Your data, explained clearly.
This notice explains what Duewise processes, why, who receives it, how long it is retained and how you can exercise your rights.
Effective and last updated: 18 July 2026
Sergi Riera Félix, trading as SRF Systems
Sergi Riera Félix, trading as SRF Systems, operator of Duewise, determines how and why personal data is processed. Privacy requests may be sent to DueWise@srfsystems.uk.
UK service
Duewise is designed for UK vehicle checks and applies the UK GDPR, Data Protection Act 2018 and PECR. If EU data-protection law applies to a particular user or activity, we will also honour those rights.
Processing record
What we process and our lawful basis.
We collect only the information reasonably required to provide, protect and account for the service.
Account and authentication
Data: Name, email address, account identifiers, authentication events and account role.
Purpose: Create, secure and administer your account.
Lawful basis: Performance of our contract and legitimate interests in service security.
Vehicle checks and reports
Data: Registration, mileage, price, advert text, URL, seller details you choose to provide, report inputs and saved results.
Purpose: Generate, save and reopen the buyer report you request.
Lawful basis: Performance of our contract.
Payments
Data: Stripe customer and transaction identifiers, product purchased, amount, currency, invoice and payment status. Duewise does not receive or store full card details.
Purpose: Take payment, allocate checks, provide receipts and meet accounting duties.
Lawful basis: Performance of our contract and legal obligations.
Security and abuse prevention
Data: IP address, browser and device signals, security logs, rate-limit events and a one-way device hash used to prevent repeated introductory-check claims.
Purpose: Protect users, prevent fraud and enforce fair-use limits.
Lawful basis: Legitimate interests in security, fraud prevention and service integrity.
Support and feedback
Data: Support messages, issue reports, ratings, optional public comment and optional first-name display consent.
Purpose: Resolve problems and improve Duewise.
Lawful basis: Performance of our contract, legitimate interests and consent for optional public attribution.
Product analytics
Data: Consent-dependent usage events and technical information where analytics is enabled.
Purpose: Understand product performance and improve user journeys.
Lawful basis: Consent where PECR requires it; otherwise applicable legitimate interests subject to your right to object.
AI transparency
How artificial intelligence is used.
Duewise is a decision-support service, not an automated legal, financial, safety or mechanical decision-maker.
Duewise uses server-side AI to help create and structure vehicle knowledge and buyer-report explanations. Outputs may be inaccurate, incomplete or out of date and must be verified against official records, the vehicle, its documents and an appropriate professional inspection. Duewise does not use report output to make a decision producing legal or similarly significant effects about a person. Users can report an error and request human review through support.
Processors
Service providers that may receive data.
Authentication, database and storage infrastructure.
Checkout, payment processing, invoices and fraud controls.
Hosting, content delivery, serverless processing and technical logs.
Product analytics only when lawfully enabled and subject to the user's choices.
Server-side assistance with vehicle-knowledge and report content. Do not enter unnecessary personal information in advert text.
Verification, password reset, service and support emails.
Providers may process data outside the UK. Where required, Duewise relies on adequacy regulations or approved contractual safeguards and applies data-minimisation and access controls.
How long we retain data
- Account, saved vehicle and report data: while the account remains active, then deleted on a valid account-erasure request.
- Payment and accounting records: up to six years where required for tax, accounting, chargeback or legal claims.
- Support and security records: normally up to 12 months, longer only where a live dispute, investigation or legal duty requires it.
- One-way introductory-check device hash: up to 24 months after account deletion for abuse prevention, without the deleted account identifier.
Self-service erasure
Account deletion removes Supabase authentication and account-linked reports, vehicles, wishlist, credits and feedback. A minimal record may be retained where necessary for payments, taxation, fraud, security or legal claims. The right to erasure is not absolute.
Open account profileControl your information.
We normally respond within one month. We may ask for proportionate evidence of identity before disclosing or changing data.
Contact DueWise@srfsystems.uk. You may also complain to the Information Commissioner's Office. You can read our Cookie Policy.