Privacy policy

Who we are

Autoselecta is a trading name of Boxbox Life Ltd, a company registered in England and Wales (company number 12247285), whose registered office is at 3 Beale Road, Barrow, Bury St Edmunds, Suffolk, IP29 5ES, registered with the Information Commissioner’s Office under ZC258350. We buy cars at Japanese auctions for customers and import them, and we are the controller of the personal data described here. You can reach us on WhatsApp at +44 7908 911 247 or through our enquiry form.

What we collect and why

• Your account. Your email address, and your name and phone number if you give them. We use them to sign you in (with a password you choose, stored only in a form that cannot be read back, or a one-time code we email you), to contact you about your bids and to meet our legal obligations.
• Enquiries. What you tell us on the enquiry or trade form: name, email, phone, budget, timescale, the car you are after and your message. We also note the internet address you sent it from, only to stop automated spam. We use this to reply and to find you a car.
• Bids. The car, your maximum bid, the exchange rate we fixed it at and the result. Deposits are taken by our payment provider, Stripe: we never see or store your card number. A deposit is authorised on your card and only taken if you win.
• WhatsApp. If you message us on WhatsApp we receive your number, your WhatsApp name and your messages. Our WhatsApp assistant is automated: an AI model reads your messages to answer questions, suggest cars, and record the details you give (name, email, budget, timescale). A member of our team can read the conversation and take over at any time.
• Saved cars and alerts. The cars you save and the models you follow, so we can remind you before bidding closes and tell you when another is listed. You can turn each email off in your account or from the link in the email.
• The cars you look at, only with your OK. If you choose “Accept all” in our cookie notice, we remember which cars you open, under a random id in your browser (and under your account once you sign in), with the cars you save. From these we work out the makes, models, kinds of car, age and price you seem to like, and show you other cars at auction under “Picked for you”. This is profiling, but it only chooses which cars to show you: it never affects your prices, your deposit or whether you can bid. We keep each car for six months after you last looked at it. Choose “Essential only” and we delete what we had, including, if you are signed in, what your account looked at on other devices.
• “Cars you may like” emails, only if you ask. If you tick the box when you make an account, or turn them on in your account, we email you about once a week with cars picked the same way, importable to the country you chose. We record when and where you asked and the words you agreed to. Every email has a link that stops them at once, and your email app’s own unsubscribe button works too.
• Browsing. Our servers keep routine technical logs (such as internet address and pages requested) for security and to fix faults.

Our legal bases are: taking steps at your request before a contract and performing it (your account, enquiries, bids, buying and importing your car, and the saved-car emails you set up); our legitimate interests in running and securing the service and answering questions; your consent, for remembering the cars you look at and for “Cars you may like” emails, which you can withdraw at any time as easily as you gave it; and legal obligations, such as keeping financial records.

Automated decisions

Before you can bid online, our WhatsApp assistant checks you have given us your name, a working email, your budget and timescale, and that you understand how the deposit works. If you have, it switches on online bidding for your account automatically. If you disagree with a decision, ask for a person to review it and one of our team will.

The cars picked for you (see above) are chosen automatically, but they only decide which cars we show you first. They have no legal or similarly significant effect on you.

Who processes data for us

We use these companies to run the service. Each processes data only on our instructions.

• Stripe: card payments and deposit holds.
• Meta (WhatsApp): delivering WhatsApp messages.
• Anthropic: the AI model behind our WhatsApp assistant.
• Klaviyo, Google Workspace and Resend: sending our emails, such as sign-in codes, alerts and, if you ask for them, cars you may like.
• Vercel, Hostinger and Neon: hosting the website and its database.
• Cloudflare: encrypted backups.

Some of these companies are based in, or process data in, the United States. Where data leaves the UK, it is protected by the UK’s approved safeguards (such as the UK Extension to the EU–US Data Privacy Framework or the ICO’s international data transfer agreement).

We do not sell your data, and we do not use advertising cookies or share what you look at with advertisers. We count visits to our pages and measure how quickly they load anonymously (Vercel Web Analytics and Speed Insights), without cookies and without identifying you.

Cookies

When you first visit we ask which cookies you are happy with. Apart from the essential ones and the free-car-pages count below, nothing is set until you say so, and you can change your answer at any time: Cookie settings.

Essential: always on, needed for the site to work

• as_session: keeps you signed in. Removed when you sign out.
• as_country (and an older as_market): the country you are importing to, so we only show cars you can legally import there. Up to a year. We may suggest one from your approximate location (your country only, from your internet address), which we do not store.
• as_consent: your answer to the cookie question, so we don’t ask again. A year.
• as_google_state: for our staff only, a security check while connecting Google Search Console. Ten minutes.

For every visitor: free car pages

• as_seen: the numbers of the cars you have opened while signed out, so after a few we can ask you to make a free account to see more. Nothing else is in it, it is never used for advertising or shared, and it is removed after 90 days. We rely on our legitimate interest in asking regular visitors to make an account; if you would rather it were not set, make a free account and it is no longer used.

Only if you choose “Accept all”

• as_visitor: a random id for your browser, so we can remember the cars you open and pick others you may like. A year, or until you choose “Essential only”.

How long we keep it

We keep your account, enquiries and chats while they are useful to you, and delete them when you ask (see below). The cars you look at are kept for six months after you last looked at each, and a record of the cars we have emailed you for six months, so we never send one twice. Records of bids, payments and purchases are kept for six years, as UK tax law requires. Sign-in codes expire after ten minutes.

Your rights

Under UK data protection law you can ask for a copy of your data, have it corrected or deleted, object to how we use it, or ask us to restrict it. Where we rely on your consent you can withdraw it at any time (cookie settings, your account, or the link in any email), and you can always object to marketing emails: we will stop them. You can also complain to the Information Commissioner’s Office at ico.org.uk, though we would like the chance to put things right first.

Deleting your data

1. Message us on WhatsApp at +44 7908 911 247, or send an enquiry, saying you want your data deleted. Include the email address or phone number you used with us.
2. We will confirm it is you, then delete your account, enquiries, WhatsApp conversations, saved cars and alerts, and the cars you looked at.
3. We will confirm when it is done, within one month. Records we must keep by law (bids, payments and purchases) are kept for the legal period and then deleted.

To stop WhatsApp messages from us at any time, just tell us in the chat, or block the number in WhatsApp.