Who we are (Data Controller)
Engines Market is a trading name of Engine Finders UK Ltd, a private limited company registered in England and Wales.
We act as a data controller for the personal data you provide to us when you use our Platform. This means we decide how and why your data is processed, and we are responsible for protecting it.
The personal data we collect
We collect different categories of personal data depending on how you interact with our Platform.
2.1 Data you provide to us (voluntary)
When you submit an engine replacement quote request, we collect:
| Data type | Examples | Purpose |
|---|---|---|
| Identity data | Full name, title | To address you correctly and match quotes |
| Contact data | Email address, phone number, postcode | To send quotes and allow suppliers to contact you |
| Vehicle data | Registration number (looked up via DVLA API), make, model, engine code, fuel type, year, mileage | To identify the correct engine and provide accurate quotes |
| Enquiry data | Description of the engine problem (e.g., "timing chain rattle", "blue smoke") | To help suppliers diagnose and quote accurately |
| Communication data | Messages you send to our support team (via form, email, WhatsApp, or phone) | To respond to your queries and improve our service |
If you contact us by phone, we may record the call for training, quality control, and security purposes. You will be informed of any recording at the beginning of the call.
2.2 Data collected automatically (technical)
When you visit our Platform, we automatically collect certain technical data:
| Data type | Examples | How collected |
|---|---|---|
| Device and browser data | IP address, browser type and version, operating system, device type | Server logs, browser headers |
| Usage data | Pages visited, time spent, clicks, scroll depth, referral source | Cookies, analytics tools (e.g., Google Analytics) |
| Location data | Approximate geographic location derived from IP address (city/region level only) | IP geolocation |
2.3 Data we do NOT collect
- Payment card or bank account information
- Driving licence or passport numbers
- Any special category data (as defined under UK GDPR Article 9)
- Information about children (our services are for adults only, aged 18+)
How we collect your personal data
| Collection method | Description |
|---|---|
| Direct interactions | You provide data by filling in our quote request form, contacting us via email, phone, WhatsApp, or the contact form. |
| Automated technologies | As you browse our Platform, we automatically collect technical data via cookies and server logs. See our Cookie Policy for details. |
| Third parties | We may receive data from DVLA (via registration lookup API) to identify your vehicle. We do not buy or receive marketing lists from third parties. |
How we use your personal data (lawful bases)
Under UK GDPR, we must have a lawful basis for each processing activity. We rely on four lawful bases:
- Contract - processing necessary to provide the service you requested.
- Legitimate interests - processing that is necessary for our legitimate business interests, provided your rights do not override those interests.
- Legal obligation - processing required to comply with the law (e.g., tax, fraud prevention).
- Consent - where you have given explicit permission (e.g., for non-essential cookies).
| Purpose | Lawful basis | Explanation |
|---|---|---|
| To provide you with engine replacement quotes | Contract | Processing is necessary to perform our contract with you - we cannot provide quotes without sharing your data with suppliers. |
| To match your enquiry with relevant suppliers | Contract | Essential part of the service. |
| To manage our supplier network (onboarding, monitoring) | Legitimate interests | We have a legitimate interest in maintaining a high-quality supplier network. This does not override your rights because we use aggregated or anonymised data where possible. |
| To improve our Platform (analytics, A/B testing) | Legitimate interests | We have a legitimate interest in understanding how users interact with our Platform to improve performance. We use pseudonymised data where possible. |
| To secure our Platform (fraud prevention) | Legitimate interests | Protecting our business and users from security threats is a legitimate interest. |
| To comply with legal obligations | Legal obligation | We may be required to retain or disclose data by law. |
| To send service-related communications | Contract | These are part of the service you requested. You cannot opt out of service emails because they are necessary to deliver the service. |
How we share your personal data
5.1 Sharing with engine suppliers (core service)
When you submit a quote request, we share your personal data with our network of vetted UK engine suppliers. This is the fundamental purpose of our service.
What we share: Your name, email address, phone number, postcode, vehicle registration, make, model, engine code, mileage, and your description of the engine problem.
