PRIVACY POLICY

SDM’S DATA PROTECTION AND PRIVACY STATEMENT

Square Deal Motors Ltd (SDM) is committed to the protection, safe storage, and the appropriate use of any personal information you may choose to share with us.

This statement describes:

• What types of information we collect from you
• How it is used by us,
• How we share it with others,
• How you can manage the information we hold and
• How you can contact us

SDM shall always give you the option not to receive marketing communications from us. We will never send you unsolicited email or communications. We do not sell your information to third parties. We do work closely with our selected partners. Including the manufacturers that we represent, our finance partners, and our peace of mind insurance product provider Car Care Plan Ltd. These organisations help us to provide you with the information, products and services that you request from us. We will on occasion forward, transfer and or send your information to these organisations to facilitate your requests and or instructions.

For example: SDM will forward your personal information to Toyota, the DVLA and Toyota Financial Services to facilitate the purchase of your vehicle. Should you wish to purchase a GAP policy, we will also forward your details to Car Care Plan Ltd, so that policy can be set up, registered and administered.

The contents of this policy may be amended, reviewed and updated timeously. Therefore, it is our recommendation that you regularly review this page to ensure that you remain satisfied to share your personal information with SDM.

What Information Do We Collect?

We only collect information which is necessary, relevant, and adequate for the purposes shown and identified to you.

We collect information about you and or your vehicle when you, purchase, hire, enquire, use, visit SDM, branches, websites, and our aftersales, parts and bodyshop facilities.

We collect the following categories of personal information to implement our business objectives and to facilitate the purchase of products and or services that you have indicated.

• Name (including title);
• Address;
• Phone number, including mobile phone number.
• Date of birth (to ensure that you are eligible)
• Email address;
• Affordability information
• Vehicle information (including registration number, VIN, service reminders, mileage and warranty repair information, SAT NAV information and in drive analytics and driving style);
• The date and time you used our services;
• The pages you visited on our website and how long you visited us for;
• The internet browser and devices you are using.
• Cookies, (for more information please see our Cookie Policy);
• Details of any transactions between you and us or any authorised repairer;
• Where you engage with us in a business context, we may collect your job title, company contact details (including email addresses), fleet size and company details;
• “Live chat” records; and
• Any information within correspondence you send to us.

How Do We Use This Information?

SDM will only process information that is required for the purpose for which it has been collected.

You will always have the option to unsubscribe from SDM’s (any of its companies and subsidiaries) marketing communications. It is also your option not to receive marketing communications and you can withdraw your consent at any stage. We will not share or sell your personal information with anyone else who may send unsolicited marketing. There are a variety of ways in which we may use, store or process your personal information.

Consent

In the circumstances where your consent has been provided, we may use and process your information to:

• Contact you from time to time about promotions, offers, events, products, services or information which we think may be of interest to you from SDM and our manufacturer partners.

• To share your personal information with our third-party partners, so that they can contact you with marketing information about their promotions, offers, events, products and services (we will, of course, give you details about these third parties before you give your permission for us to send information to them).

Contractual Performance

We may use and process your personal information where it is required and or essential to perform or complete a contract (or contractual elements) with you and to fulfil and complete your orders, purchases, services and other transactions entered with us (or one of our authorised repairers or selected partners).

Legitimate Interests

We may collect, use and process your personal information as detailed below where it is necessary for SDM to carry out actions, processes, services and activities for which it is in our legitimate interests as an organisation to do so.

Processing Necessary to Support Customers with Sales and Other Enquiries

• To respond to customer correspondence (telephone calls, emails, letters, live chats, social media) and to address the instructions and requests made by customers (for example: test drives, service requests, brochure requests or information about specific vehicles);

• To provide vehicle support, aftersales servicing, parts, and services (for example warranty and MOT services);

Processing Necessary for Us to Respond to Understanding Customers’ Needs

• To analyse, assess, and improve our products and or services so that your interaction with our website, our members of staff and our branches are more useful and enjoyable, professional and proficient.

• To undertake analysis and research (including contacting you with customer surveys) so that we can better understand you as a customer and provide tailored offers, products and services that we think you will be interested in. We will only send marketing communications to you if you have provided your consent for us to do so or which we have obtained in the ways mentioned within this policy;

• In some cases, we may use methods to analyse, combine and evaluate information that you have provided to us. We collect and analyse this information so that we can deliver the most appropriate customer experience and journey to you by tailoring and making appropriate all our service and messages (for example, when your vehicle indicates a service is due);

Processing Necessary for Us to Promote Our Business, Brands and Products, Services and Measure the Effectiveness and Influence of Our Marketing Campaigns and Strategies.

• To send you marketing information from time to time (where appropriate) after you have purchased a product or service from us or made a purchasing enquiry, closed your browser with items in your shopping basket or requested a test drive, brochure, quotation, valuation or other information of interest. We will only contact you with information about our own products and services (and solely in a manner compliant with the GDPR), which we consider may be amenable to you. The option to object to us sending you these types of information at any time remains with you.

• To contact you from time to time with marketing information (unless you object) if you have expressly indicated to us that you are acting on behalf of a business and or a professional capacity or where we have obtained your business contact details from an online or public business directory. In relation to any such information we send by email or SMS, we will include an option allowing you to object to receiving future messages by unsubscribing;

• To contact you with targeted advertising delivered online through social media and other platforms operated by other companies unless you object. You may receive advertising based on information about you that we have provided to the platform or because, at our request, the platform has identified you as having similar attributes to the individuals whose details it has received from us. To find out more, please refer to the information provided in the help pages of the platforms on which you receive advertising from us;

• To identify and record when you have received, opened or engaged with our website or electronic communications (please see our Cookie Policy for more information);

• To administer competitions and promotions (held and entered on various platforms, including social media) that you enter with us from time to time and to distribute prizes;

• Processing necessary for SDM to operate the administrative, procedural and technical aspects of our business efficiently effectively and professionally.

