JCT600 Ltd - Group Privacy Statement

We collect information about you and your vehicle when you engage on our website or contact one of our retail centres. This contact may be electronically, by telephone, by post or in person. We will also collect your information when it is shared with us following your contact with one of our manufacturer partners, for example when requesting a test drive. We only request information which is necessary, relevant and adequate for the purpose you are providing it. The information we collect includes some or all of the following:

• Name (including title)
• Address
• Phone number
• Date of birth
• Email address
• Vehicle information (including make and model, registration number, VIN, mileage, service and warranty information)
• The date and time you used our services
• Details of any transactions between you and us
• The pages you visited on our website and how long you visited us for
• Your IP address
• Your GPS location (where you have permitted access to this)
• The internet browser and devices you are using
• Cookie, pixels or beacon information (for more information see our Cookie Policy)
• The website address from which you accessed our website
• Where you engage with us in a business context we may collect your job title, company contact details, fleet size and company details
• Voice recordings of calls you make to us
• "Live Chat" records
• CCTV images collected during site monitoring security purposes
• Any information within correspondence you send to us

When you contact one of our retail centres we may request your explicit consent for our manufacturer partners and finance partners (specific to your vehicle type) to contact you for marketing purposes. Please be aware we are doing this on behalf of our manufacturer/finance partners as part of our franchised agreement with them and the consent/non-consent you provide will not affect the way in which we process your information. Non-consent to the manufacturers request does not influence any transaction between ourselves. A copy of their privacy statement will be available at the time of this request for consent.

Legal Basis for Processing your Personal Data

We will only use your personal data where the law allows us to. Most commonly, we will use your personal data in the following circumstances:

Contractual Performance

We may use your personal information where this is necessary to perform a contract with you and to fulfil and complete your orders, purchases and other transactions entered into with us.

Legitimate Interest

We may use and process your personal information as set out below where it is necessary for us to carry out activities for which it is in our legitimate interests as a business to do so.

• Processing necessary for us to support customers with sales and other enquiries
  • To respond to correspondence you send to us and fulfil the requests you make to us (for example test drives, service requests, brochure requests and information about specific vehicles)
  • To provide vehicle support and services (for example warranty services)
• Processing necessary for us to respond to understanding customers and drivers needs
  • To analyse, evaluate and improve our products and services to ensure your contact with us is more useful and enjoyable
  • To undertake market analysis, research and customer surveys so we can better understand you as a customer and provide tailored offers, products and services that we think you will be interested in.
• Processing necessary for us to promote our business and services
  • To send targeted marketing information from time to time after you have purchased a product or service from us, including
    • Vehicle servicing, warranty and MOT reminders as they fall due
    • Product launches, special events and offers tailored to assumed buying patterns
  • To identify and record when you have received, opened or engaged with our website or electronic communications (see our Cookie Policy for more details)
  • To administer competitions and promotions that you enter with us from time to time and distribute prizes.
• Processing necessary for us to operate the administrative and technical aspects of our business efficiently and effectively
  • To verify the accuracy of information that we hold about you and create a better understanding of you as a customer
  • For network and information security purposes, in order for us to protect your information against loss, damage, theft or unauthorised access
  • To comply with a request from you in connection with the exercise of your rights (i.e. where you have asked us not to contact you for marketing purposes we will keep a record of this on our suppression lists in order to comply with your request)
  • To inform you of updates to our terms and conditions and policies
  • To enforce or protect our contractual or other legal rights or to bring or defend legal proceedings
  • To assist in providing a safe and secure environment within our premises
  • To manage your queries, complaints and claims

Legal or Regulatory Obligation

We may process your information to comply with our legal requirements (i.e. to register your car with the DVLA or to assist with HMRC).

Vital Interest

Sometimes we will need to process your personal information to contact you if there is an urgent safety or product recall notice and we need to tell you about it.

Consent

Where customers and contacts have given consent prior to the new General Data Protection Regulations coming into force on 25 May 2018 we will continue to send targeted marketing of our products and services. We may also rely on a "soft opt-in" to send you targeted marketing material where it is legal to do so. You can withdraw this consent by contacting us at any time.

In addition to the third parties mentioned, we may disclose your information to third parties for our following legitimate interests as follows:

• to staff members in order to facilitate the provision of goods or services to you;
• to our affiliated entities to support internal administration;
• IT software providers that host our website and store data on our behalf;
• professional advisers including consultants, lawyers, bankers and insurers who provide us with consultancy, banking, legal, insurance and accounting services;
• HM Revenue and Customs, regulators and other authorities who require reporting of processing activities in certain circumstances; and
• third parties who we may choose to sell, transfer or merge parts of our business or assets. Alternatively, we may seek to acquire other business or merge with them. If a change happens to our businesses then the new owners may use your personal data in the same way as set out in this privacy policy.

We may disclose personal data to the police, regulatory bodies, legal advisors or similar third parties where we are under a legal duty to disclose or share personal data in order to comply with any legal obligation, or in order to enforce or apply our website terms and conditions and other agreements; or to protect our rights, property, or safety of our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

On rare occasions your personal data may be stored outside the European Economic Area (EEA). When this is the case we ensure sufficient agreements and processes are in place to replicate the data storage and security provisions that exist within the EEA.

We do not sell your information to third parties. However, we may from time to time share your information with our selected business partners under the following categories. Where we do share your information we take the necessary steps to ensure any third party handling this information fully complies with data protection legislation and protects your information just as we do. We will only disclose personal information that is necessary for them to provide the service.

