Privacy policy

The Service is an internal application available only to authorised CarCargo employees and approved workers. It supports marketplace order, inventory, fulfilment and finance operations, including connections to eBay and Intuit QuickBooks Online.

Depending on your role and the work being performed, we process:

• authorised-user identity, work email, role, account status, authentication and session information;
• activity, approval, change and security audit records, plus technical logs such as time, IP address and device or browser information;
• marketplace order, product, SKU, quantity, price, tax, refund, dispute, fulfilment and inventory information;
• buyer name, delivery and billing address, postcode, email address and telephone number where supplied for an order;
• payout, sales, fee, refund, VAT, account-mapping and other accounting information; and
• connected-company identifiers, reference data and encrypted authorisation tokens needed to operate approved integrations.

We use this information to:

• authenticate users, apply role-based permissions and keep the Service secure;
• receive, fulfil, support, refund and reconcile marketplace orders;
• maintain inventory and operational records;
• prepare, review, export and post sales, customer and expense records to QuickBooks Online;
• calculate and evidence VAT treatment based on order and delivery information;
• maintain accounting, tax, security and compliance records; and
• diagnose errors, prevent misuse and improve the reliability of our internal processes.

Our UK GDPR grounds are CarCargo’s legitimate interests in running and protecting its business, performing contracts with customers and workers where relevant, and complying with legal obligations such as accounting, tax and employment duties. Where a different lawful basis is required, we will identify and apply it.

The Service reads authorised eBay order and finance data. When an administrator approves API delivery or a CSV import, relevant order and accounting information is sent to or prepared for Intuit QuickBooks Online. This may include a buyer’s name, postal address, email address and telephone number so the QuickBooks customer and sales record match the order. We do not use QuickBooks data for advertising or sell it.

QuickBooks access tokens are encrypted. Disconnecting the integration revokes the connection and replaces stored active tokens. Reference names, posting records and audit evidence may remain where needed for finance reconciliation and legal record-keeping.

We disclose data only where needed to operate CarCargo, fulfil an order or meet a legal obligation. Recipients may include eBay, Intuit QuickBooks Online, hosting, database, authentication and technical service providers, delivery providers, professional advisers, regulators and law-enforcement bodies. Access is limited by role, contract and business need. We do not share one customer’s data with another customer.

Some service providers may process information outside the United Kingdom. Where UK data-protection law requires it, we use an adequacy regulation, approved contractual safeguards or another lawful transfer mechanism and apply appropriate security measures.

We keep personal data only for as long as needed for the purpose collected. Order, finance, VAT and audit records are retained for the periods required by accounting, tax, fraud-prevention and other applicable law. Operational copies and logs are deleted or anonymised when no longer needed, subject to backup rotation and legal holds. Authorised-user access is disabled when it is no longer required.

A request to delete data will be assessed against CarCargo’s legal and operational retention duties. Where deletion is not legally available, we will restrict use to the required purpose where appropriate.

We use access controls, encrypted connections, encrypted integration credentials, audit records and other proportionate safeguards. No system is completely secure, so authorised users must protect their credentials and report suspected incidents promptly. The Service uses necessary session and security cookies; it does not use advertising cookies.

Subject to UK data-protection law, you may ask for access, correction, erasure, restriction or portability of your personal data, or object to certain processing. You may also complain to the UK Information Commissioner’s Office. Some rights are limited where CarCargo must retain or use information for employment, tax, accounting, legal claims or other legal duties.

Employees should first contact their CarCargo administrator with privacy questions or rights requests. You may also write to CarCargo Ltd at the registered office address above. We may update this policy when our service, providers or legal duties change; the effective date identifies the current version.