1. Introduction

1.1 Jardine Motors Group takes its obligations with regard to data protection seriously. As such, we are providing this notice (“Privacy Notice”) to you so that you are provided with information about how Jardine Motors Group collects and processes your Personal Data in accordance with the General Data Protection Regulation (“GDPR”). Please read this Privacy Notice, as it contains important information that you need to know.

1.2 We have set out our contact details at the end of this Notice which you can use if you have any queries relating to how to access your Personal Data under the GDPR.

1.3 This Notice was updated in September 2019.

2 About us

2.1 Jardine Motors Group operates a number of individual companies which includes Lancaster plc and its subsidiary operating companies including Lancaster Motor Company Limited, Lancaster Cars Limited, Lancaster Luxury Vehicles Limited, Lancaster Specialist Cars Limited and Lancaster Sports Cars Limited (the “Operating Companies”). Details of the Operating Companies can be found on the website www.jardinemotors.co.uk. All share a registered office at 770 The Crescent, Colchester Business Park, Colchester, Essex, CO4 9YQ, together being the Jardine Motors Group of companies (“Jardine Motors Group”).

2.2 Please note that references to “we”, “us” or “our” means the members of the Jardine Motors Group that process your personal information, being any Jardine Motors Group company or dealership that supplies details about, or provides, vehicles, accessories, parts and/or related services to you, and Lancaster plc.

2.3 In this Privacy Notice, references to “you” means the person whose personal information we collect, use and process. This includes anyone who contacts us in connection with the products and services we provide or otherwise interacts with us about them including, for example, at any of our dealerships.

2.4 Jardine Motors Group is a “controller”. This means that we are responsible for deciding how we hold and use personal information about you.

3 How is your Personal Data collected and why?

3.1 In order for us to provide our products (including vehicles and parts) and our services to you, it is necessary for us to collect, maintain and process Personal Data about you as a prospective and/or existing customer. “Personal Data” is information that relates to you and (either on its own or in combination with other information Jardine Motors Group holds) allows Jardine Motors Group to identify you as an individual prospective, existing and/or historic customer and thus enables us to provide our products and services, or details of them, to you.

3.2 This Notice applies to Personal Data that we collect from or about you, through the methods described below from the following main sources:

3.2.1 Our websites operated by or for us, such as sites that we operate under our own domains/URLs:

• www.jardinemotors.co.uk;
• news.jardinemotors.co.uk;
• landrovershop.jardinemotors.co.uk;
• jaguarshop.jardinemotors.co.uk;
• audishop.jardinemotors.co.uk; and
• mclarenshop.jardinemotors.co.uk

3.2.2 E-mail, text and other electronic messages which are interactions with electronic communications between you and us.

3.2.3 Offline registration forms which are printed or digital registration and similar forms that we collect via, for example, postal mail, in our dealerships, contests and other promotions or events.

3.2.4 Interactions with our advertisements (e.g. if you interact with one of our advertisements on a third party website, we may receive information about that interaction).

3.2.5 In the course of our interactions with you, we may create Personal Data about you (e.g. records of your purchases of any goods and/or services from us).

3.2.6 Data from other sources which includes third party social networks (e.g. such as Facebook, Google), market research (if feedback not provided on an anonymous basis), third party data aggregators, promotional partners, public sources and data received when we acquire other companies.

3.2.7 Personal Data may be collected from monitoring devices and systems such as closed circuit television (CCTV) within our dealerships and premises. Our CCTV monitors our business premises 24 hours a day and this data is continuously recorded. Images may be monitored by authorised personnel during working hours and can be accessed remotely at other times if required. Live feeds from CCTV cameras are monitored where this is reasonably necessary, for example to protect health and safety.

