PRIVACY NOTICE v1/MA/170518
Your privacy is extremely important to us. This Privacy Notice explains what personal information we collect and how we use it. For the purposes of the document the terms 'we', 'us', or MMG are each intended as reference to Marshall Motor Group Limited (“MMG”) and other companies in the group of companies of which Marshall Motor Holdings plc is the parent company.
This Privacy Notice explains what we do and why we do it and tells you about your privacy rights and how the law protects you. This Privacy Notice applies to anyone who contacts MMG or any of its companies within the Group and/or any of its franchise dealerships within the UK. In particular it is intended for customers and prospective customers who buy our goods and services and/or communicate with us about our goods and services.
We respect your privacy and your right to control your personal data. Our guidelines are clear and simple. We will be transparent with you about the data we collect and why. We do not and will not sell your data to third parties. The primary purpose of collecting your data is to process your purchase, deliver our services, improve your buying experience and to keep in touch with you.
This Privacy Notice explains the personal information we collect from you, either directly or indirectly, and how we will use it. The Notice also covers the choices you can make about the data we collect, and how you can control these decisions. It applies to all MMG’s goods and services including after-sales. It also applies to any MMG’s websites, as well as other offline interactions such as visiting one of our dealerships to buy or enquire about purchasing a vehicle or attending a MMG promotional event. Please read this Privacy Notice carefully to understand when you may provide personal information to us and how MMG uses the personal information provided. By using, enquiring about, or buying MMG’s goods and/or services you agree to the use of your personal information as described in this Privacy Notice.
We will use your personal information in accordance with the General Data Protection Regulation (“GDPR”) together with other applicable laws and regulations that relate to data protection and privacy. For the purposes of data protection legislation, MMG is the data controller in respect of your personal information that we collect and process as further described in this Privacy Notice.
What this Privacy Notice will explain
This Privacy Notice will explain:
1. What information we may collect about you
2. Why we collect the information and how we use it
3. Where and how it is stored
4. Who we share your data with and in what circumstances
5. The circumstances in which we need your consent to process your data
6. Your rights in relation to the data that we hold
7. How you can withdraw your consent to us processing your data
9. How to contact us
10. How to make a complaint or exercise a data subject right
WHO WE ARE
Marshall Motor Group Limited is registered in England under company registration number 295579.
Marshall Motor Group Ltd is authorised and regulated by the Financial Conduct Authority for general insurance mediation and credit broking (Firm Reference Number 310503).
For more information on Marshall Motor Group Limited, the companies within our group, our dealerships and our brands please visit www.marshall.co.uk
YOUR PERSONAL INFORMATION
What type of personal information do we collect?
We will only collect information that is necessary for the relevant processing activities but is likely to include the following (although the list is not exhaustive):
We may also receive information about you from other sources such as:
When do we collect your personal information?
You are likely to provide personal information to us in a number of circumstances which will include the following:
Why do we collect your personal information?
MMG collects and uses information to efficiently process the sale and supply of new and used motor vehicles to our customers and in the provision of our after-sales services. We carry out a range of processes and procedures connected with the effective and efficient running our business. We collect personal data:
Where do we store your personal information?
Personal data collected by MMG may be electronically stored and processed in your region, in the UK or EU where MMG or its companies, subsidiaries or service providers maintain facilities. All information you provide may be transferred or accessed by entities in the UK or EU as described in this Privacy Notice.
We store manual data at our dealerships, offices, premises as well as placing it in long term secure external storage facilities.
Who may use your personal information?
Your personal information may also be used by our employees, contractors or agents and disclosed to third parties either with your consent or on another lawful basis.
How long do we keep your personal information for?
MMG retains personal data for as long as necessary to provide goods and services, support your vehicle purchase and fulfil the transactions you have requested, or for other essential purposes such as complying with our legal obligations, and resolving disputes and enforcing our agreements. Because these needs can vary for different data types in the context of different goods or services, actual retention periods can vary significantly.
