Stoneacre Privacy Policy Where we use ‘we’, ‘our’ and ‘us’ this refers to Decidebloom Ltd t/a Stoneacre, which includes all dealerships in the Stoneacre Motor Group as detailed on www.stoneacre.co.uk. Our company details are as follows: Company number - 3003995 | Registered office - Omega Boulevard, Capitol Park, Thorne, DN8 5TX | VAT Number - GB616996004 This website is owned and operated by Decidebloom Ltd. We are the controller and responsible for any personal data you submit to us. We are registered as a controller with the Information Commissioner’s Office (ICO) and our registration number is: Z7037971 Introduction Your privacy is of paramount importance. It is important that you read this privacy statement together with any other privacy policy or fair processing notice that we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy statement supplements any other such notices and privacy policies and is not intended to override them. We aim to ensure your experience of using our website or visiting us in branch is fulfilling, hassle-free and secure. To achieve this, we will outline below; • what data we collect from you (online and in branch) • how we use this data and conditions under which we may disclose this data to others • how we keep any data held secure • how our website works If you have any questions about this privacy statement, including any requests to exercise your legal rights, please contact Group Compliance Officer using the details set out below: • email: group.compliance@stoneacre.co.uk • post: Stoneacre, Omega Boulevard, Capitol Park, Thorne, DN8 5TX You have the right to make a complaint at any time to the ICO, the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance. What data we collect from you We collect information about you and your vehicle when you engage with us via our website or contact one of our retail centres. We may collect this information electronically, over the telephone, through postal correspondence or in person. We may also collect your information when it is shared with us following your contact with one of our manufacturer partners, for example when requesting a test drive. We only request information which is necessary, relevant and adequate for the purposes you are providing it for. The information we collect may include some or all of the following: • Identity Data which includes your name, title, username or similar title, date of birth and gender • Contact Data which includes your address, email address, telephone numbers • Financial Data which includes bank account and payment card details • Vehicle Data which includes make and model, registration number, VIN, mileage, service and warranty information • Transaction Data which includes details about payments to and from you, details of any transactions between you and us which includes the date and time you used our services, voice recordings of calls you make to us in connection with your transaction "Live Chat" recordings and information within correspondence you send to us • Technical Data which includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website, the website address from which you accessed our website and the pages you visited on our website • Usage Data which includes information on how you use our website, products and services • Profile Data which includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses and your GPS location (where you have permitted access to this) • Marketing and Communications Data which includes your preferences in receiving marketing from us and our third parties and your communication preferences • Cookie, pixels or beacon information (for more information see our Cookie Policy) • When engaging in a business context we may collect your job title, company contact details, fleet size and company details • CCTV images collected during site monitoring and security purposes - see Policy We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy statement. Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may break the law or not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time. How do we use this data? We will only use your personal data where there is a legal basis for processing your personal data. Generally, we will use your personal data in the following ways: Contractual Performance We may use your personal data, where necessary to perform a contract with you and to fulfil and complete your orders, purchases and other transactions entered into with us, and to enable us to respond to or understand customer/driver’s needs. We may also process data necessary for us to operate the administrative and technical aspects of our business efficiently and effectively. Legitimate Interest We may use and process your personal data where necessary for our legitimate interests provided that such interests are not overridden by your interests and fundamental rights and freedoms. Examples of where processing may be necessary for our legitimate interest include: • Processing to enable us to support customers with sales and enquiries and provide important information about any products or services you have purchased from us • Responding to customer’s correspondence and fulfilling requests (for example test drives, service requests, brochure requests or providing information about specific vehicles) • Analysing, evaluating and improving our products and services to enhance our customers experience • Undertaking market analysis, research and customer surveys, to improve our understanding of our customers and provide tailored offers, products and services • Processing necessary for us to promote our business and services • Sending targeted marketing information to customers from time to time following the purchase of a product or service from us where legally permitted • Verifying the accuracy of information we hold to create a better understanding of our customers • For network and information security purposes, so we can protect information against loss, damage, theft or unauthorised access • Enforcing or protecting contractual or other legal rights or to bring or defend legal proceedings • Assisting in providing a safe and secure environment within our premises • Managing your queries, complaints and claims • To recover debts due to us Legal or Regulatory Obligation We may process your information regarding updates to our terms and conditions and policies, and to comply with legal requirements (e.g. to register your car with the DVLA, assist with HMRC, undertake legal checks and comply with our obligations