Data Privacy Notice

Introduction

At Carsa LTD, we take your privacy seriously and will only use your personal information to administer your account and to provide products and services you have requested from us. We will never sell your data on to third parties.

Under the General Data Protection regulations, which is law from May 2018, we are required to inform you as to the lawful basis under which we process your personal data. This Privacy Policy describes how we will use your personal information and how you can exercise your rights with respect to your personal information.

On every occasion we update our Privacy Policy, we will post the updated version on our website so that you can be informed as to what personal information we collect, how we use it and under what circumstances we disclose it with other parties.

Within this Privacy Policy, reference to we, us or our implies the legal entity of Carsa which is the body which processes your personal information and interacts with you.

References to you imply the person whose personal information we collect, use and process. This includes anyone who visits our websites, contacts us in relation to the purchase of a vehicle and/or goods or services we provide, or otherwise interacts with us (e.g. Contact Enquiry Form). References to our website implies any website owned and operated by or on behalf of Carsa.

Your personal information will be processed in accordance with the Data Protection Act 1998 up to the 24th May 2018 and going forward, the EU General Data Protection Regulations (collectively referenced as the Data Protection Legislation) and other applicable law and regulation.

Who are Carsa?

Carsa consists of Carsa Limited. We are a privately owned used car dealer group.

Data Controller

For the purposes of Data Protection legislation, Carsa is the data controller of your personal information that we collect, and process as explained within this Privacy Policy.

Information we may collect

Information we may collect about you includes your name, date of birth, address, contact details (including email and phone numbers), vehicle details, purchase historybank details, existing finance documentation and data collected as part of any new finance application or payment. This information is referred to as personal information.

Several different methods by which we may collect your personal information include:

• Information collected through forms completed both in our dealerships or on our website.
• A copy of your driving licence when you test drive one of our vehicles.
• When you enquire or purchase goods/services we collect personal information to respond to your enquiry and process your purchase.
• When you sell a vehicle we will collect details about your vehicle including the registration, mileage, service history as well as your bank details so we can pay you upon completion.
• Information of transactions you have processed with us including services and purchases of vehicles and other goods.
• CCTV footage of yourself on our premises.
• Information contained in and records of communication between us including emails, text messages, letters and recorded phone calls.
• Records of your visits to our website, including, but not limited to, traffic data, location data, IP address and the resources that you access.
• Your marketing preferences.
• We also gather information to enable third parties to carry our credit reference checks on you (if you are purchasing a vehicle on finance) and we will have and process information about the result of those checks to complete your purchase.
• We will collect information relevant to the additional products that we sell, that are provided by third parties.

If you provide us with another person’s personal information, you must ensure beforehand that you have their agreement to do so and that they are aware of the ways in which we use personal information as set out within the Privacy Policy.

Processing Personal Information

We use your personal information in relation to our business activities. In particular, we may use your personal information in the following ways:

• To respond to your query regarding the possible purchase of goods or services.
• To carry out our obligations arising from any contract between you and us including the purchase of vehicles and provision of services, and to respond to query from you regarding those such contract.
• To manage and administer the relationship between you and us.
• To obtain feedback from you regarding us.
• To provide you with reminders regarding your vehicle including, for example, when your vehicle is due to have a service or MOT undertaken.
• To provide you with information about vehicles, services, promotions and offers that may be of interest to you.

Our lawful basis for processing personal data

At Carsa we may lawfully process your personal data under one of three options:

• 6 (1) (A) Consent: In circumstances where you have provided us with a freely given, informed and specific choice to allow Carsa to process your data, consent will be the lawful basis under which we process your data.
• 6 (1) (B) Contract: If you have entered or are in the process of entering into a contract with Carsa, your personal data may be processed if it is necessary for performance of the contract or is in order to take steps at your request prior to entering into a contract.
• 6 (1) (F) Legitimate interest: If you have completed or negotiated a sale with Carsa, you may have your personal data processed for the purposes of the legitimate interests pursued by Carsa or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data.