When and why do we use your personal information?
Booking a test drive
If you book a test drive we require a copy of your driving licence which we will retain for a period of 6 months in case of a speeding, parking or other motoring offence that may occur.
Making an enquiry or showing an interest
As you gather more information about MMG you may visit our website or physically visit a dealership that we own. Examples include browsing our website, calling our in-house sales representatives, visiting a MMG dealership or attending MMG promotional events. To learn more about our goods and services, you may voluntarily provide personal information, such as your name and email address during these interactions. You may also provide information online via cookies or similar technologies when you visit our website.
If you request a vehicle is moved to a different more convenient location we will require your name, address and contact details. We will contact you to confirm the transfer of your chosen vehicle to your selected dealership.
Selling your car
If you request a valuation for your current vehicle then we will require your vehicle details including registration number, mileage plus your name, email address and telephone number so that we can send to you your indicative valuation. If you decide not to proceed with your valuation we will delete your details after 3 months after the expiration of your valuation.
Purchasing a vehicle and using our other services
Once you have decided to buy our goods such as a vehicle, van or motorcycle we can offer various ways for you to fund your purchase. When you buy from us, you may be asked to provide information so that we can complete your purchase. Information may include your name, phone number, email, postal address, and payment information. We will also need to collect proof of your identity for the purpose of avoiding fraud and other types of financial crime.
If you want us to arrange finance for you then we may need to collect further information and send this to one of our finance providers. If for any reason your finance application is declined, then we can send your application to other lenders for consideration. However we will always seek your consent before passing your application on to other lenders or credit brokers. Our finance providers will conduct a credit check and affordability assessment on you before making a decision whether to offer you finance to fund your vehicle purchase.
We may collect your name, phone and mobile number, email address, postal address, and payment information. We may also have to collect bank statements, wage slips and recent utility bills to support your finance application. We will ask for proof of your identity such as your driving licence and/or passport. We use this information to complete your transaction, follow up with you about your purchase, help with any delivery issues, process your finance application, and other issues related to the purchase of your goods and services. Please note, we may store your payment or credit card information but we will ensure that we anonymise the long card number (except the last 4 digits) and the security code. We only use payment information in connection with the purchase of our goods and services.
Registering your vehicle with the manufacturer
Once you receive your vehicle, you will be required to register any new or remaining warranty that you are entitled to with the relevant manufacturer. We will do this for you on your behalf and will pass your personal information to the manufacturer. This will include your name, postal address, phone and mobile numbers, email address and details of your vehicle purchase. As part of their service to you, the manufacturer may contact you from time to time and ask you to confirm and update your marketing preferences with them. As part of the registration process you may be required to set up a separate account directly with the manufacturer. If this is the case we will advise you on what to do. We collect this information to help put your warranty in place and registered for you as soon as possible so that you can utilise the benefits to which you are entitled.
Certain categories of the data that we collect are necessary for the registration of your vehicle with the DVLA and you will not be able to opt out from this data collection, sharing and/or processing. This data includes your name, postal address, email address, vehicle registration number and chassis number. We collect this information to help ensure that your vehicle is properly registered with the DVLA before delivery and that you are registered with the correct road fund licence applicable to your vehicle.
When buying your vehicle you may decide to purchase one or more of our after-care services including our Service Pans. We may contact you on the basis of our legitimate interests to remind you of your MOT and compliance with service requirements so that you can keep your vehicle in a roadworthy condition, adhere to safety standards and comply with the terms of a manufacturer’s (or other warranty provider) valid unless you have objected and have requested that we do not do this. We may also make contact with you based on our legitimate interests associated with other aftersales services such as vehicle health checks, vehicle repairs, manufacturer recalls and other similar services. The legal responsibility for looking after your vehicle, meeting all the necessary safety and legal requirements and complying with any associated contractual obligations, rests with you.