How the sharing works (safeguards):
| Safeguard | Description |
|---|---|
| Supplier cap | A maximum of 10 suppliers can access your lead. Once 10 suppliers have viewed or quoted on your request, the lead is automatically closed and no further suppliers can access your data. |
| Data Sharing Agreement (DSA) | Every supplier signs a binding DSA before joining our network. The DSA requires suppliers to: (i) act as an independent data controller; (ii) use your data only to provide a quote for the specific engine you requested; (iii) not add your data to any marketing database; (iv) not share your data with any third party; (v) indemnify us against any fines or claims resulting from their misuse of your data. |
| Supplier vetting | Suppliers must be UK registered, have a physical business address, at least 12 months trading history, and a sustained average public review score of 4.0 stars or higher. |
| Monitoring and removal | We monitor complaints and public reviews. If a supplier repeatedly breaches our terms or their rating falls below 3.5 stars, we remove them from our network. |
5.2 Sharing with service providers (processors)
| Service provider | Purpose | Data shared |
|---|---|---|
| Website hosting provider | To store and serve our website | Technical data (IP addresses, server logs) |
| CRM platform | To manage leads and supplier interactions | Name, email, phone, vehicle details, enquiry notes |
| Email delivery service | To send you quote confirmations and follow-up emails | Email address, name |
| Analytics provider (e.g., Google Analytics) | To analyse website usage (pseudonymised) | Pseudonymised IP address, browser data, page views |
| DVLA vehicle lookup API | To retrieve vehicle details from your registration | Vehicle registration number |
5.3 Sharing for legal or regulatory reasons
We may disclose your personal data if required by law, court order, or a government authority (e.g., HMRC, police, ICO). We may also disclose data to enforce our terms and conditions, or to protect the rights, property, or safety of our business, our users, or others.
5.4 Sharing with your consent
In any other situation, we will ask for your explicit consent before sharing your data.
Your rights under UK GDPR
You have the following rights regarding your personal data. They are free to exercise (except in limited circumstances).
| Right | Description | How to exercise |
|---|---|---|
| Right of access | You can request a copy of the personal data we hold about you. | Email dpo@enginesmarket.co.uk with "SAR" in the subject line. We will respond within one month. |
| Right to rectification | If your data is inaccurate or incomplete, you can ask us to correct it. | Email dpo@enginesmarket.co.uk with the correct information. |
| Right to erasure | You can ask us to delete your personal data. This is not absolute (e.g., we may need to retain data for legal reasons). | Email dpo@enginesmarket.co.uk. We will delete your data within one month, unless a legal exception applies. There is no fee for erasure requests. |
| Right to restrict processing | You can ask us to temporarily stop processing your data (e.g., while a dispute is resolved). | Email dpo@enginesmarket.co.uk explaining why you want restriction. |
| Right to data portability | You can request a copy of your data in a structured, machine-readable format (e.g., CSV) to transfer to another service. | Email dpo@enginesmarket.co.uk. We will provide your data within one month. |
| Right to object | You can object to processing based on legitimate interests (e.g., analytics, service improvement). | Email dpo@enginesmarket.co.uk. We will stop processing unless we have compelling legitimate grounds to continue. |
| Right to withdraw consent | If we ever rely on consent (e.g., for marketing or non-essential cookies), you can withdraw it at any time. | Adjust your cookie preferences via our banner or email dpo@enginesmarket.co.uk. |
To exercise any right, please contact: dpo@enginesmarket.co.uk
We may need to verify your identity before processing your request. We will respond within one calendar month (30 days). If your request is complex or you have made multiple requests, we may extend the response time by a further two months - we will inform you within the first month.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you are unhappy with how we have handled your data. See Section 14 for contact details.
