Who we are
We are Inchcape. Inchcape is the trading name for Inchcape Retail Limited. Our registered office is at First Floor, Unit 3140 Park Square, Solihull Parkway, Birmingham Business Park, Birmingham, B37 7YN. All of the companies within the Inchcape group are registered with the ICO as data controllers.
We are dedicated to ensuring that all personal data that we process is done so in a fair, lawful and transparent manner. We take the security of your data very seriously and adhere to all relevant data protection legislation including the Data Protection Act 2018, the General Data Protection Regulation 2016/679 (‘GDPR’) and The Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”).
How to contact us or make a complaint
If you have any questions relating to this notice, your rights under data protection legislation or the processing of your personal data then you can contact us by:
- Email: firstname.lastname@example.org
- Post: FAO Privacy Compliance Manager, First Floor, Unit 3140 Park Square, Solihull Parkway, Birmingham Business Park, Birmingham, B37 7YN
- Telephone: 0333 130 0108
You are important to us, and so is protecting your personal information. We have high standards when it comes to collecting and using personal information. For this reason, we take any complaints we receive from you about our use of your personal information very seriously and request that you bring any issues to our attention.
Where you are communicating with us for the purpose of making a complaint, we will only use your personal information to handle, investigate and respond to the complaint and to check on the level of service we provide. Where the complaint is about a member of our team, we may have to disclose your identity to whoever the complaint is about. You may let us know that you don't want information that identifies you to be disclosed and we will try to respect your request; however, it may not be always possible to handle a complaint on an anonymous basis.If you are unhappy with our use of your personal data or our response to the exercise by you of any of your rights, then you have the right to complain the UK’s data protection authority the Information Commissioner's Office (ICO) (www.ico.org.uk).
What is Personal Data?
Personal data includes any information about an individual from which that individual can be identified. Examples include your name, identification number, email or home address, photograph and bank account details, factors specific to an individual (such as your physical, physiological, mental, economic, cultural or social identity) and any data that would allow you to be identified when combined with other data.
It is our intention to provide you with as much information as possible about what we do with that personal data, so that when you provide your personal data to us, you do so with an awareness of how it will be used.
If you provide us with personal data on behalf of someone else, for example if you provide your spouse’s details in connection with the purchase of a vehicle, you confirm to us that you have their permission to do so. The exercise of any further rights in connection with such personal data will need to be done by the relevant individual.
How we collect your personal information and why
- We are not interested in collecting every personal detail about you. Our main reason for collecting your personal information is to provide and improve the service, products and experiences that your customers expect from us.
- We will need to collect personal information about you in order for us to be able to carry out the service you have requested or accessed. We will only collect the information that we need.
We collect your personal information in a number of different ways which we have explained in this section.
Information that you share with us
We collect personal information that you share with us when you contact or interact with us. For example, where you provide it to us:
- by entering personal data via our website, live chat boxes or social media platforms and testimonials and opinions you may have posted publicly
- when you contact our customer service teams and our call centre
- if you make an enquiry or register your interest in a vehicle in a showroom or at an event we, a manufacturer or third party have held
- when you place an order, purchase or book an appointment for a vehicle or for any parts, goods or any other products or services
- where you make an appointment for a vehicle service or MOT
- when you apply for a loan, personal contract purchase or lease agreement from one of our accredited finance providers to purchase your vehicle
- when you part exchange your vehicle or where you provide any service history relating to your vehicle or provide any information to evidence that you are insured to drive a vehicle
- when you register on the careers page of our website and when you apply for a role with us
- by corresponding with us by phone, email, in person or any other means for any reason
Information that we receive from third parties
We may also receive your personal information from third parties, such as:
- if you have requested a brochure, test drive, details about a vehicle or registered an interest in a vehicle
- to provide vehicle support services or in the event of a safety or product recall
- if you exercise your data subject rights and we receive notification from the manufacturer
finance providers and brokers
- where you have engaged a third party broker to act on your behalf to administer the purchase of a vehicle
- where we are provided with your personal information by our approved finance providers to allow us to contact you during the term of your contract. For example, we may contact you towards the end of your Personal Contract Purchase (PCP) contract to discuss your options before and at the end of the contract
- when we are required to carry out repairs on your vehicle as part of a claim you have made through your insurance
Regulatory and supervisory bodies
- such as the Driver and Vehicle Licencing Agency (DVLA) where we need to confirm if you hold a valid driving licence for the purposes of providing a courtesy or loan car or a test drive
- if you apply for a role with us through a recruitment agency or job board provider then we will need your personal information for the purposes of assessing your application.