4 What type of personal information does Jardine Motors Group collect?

4.1 The Personal Data which we process may include the following:

• your full name and contact information (address, city, post code, email address and telephone number);
• your work address and contact details;
• the details and verification of your driving licence (including carrying out appropriate checks with DVLA) to verify your eligibility to legally drive any of our vehicles and to meet our legal requirements and/or the requirements of our insurers;
• details of your enquiry or interest or preferences about our products or services, such as possible planned purchase or lease date, vehicle(s) brand, make and/or model, or vehicle requirements;
• capturing and sending telematics device data for your specific location, direction, current speed, duration of journey and braking and cornering, amongst other factors to our telematics suppliers' server and we will use the information to understand road type, speed and other conditions relating to your journey. This information is only available to us where you are provided with a courtesy/demonstration vehicle and the information will be combined to form a driving score based on your driving behaviour. In addition to the above, the telematics device may also collect vehicle and battery health data;
• records of calls, emails, correspondence with you and of visits to us in relation to such enquiries, negotiations, resultant sales and/or supplies;
• the registration number, brand, make and model of your vehicle, and GPS data;
• your image, actions and location if you are recorded on CCTV that we operate on and around our sites;
• if you purchase a vehicle and/or services, information including registration number, brand, make, model, model year, selling dealership, servicing dealership, date of purchase, lease or service history;
• if you purchase vehicle parts, what they are, for which brand, make and model;
• time and date of any purchases or sales by you, including any prices and payment (including bank account and/or credit card) details, data collected on finance applications, payment history, default, and non-payment of any credit;
• with your consent, credit check details and proof of identity/valid driving licence information, such as passport/driving licence and utility bill details;
• demographic information (including your age range, employment status, marital status and household composition);
• details about any marketing consents and marketing preferences; and
• feedback and survey results.

4.2 Personal Data will be primarily collected from you directly on a voluntary basis. However, some Personal Data may, where lawful to do so, be collected by us from third parties, public sources, individuals who you have indicated have agreed for you to provide their personal information, government, tax or law enforcement agencies and any other third parties. We may also collect personal information about you from your use of other Jardine Motors Group websites or services. In addition, we may combine your Personal Data with other data held by third parties (such as vehicle and value data to allow us to provide vehicle valuation services). We may also buy in data for marketing purposes.

4.3 Please note that you are under no obligation to provide us with your Personal Data, but not providing such data when requested could prevent us from being able to help you, from providing information or products and/or services to you as requested and from fulfilling your order or contract with us.

4.4 We do not usually collect any Special Categories of Personal Data about you. This includes details about your race or ethnic origin, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. We do not usually collect any information about criminal convictions and offences, with the exception of any driving or motoring offences revealed from a check of your driving licence.

4.5 For customers with a disability who are seeking to purchase a vehicle supplied by us with the benefit of zero rated VAT relief (or any other tax benefits, as amended from time to time by law), we may require proof of your eligibility (including appropriate medical information) to process the benefit(s) or otherwise to process the transaction in accordance with the scheme rules, any relevant guidance and recognised best practice.

5 Personal Data of children

We do not knowingly solicit or collect Personal Data from children below the age of 16. If you believe we have collected information from your child in error or have questions or concerns about our practices relating to children, please contact us as described below.

6 Your Personal Data collected on our website

6.1 When you visit our websites, we may automatically collect standard internet and website log information and details of patterns about how website visitors behave. The information we may collect includes information about your Internet service provider, your operating system, browser type, domain name, the Internet protocol (IP) address of your computer (or other electronic Internet-enabled device), your access times, the website that referred you to us, the web pages you request and the date and time of those requests. This may allow us to find out which parts of the website are popular or need changing or to show you products and services of relevance to you, either on our website or through online advertising on Google, Facebook or other websites. These details are in addition to other Personal Data collected from you but, unless you register an account with us and use that on our website, your website usage details are not linked to other Personal Data we may collect about you.

6.2 Our websites use information and may also involve the use of cookies and Web beacons. Please see our Cookies Policy https://www.jardinemotors.co.uk/site/nd-cookies-po... for more information.

6.3 Our website allows you to interact with us in many ways, including raising customer services enquiries, emailing us if you have a question, any feedback, suggestions for us to consider as well as interacting with us through our social media accounts including Facebook, Twitter and Live Chat.