Data retention - how long we keep your data
We keep your personal data only as long as necessary for the purposes described in this policy.
| Data category | Retention period | Reason |
|---|---|---|
| Active quote request data | 6 months from your last interaction | To allow you to follow up on quotes, and for us to improve our service. After 6 months, data is automatically deleted from our active systems. |
| Anonymised data | Indefinitely | For analytics, market research, and improving our Platform. |
| Supplier performance data | Up to 6 years | To maintain network quality and defend against legal claims. |
| Communication records | 6 months from the date of the communication | For training, quality control, and resolving disputes. |
| Cookie data (non-essential) | Varies - see our Cookie Policy | As set by each cookie. |
After the retention period expires, your data is automatically and permanently deleted from our active databases. It may remain in encrypted backups for a short additional period (up to 30 days) before being deleted.
International data transfers
Your personal data is primarily stored and processed within the United Kingdom.
Some of our service providers (e.g., cloud hosting, analytics) may operate servers outside the UK - typically in the European Economic Area (EEA) or other countries with adequate data protection laws.
When we transfer your data outside the UK, we ensure an equivalent level of protection by using:
- The UK International Data Transfer Addendum (IDTA) - the UK's replacement for the EU SCCs
- Transfers to countries with UK adequacy decisions (e.g., the EEA, Japan, South Korea)
We do not transfer your data to countries without adequate protections unless we have your explicit consent or it is necessary for the performance of a contract.
If you want more information about our transfer mechanisms, please contact dpo@enginesmarket.co.uk.
Data security - how we protect you
| Measure | Description |
|---|---|
| Encryption | Data is encrypted at rest (on our servers) and in transit (using TLS 1.3/1.2 across our website). |
| Access controls | Only authorised employees and our data processors have access to personal data, and only for legitimate purposes. |
| Supplier cap | We limit the number of suppliers who can access your lead to a maximum of 10, reducing exposure. |
| Supplier agreements | Suppliers sign binding Data Sharing Agreements that require them to protect your data and indemnify us against breaches. |
| Regular testing | We perform vulnerability scans and penetration tests (at least annually) to identify and fix security weaknesses. |
| Staff training | All employees receive annual data protection and security awareness training. |
If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO within 72 hours, as required by UK GDPR.
Cookies and tracking technologies
We use cookies and similar technologies to:
- Ensure our Platform works properly (strictly necessary cookies)
- Analyse how users interact with our Platform (performance/analytics cookies)
- Remember your preferences (functional cookies)
We do not use targeting/advertising cookies that track you across other websites.
For full details, including how to manage your cookie preferences, please read our separate Cookie Policy.
Image copyright - our commitment to intellectual property rights
Our Platform displays thousands of images of engines, vehicles, components, and related automotive content. We are committed to respecting intellectual property rights and complying with UK copyright law (Copyright, Designs and Patents Act 1988).
11.1 Sources of our images
| Source | Description | Copyright status |
|---|---|---|
| Original photography | Images we have taken ourselves (e.g., of reconditioning processes, workshops). | © Engines Market / Engine Finders UK Ltd. All rights reserved. |
| Supplier-provided images | Images supplied to us by our network of engine specialists. | We hold a perpetual, royalty-free licence from each supplier to use these images on our Platform. The supplier warrants that they have the right to provide the image. |
| AI-generated images | Images created using artificial intelligence tools (e.g., DALL-E, Midjourney, Stable Diffusion). | These images are original works generated by AI at our direction. No human creator was directly involved. However, we acknowledge that AI-generated images may unintentionally resemble existing copyrighted works due to the nature of AI training data. |
11.2 AI-generated images - disclaimer
If you believe an AI-generated image on our Platform infringes your copyright, please contact us using the process below. We take such claims seriously and will investigate promptly.
11.3 Copyright infringement reporting (takedown process)
If you believe that any image on our Platform infringes your copyright (whether the image was AI-generated, provided by a supplier, or otherwise), please send a copyright infringement notice to:
copyrights@enginesmarket.co.uk
Your notice must include:
- Your full name and contact information (email address and postal address).
- A clear identification of the copyrighted work you claim has been infringed (e.g., a description and, if possible, a URL or copy of the original work).
