Privacy Policy

Effective from: 2026-01-04

Data Controller: Built to Roam Ltd, registered in England and Wales under company registration number 16845135.

Built to Roam Ltd ("Built to Roam", "we", "us", or "our") operates a digital marketplace that enables the buying and selling of automotive vehicles. To access the full range of products and services, we need to collect and process certain information about you.

This Policy Statement together with our Cookies Policy apply to users of:

  • the Built to Roam website (the "Website");
  • any related sites, features, applications or services or features (collectively, the "Services");
  • Built to Roam social media accounts.

This Policy Statement governs your use of the Website and the Services, including any disputes concerning privacy. Please read carefully and ensure you understand its effect before using the Site and/or Services.

This Policy Statement does not apply to the practices of third parties that we do not own or control, including Campervan Converters, Sellers, or external services that you access through our platform.

1. Definitions

"Data Protection Legislation" refers to all applicable UK data protection and privacy legislation in force from time to time, including the UK GDPR; the Data Protection Act 2018; the Privacy and Electronic Communications Directive (as amended) and the Privacy and Electronic Communications Regulations 2003.

"UK GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act of 2018.

2. Your acceptance of this Policy

By using the Website and/or Services, you acknowledge and accept this Privacy Policy in full. If you do not agree, you should stop using our Website and Services.

We reserve the right to modify this Policy at any time by posting the revised version on our Website. Your continued use of any part of the Website following any updates will constitute acceptance of the amended Policy.

3. Information collected by data controller and how it is used

Website Security and Infrastructure

Our website processes certain technical data to protect our platform and ensure reliable performance. This includes data used for rate limiting, bot prevention, and detecting malicious activity.

We use Upstash as part of our security and performance infrastructure. Upstash provides a high-performance database and caching layer that helps us manage request volumes, prevent automated abuse, and identify potentially harmful behaviour. All data processed by Upstash is stored on AWS infrastructure in the EU-West-2 region (London, UK).

This data primarily consists of technical identifiers such as IP addresses, request headers, and activity patterns. For view-event throttling on converter profiles and van ads, we use a hashed (non-reversible) and truncated form of an IP address in short-lived rate-limit keys.

We use Vercel's security features to detect and mitigate bots, malicious traffic, and harmful behaviour targeting our Website. Vercel also processes technical identifiers necessary for safeguarding the platform. All data processed by Vercel is stored on AWS infrastructure in the EU-West-2 region (London, UK).

Data processed for security purposes is used solely to maintain system integrity, prevent fraud, and protect the Website from harmful activity.

Data processed for Website Security and Infrastructure is not used for marketing or profiling and is retained only for as long as necessary to support these security functions.

Account Creation

When you register for a Built to Roam account, we collect:

  • Email address
  • Password
  • Optional: full name and telephone number

Once you have registered, this information will be saved in your account, and you can update your personal details at any time.

We use this information to:

  • Create and manage your account
  • Send essential service communications
  • Contact you (if necessary) about account activity

You can change your marketing communication preferences at any time in your account.

We only share personal data when necessary to deliver the requested service and never for third-party marketing unless you have expressly consented.

Data is stored using Supabase, on AWS infrastructure in the West Europe region (London, UK), ensuring your personal data remains within the UK. Supabase provides industry-standard security measures, including encryption and controlled access, to help safeguard your information.

Advert Placement

When you place an advert, we collect:

  • Name
  • Email address
  • Telephone number
  • Postcode
  • Vehicle details, including the vehicle registration number

How this data is used:

  • Postcodes are used for location-based search positioning and are not published.
  • Vehicle registration numbers (VRMs) are required for regulatory and security purposes and are not displayed in advert text. If a VRM appears in photographs you upload, it may be visible to others. We may share VRMs with prospective buyers – for example, to enable vehicle checks.
  • You may be contacted if your advert expires and requires renewal.

For Private Adverts, we automatically enable our Protect Your Email feature when a customer provides a contact email. This service replaces the buyer's and seller's real email with a substitute email when sending messages, helping to maintain privacy.

If you contact a service provider, we will share the necessary information (for example, name, contact details, and message content) solely for responding to your enquiry. Each service provider acts as an independent data controller.

We may retain a copy of the enquiry for security, fraud prevention, and audit purposes.

Payment Information

Online payments are securely processed through our third-party payment provider, Stripe, and processed in accordance with Stripe's Privacy Policy.

All payment transactions are encrypted. We do not store or retain your payment card details.

Communication with Us

You may provide your personal information for one or more of the following reasons:

  • To request information about advertising with Built to Roam or about any of Built to Roam's services
  • To make a complaint
  • To provide feedback to us on your experience with using the Website and our Services
  • To enquire about partnerships
  • To register for and / or attend an event
  • To respond to a survey
  • To respond to social media campaigns

We use this information solely for the purpose for which you provided it.