Arranging a courtesy vehicle
If we agree to provide you with a courtesy vehicle then we will require a copy of your driving licence which we will retain for a period of 6 months in case of a speeding, parking or other motoring offence that may occur.
What is the legal basis for using your personal information?
Your privacy rights are protected by law. We can only use your personal information if we have a proper and lawful reason for doing so which may include:
We may use your personal information on one or more of the following basis:
When you have provided consent, we may use and process your personal information for the following purposes:
You can have a “Right to Withdraw” your consent at any time.
2. Performance of a contract
We may use and process your personal information where it is necessary for the negotiation or performance of a contract with you for the following purposes:
3. Vital Interests
We may use your personal information to contact you if there are any urgent safety or product recall notices to communicate to you or where we otherwise reasonably believe that the processing of your personal information will prevent or reduce any potential harm to you. It is in your vital interests for us to use your personal information in this way.
We will contact you in relation to MOTs, services and other general vehicle safety related matters that we are or become aware of.
4. Compliance with legal obligations
We will use your personal information to comply with our legal and compliance obligations which may include:
5. Legitimate Interests
A legitimate interest is when we have a business or commercial reason to use your information. You have a right to object if we rely on our legitimate interests and we have a duty to properly consider that objection.
We may use and process your personal information where it is necessary for us to pursue our legitimate interests as a business for the following purposes:
You have a “Right to Object” to use of your personal data on the basis of our legitimate interests
Sharing your information with third parties
Who do we share it with?
MMG does not and will not sell personal information about its customers. We only disclose your data as authorised in this Privacy Notice. We may share information with the following types of third parties:
We will share your personal information as set out in this Privacy Notice but in particular please note the circumstances listed below:
Third Party Agents
MMG uses a variety of third party agents to carry out services like website management and hosting, credit card processing, marketing companies (acting strictly on our behalf) and email communications. We only share your personal data as is necessary to complete a transaction, provide goods or services you have requested or authorised and only with vendors or agents working on our behalf for the purposes described in this Notice. In this case, your personal information will be shared with these agents or contractors but only for the purpose of performing services on behalf of MMG and in accordance with this Privacy Notice.
Card Payment Services
If you pay by debit or credit card with us we will share transaction details with companies which help us provide this service (such as Visa and MasterCard). We do not charge any processing fees or charges.
If you set up as direct debit payment (for example to pay for a Service Plan) we will share your data with the Direct Debit Scheme.
To ensure the best customer experience and to ensure a smooth, convenient and comprehensive buying service that MMG can offer, we may share relevant Information with finance and insurance companies and other relevant parties in the transaction you have authorised in relation to your finance and/or insurance services.
Once you have purchased goods and/or services from us we may share relevant activity information with our business partners that you have authorised to interact with you in order to performance the service or contractual obligation.
Parties with whom it might be necessary to complete a financial or corporate transaction such as a merger or sale of assets.
If we choose to sell, transfer or merge parts of our business or our assets or we seek to acquire other businesses or merge with them then during this process we may share your data with other parties. We will only do this if they agree to keep your data safe and secure. If this happens then other parties may only use your data in the same way as set out in this Privacy Notice
We also share data with MMG companies within the Group.
MARKETING AND PROMOTIONS
For all of the data collected prior to 25 May 2018 we will rely on our legitimate interests to conduct our marketing and promotional activities. However you have a right to object to this. We will consider your objection and confirm to you in writing what our position is. We will always respect your right not to receive marketing and promotional information.
For all of the data collected from 25 May 2018 onwards we will obtain your consent to conduct marketing and promotional activities. This will be by opt-in. We will never assume that you will want to receive marketing from us. We will always obtain your consent to marketing activities. You will be given the choice as to which marketing mediums you would like to receive.
Please note, we will continue to communicate with you for significant safety information about a vehicle that you own for a safety related issue such as a manufacturer recall. We may be legally obliged to do so and/or we may believe it to be in your vital interests that we do so. We do not classify this type of communication as marketing.
