Privacy policy

What we collect about you, why, who sees it, how long we keep it, and your rights.

Last updated: 1 November 2026

This page explains what we do with your personal information when you use www.usedmobility.uk, ring us or email us. Some of what we ask for, such as the VAT-relief declaration, is sensitive, so we take extra care with it.

The short version

We collect only what we need to sell you a machine, deliver it and help you afterwards.
We never sell your details. We don't send marketing emails. Google's cookies, which measure our adverts, are used only if you say yes.
If you ask us to email you when a model comes in, we use your email address for that and nothing else. You can stop at any time, and stopping deletes it.
The VAT-relief declaration tells us about someone's health. We keep it only as evidence for HMRC. Only staff who manage orders, and the site's administrators, can see it.
Staff sometimes use an AI writing tool to help draft a reply to your message. A person always checks the reply and sends it.
You can ask to see your information, correct it or have it deleted. You can complain to us or to the Information Commissioner's Office (ICO).
Any questions? Ring 03330 540 630 or email hello@usedmobility.uk.

1. Who we are

www.usedmobility.uk is a trading name of NBR Mobility Ltd, registered in England and Wales, company number 07231153. Registered office: 142-144 Victoria Road, Diss, IP22 4JN.

NBR Mobility Ltd is the "controller" of your personal information. That means we decide how it is used, and we are responsible for looking after it.

We are registered with the Information Commissioner's Office. Our registration number is Z2354658.

How to contact us about your information:

Email: hello@usedmobility.uk
Phone: 03330 540 630 (Mon–Fri 9am–5pm · Sat 9am–1pm; closed Sundays and bank holidays)
Post: NBR Mobility Ltd (www.usedmobility.uk), Gilray Road, Diss, IP22 4EU
Our Contact page

2. What we collect, and when

When you send us a message, ask about a part, book a visit or ask us to ring you when a machine comes in:

your name, phone number and email address;
what you asked about: the machine you were looking at (its reference) or the part you asked about;
for "Ring me when one comes in": what you are looking for, your budget, the user's weight, and the best time to ring;
anything you type in a message box. Please don't put more in there than you need to. It is easy to mention someone's health without meaning to.

When you ask us to email you when a machine comes in ("Email me when one comes in"):

your email address;
the make and model you want, and the highest price, if you give one;
when you asked, when you confirmed your email address, when the request ends, and which machines we have emailed you about.

When you buy from us:

your name, email address, phone number and delivery address, and any access notes you give us for the delivery;
which machine you bought, how you chose to have it delivered, and whether you asked for the free 12-month Premier Care policy;
whether the payment went through, the amount taken, and Stripe's reference for the payment. We never see or keep your full card number. You type it into a box run by Stripe, our payment provider.

The VAT-relief declaration. Please read this part: it covers health information. If you say you qualify for VAT relief, you make a short declaration at checkout. We record:

the name of the person the machine is for;
a few words describing their long-term illness or disability;
your tick confirming the declaration, the exact wording you agreed to, and its version number;
your email address, a copy of the delivery address and postcode, the order total and the amount of VAT relieved, and the date and time;
the internet (IP) address and browser details the declaration was sent from, so that we can show where it came from.

A description of someone's illness or disability is "special category" information under data protection law, so we give it extra protection (see section 4).

When you ring us: staff make notes of the call so we can follow it up and keep a record of your order or enquiry.

If you choose the free 12-month Premier Care policy: we record that you opted in and when we registered you with Premier Care.

If you are an approved trade partner, we keep:

your name, business name, business contact details and sign-in details;
a record of which version of our trade terms you accepted and when, with the internet address and browser used;
a record of when you sign in, when you open the stock list and which machines you look at, which our staff can see;
if you use stock alerts: the models on your list, how often you want to hear, and which machines we have emailed you about;
short-lived records of failed sign-ins and sign-in link requests, to stop misuse;
a reference that links your account to our invoicing system.

When you visit the website: our server keeps short-lived technical logs to keep the site secure and working. These include your internet (IP) address, the pages requested and the time. Our pages, pictures and typefaces come from our own server, and Stripe loads on the checkout page to take your payment. If you say yes on our cookie message, Google Ads and Google Analytics also load, to tell us which of our adverts bring people here and how the site is used (see sections 3, 8 and 13). If you say no, or ignore the message, nothing from Google loads.

"How did you find us?": if you answer this optional question at checkout or on a form, we keep your answer with your order or message, to learn where to advertise.