Using Services on the Platform

Depending on the service you use, we may collect:

  • Name
  • Email address
  • Telephone number
  • Postcode or address
  • Vehicle details (VRM, make, model, mileage)

This information may be shared with trusted third parties where necessary to deliver the requested service.

Vehicle Search Facility: To use our vehicle search facility, you will be asked to provide your postcode. This allows us to filter and display adverts that match your search criteria within your chosen distance, or that are available for delivery to your location.

Online Vehicle Enquiries: When you enquire about a vehicle, your details are shared with the relevant Campervan Converter or Seller, who becomes an independent data controller. We recommend reviewing their privacy policies.

Vehicle Check: A Built to Roam account is required, and you must submit a VRM. Payments are processed securely by third-party providers.

Chat Service: Our messaging tool allows you to send enquiries to Campervan Converters or Sellers. This Chat Service does not operate as a real-time live chat. It functions as an email-to-email communication system. Logs of all enquiry messages are retained for security, fraud prevention, and audit purposes.

Messages are delivered and logged using Resend, which may process data outside the EEA under appropriate safeguards. Service providers receiving your enquiry are independent data controllers and will process your data in line with their own policies.

Information shared with Campervan Converters and Sellers: Built to Roam acts as a data controller for the collection and processing of your personal data in connection with managing and responding to your enquiries. We share your information with the relevant Campervan Converter or Seller via the Online Portal to allow them to progress your enquiry.

We may also share:

  • Whether you are local to the seller
  • Whether you saved the vehicle
  • Relevant activity-based insights (where cookie consent allows)
  • Your buying preferences

This helps sellers respond efficiently and prioritise genuine enquiries.

4. Usage information

To maintain and develop our Website and Services we use your personal information provided and details of your activity on the Website, use of our Services and your interactions to:

  • Operate, maintain and improve our Website and Services
  • Support testing, analytics, research, and troubleshooting
  • Understand audience interests and behaviour
  • Personalise your experience and recommendations
  • Deliver marketing communications (where consented)
  • Detect and prevent fraud or misuse
  • Improve Website speed, performance, and reliability

We also record view events when visitors load converter profile pages and van ad pages. This measurement is performed server-side and does not rely on analytics cookies or local storage.

5. Legal basis for processing

We process personal data on the following legal bases:

Contract: To provide the services you request, including:

  • Account management
  • Advert publication
  • Customer support
  • Service updates

Consent: We rely on your consent where you have chosen to receive specific services or communications from us. This includes:

  • Marketing communications
  • Sharing your enquiry details with third parties

You may withdraw consent at any time.

Legal Obligation: For example:

  • Responding to lawful requests
  • Fulfilling statutory record-keeping or reporting requirements

Legitimate Interests: We process certain personal data where it is necessary for our legitimate business interests (or those of a third party), provided your rights and freedoms are not overridden. These legitimate interests include:

  • Monitoring, maintaining, and improving our Website and Services
  • Understanding how visitors and customers use our Website and Services
  • Personalising content, recommendations, and marketing
  • Responding to enquiries and handling complaints
  • Conducting market research and informing our marketing strategy
  • Maintaining the security and integrity of our Website and Services

6. Consent

Where we rely on consent, it must be freely and clearly given.

You may withdraw consent at any time by contacting: hello@builttoroam.co.uk.

Withdrawal does not affect processing already carried out.

If your data has already been shared with a third party, you must contact them directly to withdraw consent from their systems.

7. Where we store your personal data

Built to Roam will take all reasonable steps to ensure that your data is treated securely and in accordance with this Policy. All information you provide to us is stored securely within the UK or EEA, and not transferred outside the UK or EEA unless specifically detailed in this Policy.

Some third parties may process your data outside of the UK or EEA. Where they act as independent controllers, we are not responsible for their processing activities.

You should review their individual privacy policies for further information.

8. Data retention

We retain personal data only for as long as necessary to fulfil the purposes we collected it for, including legal, accounting, reporting, fraud-prevention, and security requirements.

For example:

  • Account or advert data is retained while active, and for a period afterwards to meet legal obligations
  • View event records (for example, converter profile views and van ad views) are retained for a limited period (typically up to 180 days, configurable) and then deleted.

In some cases, we may anonymise your data for research or statistical purposes, in which case it may be used indefinitely.

9. Your rights

Under the UK GDPR and Data Protection Act 2018, you have the right to:

  • Access – Request a copy of the information we hold about you
  • Rectify – Request corrections to inaccurate or incomplete data
  • Erase – Request that we delete your data ("right to be forgotten")
  • Restrict – Limit how your data is used
  • Portability – Request that your data be transferred to another service
  • Object – Object to processing based on legitimate interests or direct marketing
  • Complain – Raise concerns with the ICO or with us directly

10. Complaints

If you have concerns about how your data is handled, please contact us: hello@builttoroam.co.uk.

You also have the right to lodge a complaint directly with the UK supervisory authority:

Information Commissioner's Office (ICO)
www.ico.org.uk.