If you agree, we may take photographs of you buying your vehicle and based on our legitimate interests use these on our website and/ or for other promotional purposes. If at any time you would like us to stop using your photographs on our website and/or for other marketing and promotional purposes please let us know and we will action your request within a reasonable period of time.
Withdrawing your consent
You have a right to withdraw your consent for marketing purposes at any time. The process for withdrawing your consent is stated below:
Send an email to firstname.lastname@example.org
We will respond to any request to update your marketing preferences as soon as possible, and within 5 working days. It may take up to 21 days before all the marketing and promotions completely stop. We thank you for your patience and understanding.
Please send a letter to the Data Protection Officer at:
Data Protection Officer
Marshall Motor Group
We will acknowledge all requests to be removed from the marketing database.
If you wish to stop receiving emails from us, you can do so by following the instructions included in every email sent to you via the “unsubscribe” tab. We respect your choice, and we will stop sending you promotional emails once you unsubscribe. However it may take up to 21 days before you will be fully removed from all email lists. In relation to text messages and other communications please follow the unsubscribe procedure communicated in the message.
You can adjust the amount of 'interest based advertising' you may receive by changing your cookie settings, changing your device settings, and/or opting out of certain advertising networks. If you have opted out of receiving emails from us, we will not use your email for internet based advertising activities.
Our website is powered by G-Forces Web Management Limited (“GForces”), our third party web services provider. GForces is committed to ensuring that data is processed in accordance with applicable data privacy laws, and is kept secure. GForces is certified to the standard of ISO27001 (an international standard for information security). GForces uses Amazon Web Services, Inc. as its cloud platform provider. All data processed by GForces is stored on Amazon’s web servers in the EEA.
If you visit our website
When someone visits our website, GForces collects standard internet log information (your IP address, browser, and type of device) and details of visitor behaviour patterns (where you joined our site from, the path you take through our site and where you leave). These are stored against unique ids (which are strings of numbers). GForces collects this information for the legitimate business purpose of monitoring the number of visitors to the various parts of the site, the general geographic location of visitors and engagement levels, which in turn enables it to make improvements to its websites and services, and provide business intelligence. This information is only processed in a way which does not identify anyone. It is kept indefinitely.
GForces also uses Google Analytics to collect standard internet log information and details of visitor behaviour patterns, which are stored against unique ids (i.e. strings of numbers). We collect this information for the legitimate business purpose of monitoring website traffic and engagement levels, which in turn enables us to make improvements to our website and the way we sell our cars and services. This information is only processed in a way which does not identify anyone. It is kept indefinitely.
If you use our enquiry forms
When you submit information using an online form, GForces processes the data collected and stores it for 31 days for the legitimate business purpose of enabling us to access the information and deal with your request (it is then kept for a further 14 days in GForces’ routine back-up sm for business continuity purposes). We collect the following information:
If you enter your postcode, GForces stores the first part of it (e.g. ‘ME14’ or ‘SW1’) and links it to standard internet log information already collected (it is used for the same purposes as that information, as outlined above).
If you use our LiveChat service
We use a third party provider, LogMeIn Inc., to supply our LiveChat service (BoldChat). If you use the LiveChat service we will collect any personal information that you volunteer to us. This is used for the legitimate business purpose of handling customer enquiries in real time and then following up in order to resolve them. This data is stored for 30 days by LogMeIn Inc. to enable us to access the information and deal with your enquiry. LogMeIn stores the information in the US under the EU-US privacy shield framework.
We use a third party provider, Call It Automotive Limited to support our BoldChat service. Personal information that you volunteer to us via the BoldChat service may be shared with Call It Automotive for the legitimate business purpose of assisting with the handling of customer enquiries and follow ups. Personal information will be stored by Call It Automotive for a maximum of 2 years to enable us to access the information and deal with your enquiry. Call It Automotive stores the information in the EEA.
Online Data Preference Centre
Under data privacy laws, you have the rights to request access to your personal data; request deletion or correction of your personal data; and request that your personal data be transferred to another person.
