrypted with AES-256-GCM before they are written, using a key held separately from every other secret in the system. They are not readable from the database. The last four digits of the account number are the one part kept in the clear, so that we can confirm an account with you over the telephone without decrypting anything. Your National Insurance number is held the same way.

If your application is declined, the mandate and your National Insurance number are deleted with the rest of the application — see how long we keep things, below.

If that encryption key is ever missing or malformed, the system refuses to store the mandate at all. There is no path in the code that writes bank details unencrypted.

Records we keep of our own actions

• ·An audit trail of actions taken by our staff on your record — what was done, by whom, when, and the IP address and browser it was done from.
• ·Messages exchanged between you and our team through the portal.

A passport, driving licence or bank statement is not special category data under the UK GDPR, but we treat these as the most sensitive things we hold, and the controls described above reflect that.

Our database and our servers are in the United Kingdom. Files and email are handled by providers outside it, as set out below.

Where a provider processes personal data outside the UK, that transfer is covered by the UK International Data Transfer Addendum or equivalent safeguards in that provider’s terms. [TBC — confirm the transfer mechanism in place with each provider]

We do not sell your data, and we do not share it with advertisers. We share it with a funder only when you have asked us to arrange an agreement, and only what that funder needs to make a decision.

Six years matches the period during which a claim under the agreement could still be brought, which is the reason those records are kept rather than deleted sooner.

The documents you upload do not keep the six-year period. A bank statement or a payslip supports one funding decision; once the agreement it supported has ended there is no purpose left that needs the document itself, so it goes at 12 months rather than being held for as long as the contract record. That is why the rows above are different lengths — the contract is kept because a claim could still be brought on it, and the evidence used to reach it is not.

A declined application is deleted in full — the application, the address history, any mandate, and the files themselves are removed from storage, not merely unlinked.

How this is currently carried out. Deletion is performed on review by a member of staff. The scheduled job that will enforce these periods automatically is written but is not yet switched on, and we would rather say so than describe a timetable that nothing is keeping. We may also keep information for longer where it is needed for a live complaint, dispute, or a legal or regulatory obligation.

Under UK data protection law you have the right to:

• ·Be told what we hold about you and why — which is what this page is for.
• ·Get a copy of your data (a subject access request).
• ·Have it corrected if it is wrong or incomplete.
• ·Have it deleted, where we no longer have a reason to keep it. We cannot delete what we are required to keep for accounting, or what is needed for a live agreement or dispute.
• ·Restrict how we use it while a question about it is resolved.
• ·Object to processing we do on the basis of legitimate interests.
• ·Portability — receive the data you gave us in a machine-readable form, or have it sent to someone else.
• ·Withdraw consent to marketing at any time. Every marketing email has an unsubscribe link, and withdrawing does not stop the transactional emails about an order you have placed.

To exercise any of these, email info@rapidvehiclesolutions.com or write to us at the registered address above. We will respond within one month. There is no charge. We may ask you to confirm your identity first — that check exists to stop someone else obtaining your data, which is the risk a subject access request creates.

If you think we have handled your data wrongly, please tell us first — we would rather fix it. You do not have to, and you can go to the regulator directly.

You have the right to complain to the Information Commissioner’s Office, the UK’s independent data protection regulator.

• ·Online: ico.org.uk/make-a-complaint
• ·Helpline: 0303 123 1113
• ·By post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

For a complaint about the service itself rather than your data, see our complaints procedure.

If we change how we handle your data we will update this page and the date at the top. If the change is significant and affects an agreement you hold, we will tell you directly.