• To verify the accurateness of information that we store, process and document about you;

• For network and information security purposes. For SDM to take steps to protect and secure your information against loss, damage, theft or unauthorised access;

• To allow SDM to comply with a request from you in connection with the exercise of your rights available under GDPR (for example where you have asked SDM not to contact you for marketing purposes, we will keep a record of this on our no contact lists in order to be able to comply with your instruction(s));

• To inform and advise you of updates to our terms and conditions and policies.

Legal Obligation

We may and can process your personal information to comply with our legal, legislative and regulatory requirements (for example to registering and taxing your vehicle with the DVLA).

Vital Interest

There are certain situations and circumstances in which SDM will require to process your personal information to contact you if there is an urgent, product, service, after sales, MOT related issue, safety or product recall notice and we must inform you of it.

How Do We Share This Information?

We do not sell your personal information to third parties. We may from time to time release your information to the following categories of companies or organisations to which we pass the responsibility to handle services on our behalf:

• The vehicle manufacturers we represent,
• The finance providers we represent,
• Our insurance product provider,
• Mobility and car hire providers,
• Direct marketing communications agencies and consultants,
• Mandatory manufacturer appointed market research and market analytics service providers,
• Our legal and other professional advisors.

We may also share your information with external third-party repairers, maintenance and service providers and suppliers in situations where we need to pass your information to them to manage any request, instruction, or complaint you have made to us. For example, where you have requested a test drive, we will need to share your personal information with a manufacturer and appropriate branch so that they can contact you to arrange for the test drive to take place.

Third Party Partners

We take steps to ensure that any third-party partners who handle your information comply with data protection legislation, the GDPR and any updates and amendments of said legislation and protect your information to the same standards that we enforce. We only provide personal information that is required for the third party to provide the product and or service that they are undertaking on our and your behalf. We can and have the option to carry out any necessary due diligence checks on our third-party partners to assess their data protection preparedness.

Data Transfer

We do not transfer any information we hold about you out with the European Union / EEA.

How Long Do We Keep Your Information For?

In general, we will not hold your personal information in an identifiable format (physical or electronic) for any longer than is necessary. If you are a customer or otherwise have a relationship with us we will hold personal information about you for a longer period than if we have obtained your details in connection with a potential relationship.

• If a customer transacted with us, for example bought, hired or leased a product and or service from us, provided consent for marketing our retention period will be 5 years.
• If a customer transacted with us, for example bought a product and or service from us but did not provide marketing consent our retention period will be 42 months.
• If a customer does not purchase a product and or service from us, but provides their personal information, in relation to a test drive, brochure, valuation, quotation or any other information application on any of our products or services the retention period will be 18 months. Unless during that period we form a relationship with you. For example, you purchase or lease a vehicle or make use one of our services. We hold your personal information for this period to give us an opportunity to form a relationship with you.

• In addition, we hold your personal information for the above-mentioned periods of time to initiate, bring or defend legal matters. Our relationship may end for numerous reasons including where the vehicle warranty or lease expires, or we have been made aware that you no longer own or drive a specific vehicle.

The only exemptions to the periods mentioned above are where:

• Legislation and regulation requires us to hold your personal information for a longer period, or delete it sooner;
• Where a complaint or concern has been submitted regarding a product or service provided by us, in which case we will retain your information for a period of 6 years following the date of that complaint or query; or
• You exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law

How Can I Manage the Information SDM Hold About Me?

You have the right as an individual to access the personal information that we hold about you and make corrections if necessary. You also have the right to withdraw any consent you have previously given us and ask us to erase information we hold about you. You can also object to us using your personal information (where we rely on our business interests to process and use your personal information).

You have several rights in relation to your personal information under the General Data Protection Regulation (GDPR). In relation to most rights, we will ask you for information to confirm your identity and, where applicable, to help us search for your personal information. Except in rare cases, we will respond to you within 30 days following receipt of any request.

You have the right to:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling (we do not engage in any automated decision making and profiling).

To clarify, the above-mentioned rights and how they operate in practice:

• Ask for a copy of the information that we hold about you;
• Amend and revise your information;
• Withdraw your consent (where SDM relies on it).
• Challenge our use of your information (where we rely on our legitimate interests to use your personal information) provided we do not have any continuing lawful reason to continue to use and process the information. When we do rely on our legitimate interests to use your personal information for direct marketing, we will always comply with your right to object;
• Erase your information (or restrict the use of it), provided we do not have any continuing lawful, contractual or legitimate reason to continue to use and process that information;
• Transfer your information in a structured data file (in a commonly used and machine-readable format), where we rely on your consent to use and process your personal information or need to process it in connection with your contract.

Exercise of Rights

You can exercise the above rights and/or manage your information and consents by contacting us using the details below:

By visiting our website: www.sdm-group.co.uk

Post: Square Deal Motors, Ladysmill, Grangemouth Road, Falkirk, FK2 9AU

Email: data@sdm-group.co.uk

Phone: 01324 616800

If you have any specific data protection concerns or a complaint, you can address it to our Data Protection Team at data@sdm-group.co.uk

The Information Commissioner (ICO)

If you are unsatisfied you have the option to submit a complaint with a data protection regulator in a country where you work or live or where your data protection rights have been infringed. The contact details for the Information Commissioner’s Office, the data protection regulator in the UK, are mentioned below:

Post:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Call: 0303 123 1113 | Email: casework@ico.org.uk