7 Why and for what purposes do we need your Personal Data?

7.1 Jardine Motors Group processes Personal Data about you for a number of purposes, including:

• to respond and/or deal with your requests or enquiries;
• where we need to perform the contract we have entered into with you;
• where we need to comply with a legal or regulatory obligation;
• to make an appointment with you to visit one of our dealerships, or to arrange a test drive;
• for internal record keeping (including customer enquiry, deal files, accounting and complaint files);
• for vehicle number plate recognition that alerts us when you arrive at some of our dealerships and allows us to improve on site security and customer service;
• to provide our products and services to you as requested or agreed;
• to help us review, develop and improve the products and services we offer, for example through surveys, research, analysis and planning;
• where you are an existing or historic customer, to provide you with updates and promotional offers about our goods and/or services, MOT/Service reminders and invitations to events, where you have not opted out of receiving such communications from us. Similarly, if you are not an existing customer but have previously enquired about our goods or services, to market you by post or telephone unless you have asked us not to do so;
• to communicate with you to provide you with customer and vehicle support, such as notifying you about changes to our products and services, any issues with them, product recall, and to otherwise communicate with you, for example to respond to queries from you;
• to process and retain Personal Data relating to your credit/debit card (or bank account details) and order details to enable the fulfilment of your order, finance or insurance applications and to deal with any payments, sales proceeds, or refunds of payment;
• to remind you about important dates, such as service due dates and warranty expiry dates;
• to contact you from time to time to ensure your details on record are correct and up to date and to ensure we have your up to date preferences for marketing and contact;
• to depersonalize, pseudonymise or fully anonymise and/or aggregate your data to reduce privacy intrusion but facilitate our use of the data for analysis and research, to better understand our business and customer base and their needs and to improve our products and services and business;
• where necessary as part of any restructuring of Jardine Motors Group or the sale of any Jardine Motors Group company, business or assets; and
• to carry out security checks to protect against fraudulent transactions at or following any purchase or order you make to prevent and detect criminal activities. For example, we may undertake verification checks to identify any discrepancies with your payment details for fraud prevention and staff training purposes.

7.2 This list is not exhaustive and may be updated from time to time.

7.3 We also may use automated decision making, where a decision is taken solely on the basis of automated processing of your Personal Data. This means processing using, for example, software code or an algorithm, which does not require human intervention.

7.4 We use automated decision making, including profiling, in certain circumstances, such as when it is in our legitimate interests to do so, or where we have a right to do so because it is necessary for us to enter into, and perform, a contract with you. We use profiling to enable us to give you the best service across the Jardine Motors Group, including specific marketing in which we believe you will be interested. You have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal effects for you or affects you in any other significant way. If you are seeking to exercise this right, please contact us using the details in section 16 below.

7.5 If you are a prospective customer and/or an existing customer with us, we may use automated decision making to carry out a credit check on you. In an underwriting context, profiling is routinely carried out on your personal risk information to assess your individual risk in order to make a decision about whether to provide you with the goods and/or services. We may also apply automated decision making to telematics data.

7.6 You have certain rights in respect of automated decision making, where that decision has significant effects on you, including where it produces a legal effect on you.

8 How long do we keep your Personal Data?

8.1 We will retain your Personal Data for as long as is reasonably necessary for the purposes for which it was collected. In some circumstances we may retain your Personal Data for longer periods of time, for instance where we are required to do so in accordance with legal, regulatory, tax or accounting requirements.

8.2 In specific circumstances we may also retain your Personal Data for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your Personal Data or dealings with us.

8.3 We maintain a Data Retention Policy which we apply to records in our care. When your Personal Data is no longer required we will ensure it is either securely deleted or stored in a way which means it will no longer be used by the business.

9 Explaining the legal bases we rely on to process your Personal Data

9.1 The following table describes the various purposes for which we may collect and use your Personal Data, and the different types of Personal Data that are collected for each purpose. Please note that the list is not exhaustive.