To provide products or services you have requested

During the course of a transaction with us you may request additional products and services which are supplied by our carefully selected list of suppliers these may include guaranteed asset protection, tyre and alloy insurance and extended warranties along with other products. We will pass your information with your agreement to the third party for the fulfilment of your order. When this is the case we have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.

To provide finance for the purchase of a vehicle

During the purchase of your vehicle we may broker a finance deal to assist the purchase. We will provide your information upon your agreement to the selected finance partners who will use this to put the finance in place. They will not use this for marketing purposes unless your explicit consent has been given.

To our manufacturer partners

During the course of a transaction with us (vehicle purchase or vehicle service), some of your personal information may be shared with our manufacturer partners to enable them to analyse and evaluate sales data to further enhance their product offerings, they may also contact you to carry out a customer survey. Occasionally we may share voice recordings to support our customer service levels. They will not use this for marketing purposes unless your explicit consent has been given.

To deliver our targeted marketing

Following a purchase of a product or service we will carry out targeted marketing such as service reminders, to enable this your data may be provided to one of our marketing fulfilment partners. We will only provide information necessary to fulfil this and data will be erased by these third parties once processing is complete.

We do not retain personal information in an identifiable format for longer than is necessary.

If we have a relationship with you (I.e. you are a customer of ours having purchased a car or had a vehicle service) we will continue to hold your personal information. Once this relationship ends we will retain your data for 10 years from the date our relationship ends. We hold your personal information for this period to establish, bring or defend any legal claims.

Where we have obtained your personal information following a request for test drive, brochure, quotation or any other information on our products or services we will retain this information for a period of 3 months following the last contact with you. Should you in that period form a relationship with us by purchasing one of our products or services we will hold your information as stated above. If a customer relationship is not formed then after 3 months we will ask whether you would like to receive information on any special offers or events we have from time to time. If you say no then after a further 9 months your personal data will be removed from our database, otherwise you will remain on our database until you let us know differently.

The exceptions to these retention periods are where,

• The law requires us to hold your personal information for a longer or shorter period
• You have raised a complaint or concern regarding a product or service offered by us, in which case we will retain your information for a period of 10 years following the date of the complaint or query
• You exercise your right to have the information erased and we do not need to hold it in connection with any of the reasons permitted or required under the law.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if the personal data we hold about you changes.

Data protection legislation gives you the right to object to the processing of your personal data in certain circumstances or withdraw your consent to the processing of your personal data where this has been provided. You also have the right to access information held about you and for this to be provided in an intelligible form. If you would like a copy of some or all of your personal data, please visit www.jct600.co.uk/sar. In certain circumstances we reserve the right to charge a reasonable fee to comply with your request.

You can also ask us to undertake the following:

• update or amend your personal data if you feel this is inaccurate;
• remove your personal data from our database entirely;
• send you copies of your personal data in a commonly used format and transfer your information to another entity where you have supplied this to us, and we process this electronically with your consent or where necessary for the performance of a contract; or
• restrict the use of your personal data.

We may request specific information from you to help us confirm your identity and your right to access, and to provide you with the personal data that we hold about you or make your requested changes. Data protection legislation may allow or require us to refuse to provide you with access to some or all the personal data that we hold about you or to comply with any requests made in accordance with your rights referred to above. If we cannot provide you with access to your personal data, or process any other request we receive, we will inform you of the reasons why, subject to any legal or regulatory restrictions. Except in rare cases we will respond to you within 30 days after we have received any requests.

Please send any requests relating to the above to our Group Data Manager at, JCT600 Ltd, Tordoff House, Apperley Bridge, West Yorkshire, BD10 0PQ specifying your name and the action you would like us to undertake.

JCT600 Ltd use technical and organisational security measures to protect the personal information we hold against manipulation, loss, destruction and access by third parties. These measures are continually improved in line with technological developments.

We will store all the personal information we hold on our secure servers located in specialist hosting centres. These servers are accessed via a secure firewall using individual password protected logins. Where we hold personal information in hard copy/paper format this will be stored in secure archiving.

Where we pass your information to third parties to process on our behalf we will have contracts in place which restrict the processing to that requested by us and also specify deletion of the information once processing is complete.

In certain cases where we share your information with third parties such as our manufacturer and finance partners they will become data controllers and will be bound by the same legislation as we are, you will be able to review their privacy statements and manage your information with them.

Our website may contain links to other websites run by organisations which we do not control. This policy does not apply to those other websites and Apps. We provide links to those websites solely for your information and convenience and we make no endorsements, representations or promises about their accuracy, content or thoroughness. Please note that if you follow a link to any of these websites, such websites will apply different terms to the collection and privacy of your personal data and we do not accept any responsibility or liability for these policies. Your disclosure of personal information to third party websites is at your own risk.

We use so-called social plugins (buttons) of social networks such as Facebook, Instagram and Google+. After activation these buttons provide a direct link to the social network you selected and can transfer data independently of whether or not you interact with the button. Your visit to the website can then be assigned to your user account.

We have no influence on the scope of data that is collected by these buttons. The data use policies of the social networks provide information on the purpose and extent of the data that they collect, how this data is processed and used, the rights available to you and the settings that you can use to protect your privacy.

We may review this policy from time to time and any changes will be notified to you by posting an updated version on our website, these changes will take effect 7 days after the date the modified version was posted to the website. We recommend you regularly check for changes and review this policy when you visit our website. If you do not agree with any aspect of the updated policy you must notify us on our contact details below.

This policy was last updated on 11 May 2018.