How we may process your personal data
We will only process your data where the law allows. Your personal data will, most commonly, be processed in the following circumstances:
Where required to perform a contract with you. Where it is necessary to process your personal data for the performance of a contract with you or in order to take steps at your request before entering into a contract with you.
Where there is a legal or regulatory obligation. Where we need to process your personal data to comply with our legal obligations such as assisting the ICO, DVLA, DVSA, FCA, HMRC, the police or any other public authority or criminal investigation body. We may also need to process your personal data to identify you when you contact us or to verify the accuracy of the data that we hold about you.
Legitimate interest. We may process your personal data where it is in our legitimate interests (or that of a third party) and those interests do not override your rights and freedoms. For example, we may contact you to notify you about your vehicle’s servicing or MOT requirements.
Vital interests. Where it is necessary to process your personal data to protect your vital interests or those of another person. For example, we may contact you to notify you about safety or product recalls relating to your vehicle.
Consent. We may rely on your consent to send you direct marketing communications. Details on how you can change the way we contact you are set out in section 11.
Please click here to view and/or download a table describing in more detail the ways in which we may process your personal information and which of the legal means we rely on to do so.
We will only use personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. Please contact us using the details set out in section 2 if you need details about the specific legal ground on which we are relying to process your personal data.
Cookies are small files of letters and numbers that we store on your browser or the hard drive of your device. There are different types of cookies that we use for different purposes; however generally speaking cookies help us to distinguish you from other users of our website, which allows us to provide you a better experience and also allows us to improve our website.
You can block cookies at any time by activating the setting on your browser that allows you to refuse some or all cookies. However, if you do block cookies there may be parts of our website that you will be unable to access or that will not function properly.
We use the following types of cookies:
Strictly necessary cookies.
These are cookies that are essential for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.
They allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
These are used to recognise you when you come back to our website so that we can personalise our content for you, greet you by name and remember your preferences (for example, your region).
If you require further information about the cookies we use, then please contact us using the details provided in section 2.
Third party services
Subscribing and unsubscribing to our marketing
If you have made an enquiry into our products or services, we will provide you with a clear choice to consent to receiving marketing materials by giving you an opt-in to receiving such communications. If you have provided your consent we may collect your contact details (name, postal address and email address) and vehicle details (make and model) to provide you with such communications.
If you ever decide you want to change your marketing preferences or no longer wish to receive our marketing communications, you can do so at any time by using the link provided in the marketing communications email, or by using the contact details in section 2 above. If you do unsubscribe, please note that we will still keep your email in a separate secure list so that we can make sure that you do not receive our marketing communications again in the future.
Your data and third parties
We may share your personal data with carefully selected third parties in order to make certain services available to you and we have explained those types of scenarios in the table in section 5.
We only share the minimum amount of data required and our third party suppliers only have rights to use your personal data for the purpose of fulfilling the service required from them.
We use a large number of suppliers so we have not provided a full list in this Privacy Notice. We can confirm that the categories of third party that we may share your personal data with in order to provide our products and services include:
We share data with the BMW Group UK for the following purposes:
- to fulfil your order for a vehicle
- for warranty, registration and safety/product recall purposes relating to your vehicle
- to diagnose and fix problems with your vehicle
- or, where you have provided consent, for marketing communications
If we provide you with a Service Plan quote we will disclose your information to our Service Plan partners. If you decide to purchase a Service Plan from us then our partner will act as a Data Processor on our behalf.
Other Third Parties
We may also provide your personal information to our insurance administrators, IT providers, service, maintenance and repair providers, vehicle breakdown and recoveries providers, accident and incident management providers, risk management and driving licence checking providers, financial organisations, banks and credit brokers, credit reference agencies, marketing agencies, the Inchcape group and legal, governmental and regulatory authorities.
Some of our third party suppliers will be data controllers in their own right. If they are in receipt of your personal data or they collect it from you directly they will provide you with a copy of their individual privacy notices.
