TOOMEY MOTOR GROUP – PRIVACY POLICY AND DATA PROCESSING OUTLINE

At Toomey Motor Group we will process your data using the lawful bases of contractual obligation and legitimate interest – complying with General Data Protection Regulation (GDPR) and the Privacy and Electronic Communications Regulation (PECR) – based on the following conditions: we are fulfilling our contractual obligations to you; we are fulfilling something you have asked us to do prior to entering into a contract with us (e.g. a vehicle/servicing quote); contact details are obtained during a sale (or negotiations of a sale) of a product or service; we will only market our own similar products or services; we will only be contacting you on timescales that you might reasonably expect to be contacted in; we provide a simple opportunity to refuse or opt-out of the marketing when information is first collected, and in every subsequent communication.

Lawful basis for processing your personal data

Depending on the processing activity, we rely on the following lawful basis for processing your personal data under the GDPR:

• Article 6(1)(b) which relates to processing necessary for the performance of a contract.

• Article 6(1)(d) in order to protect your vital interests or those of another person.

• Article 6(1)(f) for the purposes of our legitimate interest.

• Article 6(1)(c) in compliance with a legal obligation.

We have categorised our data processing into the following sections – and outlined when communications could be received. It is our duty to ensure that data processing does not fall outside of these parameters. We believe this policy demonstrates how you might reasonably expect your data to be processed in the following ways.

Under the principles of accountability and transparency we would like to outline below the many ways we process individual data.

Toomey Motor Group respects your rights, which include:

• your right to object to processing;
• your right to restrict processing;
• your right to complain to the ICO via www.ico.org.uk/concerns;
• your right to be forgotten;
• your right to make subject access requests;
• your right to data portability; and
• your right not to be subject to automated profiling and decision making.

The right to object and right not to be subject to automated profiling and decision making does not apply when we are using the lawful basis of contractual interests; and the right to data portability does not apply under the lawful basis of legitimate interests.

You can access our processing objection/restriction form at any point by visiting:

https://www.toomeymotorgroup.co.uk/contact-preferences

Toomey Motor Group consists of multiple trading franchises – each identified as separate legal companies. We make every reasonable effort to ensure that all of our records are accurate and not duplicated. We also make sure that we are clear about how we will process your personal information depending on how you interact with our businesses. We have displayed our privacy policy and contact preferences URL on all available correspondence or mediums that may be in contact with you so that you can rectify your records or update your communications preferences.

Please note that we have different parts of the business that will need to process your data in different ways. For example fulfilling a sale or service obligation to you will be covered by a different lawful basis to sending you relevant promotional materials. We believe we are processing your data in a fair and transparent manner and have made it as simple as possible for our customers to control how we communicate with them. 

Please be aware that if you have previously had all of your details removed from the Toomey Motor Group system but then get back into contact with us then you will need to visit our contact preferences URL above to let us know how to use your new record moving forwards as this will count as a new customer and be subject to the following policy.

Toomey Motor Group operates as several different legal entities - and where most of these operate independently it is sometimes necessary to facilitate the sharing of personal data relating to customers between the parties - therefore acting as joint data controllers. The correct agreements between the different entities have been put in place to ensure that any personal data sharing is done in the most responsible way and in compliance with national data protection laws. The type of information shared in this manner is described in the section below - it is the same as the type of information we collect from our customers. This purposes of this information being shared is to operate our daily sales and servicing of vehicles with the highest level of efficiency for our customers - as a multi-branded business some of the motor group staff require supervisory access to several entities.

 

What information do we collect?

We collect information about you and your vehicle when you use our website; call our contact centres; and when you visit us on site. We collect any combination of the following pieces of information:

1. Name (including title);
2. Home address;
3. Phone number;
4. Date of birth;
5. Email address;
6. Vehicle information (including registration number, VIN, service reminders, mileage and warranty repair information);
7. The date and time you used our services;
8. Dashcam recordings and in car audio’ for test drives. 
9. The pages you visited on our website and how long you visited us for;
10. Your IP address;
11. Your GPS location (where you have permitted access to this);
12. The internet browser and devices you are using;
13. Cookie, Pixels or Beacon information (for more information please see our Cookie Policy);
14. The website address from which you accessed our website;
15. Details of any transactions between you and us;
16. When you engage with us in a business context, we may collect your job title, company contact details (including email addresses), fleet size and company details;
17. Voice recordings of calls you make to our customer service centre (for more information please see our Call Recording Policy);
18. "Live chat" records; and
19. Any information within correspondence you send to us. 
20. Photographs of vehicle handovers for social media.
21. Passport and driving licence information; including where necessary copies of this identification.