3. Why we use it, and the law that allows it

Data protection law says we need a "lawful basis" for each thing we do with your information. Here is each one, with the law in brackets.

To take your order and payment, deliver or set up your machine, arrange a collection, and deal with returns, repairs and your warranty. We need to do this to carry out our contract with you, or to take steps you asked for before a contract (UK GDPR Article 6(1)(b)).
To reply to your messages, ring you when a machine comes in, and arrange your visit. You asked us to, and we have a legitimate interest in answering you (Article 6(1)(b) and 6(1)(f)).
To email you when a machine you asked about goes on our website, and once near the end of your request to ask if you are still looking. You asked us to, and you can withdraw your consent at any time by stopping the alerts (Article 6(1)(a)). We use your email address for nothing else: no newsletters and no offers.
To measure which of our adverts bring people to the website and how the site is used, with Google Ads and Google Analytics. Only if you say yes on our cookie message: your consent (Article 6(1)(a)). You can change your mind at any time with "Cookie settings" at the bottom of every page.
To learn where our customers hear about us, from the optional "How did you find us?" question. We have a legitimate interest in knowing where to advertise (Article 6(1)(f)).
To help staff write replies to messages faster, using an AI writing tool. When a member of staff chooses to, the details of your message are sent to an AI service (Claude, made by Anthropic) to suggest a draft reply. That includes what you wrote and the machine or part you asked about; for "Ring me when one comes in" requests it also includes your budget, the user's weight and any notes. Your name and contact details are never sent: we take them out first, including any email address, phone number or postcode you typed in your message. A member of staff always reads the draft, changes it where needed and decides whether to send it. The AI does not make any decision about you. Your VAT-relief declaration and your order are never sent to the AI tool. We do this because we have a legitimate interest in answering enquiries quickly and well (Article 6(1)(f)).
To register you with Premier Care, if you tick the box for the free 12-month policy. You asked us to (Article 6(1)(b)).
To keep VAT and accounting records, including VAT-relief declarations, and to show HMRC that a sale could be zero-rated. The law requires us to keep VAT and accounting records (Article 6(1)(c)). Section 4 explains the health information.
To keep the website and our systems secure, and to stop fraud and misuse. This includes the server logs and the records of failed trade sign-ins. We have a legitimate interest in security and preventing fraud (Article 6(1)(f)).
To run trade accounts and invoice trade partners, including the record of trade sign-ins and the machines partners look at. We need to do this to carry out our contract with the trade partner's business, and we have a legitimate interest in running the trade side of the business (Article 6(1)(b) and 6(1)(f)).
To deal with complaints, disputes or legal claims. We have a legitimate interest in sorting out problems and defending our position (Article 6(1)(f)).

Where we rely on "legitimate interests", we have checked that our reasons are not outweighed by your rights. You can object at any time (see section 11).

We do not use your information for marketing. If we ever want to send marketing emails, we will change this policy and ask you first.

4. The VAT-relief declaration: the health information

Why we ask for it. Mobility equipment for someone who is chronically sick or disabled can be sold without VAT. HMRC expects us to be able to show that each VAT-free sale met the conditions, and a written declaration is how we do that (VAT Notice 701/7). You don't have to make a declaration. If you don't, we add VAT at 20%.

The law that allows it: we keep the declaration because the law requires us to keep VAT records (Article 6(1)(c)). Because it includes health information, data protection law also needs a special condition for it. Ours is "substantial public interest" (Article 9(2)(g), with the Data Protection Act 2018, Schedule 1, paragraph 6): Parliament provides VAT relief so that equipment for disabled people costs less, and the law requires us to keep the evidence that each VAT-free sale qualified. We collect it only because HMRC's rules for VAT relief need it, and we use it for nothing else.

We keep a written policy (an "appropriate policy document") that explains how we look after this information and how long we keep it. Ask us and we will send you a copy.

How we protect it:

Only staff who manage orders, and the site's administrators, can see the declaration.
We never put the description of the condition in the emails we send you or in our own order emails. Your order confirmation says only that the sale was zero-rated on your declaration.
It is never sent to our payment provider or to the AI writing tool. It is never used for marketing, or for anything except showing HMRC that the sale could be VAT-free.
We give it to HMRC only if HMRC asks to see it.

If you are buying for someone else, please tell them you have given us their name and a description of their condition for the VAT declaration, and show them this policy. See section 5.