under applicable legislation). Marketing We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what products and services we think you may want or need, or what products and services may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing). You will receive marketing communications from us if you have requested such information from us or purchased goods or services from us and you have not opted out of receiving that marketing, or where it is in our legitimate interests to send such marketing and we are legally permitted to do so (for example, if you are a business customer). We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. You can opt-out of receiving marketing at any time and control your marketing preferences by clicking here and checking or unchecking the relevant boxes to adjust your marketing preferences. You can also access this page by following the opt-out links on any marketing message sent to you. Alternatively, you can contact us using the contact details above and we will update your preferences. Where you opt out of receiving these marketing messages, this will not affect our ability to continue to process any personal data provided to us in connection with a product/service purchase, warranty registration, product/service experience or other transactions and we may still contact you in relation to purely transactional matters. If you enquire or purchase a product from Stoneacre after opting out, you will automatically be reinstated to full opt in. Third Party Contact Except as otherwise expressly stated in this policy, we will only pass on your information to third parties such as our manufacturer and/or finance partners for marketing purposes where you have given us consent to do so. How do we share this information? Sometimes it is necessary for us to share the information we hold on you. These circumstances are outlined below. Third Parties We may disclose your information where there is legitimate reason to do so to other third parties. This may include: • To our affiliated entities to support internal administration • IT software providers that host our website and store data on our behalf • To professional advisers which may include consultants, lawyers, bankers and insurers who provide us with consultancy, banking, legal, insurance and accounting services • HM Revenue and Customs, regulators and other authorities who require reporting of processing activities in certain circumstances • Third parties who we may choose to sell, transfer or merge parts of our business or assets with, or who we may seek to acquire other business or merge with them. If a change happens to our businesses, the new owners may use your personal data in the same way as set out in this privacy policy. Legal Obligation/Safety We may also disclose personal data to the police, regulatory bodies, or similar third parties where we are under a legal obligation to do so. In addition, we may disclose data in order to enforce or apply our website terms and conditions and other agreements; or to protect our rights, property, or safety of our customers, or others. This may include exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction. To provide products or services you have requested While completing a transaction with us you may request additional products and services (such as guaranteed asset protection, tyre and alloy insurance, along with other products) which will be supplied by our carefully selected list of suppliers. In order to fulfil your request, we will pass your information, with your agreement, to the necessary third party. We have contracts in place with our suppliers which means they must keep your information secure and can only use it in accordance with our specific instructions. To provide finance for the purchase of a vehicle When you apply for finance with us, your details will be passed into a 3rd party company, Blue Owl Network Ltd trading as AutoConvert (contact details below). This organisation will check the following records about you and with their chosen Credit Reference Agencies (CRA), Equifax Ltd and Experian Ltd (contact details below) a. Our own; b. Up to date contact information can be found for AutoConvert at http://www.autoconvert.co.uk c. Those at Equifax Ltd and/or Experian Ltd. When Equifax and/or Experian receives a search request from us via AutoConvert, they will place a soft quotation footprint that will be visible to you only, on your credit file, other parties including lenders will not see this. This quotation footprint will not be seen by other parties and it will not affect your credit score/rating or ability to apply for finance from other lenders. d. AutoConvert will access from Equifax Ltd and/or Experian Ltd both public (including the electoral register) and shared credit and fraud prevention information. This information will be used to check your eligibility against a select group of lenders. e. Those at fraud prevention agencies (FPAs). We will make checks such as; assessing this application for credit and verifying identities to prevent and detect crime. a. Information on applications will be sent to CRAs and will be recorded by them. b. If you give us false or inaccurate information and we suspect or identify fraud we will record this and may also pass this information to FPAs and other organisations involved in crime and fraud prevention. c. Your data may also be used for other purposes for which you give your specific permission or, in very limited circumstances, when required by law or where permitted under the terms of the Data Protection Act 2018. How to find out more You can contact our chosen 3rd Party, Blue Owl Network Ltd trading as AutoConvert, Moneybarn or the Credit Reference Agencies, Equifax and Experian; the information they hold may not be the same so it is worth contacting them all. Equifax Ltd, Customer Services Centre, PO Box 10036, Leicester, LE3 4FS or call 0800 014 2955 or visit www.equifax.co.uk Experian Ltd, The Sir John Peace Building, Experian Way, NG2 Business Park, Nottingham, NG80 1ZZ, UK www.experian.co.uk/contact-us AutoConvert, 1 Tony Wilson Place Manchester, M15 4FN, UK www.autoconvert.co.uk Moneybarn, Athena House, Bedford Road, Petersfield, Hampshire, GU32 3LJ www.moneybarn.com/privacy-policy/ To our manufacturer partners During the course of a transaction with us (vehicle purchase or service), some of your personal data may be shared with our manufacturer partners and they may contact you to carry out a customer survey. This helps manufacturers