How do we use this information?

We will predominately be using the lawful basis of contractual obligations to fulfil your requests – along with legitimate interests in some categories. We believe we can demonstrate that we are fulfilling our contractual obligations to our customers; our customers would reasonably expect to be contacted in the following ways; that it is within our commercial interest to keep in contact with our customers in the following ways; and that our customers can object to this processing at any time.

We will use your information to fulfil any request you have with us. Where you have made enquiries about our services; purchased something from us; or had a repair with us; we will assume your implied consent to receive information about promotions, events, products, services or information from our various departments that are relevant to your enquiry or purchase. This applies to the use of our online forms or services we provide via our website - for example vehicle valuations or motor credit checks. 

To fulfil our legitimate interests or as part of our contractual obligation your information is also shared with several third-party partners who act in tandem with our business - we will outline all the details of these companies in this policy.

We may from time to time use part or the entirety of a review from our customers in public forums - where it has previously been left on review forums such as TrustPilot. This will only be associated with the customers name - and has been left on review forums such as TrustPilot after receiving an invitation to do so, and is deemed acceptable to share these reviews on social platforms according to the prevailing terms and conditions of these third parties. The review and name associated with the review will be retained on our internal digital files for 12 months before being deleted. The review on TrustPilot will be retained in accordance with the TrustPilot privacy policy.

We may also with permission be capturing photographs of customers collecting their vehicles - for our promotional purposes on social media platforms. These documents are permanently deleted once they have been uploaded.

We use your information for various purposes including accounting, billing and audit, credit or other payment card verification, fraud screening, event organisation, customer satisfaction reviews. safety, security and legal purposes, statistical and marketing analysis, systems testing, maintenance and website development. We also collect your personal data for the detection and prevention of crime purposes, when you visit our premises, and we capture your image on our CCTV systems.

We process your personal data, in accordance with our obligations under applicable data protection laws and regulations. Accordingly, we will not sell, distribute, or lease your personal data to any third parties unless it is necessary for us to fulfil our obligation to you, we have your permission to do so, or we are required to disclose your information by law with competent authorities e.g. the police, or regulatory bodies e.g. the ICO.

Processing necessary for us to fulfill your requests in sales and aftersales - contractual obligations

This section refers to Toomey Motor Group fulfilling the requests you make to us (ie test drives, service requests, brochure requests, vehicle enquiries, quotations). This also refers to us providing vehicle support and services (eg warranty; servicing; MOT). We will use the information you provide to do this. Depending on your relationship with our company (ie if you enter a customer relationship with us) your information may then be processed further as outlined below).

Toomey Motor Group records enquiries for Sales and Aftersales services. Enquiries can be made face-to-face; digitally (online forms); or on the phone. Sales-related enquiries are processed in a system called Dealerweb; service-related enquiries are processed in a system called ADP/MDF. It is our duty to use this information to fulfil your request with us ie booking a service or making a sales appointment – this may involve you being contacted via a phonecall; email; or SMS, and you will be contacted by the department responsible for fulfilling your request. On occasion (sales only) your data will be temporarily processed in a Google Sheet in conjunction with being formally recorded on Dealerweb during specific marketing campaigns – in order to provide quick and convenient access to the staff and management involved in the processing and success of the campaign. This information will be permanently deleted once it has been fully recorded on Dealerweb. Our executives will attempt to contact you to fulfil your request, but after 12 months of no contact we will assume you no longer want to be contacted for this initial request (sales/service). We may retain your details with your implied consent in order to contact you about other relevant products or services.

If your enquiry is no older than 12 months we may send you information that will be relevant to the brand/products you have been discussing with our business – with your implied consent – this information may be via SMS, phone; email; or post.

Once you become our customer our contractual obligations to you are extended in the following ways:

You may be contacted periodically into your sale with Toomey Motor Group by one of our sales executives to make sure you are happy with your purchase – a courtesy call. This contact may be via SMS, phone, email, or post.

