Legal

Privacy Policy

This policy explains what personal information McMillan Imports collects, why we collect it, who we share it with, how long we keep it, and what you can require us to do with it. It is written to be read, not to be survived.

Effective: 3 August 2026 · Last updated: 3 August 2026

1. Who we are

McMillan Imports ("McMillan", "we", "us") is a vehicle sourcing and import coordination service based in West Palm Beach, Florida, United States. We do not buy, sell, or take title to vehicles. You remain the purchaser and the importer of record on every transaction.

We are the controller of the personal information described in this policy — meaning we decide what is collected and why. For privacy questions, requests, or complaints, contact privacy@mcmillan.ltd. If you need a postal address for a formal notice, ask and we will provide one.

2. What we collect

We collect only what a vehicle import actually requires. Specifically:

We do not knowingly collect information from anyone under 18, and our services are not directed to children. If you believe a child has given us information, contact us and we will delete it.

3. Why we use it, and on what basis

We use your information to: verify vehicle eligibility and quote your import; coordinate with the exporter, your customs broker and your shipping provider; take and account for payments; keep you updated on your vehicle; meet our record-keeping and tax obligations; and secure the service against fraud and abuse.

Where the EU or UK GDPR applies to a particular visitor, our legal bases are: performance of a contract (coordinating your import), legal obligation (records we are required to keep), legitimate interests (security, fraud prevention, improving the service), and consent (marketing email, and any non-essential cookies).

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California and other US state privacy laws. We have never done so.

4. Who we share it with

We share the minimum necessary, and only with parties who need it to complete your import:

• Our service providers (processors) — our website host, our database and authentication provider, our payment processor, our AI provider for the “Ask about imports” assistant (see section 5), and our internal automation tooling. They act on our instructions and may not use your information for their own purposes.
• The exporter or seller of your vehicle, typically in Japan — the details needed to identify you as the buyer and to prepare export documentation.
• Your customs broker — a licensed party you appoint directly. We make the introduction and then step out of the entry process. We do not hold your customs power of attorney.
• Your shipping and transport providers — the details needed to move and deliver the vehicle.
• Government authorities — where required by law, including customs, transport and tax authorities.
• Professional advisers, insurers, and — if the business is ever sold or reorganised — an acquirer, subject to the same protections.

5. The “Ask about imports” assistant

This site offers an assistant that answers questions about importing. We want to be direct about what it is and where your words go.

• It is software, not a person. It gives general guidance only. It is not legal, tax, customs or financial advice, and nothing it says binds us or creates a quote.
• What you type is sent to our AI provider — Anthropic, in the United States — to generate the answer. They process it on our behalf as our service provider and do not use it to train their models.
• The conversation is stored in your own browser, in session storage, and is discarded when you close the tab. We do not attach it to your account or build a profile from it.
• Please do not paste sensitive information into it — no passport or licence numbers, no card details, no bank details. It does not need them, and the secure place for documents is your account’s document upload.
• You never have to use it. Everything it does can be done by email or phone with a person — see our accessibility statement.

6. International transfers

The vehicles we source are located abroad, so completing your import necessarily involves sending some of your information outside the United States — principally to Japan, and in future to other source markets. Where we transfer personal information from a jurisdiction that restricts such transfers, we will have the appropriate safeguard for that jurisdiction in place before the transfer is made — for most such transfers, Standard Contractual Clauses. We are putting that documentation in place with our Japanese counterparties now, and you may ask us where any particular transfer stands.

7. How long we keep it

The seven-year periods reflect customs, tax and vehicle-import record-keeping expectations. Where a longer period is required by law or by an open dispute, we keep the record until that requirement ends.

8. Your rights

Depending on where you live, you may have the right to: know and access what we hold; correct it; delete it; obtain a portable copy; opt out of sale, sharing, or profiling (we do none of these); limit the use of sensitive information; withdraw consent; and to be free from retaliation for exercising any of them.

To make a request, email privacy@mcmillan.ltd with the subject line "Data Request". We will verify your identity against information we already hold — we will not ask you to create an account or send new identity documents in order to make a request. We respond within 45 days, and will tell you if we need a permitted extension. You may use an authorised agent. There is no charge.

If you are in the EU or UK you may also complain to your supervisory authority. If you are in Florida you may contact the Florida Department of Legal Affairs. We would rather you came to us first.

9. Security, and what happens if it fails

The site is served over HTTPS only. Database access is restricted by row-level security so that a signed-in customer can reach their own records and no one else's. Uploaded documents sit in a private bucket, not a public one. Card data never touches our systems.

No system is perfect. If a breach affects your personal information, we will notify you and the relevant authorities as required — for Florida residents, within 30 days under Fla. Stat. § 501.171, and without undue delay elsewhere.

10. Cookies

We use a small number of cookies and browser-storage entries — to keep you signed in, to remember your light or dark theme, to remember the delivery postal code you last entered, and to hold your conversation with the assistant for the length of your tab. Our payment processor sets its own fraud-prevention cookies on payment pages. The Cookie Notice names every one of them. If we ever add analytics or advertising cookies, we will ask for your consent first.

11. Changes

If we change this policy materially, we will update the date above and, where the change affects an active import, tell you directly. We will not apply a materially different use to information already collected without your consent.