Privacy Policy

Summary

The purpose of this policy is to set out T G Holdcroft (Holdings) Ltd and its subsidiaries commitment and procedures for protecting personal data. The Directors regard the lawful and correct treatment of personal information as very important to successful working, and to maintaining the confidence of those with whom we deal with. In this document T G Holdcroft (Holdings) Ltd will be referred to as TGH.

Introduction

In this policy, references to we, us or our (or words of similar import) means the TGH entity that processes your personal information (as defined below) and interacts with you (for example, the entity from whom you purchase a vehicle or other services).

The documents you receive from any TGH entity will identify the relevant TGH entity that you are dealing with in any particular instance.

In this Privacy Policy, references to you mean the person or data subject whose personal information (as defined below) we collect, use and process. This includes anyone who contacts us in connection with the purchase of a Vehicle and/or any goods or services we provide or otherwise interacts with us (for example, via a dealership).

In this Privacy Policy, references to website means any website owned and operated by or on behalf of any TGH entity including websites of our dealerships.

We are committed to protecting your privacy. We will use your personal information in accordance with the General Data Protection Regulations 2018 (GDPR), and other applicable laws and regulations that relate to data protection and privacy.

Who is responsible for your personal information?

For the purposes of GDPR, we are the data controller in respect of your personal information that we collect and process as further described in this Privacy Policy.

We may share your personal information with other organisations that may receive and process your personal information as a data controller in their own right. Please see below for further information.

What information do we collect?

• We may collect and process information about you, including your name, date of birth, address, contact details (including email address and mobile phone number), vehicle details, purchase history and data collected as part of any finance application or payment (including previous addresses, employment details, income and expenditure and bank account details). This information is referred to in this Privacy Policy as personal information.
• In particular, we may collect and process the following personal information about you:
• Information that you provide by filling in forms, including those on our Website.
• A copy of your driving licence when you test drive a vehicle or are provided with a courtesy car.
• When you enquire about or purchase a vehicle or services we collect personal information to respond to your enquiry and to process and complete your purchase.
• If finance is required when purchasing a vehicle we will be required to collect further details including marital and housing status, number of dependents, previous address, occupation, employer, business address and bank details as well as a copy of driver’s licence, a proof of address (i.e. a utility bill) and any other relevant documentation. This information will be passed by us with your permission to the finance companies.
• Details about the transactions you carry out with us including vehicle support services and vehicle purchases and purchases of other goods.
• CCTV footage in which you feature when you visit our premises. TGH branches use CCTV to monitor all our premises, therefore, any image and potentially vehicle registration may be captured and stored for up to 28 days, depending on the system used.
• Information contained in and records of communications between us, including e-mails, letters and text messages. We may record calls between us for training, monitoring and quality control purposes. Call recordings are retained for 30 days, unless a copy of the recording is specifically requested in that time, the recording will be permanently deleted.
• Details of your visits to our Website, including, but not limited to, traffic data, location data (including the country and telephone area code where your computer is located) and the resources that you access (including the pages of our Website that you view).
• We will collect information concerning your marketing preferences.
• We also collect information to enable third parties to carry out credit reference checks on you (if you are purchasing a vehicle on finance) and we will receive and process information about the outcome of those checks in order to complete your purchase.

If you provide us with personal information about another person, you must ensure that before you provide us with their personal information, you have their agreement to do so and that they are aware of the ways in which we use personal information as set out in this Privacy Policy.

We may also collect non-identifying information about your preferences in connection with our Website, for the purposes of enhancing and personalising your experience on the Website. We may provide our manufacturer partners and our advertisers with aggregate information about Website users. We may also use such aggregate information to help advertisers reach the kind of audience they want to target. We may make use of the personal data we have collected from you to enable us to comply with our advertisers' wishes by displaying their advertisement to that target audience.

How do we use your personal information?

We use your personal information in connection with our business activities. In particular, we may use your personal information in the following ways:

• to respond to queries from you regarding the possible purchase of goods or services;
• to carry out our obligations arising from any contracts entered into between you and us including purchase of vehicles and provision of services, and to respond to queries from you regarding those contracts;
• to manage and administer the relationships between you and us (or one or more of the members of the TGH Group);
• to notify you about changes to our services and to otherwise communicate with you; for example, we will use your contact details in order to respond to any queries that you submit to us; and
• to obtain feedback from you regarding us; and
• to provide you with reminders regarding your vehicle including, for example, when your vehicle is due to have a service or MOT undertaken.

In accordance with your preferences, we may also use your personal information to provide you with information about vehicles, services, promotions and offers that may be of interest to you. We may use your personal information in order to ascertain the vehicles, services, promotions and offers that are likely to be of particular interest to you. The section below entitled "What choices do I have?" explains how you can change whether to receive this information. Please note that, even if you choose not to receive this information, we may still use your personal information to provide you with important services communications, including communications in relation to any purchases you make or vehicle support services.

Your personal information may also be used by us, our employees, contractors or agents, and disclosed to third parties, in order to comply with any legal obligation (including in connection with a court order), or in order to enforce or apply the terms of any agreements we have with or otherwise concerning you (including agreements between you and us (or one or more TGH entity)), or to protect our rights, property or safety or those of our customers, employees or other third parties. All of our third parties operate with a Data Processing Agreement and adhere to our GDPR processes and the data remains within the control of Holdcroft.

With whom do we share your personal information?

In connection with the above uses of your personal information, we may share your personal information with third parties as described below. We will share your personal information with other TGH entities in the TGH group for the purposes set out above and below.