You may be contacted towards the end of your sale by one of our sales executives in order to check what your next steps might be and if you would like to re-engage with Toomey Motor Group for your next purchase. This contact may be via SMS, phone, email, or post.

Your relationship with our sales department after you become one of our customers may involve regular contact with our teams to discuss your purchase and future options with us – as part of our contractual obligations to you.

In the same way, we also have a contractual obligation to our aftersales customers to keep them informed about the status and health of their vehicle in the form of MOT reminders; service reminders; recall notices. Your details are stored on our system (ADP) - these details are also sent to a management software for service/MOT reminders (MDF). These details are used to process your request and/or remind you of any upcoming repair work you may have with us. This contact may be via SMS, phone; email; or post.

Processing necessary for us to provide our customers and drivers with the best possible information and service - legitimate interest

1. Enquiry Stage Only

Toomey Motor Group does record your data if you have booked a service and then cancelled. This data is not processed in any other way other than to fulfil the booking. This data will be retained for 12 months. See section 2 below for details on further processing when somebody becomes one of our service customers.

Toomey Motor Group does record and store your data when you have enquired about purchasing a vehicle/having a test drive with us but have not yet purchased a vehicle. This data is stored in Dealerweb as is common practice in the Automotive Industry. We believe it is reasonable for our executives to attempt to contact via phone, email or SMS before closing your enquiry down from further processing – under our contractual obligations to fulfil your request.

Test drives may include the vehicle being equipped with front and rear dashcams that record the entire test drive, including speed, g-force, and in-car audio.

2. Customer Stage Only

If you have been in contact with us for a repair in the last five years we may process your data in order to provide you with relevant products and information. This information will only be relevant to the vehicle brand/service you are interested in and will not be processed outside of the range specified above. This contact may be via SMS, phone; email; or post.

If you are an existing sales customer you may be provided with products and information after your sale. This information may be provided via SMS, phone, email, or post. You will only be contacted in a reasonable time period. You will only receive information related to the products/brand you have shown an interest in. You will not be contacted in this manner 5+ years after your sale. At the point you have not engaged with our sales or service departments for 5+ years your data will be removed from our systems - see section below on ‘How long do we hold your data for?’. Toomey Motor Group is currently making all reasonable effort to ensure our existing database complies with this policy on data retention – and updates will be made to inform our customers when this is complete.

Processing necessary for us to respond to understanding our customers’ and drivers’ needs 

You may receive online advertising through digital platforms operated by other companies ie Google and Facebook. This will be because those platforms have identified you as a member of the advertising audience that we are targeting. This is not based on any personal details we hold and does not lead us to be able to identify you as an individual from the data these applications generate.

We may be able to identify when you have received, opened or engaged with electronic communications sent by us – this data is used for marketing effectiveness analysis and is retained for 12 months.

Full details of the applications and cookies used in this section will be outlined in this policy.

Processing necessary for us to operate the administrative and technical aspects of our business efficiently and effectively

We may use your information to contact you and check the accuracy of this information to create a better understanding of you as our customer. We have a responsibility to maintain accurate and up to date records.

We will process your data for network and information security purposes i.e. in order for us to take steps to protect your information against loss, damage, theft or unauthorised access; 

We will use your information to comply with a request from you in connection to your data rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this on our suppression lists in order to be able to comply with your request) 

We will process your information to inform you of updates to our terms and conditions and relevant policies. 

How do we share this information?

We do not sell your information to any third parties. Your information is sometimes disclosed/visible to the following types of company who handle services on our behalf or manufacture the vehicle you own: roadside assistance service providers, customer contact centres, mobility and car hire providers, direct marketing communications agencies and consultants, market research and market analytics service providers, review providers, our legal and other professional advisors. 

We have adopted a risk-based approach to our third parties – where we will hold a signed agreement from them or are satisfied with their privacy policy – to ensure that they understand their responsibilities with your data. We ensure that they only use your data for the purpose we have specified and that the data is only retained for as long as necessary to fulfil the processing we have asked them to do. We only disclose personal information that is necessary for them to provide the service they are undertaking on our behalf. These third parties are forbidden from selling any of our customer data or having it processed by anyone else.