Our online data preference centre helps you to exercise the rights that data privacy laws give you and control your personal information. It contains five separate forms, as set out below:
See your data
You can ask to see any personal information that we hold (known as a “subject access request”) by submitting the form on the “See your data” tab. If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.
Transfer your data
By completing the form on the “transfer your data” tab, you can ask us to provide your data to a third party.
Delete your data
You can ask us to delete the information we hold about you by completing the form on the “delete your data” tab.
Change your data
If we do hold information about you, you can also ask us to correct any mistakes by completing the form on the “Change your data” tab.
On the “marketing preferences” tab, you can tell us how you would like us to send you marketing information, or ask us to stop marketing to you entirely. Any data collected through the data preference centre is stored for 5 years and for marketing purposes.
Links to other websites
We use so-called social plugins of social networks such as Facebook and Twitter. This policy does not apply to those other websites and Apps‚ so we encourage you to read their privacy statements. We are not responsible for the privacy policies and practices of other websites and Apps (even if you access them using links that we provide) and we provide links to those websites solely for your information and convenience.
HOW THE LAW PROTECTS YOU
Data Subject Rights
Personal data must be processed in accordance with the rights of individuals. All data subject requests are handled by the compliance function and all requests must be referred to compliance immediately upon receipt. These rights are:
1. The right to be informed
2. The right of access (“Subject Access Request”)
3. The right to rectification
4. The right to erase
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling
The Right to be Informed
All data subjects have a right to be informed as to how their data is being processes and whether it is being transferred to any third parties. We inform data subjects of our processing activities through the provision of our Privacy Notice which is available externally on the website www.marshall.co.uk and available internally on the compliance section of Eagle.
The Right of Access (“Subject Access Request”)
This is a right for an individual to obtain confirmation whether a data controller processes personal information about them and if they do, to be provided with details of that personal information and access to it.
The Right to Rectification
This is a right for an individual to obtain rectification without undue delay of inaccurate personal data that the data controller holds about them. For example if a customer notified you that you had inputted the wrong date of birth onto your systems then they would have the right to have this incorrect data amended with the correct date of birth.
The Right to Erase (“Right to be Forgotten”)
This is a right for an individual to require a controller to erase personal information about them on certain grounds. A customer (who has not bought a car) may wish to have their contact details removing from the marketing database. This is a reasonable request and must be actioned. The right to be forgotten however not an absolute right and in some circumstances the right will be refused on lawful grounds.
Right to Restrict Processing
This is a right for an individual to require a data controller to restrict processing of personal information about them on certain grounds.
Right to Data Portability
The data subject can request that all their data is transferred from one provider to another in a structured, commonly used and machine readable format and to transmit the information to another controller.
Right to Object
This is a right for an individual to object on grounds relating to a particular situation to a controller’s processing of personal data about them if certain grounds apply.
Rights in relation to Automated Decision Making and Profiling
If a decision has been made about a data controller using automated means or the data subject has been profiled then they have the right to have access to speak with a human being about this.
Special category data
We only collect special category data in very limited and specific circumstances such as processing an order through Motability. If we do need to collect special category data we will obtain your explicit consent to process this information.
Special category data is defined as personal data relating to an individual’s:
Your right to complain
We will investigate and respond to all complaints that we receive about how we process your personal information. If you are unhappy with how we have handled your personal information and believe we have either breached data protection legislation or we have otherwise caused you financial loss, distress and/or inconvenience, then please get in touch. We advise that you contact the Data Protection Officer who will deal with your complaint either formally under our written complaints procedure or informally (if we can resolve the matter to your satisfaction within 3 working days).
If you are unhappy with the way we have handled your complaint or the response we have provided then you are entitled to raise the matter with the Information Commissioner’s Office (“ICO”) whose details are set out below:
Information Commissioner's Office:
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
The ICO is the supervisory body for data protection in the UK.