To balance your fundamental rights and freedoms with Carsa’s commercial interests, you will be informed that you may receive marketing communications for similar products and services and will be given the ability to opt-out of further processing at any subsequent point in the relationship by emailing our data protection officer below with the subject line “Marketing Opt-Out”.

Sharing Personal Data

We may disclose your personal information to third parties in connection with our business activities, including in the following circumstances:

• To third parties that provide services to us such as marketing activities.
• To external organisations for the purposes of detecting and preventing fraud and criminal activities.
• To third party finance companies for the purposes of them providing you with finance. These organisations may carry out credit checks and may disclose your data to credit reference agencies for that purpose.
• To RS Connect or similar third-party companies for the purpose of arranging vehicle fitting appointments. This ensures timely and efficient processing of your orders and eliminates the need for additional customer communication for these arrangements.
• To third party providers of insurance products if you take up the option of purchasing one of those products.
• We may pass your personal information to third parties if we are under a duty to disclose or share your personal information in order to comply with any legal obligation, or in order to enforce or apply the terms of any agreements we have with or otherwise concerning you or to protect our rights, property or safety or those of our customers, employees or other third parties.
• We may contact you as advised by our suppliers to ensure the ongoing safety and care of your vehicle and any policies are maintained, and the replacement of your vehicle and car care related products.

We will register your vehicle keeper details and will cross-check your data with DVLA to ensure accurate and timely communications can be made.

Your Rights

Under the Data Protection Legislation, you have several rights available to you in respect of your personal information. These are the rights to:

• Request copies of your data.
• Rectification of your data.
• Erasure of your data.
• Object to us or restrict the processing of your data.
• Where our systems allow, give electronic access to copies of your data in a digital format.

Except as required by law, we will not use or disclose your personal information for any purpose for which you have not given us your consent or have requested to no longer be communicated to on a legitimate interest basis. If you object or ask to restrict the processing of your data, you agree that despite this we may continue to use the personal information previously provided to us to the extent that we are contractually obligated to do so and to the extent necessary to enforce any contractual obligations you may have, for example, a finance agreement.

To learn more or to exercise any of these rights you can contact our Data Protection Officer whose contact details are provided at the bottom of this page.

If you’re receiving communications from one of our franchise partners, you would need to opt-out directly with them.

Data Storage

The security of your data is paramount. The duration for which we retain your personal information will differ depending on the type of information and the reason why we collected it from you.

However, in some cases personal information may be retained on a long-term basis: for example, personal information that we need to retain for legal purposes will normally be retained for at least seven years in accordance with usual commercial practice and regulatory requirements. How long we keep data is primarily determined by how long we need it for the purposes we told you we were going to use it for, time periods set out in law and the period we need to keep it to defend ourselves against legal action.

We also retain certain details for such period as may be necessary to validate and handle any claims we receive after the statute of limitations has expired and any claims we receive where the claimant was not aware of the injuries/damages until a long time after they were caused. We take steps to ensure any business we work with has security protocols and policies in place to manage and record your data privacy and preferences correctly and that your data is stored securely.

Carsa reserves the right to update or amend this Data Privacy Notice in line with customer feedback or updates in legislation and it will be published at www.carsa.co.uk

A full listing of our manufacturers and nominated suppliers, who we may share information with, together with the various sources (e.g. service plan and vehicle health check data) can be found here.

If you would like to find out more about how we use your data, please contact our DPO.

Data Protection Officer

Name: Gary Neve, Email: Gary.Neve@carsa.co.uk

Address: Carsa Limited, Unit 7 Barton Road, Chickenhall Lane, Eastleigh, Hampshire, England, SO50 6RR

If we are unable to resolve any issues you raise within 30 days you have you have the right to complain to the Information Commissioners Office @ https://ico.org.uk/concerns

‍

‍