5. Information you give us about someone else

Sometimes you give us details about another person, for example:

the name and condition of the person a machine is for, in a VAT-relief declaration;
the weight of the person who will use the machine;
a friend's or relative's details in a visit booking or a message.

We get this information from the person who placed the order or sent the enquiry, not from the person it is about. Please give us only what we need, and let the person know. We use their details only for the reason you gave them to us, and we keep them for the same time as the rest of your order or enquiry (see section 10). They have the same rights as you (see section 11), and they can contact us directly.

6. Do you have to give us your information?

To place an order, we need your name, email address, phone number and delivery address. Without them we cannot take, deliver or support your order.
The VAT-relief declaration is your choice. If you don't make one, the sale cannot be VAT-free, and 20% VAT is added.
To reply to a message, we need a way to contact you. Boxes marked "optional" really are optional.
The free Premier Care cover is optional. If you don't tick the box, nothing is sent to Premier Care.

7. Decisions made by computer

We don't make decisions about you by computer alone, and we don't build profiles of you.

Stripe, our payment provider, checks payments automatically to stop fraud, and its checks can decline a payment. Stripe's own privacy notice explains how (stripe.com/gb/privacy). If your payment is declined and you think that is wrong, ring us.

8. Who we share your information with

We never sell your information. We share it only with the people and firms who help us run the shop, and we give them only what they need.

Stripe (payments). To take your payment, we pass Stripe your name, email address, phone number, delivery address, the amount, and our order and machine reference. You type your card details straight into Stripe's box on our checkout page. If you choose Link, Stripe's saved-card checkout, Link's own terms apply to the details it saves for you. Stripe also uses payment details to prevent fraud, and for that part Stripe makes its own decisions about your information.
Google (Google Workspace, our email). Order confirmations, replies to your messages and our shop notices are sent through our Google mailbox, so Google carries them and a copy stays in the mailbox.
DigitalOcean (hosting). Runs our website and stores its information on servers in London.
Anthropic (the AI writing tool, Claude). Only when a member of staff asks it to help draft a reply to your message, as described in section 3, and never your name or contact details. Anthropic acts for us, as our processor.
Mark Bates Limited, trading as Premier Care (Premier House, Londonthorpe Road, Grantham, NG31 9SN). Only if you tick the box for the free 12-month policy. We send them the details they need to set up your cover and handle claims. They then look after your information as their privacy policy explains: Premier Care's privacy policy.
Our delivery carrier and our own engineers. We give them your name, delivery address, phone number and any access notes so they can deliver or set up your machine.
Our shop system. www.usedmobility.uk is part of NBR Mobility Ltd, not a separate company. When you buy, your order details go to our own shop (point-of-sale) system so we can prepare the machine, arrange delivery, keep our accounts and look after your warranty.
HMRC. To meet our VAT duties, including showing a VAT-relief declaration if HMRC asks for it.
Others, only when we must: the police or other authorities where the law requires it, our lawyers or insurers if there is a claim, or a buyer of the business if it is ever sold. A buyer would have to keep to this policy.

Google (Google Ads and Google Analytics), only if you say yes to cookies. Google then receives the pages you visit on our site, how you arrived (for example, from one of our Google adverts), your device and browser details, your internet address, and, when you buy, the order reference, the machine and the amount. We have switched off Google's advertising features that build profiles or show you adverts because you visited us (remarketing, Google signals and ad personalisation). We never send Google anything about your health, a VAT-relief declaration or who the machine is for. Google uses what it receives to provide these services to us, and as described in its own privacy policy (policies.google.com/privacy).

No other analytics or advertising company gets anything from this website.

9. Information sent outside the UK

Our website and its database are hosted in London. Some of the firms we use store information, or can access it, outside the UK. Anthropic, which runs the AI writing tool, is in the United States, and we rely on standard contract clauses approved for UK data to protect what is sent to it. Stripe, Google and DigitalOcean may also process data outside the UK. Where they do, we rely on the safeguards in their data-processing terms.

10. How long we keep your information

We keep information only for as long as we need it. Then we delete it, or remove anything that identifies you.

