1. Who we are
Racso Solutions is a sole trader operating in the United Kingdom. We build SMS lead qualification and automated test-drive booking software for car dealerships.
Data Protection Registration: ICO Data Protection Register (Tier 1, Registration ongoing) • Contact: hello@racsosolutions.co.uk
2. What data we collect and why
Your data (as a Racso customer):
- Account information: Name, email, phone, business name, business address, payment details
- Booking & availability data: Your dealership's opening hours and confirmed test-drive bookings, stored in Racso's own database — we don't connect to or read any external calendar (e.g. Google Calendar) today
- Qualifying questions: The SMS questions you define for your leads
- Inventory data (optional): Cars you add to your stock list — make, model, year, price, registration, and status
- Usage data: How you use Racso (logins, SMS sent, bookings created, feature usage)
Lead data (collected via SMS):
- Phone number (the lead's phone)
- SMS conversation: The actual text messages between lead and bot
- Extracted info: Vehicle interest, budget, timeframe, preferred test-drive time (parsed from the conversation)
- Booking details: Test drive date/time, location, booking status
- Reminders sent: Whether the same-day reminder was sent and delivered
Vehicle registration lookups (DVLA):
If you use the inventory "look up by registration" feature, we send the registration number to the DVLA's Vehicle Enquiry Service (a UK government API) and receive back the vehicle's make, colour, fuel type, year, and current MOT/tax status. We cache this result for 24 hours, keyed only by the registration itself (not linked to any specific lead or dealership), to avoid repeat lookups. No lead or customer personal data is sent to the DVLA — only the registration plate.
Important: You own all lead data. We are a data processor; you are the data controller. We never sell, share, or use lead data for our own purposes.
3. Legal basis for processing
We process your data based on:
- Contract: Necessary to provide Racso (SMS sending, booking creation, inventory management)
- Consent: You consent to us collecting usage data to improve Racso and provide support
- Legal obligation: We keep records for tax and regulatory compliance (7 years)
4. Leads' rights (GDPR)
People who text Racso are end-users, not our direct customers. But they have rights over their data:
- Right of access: They can ask you (or us) for a copy of their data
- Right to erasure: They can ask to be "forgotten" and their data deleted (subject to exceptions)
- Right to object: They can opt out of marketing or profiling
- Right to data portability: They can request their data in a portable format
If a lead emails us asking for their data, we'll respond within 30 days (GDPR requirement). You're their primary contact, but we're legally responsible for honoring their requests.
5. SMS compliance (GDPR + PECR)
Racso only texts leads who initiated contact by calling you. This is transactional SMS (not marketing), so it's GDPR and PECR compliant without explicit opt-in. However:
- The bot's first message is always a qualifying question, not marketing
- Reminders are confirmations of bookings already made
- We never send promotional SMS (e.g., "Get 20% off today")
- If a lead texts "STOP", they're not added to future conversations
If you want to send follow-up marketing SMS later, that requires explicit opt-in from the lead.
6. Data storage, security, and sub-processors
- Encryption: All data in transit is encrypted (TLS 1.2+); data at rest is encrypted at our hosting provider
- Access controls: Only authorized Racso staff can access data (authentication required); each dealership can only see its own leads and bookings
- Sub-processors we actually use:
- Twilio — sends and receives the SMS messages
- Railway — hosts our application and database
- Google (Gmail) — sends booking-confirmation and digest emails to your dealership on our behalf; we do not use Google Calendar
- DVLA Vehicle Enquiry Service — only for the optional registration-lookup feature described above
- Cloudflare — anonymous, cookieless website analytics on this marketing site only (see our Cookie Policy); not used for the dashboard application
- Google Fonts — this marketing site and the dashboard load typeface files from Google's font CDN, which means your browser's IP address is sent to Google when a page loads, the same as any external resource. No cookies are set by this and Google doesn't receive any other personal data from it.
7. How long we keep data
- Lead data: Kept for as long as your account is active. If you cancel, we retain it for 30 days so you can export. After 30 days, it's permanently deleted.
- SMS conversations specifically: Stored as part of the lead record above — same retention (active account + 30 days after closure), not deleted separately or sooner.
- DVLA registration lookups: Cached for 24 hours, then re-fetched fresh on the next lookup.
- Account data: Kept for 7 years after account closure (tax/compliance requirement)
- Usage/analytics logs: Retained for 90 days for debugging; then aggregated and kept for 2 years
8. Your rights as a customer
- Access: You can view all your data and leads' data anytime in the dashboard
- Correct: You can update your account info and qualifying questions
- Delete: Email hello@racsosolutions.co.uk with "Data deletion request" and your business name to request deletion of your account and all data (subject to 30-day delay for backups)
- Restrict processing: You can pause Racso without canceling (e.g., during quieter periods)
9. Cookies and tracking
See our full Cookie Policy. In short: the dashboard app sets one essential login cookie; this marketing website uses cookieless analytics only, no consent banner required.
10. Data retention summary
| Data type | Retention period |
|---|---|
| Lead SMS conversations | Until account closure + 30 days |
| Booking records | Until account closure + 30 days |
| DVLA registration lookups (cache) | 24 hours |
| Account/customer data | 7 years (tax compliance) |
| Usage logs / analytics | 90 days (raw) → 2 years (aggregated) |
11. International transfers
Our SMS provider (Twilio) and hosting provider (Railway) may process or store data outside the UK/EU, including in the United States. Where this happens, we rely on Standard Contractual Clauses (SCCs) or an equivalent recognized safeguard with that provider. If you need details of a specific transfer for your own compliance records, email hello@racsosolutions.co.uk.
12. Your responsibilities
As a Racso customer, you're responsible for:
- Consent: Ensuring you have the right to share leads' data with us (e.g., they called you, consented to a quote, etc.)
- Privacy notice: Informing leads how their data will be used (you could say: "Missed call? We'll text you from our bot to reschedule")
- Data accuracy: Keeping your account data up to date
- Compliance: Using Racso in a compliant way (not for spam, harassment, etc.)
13. Children's data
Racso is a business tool for car dealerships and their prospective customers, and isn't directed at or designed for children. Booking a test drive requires a driving licence, so we don't expect leads to be minors — but if we become aware that a lead is a child and their data was collected without appropriate parental consent, email hello@racsosolutions.co.uk and we'll delete it. We don't knowingly collect data from children.
14. Data Processing Agreement
We offer a Data Processing Agreement covering exactly what's in this policy — see our Data Processing Agreement page for the full template, or email hello@racsosolutions.co.uk to request a signed copy for your business.
15. Complaints and contact
Data subjects (leads): If a lead has a complaint, they should contact you first. If unresolved, they can contact us at hello@racsosolutions.co.uk or lodge a complaint with the ICO.
Customers: If you have privacy concerns, email us at hello@racsosolutions.co.uk and we'll respond within 7 days.
ICO contact: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF • ico.org.uk
See also: Terms & Conditions · Refund Policy · Cookie Policy · Accessibility Statement