Privacy Policy

1. Who we are and how to contact us

UsedMobility.uk is a trading name of NBR Mobility Ltd, registered in England and Wales, company number 07231153, registered office: 142-144 Victoria Road, Diss, IP22 4JN. NBR Mobility is a family-run mobility specialist trading since 2001 and is DfT-accredited.

NBR Mobility Ltd is the "data controller" for the personal information described in this policy. That means we decide how and why it is used, and we are responsible for looking after it.

If you have any questions about your data, or you want to make a request about it, please contact us:

• By email: hello@usedmobility.uk
• By phone: 0333 335 5277
• Through our Contact page

2. The information we collect, and when

We only collect what we need to run the shop, sell you a machine, and support you afterwards. Here is what we collect and when.

When you browse or make an enquiry: if you contact us through the site, by email or by phone, we keep the details you share — such as your name, your contact details, and what you asked about — so we can reply and help.

When you buy or reserve an item at checkout: your name, email address, phone number and delivery address. Because every item is a one-off, we place a short hold on it (about 30 minutes) while you check out, and we record your order details.

The VAT-relief declaration (please read this — it is sensitive): our prices are shown without VAT, and 20% VAT is added at checkout unless you complete a valid VAT-relief self-declaration. If you choose zero-rated (VAT-free) pricing, we ask for the name of the person the item is for and the nature of their chronic illness or disability. This tells us about someone's health, so it is "special-category data" under data protection law and we treat it with extra care. We collect it only because the law (VAT Notice 701/7) requires us to hold this declaration to zero-rate the sale, and we record the date, time, IP address and browser identifier of the submission alongside it, as evidence for HMRC that the declaration was genuinely made. A false declaration is an offence. We explain how we use and protect this information in section 3.

When you save a basket: if you enter your email during checkout but don't finish, we store your email (with your name and the items in your basket) so we can send you a reminder or call you to help you complete your order.

When you use our part-exchange or spare-part forms: your name and contact details, details of the machine (make, model, and for parts the serial number), a free-text description of the condition or the part you need, and any photos you upload. Please only include information you're happy to share — free-text boxes and photos can reveal more than you intend, including about someone's health.

Phone calls: when you speak to us, we make notes of what we discussed so we can follow up and keep a record of your order or enquiry.

Trade accounts: if you're an approved trade partner, we hold your business contact details, company name, login details and a reference that links your account to our invoicing system.

Automatically: our website and hosting keep basic technical logs (such as your device's IP address) to keep the site secure and working. We use essential cookies and similar storage that the site needs to work, and — only if you agree through our cookie banner — optional analytics and advertising cookies that may collect information about how you use the site. See the Cookies section below.

3. Why we use your information, and our lawful bases

Data protection law requires us to have a "lawful basis" for each way we use your information. Here is how that works for us.

• To take, reserve and fulfil your order, and to arrange delivery or collection — our lawful basis is performance of a contract with you (UK GDPR Article 6(1)(b)).
• To reply to enquiries, part-exchange offers, part requests and phone calls — our lawful basis is our legitimate interests (Article 6(1)(f)) in responding to you and running our business, or taking steps to enter into a contract at your request.
• To send saved-basket reminders and follow up on abandoned baskets — our lawful basis is our legitimate interests (Article 6(1)(f)) in recovering sales and helping you complete a purchase you started.
• To meet our legal and tax duties, including VAT and VAT relief — our lawful basis is compliance with a legal obligation (Article 6(1)(c)).
• To keep the site and our systems secure and prevent fraud — our lawful basis is our legitimate interests (Article 6(1)(f)).
• To manage trade accounts and invoicing — our lawful basis is performance of a contract and our legitimate interests in running the trade channel.
• To use optional analytics and advertising cookies, and for any measuring, remarketing or audience-building that follows from them — our lawful basis is your consent (Article 6(1)(a)), which you give through our cookie banner.

Where we rely on your consent — for our optional analytics and advertising cookies — you are free to say no, and you can change your mind and withdraw your consent at any time by reopening the "Cookie preferences" control in the footer of any page (or by clearing cookies in your browser). Withdrawing your consent does not affect anything we did before you withdrew it.

Saved-basket and abandoned-basket reminder emails: these are marketing emails, so alongside our legitimate interests we also rely on the "soft opt-in" under the Privacy and Electronic Communications Regulations (PECR). We only send them when you gave us your email while buying or negotiating to buy from us, they are about the same or similar products, and every reminder includes a simple way to unsubscribe or opt out. You can tell us to stop at any time.