What we use your Personal Data for	Our reasons	Our legitimate interests
Providing goods and services to our prospective and existing customers. We may use your Personal Data: to deliver our goods and/or services; to manage our relationship with you; to develop new ways to meet our customers’ needs and to grow our business; to develop and carry out marketing activities; to study how our customers use our products and services; and to market our products and services.	Fulfilling contracts Our legitimate interests Our legal duty With your consent (where required)	Keeping our records up to date; working out which of our products and/or services may interest you and telling you about them; developing products and/or services, and what we charge for them; defining types of customers for new products and services; to provide you with information relating to our goods and services; as an existing customer to keep you informed about our latest offers, deals and competitions; and being efficient about how we fulfil our legal and contractual duties.
Legal reasons. We may use your Personal Data: when required by applicable law; in response to legal proceedings; in response to a request from a competent law enforcement agency; to protect our rights, privacy, safety or property, or the public; or to enforce the terms of any agreement or the terms of our website.	Fulfilling contracts Our legitimate interests Our legal duty	Developing and improving how we deal with fraud, as well as undertaking our legal duties in this respect; complying with regulations that apply to us; and being efficient about how we fulfil our legal and contractual duties.
Operating our business effectively. We may use your Personal Data to run our business in an efficient and proper way. This includes managing our business capability, financial position, communications, corporate governance, planning and audit.	Our legitimate interests Our legal duty	Complying with regulations that apply to us; and being efficient about how we fulfil our legal and contractual duties.
Developing our products and services. We may use your Personal Data: to develop and manage our products and services; to manage how we work with other companies that provide products and services to us and our customers; and to find people who might benefit from using our products and services.	Fulfilling contracts Our legitimate interests Our legal duty	Developing products and services, and what we charge for them; defining types of customers for new products and services; being efficient about how we fulfil our legal and contractual duties; and complying with legal regulations that apply to us.
Competitions, marketing and other promotions. We may use your Personal Data to provide you with information about goods or services (e.g. marketing communications or campaigns and/or promotions). This can be done via means such as email, advertisements, SMS, phone calls and postal mailings to the extent permitted by applicable laws. Some of our campaigns and promotions are run on third party websites and/or social media networks.	Fulfilling contractual obligations Our legitimate interests With your consent (where required)	Working out which of our products and services may interest you and telling you about them; and defining types of customers for new products or services.

10 Does Jardine Motors Group share personal information with third parties?

10.1 We may disclose your personal information to other members of our group of companies as set out in section 2.1 above.

10.2 We are authorised by a number of manufacturers to market, sell and supply specific branded vehicles, accessories, parts and related services, subject to requirements imposed on us by the relevant manufacturer.

10.3 Where you have purchased goods and/or services or expressed an interest in any of the brands we represent, we may share your Personal Data with the relevant manufacturer or brand as we are an authorised retailer for these manufacturers. A link to each privacy notice can be found next to their name or you can obtain a copy of this link at any time by contacting us as set out in section 16 below:

Aston Martin	Maserati
Audi	McLaren
BMW	Mercedes-Benz/ Smart
Ferrari	MINI
Harley-Davidson	Porsche
Honda	ŠKODA
Jaguar Land Rover	Toyota
Lamborghini	Volkswagen
Lexus	Volkswagen Commercial Vehicles

10.4 We may also share your Personal Data with:

• our accredited finance providers to administer your finance application on your behalf with our accredited finance providers and/or allow you to facilitate funding to purchase a vehicle or other services; and
• our insurance providers and other added value product suppliers if you decide to purchase or express an interest in purchasing additional regulated or non-regulated products or services during the sale or after the sale of your vehicle.

In such instances, we may pass your Personal Data to the relevant provider to fulfil your request.

10.5 If we share your information with third party partners, the third party’s privacy notice will apply to their processing of your Personal Data.

10.6 Your personal information may also be made available to third parties (within or outside Jardine Motors Group) providing relevant services under contract to us, such as marketing agencies, auditors, compliance managers, insurers, IT hosting, administration and IT maintenance providers (including those companies referred to in this Notice). These companies may use information about you to perform their functions on our behalf.