Cookies and other similar technologies
A 'cookie' is a small data file containing a string of characters that is sent to your computer when you visit a website. When you visit the website again, the cookie allows that site to recognise your browser. The length of time a cookie will stay on your computer or mobile device depends on whether it is a "persistent" or "session" cookie. MMG uses both types of cookies. Session cookies will only stay on your device until you stop browsing. Persistent cookies stay on your computer or mobile device until they expire or are deleted. We use the following types of cookies on our website.
These cookies allow our websites to remember choices you make and personalise your experience. We may store your geographic location in a cookie for instance, to ensure that we show you the website relevant to your area.
Third party cookies are those placed by websites and/or parties other than MMG. These cookies may be used on our website to improve our goods or services or to help us provide more relevant advertising. These cookies are subject to the respective privacy policies for these external services, for example, the Facebook Data Use Policy.
These cookies are essential for you to browse our website and use its features. Without these cookies, certain services cannot be provided.
These cookies collect information about how you use our websites. This data may be used to help optimise our website and make it easier for you to navigate.
The cookies that we use do not store any confidential information about you. You may wish to disable these cookies however disabling these cookies may prevent you from using certain parts of our website in the most efficient way.
To learn more on how Google & Facebook cookies work on websites, please visit:
When visiting our website, we may collect data directly from you as set out in this Privacy Notice, as well as analysing your browsing and purchasing activity, both online and in the dealership, along with your previous response to our marketing communications. The results of this data (collected by Cookies) will allow us to ensure that we contact you with information on products and offers that are relevant to you. To do so, we use automated profiling software. We recommend that you accept cookies for the following reasons:
Website Banner Marketing
If you visit our website, you may receive personalised banner advertisements whilst browsing other websites including but not limited to search engines and social networking. Any banner advertisement you will see will relate to products you have viewed whilst browsing our website on your computer or other devices. You can remove or disable cookies at any time.
You may receive advertising based on information about you that we have provided to the social media platform or because, at our request, the platform has identified you as having similar attributes to the individuals whose details it receives from us.
MMG is committed to protecting the security of your personal data. We use a variety of security technologies and procedures to help protect your personal data from unauthorised access, use or disclosure. For example, we store the personal data you provide on computer systems that have limited access and are in controlled facilities.
While no service is completely secure, MMG takes precautionary measures to help prevent information about you from loss, theft, misuse and unauthorised access, disclosure, alteration and destruction. For example, we ensure that our third-party data centre vendors provide adequate security measures.
Your personal information is stored on servers that are kept in a controlled environment with limited access. While we take reasonable precautions to guard personal information we collect from you, no security system is impenetrable. Always logout and close your browser when you finish your session.If you have any questions about the security of your personal information, you can contact us at email@example.com
CHANGES & UPDATES TO OUR PRIVACY NOTICE
Changes to Our Privacy Notice
MMG may modify or update this Privacy Notice when necessary to reflect customer feedback and changes in our goods and services so please review it regularly. If there are material changes to the Privacy Notice or in how MMG uses your personal data, we will notify you either by posting a notice of such changes before they take effect or by directly sending you a notification. We encourage you to regularly review this Privacy Notice to learn more how MMG is using and protecting your information. Your continued use of the goods and/or services after any modification to this Privacy Notice will constitute your acceptance of such modification and updates.
How to Contact Us
If you have any questions about the use of your personal information, please send us an email to firstname.lastname@example.org
Unless otherwise stated, MMG is a data controller for personal data we collect as set out in this Privacy Notice. Our head office address is Marshall Motor Group, The Quorum, Barnwell Drive, Cambridge, Cambridgeshire, CB5 8RE.
For all matters relating to data protection at Marshall Motor Group Limited please contact our Data Protection Officer – details provided below - who will be pleased to assist you.
Data Protection Officer
Ms Madeleine Ansbro
Head of Compliance
Marshall Motor Group
Privacy Notice: v1/MA/170518