Privacy Policy
How we collect, use and protect your information — and the rights you have over it.
1. Introduction
Welcome to Car Boot Directory (carbootdirectory.co.uk). We are committed to protecting your privacy and collecting as little personal data as we can while still running a useful directory. This policy explains what we collect, why, and the rights you have under UK data protection law (UK GDPR and the Data Protection Act 2018).
2. Information we collect
2.1 Information you give us
When you add a sale, leave a review, report a problem with a listing, or contact us, we collect what you type into the form: typically your name, your email address, and the content of your submission (including any organiser or venue details you provide). We also store a one-way hash of your IP address with form submissions, used solely to prevent spam and abuse — we do not store the raw IP address itself.
2.2 Email alerts
If you sign up for email alerts, we store your email address and your chosen preferences. We use double opt-in: you will only receive alerts after you confirm your address via the link we send you. Every email includes an unsubscribe link, and unsubscribing takes effect immediately.
2.3 Information collected automatically
Standard, short-lived server logs (IP address, requested page, browser type) are kept by our hosting and content delivery infrastructure for security and error diagnosis. Your browser stores your theme preference and saved favourites locally on your device; that data never reaches our servers. If you accept analytics or advertising cookies via our consent banner, Google Analytics 4 and Google AdSense collect additional information described in section 4 below. See our Cookie Policy for the full list of cookies and how to control them.
3. How we use your information
- To publish and maintain accurate car boot sale listings
- To review and publish your submissions, reviews and reports
- To respond to your messages
- To send email alerts you have opted in to
- To keep the site secure and prevent spam
Our lawful bases are: performance of our service to you (handling submissions and alerts), our legitimate interests (site security, spam prevention), and your consent (marketing emails), which you can withdraw at any time.
4. Third-party services
We do not sell your personal information. We use the following third-party services:
- Cloudflare — delivers the site and protects it from abuse and attacks. Cloudflare processes connection data (such as your IP address) to route and secure traffic, and may set a small number of strictly-necessary security cookies (see our Cookie Policy).
- Google Analytics 4 (GA4) — helps us understand how visitors use the site (pages viewed, approximate location, device type), so we can improve it. Loads only after you accept analytics cookies in our consent banner.
- Google AdSense — displays adverts that help fund running the directory. Loads only after you accept advertising cookies in our consent banner.
- Google Search Console — a webmaster tool we use to monitor and improve how the site performs in Google Search. It reads publicly available search data and does not set any cookies or collect visitor data from your browser.
Both Google Analytics and Google AdSense are implemented with Google Consent Mode v2: they default to "denied" and only activate once you give consent via our cookie banner. We may also disclose information to legal authorities where required by law.
5. Data retention and security
We keep personal data only as long as needed for the purpose it was collected — for example, contact messages are kept while we deal with them, and alert subscriptions until you unsubscribe. We take reasonable technical and organisational measures to protect your information, but no website can guarantee absolute security.
6. Your rights under UK GDPR
You have the right to:
- Access a copy of the personal data we hold about you
- Have inaccurate data corrected
- Have your data erased ("right to be forgotten")
- Restrict or object to our processing of your data
- Receive your data in a portable format
- Withdraw consent at any time (for example, unsubscribe from alerts)
To exercise any of these rights, email [email protected]. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with how we handle your data.
7. Children's privacy
Our website is not intended for children under 13, and we do not knowingly collect data from children.
8. Changes to this policy
We may update this Privacy Policy from time to time. The new version will be posted here with an updated "Last updated" date.
9. Contact us
If you have any questions about this Privacy Policy, email us at [email protected] or use our contact page.