Senior Privacy Counsel

OUR MISSION

To become the car-changing destination of choice. By combining technology, media and deep automotive expertise, we’ve turned how people buy, sell, advertise and lease cars on its head.

What started as a simple reviews site is now one of the largest online car-changing destinations in Europe. Last year alone we grew over 50% with nearly £3bn worth of cars bought on site, while £1.8bn of cars were listed for sale through our Sell My Car service.

In the last couple of years we have gone big and acquired both Carwow Leasey, a leasing broker, and Autovia, creators of AutoExpress and Evo magazines, doubling our audience overnight. Together we now have one of the biggest YouTube channels in the world with almost 10m subscribers and over 1.1 billion annual views, while we sell 1.2 million print copies of our magazines and have an annual web content reach of over 350 million. We also launched our successful Sell My Car business in Germany. We are continually driving to make Carwow the go-to destination for people looking to change their car.

And we’re a long way from done!

LEGAL & COMPLIANCE @ CARWOW

Our fantastic legal team has been compared to a set of high-performance tyres, enabling Carwow to drive and corner at high speeds whilst keeping Carwow firmly on the road in all conditions. As the business pushes forward with bold ambitions, the legal team’s purpose is clear: to drive Carwow’s growth with integrity and confidence – and that’s where you come in!

YOUR MISSION

We are a platform that sits right in the middle between consumers and OEMs/Dealers in the car-changing journey. Datasits at the heart of everything we do and we want to commercialise it responsibly.

As Senior Privacy Counsel, you will be Carwow’s dedicated in-house privacy lawyer and operational privacy lead, playing a pivotal role in enabling the business to grow and scale at pace with integrity. This is an exciting opportunity to develop your career in a complex, high-growth and data-thirsty marketplace business.

We are looking for a Senior Privacy Counsel who wants to do more than provide legal advice from the sidelines. This is a rare opportunity to join a high-performing legal function as our first dedicated in-house privacy hire, taking ownership of the day-to-day privacy programme while acting as a senior legal and strategic advisor to the business as it sharpens its privacy governance programme and steers towards further growth and an exit.

We are not at “Day Zero”. We currently have an external DPO, established policies, templates, a RoPA and a risk register.

We need a tech-fluent privacy lawyer who is equally comfortable advising and doing: someone who can interpret complex legal requirements, exercise sound legal judgement and provide pragmatic advice, but who will also roll up their sleeves and build, operate and continuously improve the mechanisms that make privacy work in practice.

You will have the mandate to lift the lid on our technology stack, validate our data flows, identify legal and operational privacy risks and work directly with our Product, Engineering, Data, Marketing and commercial teams to keep the business safe and moving fast.

KEY RESPONSIBILITIES

Privacy governance and framework development: Own, develop and maintain Carwow’s enterprise privacy governance framework, encompassing internal policies, ROPAs, privacy notices, risk registers, retention schedules and associated controls. Interpret applicable legal requirements and ensure our documentation and processes reflect the reality of Carwow’s technology stack and processing activities, leading remediation where discrepancies or risks are identified.

Legal advice and business partnering: Act as Carwow’s principal in-house legal advisor on privacy and data protection matters. Develop strong business partnering relationships across Marketing, Media, Product, Engineering, Data and other parts of the business, providing pragmatic, risk-based legal advice that enables commercial objectives while appropriately managing privacy risk. Provide advice to senior management and support the General Counsel in updating the Company’s Senior Leadership Team and Executives as needed.

Culture & Training: Build a strong internal perception of privacy as a “trust builder”. Design and deliver role-specific training that is engaging, commercially relevant and free of unnecessary legal jargon, helping teams understand both their legal obligations and how to apply them in practice.

Breach response: Lead the privacy aspects of data breach and incident response, working cross-functionally to investigate incidents, assess legal and regulatory risk, determine notification obligations and oversee remediation. Liaise with the external DPO, regulators and other relevant stakeholders as appropriate.

DPAs, DSAs and data contracting: Draft, review and negotiate DPAs, DSAs and other data protection provisions and agreements arising from commercial arrangements. Provide practical legal advice on controller/processor relationships, data sharing, international transfers and related privacy risks.

DSARs and individual rights: Own and continuously improve Carwow’s processes for responding to data subject rights requests, ensuring requests can be handled lawfully, efficiently and with minimal disruption to the business. Provide legal guidance on complex or sensitive requests where required.

Retail Media and Ad Tech: Provide legal and operational privacy support on new commercial propositions looking to leverage Carwow’s data for third-party audience targeting, segmentation and advertising. Advise on the appropriate use of personal data, profiling, consent and data-sharing structures and help design commercially workable and legally robust mechanisms for using and sharing data.

Product, Data and Technology: Work closely with Data & Insights, IT, Engineering and Product teams throughout the product lifecycle to embed Privacy by Design. Lead or support privacy assessments, identify legal and operational risks in new products and processing activities, and translate complex technical data flows into clear, risk-based advice for the General Counsel, Executives and wider business.

Operationalise Compliance: Own and operate core privacy compliance processes, including DPIAs, LIAs and data-sharing assessments. Look continuously for opportunities to integrate these into existing business workflows, with an eye on making compliance proportionate, scalable and automated wherever possible.

Regulatory developments: Monitor and interpret relevant developments in privacy, data protection, digital regulation and related areas, assess their impact on Carwow and translate new legal requirements into practical changes to products, policies, controls and business processes.

Corporate work: Provide privacy legal support on M&A, funding and other corporate transactions, including conducting privacy due diligence, identifying material risks and supporting remediation and integration activity.

AI and emerging technology: Advise on the privacy implications of AI and emerging technologies adopted or developed across the business, while supporting the development of practical governance mechanisms that allow Carwow to innovate responsibly.

Multi-jurisdictional: Support Carwow’s businesses across the UK, Germany, Spain and Portugal, advising on relevant local and European privacy requirements and working with external counsel where specialist local advice is required.

KEY REQUIREMENTS

A qualified lawyer, admitted to practise in England & Wales or another relevant UK or European jurisdiction, with significant experience advising on privacy and data protection matters.

Significant experience working in-house, balancing legal and regulatory requirements with commercial objectives and operating as a trusted advisor to the business.

Strong working knowledge of UK and European data protection law, with the abil