10.7 Whenever we share your Personal Data with a third party, we take steps to ensure that any third-party partners who handle your Personal Data comply with data protection legislation and protect your Personal Data just as we do. We only disclose personal information that is necessary for them to provide the service that they are undertaking on our behalf. We will aim to anonymise your Personal Data or use aggregated non-specific data sets where possible.

10.8 We may perform credit and identity checks with one or more Credit Reference Agencies (CRAs).

10.9 CRA (credit reference agency) checks involve us sharing your personal information with the UK’s CRAs (Credit Reference Agencies). The CRAs will give us information about you including about your financial situation and financial history. CRAs will supply us with both public (including the electoral register) information and shared credit, financial situation and financial history information and fraud prevention information. We may use this information to assess your financial position and to verify the accuracy of the data you have provided to us. We are required to tell you that the identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail within the Credit Reference Agencies Information Document (CRAIN). The CRAIN can be found at:

Experian Limited:www.experian.co.uk/crain

Post: Experian, PO BOX 9000, Nottingham, NG80 7WF

Web Address: http://www.experian.co.uk/consumer/contact-us/inde...

Email: consumer.helpservice@uk.experian.com

Telephone: 0344 481 0800 or 0800 013 8888

You have a right to apply to the CRAs for a copy of your file. The information they hold may not be the same and there is a small fee that you may need to pay to each agency.

11 Will your personal information be transferred abroad?

11.1 Your personal information may be transferred to, and stored, and otherwise processed in one or more countries outside of the European Economic Area (“EEA”). This may happen where a manufacturer, supplier or service provider are from time to time located in a country outside of the EEA.

11.2 We are committed to ensuring that adequate safeguards are in place when transferring Personal Data outside the EEA. We will take appropriate security measures to ensure that your personal information is adequately protected in accordance with the requirements of the GDPR.

11.3 Whenever we transfer your Personal Data out of the EEA, we will ensure a similar degree of protection is afforded to it as set out in this Notice. These steps include imposing contractual obligations on the recipient of your Personal Data or ensuring that the recipient is subscribed to recognised international frameworks for the protection of your Personal Data.

11.4 Please contact us using the details at the end of this Notice for more information on the specific mechanism used by us when transferring your Personal Data out of the EEA.

12 Using your Personal Data for direct marketing

12.1 We may wish to provide you with information about new products, services, promotions and offers which may be of interest to you and may invite you to take part in market research or request feedback on our products and services and our services.

12.2 We may collect your marketing preferences by e-mail, telephone call or message, post or text/SMS. We will obtain your consent and advise you of how to opt-out of receiving such communications where we are required to do so in accordance with applicable law.

12.3 We may contact you with targeted advertising which is delivered through social media by using your personal information or use your personal information to tailor marketing which may be relevant to you, unless you object.

12.4 You may opt-out of direct marketing activities at any time by using the unsubscribe or opt out links in marketing communications which we send to you.

13 What rights do you have to review and amend personal information?

13.1 You have a number of rights in relation to your Personal Data.

13.2 Where our processing of your Personal Data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing your Personal Data for that purpose, unless there is another lawful basis we can rely on, in which case we will let you know. Your withdrawal of your consent will not impact any of our processing up to that point.

13.3 You may request access to your data, correction of any mistakes in our files, erasure of records where no longer required, restriction on the processing of your data, objection to the processing of your data, exercise rights of data portability and obtain information in relation to any automated decision making and profiling or the basis for international transfers. You may also exercise a right to complain to the Information Commissioner’s Office (“ICO”). For more information about each of these rights, please refer to the table set out below.

