Privacy Policy
v1.2
Last updated: 3rd March 2026
1. Who we are
Zelfi Ltd is the controller for your personal data. Contact: kevin@zelf.co.uk/Unit 1 Hopton Road, Devizes, SN102EU
2. What data we collect
We collect: account data; driving/eligibility data (licence details, DVLA check results, verification status, conviction/endorsement indicators where returned by checks); identity verification data (where used); payment data (tokenised payment method details and transaction records); trip/rental data (bookings, time, station, mileage, fuel status, photos/reports); telematics data (location, access logs, vehicle status and usage telemetry); support data; and marketing/analytics data (device identifiers and app/web events such as install, registration, verification/validation, booking, attribution and campaign performance data).
3. Why we use your data and lawful bases
We use data to provide the Service (contract); for safety, security and fraud prevention (legitimate interests and sometimes legal obligation); for insurance/claims/legal compliance (legal obligation and legitimate interests); for customer support (contract and legitimate interests); to improve the App/Service (legitimate interests and/or consent depending on the tool); and for marketing measurement and optimisation (consent where required under PECR/SDK rules and platform requirements; otherwise legitimate interests where permitted).
4. Who we share data with
We share data with identity/licence verification providers; payment providers and banks; communications providers (SMS, email, push); telematics/IoT providers; hosting and security providers; analytics/attribution/tag management providers; advertising platforms (e.g., Google/Meta) for measurement/optimisation; insurers, brokers, claims handlers, recovery and repair partners; authorities where required; and professional advisors.
A current list of key integrations/sub-processors is maintained at: [LINK: Integrations & Sub-processors].
5. International transfers
Some providers may process data outside the UK. Where this happens, we use appropriate safeguards (e.g., UK IDTA or UK Addendum to SCCs) and additional measures where required.
6. Cookies/SDKs and marketing measurement
Details of cookies/SDKs, consents and controls are in our Cookies & SDK Policy, including how to change your preferences.
7. Retention
We keep personal data only as long as needed for the purposes above, including for legal, compliance, fraud prevention and claims/insurance defence. [Insert retention periods].
8. Your rights
You have rights to access, correct, delete, restrict, object, and data portability (where applicable). You can withdraw consent for marketing cookies/SDKs at any time (see Cookies & SDK Policy).
9. Complaints
Contact us at [privacy email]. You may complain to the ICO.