We may disclose your personal information to third parties in connection with our business activities, including in the following circumstances:

• We may pass your personal information to third party organisations that provide services to us (including assisting us with carrying out marketing activities).
• We may pass personal information to external agencies and organisations (including the police and other law enforcement agencies) for the purpose of preventing and detecting fraud (including fraudulent transactions) and criminal activity. We may also disclose personal information to the police and other law enforcement agencies in connection with the prevention and detection of crime.
• We may pass your personal information to a third party finance company for the purposes of them providing you with finance. Those organisations may carry out credit checks and may disclose your data to credit reference agencies for that purpose.
• In the event that we sell or buy any business or assets (including car dealerships), we may disclose personal information held by us about our customers to the prospective seller or buyer of such business or assets. If we or substantially all of our assets are acquired by a third party (or subject to a reorganisation within our corporate group), personal information held by us about our customers will be one of the transferred assets.
• We may pass your personal information to third parties if we are under a duty to disclose or share your personal information in order to comply with any legal obligation (including in connection with a court order), or in order to enforce or apply the terms of any agreements we have with or otherwise concerning you (including agreements between you and us (or one or more members of the TGH Group)) or to protect our rights, property or safety or those of our customers, employees or other third parties;
• In the event of a new car purchase we are contracted to pass your personal information to the relevant franchise manufacturer partner relating to your vehicle.
• We share your personal information with manufacturers because:
• It is our legitimate interest to do so, as we are required to do so as part of the terms of our agreement with the manufacturer and to maintain our on-going relationship with the manufacturer;
• It is required to fulfil your order or other transaction, handle complaints or provide you with a service or information you have requested.
• It is in the manufacturers legitimate interest to have that information to enable it to communicate important information to you, better understand customer demographics and requirements and (where you agreed to receive marketing communications) to send you information that it believes may be of interest to you and
• It is also in your interest that we share your personal information with the manufacturer, so that you can receive important safety information and other relevant communication
• The manufacturer has its own responsibilities to you for any use it makes of your personal information and will have its own privacy notice which will provide you with more information about how the manufacturer uses your personal information. You can contact the manufacturer directly if you require more information about how the manufacturer will use your personal information or if you want to exercise any of your rights in respect of the manufacturer's use of your personal information.

We may share non-personal aggregate statistics (group) data about visitors to our Website, sales and traffic patterns with members of the TGH Group and other parties.

Data Collection: Legitimate Interest

We will ensure that data is collected within the boundaries defined in this policy. This applies to data that is collected in person, by completing a form, online applications, or via Enquiry Max, Finance Applications, Contact Advantage, Autoline and KPaye or via telephone.

The lawful basis we have chosen to enable TGH to carry out its duties as provider to its customers and perspective customers and other legitimate commercial functions and responsibilities to data subjects is Legitimate Interest. This decision has been made after carrying out a Legitimate Interest Assessment (LIA) When collecting data, we will ensure that the Data Subject:

• Clearly understands why the information is needed
• Understands what it will be used for
• Understands that legitimate interest is the lawful basis used for its collection and use.
• Has received sufficient information on why their data is needed and how it will be used
• Is, as far as reasonable practical, competent enough to understand the legal basis under which the data is collected and the used
• If only partial consent is given the system must be capable of screening out any unauthorised use.
• Consent can be withdrawn in the same manner of ease as opted in at anytime

Protecting your personal information

Our security procedures mean that we may occasionally request proof of identity before we are able to disclose sensitive information to you.

Information and records relating to sales/service/parts users will be stored securely and will only be accessible to authorised staff.

Information will be stored for only as long as it is needed or required and will be disposed of appropriately. It is our responsibility to ensure all personal and company data is non-recoverable from any computer system previously used within the organisation, which has been passed on/sold to a third party.

This policy will be updated as necessary to reflect best practice in data management, security and control and to ensure compliance with any changes or amendments made to the GDPR Directive 2018. Please note that under GDPR enforcement ‘the Cloud’ will not be exempt.

What choices do I have?

If you think the personal information we hold about you is inaccurate or incorrect, you can request that we correct this information (including your marketing preferences) by writing to us using the details below. Data subjects who wish to have their information the Company holds about them removed, a request in writing is required to Data Compliance Centre, T G Holdcroft (Holdings) Ltd, Leek Road, Hanley, Stoke on Trent, Staffordshire ST1 6AD or datacompliance@holdcroft.com - as long as their information is not pertinent to the completion of a contract or required for any legal reason it will be removed.

Once the request has been received in writing, the request will be processed without undue delay within 1 calendar month. In accordance with ICO guidelines our policy is that with regards to instructions to desist in marketing that electronic communications stop within a maximum of 28 days of receiving the notice, and postal communications stop within a maximum of two months.

If the data subject is concerned that we are not using their information in accordance with the law, or are not satisfied with our response to a request made above, then they can complain to the Information Commissioner’s Office. Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Tel: 0303 123 1113.

Access to your personal information

GDPR gives you the right to access your personal information. Data subjects may request, at any time, a copy of the personal information the Company holds about them, please contact us using the details below. Full details can be obtained by requesting a copy of our Subject Access Request Policy.

How to contact us

If you have any questions, comments or requests regarding this Privacy Policy, please feel free to contact us by writing to us at: Data Compliance Centre, T G Holdcroft (Holdings) Ltd, Leek Road Hanley, Stoke on Trent, ST1 6AD or email at datacompliance@holdcroft.com.

Policy changes

If we decide to change this Privacy Policy, we will post the updated Privacy Policy on our Website so that you are always aware of what personal information we collect, how we use it and under what circumstances we disclose it. The updated Privacy Policy will take effect as soon as it is posted on our Website.