analyse and evaluate sales data to enable them to enhance their product offerings. On occasion, we may share voice recordings to provide manufacturers with evidence of our customer service levels. These recordings will not be used for marketing purposes unless your explicit consent has been given. To deliver our targeted marketing Following the purchase of a product or service we may carry out targeted marketing such as service reminders where we have a lawful basis to do so. To enable this, your data may be provided to one of our marketing fulfilment partners. We may also improve our targeted marketing communication by using your data to form lookalike audiences which we can market via third party social channels such as Facebook. Repairs in our bodyshop If you are having repairs carried out in one of our bodyshops, we will hold your data on our bodyshop management system. During the repair process, information regarding the work may be shared on electronic platforms, all of which comply with our GDPR assessments For repair insurance claims, we may also provide your data to third parties for example, independent assessors or an external hire Car Company. We may also provide necessary data to specialist subcontractors like transportation agents, specialist or manufacturer agents. All of these third parties will have agreed to comply with our code of conduct with regards to holding and using your data. How long do we keep your information for? We never retain personal data in an identifiable format for longer than is necessary for the relevant purpose. If we have a relationship with you, for example if you have purchased a car from us, we will continue to hold your personal data for 6 years from the date our relationship ends. We hold information for this length of time in order to establish, bring about or defend any legal claims. Where we have obtained your personal data following a request for test drive, brochure, quotation or any other information on our products or services, we will retain this information on our database until you let us know differently. The following exceptions apply to the above retention periods: • If we are required by law to hold your personal data for a longer/shorter period (for further details, please contact group.compliance@stoneacre.co.uk ) • You have raised a complaint or concern regarding a product or service from us. In which case we will retain your information for a period of 6 years from the date of the complaint or query. How can you manage the information we hold about you? It is important that we hold accurate and current personal data about you. Therefore, we ask you to keep us informed if the personal data we hold about you changes. Under certain circumstances, you have rights under data protection laws in relation to your personal data, including the right to: • Request access to your personal data (known as a subject access request) • Request correction of your personal data • Request erasure of your personal data • Object to processing of your personal data • Request restriction of processing your personal data • Request transfer of your personal data Upon receipt of a request, we will confirm your identity before processing the request. If you have made a subject access request, any of your personal data in response to the request will be provided in the most practical format, unless you have stipulated an alternative format and this is reasonably possible. Please be aware, we may still withhold personal data that you request to the extent permitted or required by law. If you wish to exercise any of the rights set out above, please contact: group.compliance@stoneacre.co.uk You will not ordinarily have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances. In addition to the rights set out above if you have given consent to us processing your personal data for any purpose, you have the right to withdraw your consent at any time. You can do this by contacting us using the contact details set out above. If you withdraw your consent it will not affect the lawfulness of us relying on your consent prior to such withdrawal. We try to respond to all requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. How do we secure and protect your personal data? We use technical and organisational security measures to protect all personal data we hold against manipulation, loss, destruction and access by third parties. We continually work to improve these measures in line with technological developments. We store all the personal data we hold on our secure servers in specialist hosting centres. These servers can only be accessed via a secure firewall using individual password protected logins. Where we hold personal data in hard copy/paper format it is stored in secure archiving. Where we pass your information to third party processors, we have contracts in place to restrict the processing activity to that as requested by us. We also specify deletion of the information once processing is complete. Where we share information with third parties such as manufacturer and finance partners, they will become data controllers. This binds them to the same legislation as we are, and you will be able to review their privacy statements and manage your information directly with them. Third-Party Links This website may include links to third-party websites, plug-ins (such as Facebook, Instagram, YouTube, Google+ and Twitter) and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit. Changes to this policy We may review this policy from time to time. We will notify you of changes by posting an updated version of our Privacy Policy on our website. This policy was last updated on 21 July 2021 Receive our latest News & Offers By giving an email address, you're agreeing to receive our marketing emails and you can opt out at any time. Read our Privacy Policy for details on how your data will be used. Home Contact Us Customer Relations Blog Privacy Policy Cookie Policy Terms & Conditions Careers Tax Strategy Anti-Slavery Statement Gender Pay Gap Young Driver Guide Car Buying Guide Copyright © 2021 DecideBloom Ltd, Registered office, Omega Boulevard, Capitol Park, Thorne DN8 5TX Company Number - 3003995. VAT Number - GB616996004 Please note we record all our calls to ensure that we give you the service you deserve. We and our third-party partners use cookies to personalise content and ads, provide social media features and analyse traffic. You consent to our cookies if you continue to use this website. Accept All & Close Cookie Policy