LEGAL
Privacy
Policy
This Privacy Policy explains how AA (Holdings) Limited (trading as VroomVest) collects, uses, stores, and protects your personal data. We comply with the Data Protection (Bailiwick of Guernsey) Law 2017, which incorporates principles equivalent to the EU GDPR. For data protection purposes, we are the Controller of the personal data you provide to us.
01
Who We Are
VroomVest is operated by AA (Holdings) Limited, trading as VroomVest, a company incorporated in Guernsey (Company No. 57866).
We provide two services, each of which involves the collection and use of personal data:
Automotive sourcing and advisory — a brokerage service connecting clients with vehicles. Clients share personal and financial data as part of the engagement process, including for anti-money laundering compliance.
Market Intelligence — editorial content, research, analysis, and guides relating to performance and collectible vehicles, available via this website.
Use of this website is also governed by our Terms and Conditions.
02
What Data We Collect and Why
We only collect personal data that is necessary for the purposes described below. We will always tell you why we are collecting your data at the point of collection.
We collect personal data when you:
Use or browse this website
Submit a sourcing brief or selling enquiry
Complete a contact form
Purchase or access a guide or report
Correspond with us by email or other means
Engage our brokerage services (as a client)
We may also receive limited data from third-party service providers such as payment processors, analytics tools, or email platforms.
Categories of personal data we collect
Website & contact Name, email address, phone number, message content, referral sourceLegitimate interests / consentAs long as necessary to manage the enquiry or relationship
Sourcing briefName, contact details, vehicle requirements, budget range, ownership history, timeline, preferencesContract (pre-contractual steps) / legitimate interestsDuration of engagement plus up to 3 years
Sell enquiryName, contact details, vehicle details, price expectation, sale preferencesContract (pre-contractual steps) / legitimate interestsDuration of engagement plus up to 3 years
Brokerage client — AML/KYCProof of identity (passport or ID document), proof of address, source of funds documentation, financial positionLegal obligation (Proceeds of Crime (Bailiwick of Guernsey) Law 1999)Minimum 5 years from end of business relationship, as required by law
Purchases & transactionsName, email address, billing information, transaction records (card details are not stored by us)Contract / legal obligationTransaction duration plus up to 7 years for legal and accounting purposes
Marketing communicationsName, email address, communication preferences, interaction historyConsent / legitimate interestsUntil you unsubscribe or withdraw consent
Website analyticsIP address, device type, browser data, aggregated usage informationConsent (where required)Varies by tool — typically 12–26 months
We do not intentionally collect sensitive personal data (such as health information, political opinions, or criminal records) and ask that you do not submit such data to us.
We will not keep personal data for longer than is necessary for the purposes for which it was collected, or as required by applicable law.
03
Anti-Money Laundering Data
As a business that facilitates high-value transactions, we are required to collect and retain identity and source of funds information from brokerage clients under the Proceeds of Crime (Bailiwick of Guernsey) Law 1999 and related AML legislation.
This data — including copies of identity documents and source of funds evidence — is collected and retained as a legal obligation, not a commercial choice. We cannot engage you as a brokerage client without completing this process.
AML records are retained for a minimum of 5 years from the end of the business relationship, as required by law. In certain circumstances, we may be required to report information to the relevant authorities without being able to notify you that a report has been made.
AML data is held securely and accessed only by those within the business with a need to do so. It is not used for any commercial purpose.
04
Cookies and Analytics
VroomVest uses cookies and similar technologies to enable essential website functionality, understand how the site is used in aggregate, and improve performance and user experience.
Essential cookies — required for the operation of the website. These cannot be disabled.
Analytics cookies — used to understand how visitors use the site. These are only set where consent has been provided.
Further details about specific cookies in use are provided in our cookie notice or banner. You can manage your cookie preferences at any time via your browser settings.
05
Sharing Your Data
We do not sell personal data. We will never share your personal data with third parties for their own marketing purposes.
We may share personal data only where necessary, including with:
Sellers and buyers — where you have engaged us to source or sell a vehicle, we will share relevant details with the appropriate counterparty as necessary to facilitate the introduction. We will not make such introductions without your prior agreement.
Service providers — website hosting and IT providers, payment processors, email and communication platforms, and analytics providers, who process data on our behalf and are bound by appropriate data processing agreements.
Legal and regulatory authorities — where we are required to do so by law, including under our AML obligations. In such cases we may be prohibited from notifying you that a disclosure has been made.
Professional advisors — lawyers, accountants, and insurers, where necessary and subject to confidentiality obligations.
Where personal data is transferred outside the Bailiwick of Guernsey or the EEA, we ensure an adequate level of protection using mechanisms recognised under Guernsey data protection law, such as adequacy decisions or standard contractual clauses.
06
How We Protect Your Data
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including:
Secure hosting with access controls
Encryption of data in transit and at rest where appropriate
Restricted internal access on a need-to-know basis
Confidentiality obligations for all staff and contractors
If a personal data breach occurs that may pose a risk to your rights or freedoms, we will notify you and the Office of the Data Protection Authority (Guernsey) where required by law.
07
Your Rights
Under Guernsey data protection law, you have the following rights in relation to your personal data:
ACCESS
Request a copy of the personal data we hold about you.
CORRECTION
Request that inaccurate or incomplete data is corrected.
ERASURE
Request deletion of your data in certain circumstances — note that this right does not apply to data we are legally required to retain, such as AML records.
RESTRICTION
Request that we restrict processing of your data in certain circumstances.
OBJECTION
Object to processing based on legitimate interests, including direct marketing.
PORTABILITY
Request your data in a structured, machine-readable format where processing is based on consent or contract.
WITHDRAW CONSENT
Where processing is based on consent, you may withdraw it at any time — for example by using the unsubscribe link in any marketing email. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
We do not use automated decision-making or profiling that produces legal or similarly significant effects.
To exercise any of these rights, please contact us using the details in clause 10 below. We will respond within one month of receiving your request.
08
Age and Intended Audience
This website is intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.
09
Territorial Note
Content on VroomVest is not directed at any person in a jurisdiction where accessing such content would be unlawful or require registration or regulatory approval not held by us. It is your responsibility to ensure that your use of this website complies with the laws of your jurisdiction.
10
How to Contact Us
For any privacy-related queries, requests to exercise your rights, or concerns about how we handle your personal data, please contact us via the website contact form or by email at hello@vroomvest.com.
If you are not satisfied with how we have handled your personal data or responded to your request, you have the right to raise a concern with the Office of the Data Protection Authority (Guernsey), which can be contacted at www.odpa.gg.
11
Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or best practice. The most current version will always be available on this page, with the date of last update shown at the top. We will notify you of any material changes where we are able to do so.
REGISTERED OFFICE
AA (Holdings) Limited
Trading as VroomVest
5 Cedar Drive
St Peter Port
Guernsey GY1 1SS
Company No. 57866