Disclosure of personal information
We will not usually disclose your personal information other than as already explained in Sections 8 above. However, there may be circumstances where we need to share personal information other than as anticipated. These include:
- where we are legally required to disclose the information. This includes sharing the personal information with tax authorities and law enforcement agencies for the purposes of the prevention and detection of crime
- where we need to disclose the personal information for the purpose of resolving a complaint or in connection with any legal proceedings, or for the purpose of obtaining legal advice, or the disclosure is otherwise necessary for the purposes of establishing, exercising or defending legal rights
- disclosure is required to protect our interests, or someone else's interests (for example, to prevent fraud)
- disclosure is necessary to protect your vital interests (for example if you are unwell at our premises, we may need to seek medical assistance)
- it is to a third party for the purposes of providing administrative or processing services on our behalf. If such disclosure is required we will take steps to ensure that the third party protects the personal information in the same way that we do and notify you of any changes to this privacy notice
- to any prospective purchaser of our business assets or organisation
Transferring Personal Data outside of the European Economic Area
We do not routinely transfer your personal data outside of the European Economic Area (“EEA”) and we use all reasonable endeavours to select suppliers who provider assurances that personal data is stored and processed within the EEA. With any international cloud technology providers however (such as Microsoft and Salesforce) there is small possibility that personal data that is stored within the EEA is accessed outside of the EEA for technical support or account assistance. We therefore ensure that where we use technology providers or similar suppliers who potentially access personal data from outside of the EEA we ensure that we put in place adequate measures to ensure the protection of such personal data (such as using the EU’s model clauses or the US Privacy Shield framework).
Keeping personal information secure
We know that you provide your personal information in good faith and expect it to be looked after. This is why we take the security of your personal information seriously. This means that we have taken steps internally in order to ensure that our systems adequately protect your personal information. Inchcape UK is also Cyber Essentials accredited.
You have a number of rights in respect of your personal information which we have explained in a bit more detail below: If you would like more information about any of your rights, please contact us on the details set outset out in section 2 above.
The right to request correction of the personal data we hold about you. You can have any incomplete or inaccurate data we hold about you corrected, although we may need to verify the accuracy of any new information you provide.
The right to withdraw your consent where we are relying on your consent to process your personal data. If you would like to withdraw your consent to receiving any direct marketing, you can do so at any time by using the unsubscribe link provided in the marketing communications email. If you simply want to change your marketing preferences (for example, the method of communication), you can do so by using the contact details in section 2 above.
Where you have explicitly consented to us processing special categories of data, you can withdraw consent to our processing the special categories of data at any time during the application process. If you wish to withdraw consent, please do so by sending your request in writing to our contact details below.
The right to request access to your personal data. You can contact us at any time to ask whether we process any personal data about you and to be provided with a copy of that data. This will be provided free of charge. We may not provide you with a copy of some of this information if it also concerns other individuals or we have another lawful reason to withhold it.
The right to request erasure of your personal data. You can ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to request that we delete or remove your personal data where you have successfully exercised your right to object to processing, where we have processed your personal data unlawfully or where we are required to delete your data by operation of law. We may not always be able to completely comply with your request where we have specific legal reasons which will be notified to you.
The right to object to processing of your personal data where we are relying on our legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on the grounds it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your data for direct marketing purposes. In some instances we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
The right to transfer your personal data to you or another party. We will provide you or the third party with your personal data in a structured and commonly used machine-readable format.
Exercising your rights. If you wish to exercise any of your rights then please contact us using the details set out in section . You will not normally have to pay a fee to exercise your rights but we may charge a reasonable fee if your request is unfounded, repetitive or excessive. We may also refuse to comply with your request. We endeavour to respond to all legitimate requests within one month. If we will need longer than a month to respond to your request then we will let you know and keep you updated.
How long will we keep your personal data?
We will hold your personal data for no longer than is necessary for the purposes for which we are processing it. When it is no longer required we will securely dispose of it.
All electronic and hard copy files, relating solely to purchase information, will be destroyed after 7 years.
If we have anonymised or pseudonymised your personal data (so you can no longer be identified by it) we may use or hold the information for longer periods without notice.
Updating this privacy notice
We keep our privacy notice under regular review in order to ensure that it properly reflects our use of personal information. This privacy notice was last updated on 7 July 2020.