Orders, delivery details, warranty and aftercare records: 6 years.
VAT-relief declarations: 6 years, as HMRC requires.
Checkouts that were never paid for, with any VAT-relief declaration made in them: deleted 30 days after they end.
Messages, part questions and visit bookings: deleted 12 months after we finish dealing with them.
"Ring me when one comes in" requests: deleted 12 months after you send them, or sooner if you ask us to stop ringing.
"Email me when one comes in" requests: deleted straight away when you stop them. Otherwise each lasts 60 days from when you confirm your email address. Near the end we email once to ask if you are still looking; if you don't keep it, we delete it. If you never confirm your email address, we delete the request after 7 days. When a request is deleted, so are the record of which machines we emailed you about and the website's copies of those emails. Our email account keeps its own copy of each email we send; we delete those within 6 weeks of sending.
Records of AI-drafted replies (the draft reply and which member of staff asked for it): deleted after 12 months.
Copies of emails kept by our website: deleted after 12 months.
Records of trade partners' sign-ins, stock-list visits and the machines they look at: deleted after 12 months.
Trade stock alerts: the record of which machines we emailed a partner about is deleted after 12 months; their list of models is kept until they remove it or the account closes.
Your basket: kept on our server for up to 14 days, linked to your browser by a cookie, then cleared if you don't buy.
Trade accounts and trade invoices: while the account is open, then for up to 6 years.
Records of what our website sends to our shop system: 30 days.
Backups: in case something goes wrong, we keep copies of the website's database. We keep hourly copies for 2 days, daily copies for 30 days, and one copy a month for 6 years, so that we can still produce VAT declarations if HMRC asks for them. The backups are encrypted, and one copy is kept on a second NBR server so that a single failure cannot lose them. This means something we have deleted can stay in an old backup until that backup expires. We use backups only to recover from a failure.

11. Your rights

You have these rights over your personal information. You can ask us to:

give you a copy of what we hold about you (access);
correct anything that is wrong or incomplete;
delete your information when we no longer have a good reason to keep it;
limit what we do with it for a while, for example while we check that it is correct;
stop using it where we rely on our legitimate interests (object). This includes asking us not to use the AI writing tool on your messages;
withdraw your consent, where we rely on it. For "Email me when one comes in", the "Stop these emails" link in every alert does this, and deletes your request;
give you, or another organisation, a copy of information you gave us, in a common computer format (portability).

Some rights have limits. For example, we must keep VAT records, including declarations, for 6 years, even if you ask us to delete them.

Marketing: we don't send marketing. If we ever did, you could tell us to stop at any time, and we would.

How to use your rights: email hello@usedmobility.uk, ring 03330 540 630, write to us (see section 1), or use our Contact page. It's free. We may ask you to confirm who you are, or to tell us more about what you are asking for. We will reply within one month of receiving your request, or of you confirming who you are or giving us the details we asked for, if we needed to ask. If your request is complicated we may take up to two more months, but we will tell you within the first month if we need to.

12. Complaints

If you are unhappy with how we have used your information, please tell us. Email hello@usedmobility.uk, ring 03330 540 630, write to us (see section 1), or use our Contact page. We will acknowledge your complaint within 2 working days and give you our answer within 14 days.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint. Please give us the chance to put things right first, but you can contact the ICO at any time.

13. Cookies

We use only the cookies the site needs to work:

sessionid: remembers your basket and keeps staff and trade partners signed in (14 days);
csrftoken: stops another website from sending our forms in your name (1 year);
messages: carries a one-off notice to the next page, and is then deleted.

On the checkout page only, Stripe loads its payment box and sets two cookies of its own to prevent fraud. We also keep one small cookie (um_consent) that remembers your answer to our cookie message for 6 months. Only if you say yes, Google sets its own cookies to measure our adverts and how the site is used. Our Cookies page has the full details, and "Cookie settings" at the bottom of every page lets you change your answer.

14. How we keep your information safe

The whole site uses a secure (HTTPS) connection.
Staff sign in with passkeys or one-time codes sent by email, and each person sees only what their job needs.
VAT-relief declarations can be seen only by staff who manage orders and by the site's administrators.
Card details are handled by Stripe and never reach our systems.
Any passwords are stored in a scrambled (hashed) form.

No system is completely safe. If something went wrong that put you at high risk, we would tell you, and we would report it to the ICO where the law requires.

15. Children

Our shop is for adults. We don't knowingly collect information about children under 18. The one exception is when a parent or guardian gives us a child's name and condition in a VAT-relief declaration for a machine the child will use. If you think a child has sent us their details, email hello@usedmobility.uk and we will delete them.

16. Changes to this policy

When we change this policy, we change the date at the top. If a change affects how we use information you have already given us, we will tell you before it happens, for example by email. The current version is always at www.usedmobility.uk/privacy/.

Not sure how this applies to you? Ring us on 03330 540 630 (Mon–Fri 9am–5pm · Sat 9am–1pm) or send us a message.