We have connections to several financial service providers and brokers as a Dealership – and information is passed to them at point of vehicle registration. In the agreement you sign with them it will outline that they are a data controller at point of collecting your details. As such they become a separate data controller to Toomey Motor Group with their own separate consent and privacy notice. We will occasionally act as a processing agent on their behalf by being sent data from these companies. This process is independent of your contact preferences with Toomey Motor Group and any updates you wish to make must be communicated directly to them. 

We may from time to time receive personal data directly from the manufacturers we represent - not from the financial service providers working alongside them. In these instances Toomey Motor Group and the Manufacturer are identified as separate data controllers and each are satisfied that they can process this personal data under their own policies. 

We cannot do everything ourselves, so often we need to share your personal information with trusted third parties who have the skill, experience, and expertise to deliver the goods or services you need or to provide you with the services or information you have requested.

Our third parties:

The organisations that we work with can be categorised into: vehicle manufacturers; providers of vehicle sales, servicing, organisational and administrative automotive software; social media marketing; Google marketing; organisational software; direct marketing; event organisation; customer satisfaction reviews; digital sales tracking; website development; printed media; roadside assistance service providers; vehicle recovery and repair specialists; financial service providers; insurance providers; courtesy vehicle insurance providers; mobility and car hire providers; legal and other professional advisors.

We share your personal information with the third parties listed below for the reasons stated:

• Shopify. We use retail systems provided by Shopify in our Online Parts and Accessories Shop. You can view Shopify’s privacy policy here:

https://www.shopify.com/legal/privacy 

• DHL. We use DHL as our delivery agent. You can view DHL’s privacy policy here:

We may also share your personal data with other parts of Toomey Motor Group Limited.

Locations of processing

Your personal data is primarily processed on our servers located in the UK. However, some of our service provision, such as online reservations, payments, customer reviews and marketing, requires your personal data to be transferred outside of the European Economic Area (EEA). In such circumstances, if your information needs to be sent to a country that has not been granted a finding of adequacy by EC, we will only transfer your data using ‘appropriate safeguards’ i.e. Binding Corporate Rules (BCR) or Standard Contract Clauses (SCC) (also known as Model Contract Clauses) etc., or we will seek your consent, on a case-by -case basis, where appropriate to do so.

How long do we retain your information? 

We do not retain your personal information in an identifiable format for longer than is necessary. If we have a relationship with you (e.g. you are a customer or the registered driver of a leased or other vehicle purchased from us; or have engaged in vehicle repairs with us) we hold your personal information for 5 years from the date our relationship ends. We hold your personal information for this period in case we need to establish, bring or defend legal claims. Our relationship may end for a number of reasons including where the vehicle warranty or lease expires, or we have been made aware that you no longer own or drive that vehicle. This includes our Motability Customers. The type of data stored in this manner is comprised of name; email; address; telephone; vehicle; finance proposal; contact history; date of birth; registration. This information is stored as records in our Automotive Logistic System ADP Autoline and in our Sales Management System Dealerweb. A report will be run at the end of each year to determine what records are beyond the five year mark and have not been edited - and these will be deleted. From this it may be possible for a record to reach a retention period of 5 years, 11 months and 30 days - but this will be the maximum. Our Dealerweb Sales system will also retain documents associated with vehicle appraisals; demo forms and financial compliance for five years in line with the delivered customer retention period outlined above. 

Communications made with customers and potential customers within our Dealerweb Sales System for example letters; emails and texts will be retained for the minimum period that the system allows - being three years.  

Where we have obtained your personal information following your request for information, a test drive, brochure, quotation or any other information on any of our products or services, we may hold your personal information for 12 months from the date our relationship ends, unless during that period you extend your relationship with us e.g. you purchase or lease a vehicle; or engage with our repair services, in which case we will retain your information during your relationship with us, and for 5 years after that relationship ends. This includes our Motability Customers. Customer vehicle sales data is stored in ADP and Dealerweb - customer vehicle service data is stored only in ADP. The type of data stored in this manner is comprised of name; email; address; telephone; vehicle; finance proposal; contact history; date of birth; registration. This section also applies to vehicle quotes that have not been ordered - these will be retained for 12 months.