- The specific URL(s) on our Platform where the allegedly infringing image appears.
- A statement that you have a good faith belief that the use of the image is not authorised by the copyright owner, its agent, or the law.
- A statement, made under penalty of perjury, that the information in your notice is accurate and that you are the copyright owner or authorised to act on their behalf.
- Your electronic or physical signature.
We will acknowledge receipt of your notice within 5 working days and will investigate within 14 days. If we determine that the image infringes your copyright, we will:
- Immediately remove or disable access to the image.
- Notify the supplier (if the image was sourced from a supplier) or, for AI-generated images, adjust our generation prompts to avoid similar outputs in the future.
We will also keep a record of all copyright complaints for compliance and auditing purposes.
11.4 Repeat infringers
Engines Market has a policy of terminating, in appropriate circumstances, the accounts of suppliers or users who are repeat infringers of intellectual property rights.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer.
- Minor changes (e.g., clarification of wording, correction of typos) will be posted on this page with a new "Last updated" date.
- Material changes (e.g., new data sharing practices, changes to retention periods, new lawful bases) will be notified to you by email (if you have provided your email address) and via a prominent notice on our Platform at least 30 days before they take effect.
We encourage you to review this policy periodically. The "Last updated" date at the top of this page indicates when the policy was last revised.
Contact us
If you have any questions about this Privacy Policy, your data rights, or if you wish to make a complaint about our handling of your personal data, please contact our Data Protection Officer (DPO):
| Contact method | Details |
|---|---|
| Email (data rights / DPO) | dpo@enginesmarket.co.uk |
| Email (general support) | support@enginesmarket.co.uk |
| Email (copyright complaints) | copyrights@enginesmarket.co.uk |
| Email (complaints about our platform) | complaints@enginesmarket.co.uk |
| Post | Data Protection Officer, Engine Finders UK Ltd, 113 Park Road, Ilford, IG1 1SQ, United Kingdom |
| Phone | 020 3488 4649 (Mon-Fri, 9:00-17:30) |
We aim to respond to all data protection enquiries within 5 working days and resolve complaints within 30 days.
Right to complain to the ICO
You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues, at any time. We would appreciate the opportunity to resolve your concerns first, so please contact us before approaching the ICO.
ICO contact details:
Website: https://ico.org.uk
Phone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Governing law
This Privacy Policy is governed by and construed in accordance with the laws of England and Wales. Any disputes arising under or in connection with this policy shall be subject to the exclusive jurisdiction of the courts of England and Wales.
Your data, your control
To help you quickly understand your rights and our practices, here is a plain-English summary:
Do you sell my data-
No. Never. We do not sell your personal data to any third party.
Do you send marketing emails-
No. We only send service-related emails (quote confirmations, follow-ups). We do not send any marketing emails.
Who sees my data-
Up to 10 vetted UK engine suppliers (maximum) plus our trusted service providers (hosting, CRM, email, analytics).
How long do you keep my data-
6 months from your last interaction, then automatically deleted.
Can I delete my data earlier-
Yes, free of charge. Email dpo@enginesmarket.co.uk and we will delete your data within 30 days.
Do you use my data for AI training-
No. We do not use your personal data for training AI models.
What if an AI image looks like my work-
Email copyrights@enginesmarket.co.uk - we will investigate and remove if necessary.
Do I have to accept all cookies-
No. You can reject non-essential cookies via our banner. Only strictly necessary cookies are placed automatically.
Version history: June 2026 - Version 2.0: Complete rewrite to reflect UK GDPR, add image copyright section, clarify supplier cap and data sharing safeguards, extend retention to 6 months, and increase length to 4000+ words.
This Privacy Policy was last reviewed and approved by the Data Protection Officer of Engine Finders UK Ltd on 13 June 2026.
Have questions about your data or this policy- Contact our Data Protection Officer.
Email DPOCompare quotes from vetted UK suppliers
Submit your engine replacement enquiry and receive up to 4 quotes from specialists who meet our strict standards.
Get a free quote