The health information in a VAT-relief declaration is special-category data, so it needs an extra condition under Article 9 as well as a lawful basis under Article 6. Our Article 6 basis is our legal obligation to substantiate a VAT zero-rating for HMRC (Article 6(1)(c)). For Article 9, our condition is that the processing is necessary for reasons of substantial public interest (Article 9(2)(g)), read together with the "statutory and government purposes" condition in Schedule 1, Part 2 of the Data Protection Act 2018. As that law requires, we keep an Appropriate Policy Document that sets out how we comply with the data protection principles and our retention and deletion arrangements for this information; it is available on request.

We use the VAT-relief health information only to support the zero-rating. It is never sent to our payment provider and is never used for marketing. We keep it as part of our VAT records (see section 5) solely because HMRC requires us to be able to produce the declaration if asked.

4. Who we share your information with

We do not sell your personal information. We share it only with the organisations we need to in order to run the shop and meet our legal duties.

• Stripe — our payment provider, to take card payments securely. Stripe collects your card details on its own secure pages; we don't see or store them.
• Resend — our email provider, to send order confirmations and basket reminders.
• DigitalOcean — our hosting provider, which stores our data and runs the website on servers located in the UK (London).
• NBR Mobility Ltd and its point-of-sale (POS) system — the wider group we are part of, for order fulfilment, engineer delivery and set-up, and (for trade partners) invoicing.
• Delivery couriers and our engineers — to deliver or set up your machine, we share your name, delivery address and phone number so they can complete the delivery.
• HMRC — to meet our VAT obligations, including holding and, if inspected, producing VAT-relief declarations.
• Google LLC — if you consent to analytics cookies, we use Google Analytics 4 to understand how the site is used; and, separately, if you consent to advertising cookies, we use Google Ads for remarketing (showing you relevant ads after you've visited). Each tool runs only on its own category of consent — analytics consent does not switch on the advertising tool, and vice versa. Google collects information about your use of the site through these tools.
• Meta Platforms, Inc. — only if you consent to advertising cookies, we use the Meta (Facebook and Instagram) Pixel to show you relevant ads (remarketing) and to help build similar ("lookalike") audiences of people like our visitors. Meta may match the information the Pixel collects to your own Facebook or Instagram account, so this information is not anonymous to Meta. Meta collects information about your use of the site through this tool.
• Klarna — where offered as a "spread the payments" option, we would share your name, email, address and order amount so Klarna can provide the payment plan. This is not live yet; we will only share data with Klarna once it is available and you choose it.

We use an artificial-intelligence (AI) writing tool, provided by Anthropic, to help us draft the descriptions on our product listings. It is used only on product information and never receives your personal information.

We may also share information where we are legally required to, or to protect our rights, prevent fraud, or in connection with a business sale or reorganisation.

International transfers: most of our data is stored in the UK. Our hosting provider, DigitalOcean, stores our data on servers in the UK (London), but it is a US-headquartered company, so its support staff may be able to access data from the United States. Some of our other providers — including Stripe and Resend — are also based in, or process data in, the United States. Our optional analytics and advertising tools are run by Google LLC and Meta Platforms, Inc., which are US companies, so if you consent to those cookies your data may be transferred to the United States. Where personal information is transferred outside the UK, we make sure it is protected by appropriate safeguards. Google LLC and Meta Platforms, Inc. are both certified under the UK Extension to the EU-US Data Privacy Framework; where that framework does not apply, we rely on the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs). These safeguards give your data a similar level of protection to that in the UK.

5. How long we keep your information

We keep personal information only for as long as we need it for the purposes above, and to meet our legal duties. As a general guide:

• Order and customer records, including delivery details — kept for the life of the order and our aftercare and warranty period, then for as long as needed to handle any dispute (normally up to 6 years, to match our accounting records).
• VAT records, including VAT-relief declarations — kept for at least 6 years, as required by HMRC for tax records.
• Enquiries, part-exchange and part-request details and photos — deleted within 12 months of your enquiry closing, unless it leads to an order (in which case it becomes part of your order record above).
• Saved and abandoned baskets — deleted within 30 days if you don't complete your purchase.
• Trade-account and invoicing records — kept for the life of the account and for up to 6 years afterwards, as required for tax and accounting.
• Analytics and advertising cookies and the data they produce — kept only for as long as each cookie lasts and for the retention period set in the tool itself (for example, Google Analytics 4 keeps its user- and event-level data for no more than 14 months). Individual cookie lifetimes are listed in our Cookie Policy, and you can clear these cookies at any time.