Right	What this means
Access	You can ask us to: confirm whether we are processing your Personal Data; give you a copy of that data; and provide you with other information about your Personal Data such as what data we have, what we use it for, who we disclose it to, whether we transfer it abroad and how we protect it, how long we keep it for, what rights you have, how you can make a complaint, where we got your data from and whether we have carried out any automated decision making or profiling, to the extent that this information has not already been provided to you in this Notice.
Rectification	You can ask us to rectify inaccurate Personal Data. We may seek to verify the accuracy of the data before rectifying it.
Erasure	You can ask us to erase your Personal Data, but only where: it is no longer needed for the purposes for which it was collected; or you have withdrawn your consent (where the data processing was based on consent); or following a successful right to object (see Objection below); or it has been processed unlawfully; or to comply with a legal obligation to which we are subject. We are not required to comply with your request to erase your Personal Data if the processing of your Personal Data is necessary: for compliance with a legal obligation; or for the establishment, exercise or defence of legal claims. There are certain other circumstances in which we are not required to comply with your erasure request, although these two are the most likely circumstances in which we would deny that request.
Restriction	You can ask us to restrict (i.e. keep but not use) your Personal Data, but only where: its accuracy is contested (see Rectification above), to allow us to verify its accuracy; or the processing is unlawful, but you do not want it erased; or it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or you have exercised the right to object, and verification of overriding grounds is pending. We can continue to use your Personal Data following a request for restriction, where: we have your consent; or to establish, exercise or defend legal claims; or to protect the rights of another natural or legal person.
Portability	You can ask us to provide your Personal Data to you in a structured, commonly used, machine-readable format, or you can ask to have it 'ported' directly to another controller, but in each case only where: the processing is based on your consent or on the performance of a contract with you; or the processing is carried out by automated means.
Objection	You can object to any processing of your Personal Data which has our 'legitimate interests' as its legal basis, if you believe your fundamental rights and freedoms outweigh our legitimate interests. Once you have objected, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms.
Automated decision making	You can ask not to be subject to a decision which is based solely on automated processing, but only where that decision: produces legal effects concerning you (such as the rejection of a claim); or otherwise significantly affects you. In such situations, you can also obtain human intervention in the decision making, and we will ensure measures are in place to allow you to express your point of view, and/or contest the automated decision. Your right not to be subject to automated decision making does not apply where the decision which is made: is necessary for entering into or performing a contract with you; or is authorised by law and there are suitable safeguards for your rights and freedoms; or is based on your explicit consent. However, in these situations you can still obtain human intervention in the decision making, and we will ensure measures are in place to allow you to express your point of view, and/or contest the automated decision.

13.4 You will not have to pay a fee to access your Personal Data or to exercise any of the other rights within this section. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

13.5 We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data or to exercise any of your other rights. This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

13.6 We aim to respond to any valid requests within one month unless it is particularly complex or you have made a number of requests in which case we will inform you of this and we will then aim to respond within three months of receipt of the valid original request.

14 Data Security

14.1 We have put in place appropriate security measures to seek to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality.

14.2 We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator (such as the Information Commissioner’s Office) of a breach where we are legally required to do so.

14.3 If we have provided you with a password, or if you have chosen your own password, it is your responsibility to ensure that the password is kept confidential.

15 Changes to this Notice

15.1 We will keep this Notice under regular review. We may change this Notice from time to time by updating this Notice in order to reflect changes in the law and/or our privacy practices. The date in paragraph 1.3 at the beginning of this Notice will be updated accordingly.

15.2 We encourage you to check the date of this Notice when you visit our website for any updates or changes. We will notify you of any modified versions of this Notice that might materially affect the way we use or disclose your personal information.

16 Contact and complaints

16.1 The primary point of contact for all issues arising from this Notice, including requests to exercise data subject access requests, is our Customer Services Department.

16.2 The Customer Services Department can be contacted in the following ways:

Web portal: Click here

(Web portal to be used for Subject Access Requests only)

Email:customerservices@jardinemotors.co.uk.

Helpline:0800 012 5050
Write to: Customer Services Department
c/o Lancaster Toyota Wearside
Newcastle Road
Sunderland
Tyne and Wear
SR5 1JE

16.3 If you have a complaint or concern about how we use your Personal Data, please contact us in the first instance and we will attempt to resolve the issue as soon as possible. You also have a right to lodge a complaint with the Information Commissioner’s Office (ICO) at any time.