Our executives will attempt to transact your enquiry within 90 days where possible - but in some cases you may be contacted outside of this window if our executives are maintaining contact with you in order to fulfil your request. When you or a Toomey Group employee closes down the enquiry it will then enter the 12 month retention period mentioned above.

On occassion a customer order for a vehicle will be unsuccessful for multiple reasons - the hard copy files for these will be responsibly destroyed at this point. The customers personal details will still be retained as the enquiry stage in Dealerweb for the established 12 month retention period from the point our relationship ends.

We retain records of our marketing data processing for 5 years.

The only exceptions are where: 

the law requires us to hold your personal information for a longer period, or to delete it sooner; 
Where you have raised a complaint or concern regarding a product or service offered by us, in which case we will retain your information for a period of 7 years following the date of that complaint or query; or 
you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law 
 

How can you access the information we hold about you?

We have tried to make this process as simple as possible – by creating an online form for you to submit a request to us that will be recorded for verification purposes. You can do this as many times as you want to keep your records as accurate as possible and we encourage you to do so. Remember to let us know as many details as possible about the pieces of information you may have given us in the past to process your access requests – for example if you have given us two phone numbers and would like both of them removed – let us know. 

https://www.toomeymotorgroup.co.uk/contact-preferences

You have the right to opt-out of receiving any communication from us. In support of this we are currently in the process of making the above URL available on all of our correspondence with you.

You have the right to tell us to make corrections to the data we hold on you, if necessary. You have the right to ask us to erase information we hold about you and you can object to us using your personal information, unless we have a legal reason that we cannot erase or stop using your information.

You have the right to data portability to another organisation where we do not rely on our legitimate interests for the processing.

In relation to most rights, we will ask you for information to confirm your identity and, where applicable, to help us search for your personal information. Except in rare cases, in which case we will let you know as soon as possible, we will respond to you within 28 days after we have received any request. 

Data Security

We take the security of all the data we hold seriously. Relevant staff are trained on data protection, confidentiality and security.

We have a framework of policies and procedures which ensure we regularly review the appropriateness of the measures we have in place to keep the data we hold secure.

All information you provide to us is stored on our secure servers.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent un-authorised access.

Use Of Cookies

Cookies are small text files placed on your computer when you browse a website. In common with many other websites, Toomey Motor Group may use cookies for a variety of purposes. Toomey Motor Group may use 'first party cookies' in a general way, to gauge use of our website and measure response to our publicity and site usage. Toomey Motor Group may use the same cookie for more than one purpose. For example, to understand the effectiveness of a campaign a cookie may be used to measure media responsiveness and site navigation. Toomey Motor Group will not use data from which you can be individually identified in conjunction with data tracks general user behaviour.

Most browsers are set to automatically accept cookies and if you're using Microsoft Internet Explorer, Mozilla Firefox, Safari or Google Chrome you should be able to configure your browser to restrict or block cookies, or you may wish to delete them.

Please note that should you block all cookies, you may not be able to use some of the forms and other functionality on this website. If you block our tracking cookie only, your use of our site during a session should not be affected.

Complaints

We hope that you won’t ever need to, but if you do want to complain about our use of personal data, please send an email with the details of your complaint to data@toomey.uk.com. We will look into and respond to any complaints we receive.

You also have the right to lodge a complaint with the UK data protection regulator, the Information Commissioner's Office ("ICO"). For further information on your rights and how to complain to the ICO, please refer to the ICO website https://ico.org.uk/concerns

Data Controller and Contact Information

The data controller for Toomey Motor Group is Laindon Holdings Limited, our parent company.

If you have any questions about this privacy statement or how and why we process personal data, please contact us at data@toomeymotorgroup.co.uk

Changes to our privacy statement

Updates to this privacy statement will appear on this website.  This privacy statement was last updated on 06/07/21

Manufacturer Privacy Policies:

https://www.renault.co.uk/privacy.html

https://www.nissan.co.uk/gdpr.html

https://www.vauxhall.co.uk/tools/privacy-policy.html

https://www.peugeot.co.uk/privacy-policy/

https://www.citroen.co.uk/privacy

https://www.dsautomobiles.co.uk/privacy

https://mg.co.uk/privacy-policy/

https://www.dacia.co.uk/legal-and-privacy.html