When we no longer need your information, we delete it or make it anonymous. Some records that are part of our accountability or security trail may be kept in a limited form for longer.

6. Your rights

Under data protection law you have rights over your personal information. You can ask us to:

• Access — give you a copy of the information we hold about you.
• Rectify — correct information that is wrong or incomplete.
• Erase — delete your information, where we no longer have a reason to keep it.
• Restrict — pause how we use your information in certain situations.
• Object — object to us using your information, including for our legitimate interests.
• Portability — receive certain information in a portable format, or have it sent to another provider.
• Withdraw consent — where we rely on your consent, you can withdraw it at any time.

Direct marketing and profiling: if you consent to advertising cookies, this involves profiling you for direct marketing — for example, showing you our ads on other websites and building similar ("lookalike") audiences. You have an absolute right to object to direct marketing at any time, and because we rely on your consent for this you can also withdraw that consent whenever you like. The easiest way to stop the advertising cookies and this profiling is to reopen the "Cookie preferences" control in the footer of any page and turn off the advertising category; you can also unsubscribe from any marketing email using the link it contains, or tell us to stop.

Some of these rights don't apply in every situation — for example, we may need to keep VAT records to meet our legal duties even if you ask us to delete them. To exercise any of these rights, please contact us at hello@usedmobility.uk or through our Contact page. Using your rights is free, and we will normally respond within one month.

If you are unhappy with how we have handled your information, please tell us first so we can try to put it right. You also have the right to complain to the ICO at ico.org.uk.

7. Cookies and similar storage

We use cookies and similar browser storage in three groups. Strictly necessary cookies are always on — the site can't work without them. They keep signed-in staff or trade partners logged in and remember what's in your basket (including a token that lets us send you a basket reminder or help you recover a saved basket). Because these are essential, they don't need your consent.

The other two groups are optional and only ever load if you agree: Analytics cookies, which help us understand how the site is used; and Advertising (marketing) cookies, which help us show you relevant ads and measure them. When you first visit, our cookie banner lets you accept or reject these categories separately. Nothing in the analytics or advertising groups is set until you opt in, and you can change your choice at any time using the "Cookie preferences" control in the footer of every page, or by clearing cookies in your browser.

If you consent, the optional tools we may use are: Google Analytics 4 (analytics — how the site is used) and Google Ads (advertising — remarketing/retargeting), both provided by Google LLC; and the Meta (Facebook and Instagram) Pixel (advertising — remarketing, and building similar "lookalike" audiences), provided by Meta Platforms, Inc. The advertising tools involve profiling you for direct marketing, and Meta may link what the Pixel sees to your own Facebook or Instagram account. These are US companies, so consenting may involve a transfer of your data to the United States under the safeguards described in section 4.

We use Google Consent Mode v2: Google's tags start in a "denied" state and only set cookies or collect identifiers once you have given your consent. Our analytics and advertising tools are switched on or off centrally by our staff. At the time of writing they are turned off, but we describe them here so you know exactly what will run if we switch them on and you consent.

For the full list, including the individual cookies and how long each one lasts, please see our Cookie Policy.

8. How we keep your information safe

We take the security of your information seriously. Our site uses secure (HTTPS) connections, passwords are stored in a scrambled (hashed) form, and access to the personal data in our admin systems is limited to the staff who need it. Payment card details are handled by Stripe on its own secure systems and are not stored by us. Because free-text boxes and uploaded photos can contain more than you intend, we ask you to share only what you're comfortable providing. No system can be guaranteed completely secure, but we work to protect your information and to keep improving how we do it.

9. Children

Our website and shop are aimed at adults and are not intended for children under 18. We don't knowingly collect information about children. If you believe a child has given us their information, please contact us at hello@usedmobility.uk and we will delete it.

10. Changes to this policy

We may update this policy from time to time — for example, if we add new services or change how we work. When we do, we will change the date at the top of the page. If the changes are important, we will do more to bring them to your attention. This policy was last updated on 3 July 2026. You can always find the current version at /privacy.