Privacy Policy

Zelfi Ltd (trading as Zelf) Effective date: 30/06/2026

This Policy explains how We collect and use Your personal data when You use the Service. It is not part of the Agreement between You and Us — see Clause 2 of the Main Agreement for what does form the Agreement.

1. Who We are

We are Zelfi Ltd, trading as Zelf, a company registered in England and Wales (company number 05632396), of Unit 1, Hopton Road, Devizes, SN10 2EU. We are the controller of Your personal data for the purposes of UK data protection law.

You can contact Us about this Policy at info@zelf.co.uk or 0345 034 3838.

2. What We collect

• Account and identity information — name, date of birth, address, contact details, driving licence details, proof of address, and the outcome of Our identity and licence verification checks, including facial biometric (liveness) checks and Your National Insurance number used for verification.
• Driving record information — points, convictions, endorsements and accident history, as relevant to the Driver Eligibility Policy.
• Booking and payment information — Your Bookings, Rental Cost, Deposit/Hold, Wallet activity, and payment card details.
• Vehicle and telematics data — location, route, status, fuel/charge level and other data generated by the Vehicle during Your Booking.
• Communications — Your contact with Us, including App messages, calls, emails and complaints.
• Technical and usage data — collected via Our website and App, including through the cookies and SDKs described in Our Cookies & SDK Policy.

3. How We collect it

Mostly directly from You — when You register, make a Booking (whether through the App or Our website), use the Service, or contact Us. Some information is generated automatically by the Vehicle’s telematics during Your Booking. Some is obtained from third parties carrying out checks on Our behalf — for example, the DVLA for licence validity.

4. Why We use it, and Our legal basis

5. Special category data — biometric verification

As part of identity verification, Our provider carries out a facial biometric (liveness) check — comparing Your facial image against Your identity document to confirm You are the genuine holder of that document. This involves processing biometric data, which is classified as “special category data” under UK GDPR and requires a specific legal basis beyond the standard bases used for ordinary personal data.

We rely on Your explicit consent as the legal basis for this processing under Article 9(2)(a) UK GDPR. You give this consent as part of Our identity verification process when You register for an Account. Without completing this check, We are unable to verify Your identity and open an Account for You. You have the right to withdraw consent at any time, though doing so will mean We are unable to continue providing the Service to You, since identity verification is a core requirement of Our insurance and eligibility process.

6. Automated decision-making

Some eligibility decisions under the Driver Eligibility Policy are made automatically. These fall into two different categories, with different consequences for You:

• Categories where a referral can change the outcome — for example, Your age or the country that issued Your licence. Here, contacting Us or being referred to Our insurer involves a real review that could lead to a different result.
• Categories where the outcome is fixed by Our insurer’s rules — for example, certain conviction codes or accident history that Our insurer does not cover under any circumstances. Here, the automatic decline reflects a fixed rule, and a human review would not change the outcome unless the underlying information about You was incorrect.

For the second category, this is “solely automated” decision-making with a legal effect (declining to offer You a Booking) under Article 22 UK GDPR. You have the right to ask Us to have a person confirm the decision, explain it, and consider anything You want to raise — including correcting any information We hold about You that’s wrong. We can’t promise this will change the outcome where Our insurer’s rules genuinely leave no discretion, but We will tell You clearly if that’s the case, and We will always correct a decision based on inaccurate information.

7. Who We share it with

We share Your information with other organisations who help Us provide the Service, including:

• the technology platform that powers Our booking, fleet management and vehicle telematics systems;
• providers who verify Your identity, driving licence and phone number;
• payment and Wallet providers;
• messaging and notification providers;
• Our insurer and insurance broker;
• breakdown and roadside assistance providers;
• analytics and marketing providers; and
• providers who support Our internal business operations, including workflow automation and AI tools.

We also share information with public authorities — such as the DVLA, the police, and local enforcement authorities — where the law requires or allows this.

A full list of the specific providers We use, and what each does, is available on request — contact Us using the details in Section 1.

8. International transfers

Some of the providers in Section 7 are based outside the UK, including in the United States and other countries. Where this happens, We put a legally recognised safeguard in place first, such as a UK adequacy regulation, the UK extension to the EU–US Data Privacy Framework, or the UK’s International Data Transfer Agreement. Details of the specific safeguard used for each provider are available on request.

9. How long We keep it

We keep Your information for as long as You hold an Account, and for a further period afterwards to meet Our legal, accounting, insurance and fraud-prevention obligations — generally up to 6 years after Our relationship with You ends, reflecting standard limitation periods for contract-related claims in England and Wales. Zelf’s actual retention schedule, including whether any category of data — for example, biometric verification data — is deleted sooner than this general period, as some identity verification providers require.

10. Your rights

You have the right to: access the information We hold about You; have inaccurate information corrected; have information deleted in certain circumstances; restrict or object to certain processing; receive certain information in a portable format; and withdraw consent at any time where We rely on it. Where We process Your data based on consent, withdrawing it won’t affect anything We’ve already done lawfully beforehand. You have an absolute right to object to direct marketing.

To exercise any of these rights, contact Us using the details in Section 1.

11. Complaints

If You’re unhappy with how We’ve handled Your information, please contact Us first so We can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk at any time.

12. Cookies and similar technology

Our use of cookies and similar technology, including SDKs in Our App, is explained in Our separate Cookies & SDK Policy.

13. Changes to this Policy

We may update this Policy from time to time. We’ll tell You about material changes in advance where reasonably possible.