Privacy Policy

The Company:

Vansco Ltd Group provides vehicle sales and contract hiring services for business customers. We are fully committed to meeting our customers' expectations of privacy and respect when processing their personal information and providing transparency about how it is used and shared. We have established procedures to enable compliance with the UK General Data Protection Regulations 2018.

Data controller and contact information

The data controller is Vansco Limited. If you have any questions, comments or requests regarding this Privacy Policy, please feel free to contact us at:

Data Protection Officer (DPO) Vansco Limited, Senior Service Station, Romsey Rd, Cadnam 5040 2NN Tel: 02380 813 119

Purposes and lawful basis for processing personal data

We will collect, process, use and store your personal data that you have voluntarily given us by entering information via our websites or our social media pages or by corresponding by phone, email or otherwise. This includes:

a) your name, b) contact details (address, phone number, email address) and c) financial details (credit card, bank sort code, debit card number and account number) as necessary and lawfully processed in the course of supplying vehicles, goods and services to you and to manage our relationship with you, in the following ways:

Processed under the lawful basis of Consent, where:

• you have given consent to receive marketing communications from us, we will collect information concerning your marketing preferences and send you communications based on those preferences.
• you have requested us to contact you via email, text message, post or telephone with marketing information about Vansco Limited's range of services.

Our policy is to obtain consent which is freely given and not to use 'cookie' acceptance walls or pre­ ticked boxes on Vansco's web pages, or infer your consent through silence, or inactivity by an individual contacted. It will also be separate (unbundled and not a pre-condition of a service provided) from other terms and conditions, and we will support simple ways for people to withdraw consent.

Processed under the lawful basis of Legal Obligation:

• We will use your personal information to comply with our legal obligations including: a) for invoicing and accounting purposes, which are required to assist HMRC, the Police, Driver & Vehicle Licensing Agency, or any other Public Authority or criminal investigation body; b) to establish, bring or defend legal claims; c) to identify you when you contact us and; d) to verify the accuracy of data that we hold about you. e) to help us detect and prevent money laundering

Processed under the lawful basis of Contract:

• When you enquire about or purchase a vehicle, goods or contract hire services from us, we will collect your personal information to enable us to respond to your enquiry and form a contract with you in order to process and complete your purchase.
• We will process and share payment card data with approved payment card companies to include primary account number, cardholder name, service code, expiration date.
• When you enquire about purchasing a vehicle on finance, we will collect information to enable third parties to provide finance quotes and agreements before entering into a contract with you.
• To exchange information for servicing/maintenance, or warranty (you will have entered into a separate agreement for this).

Processed where it is in your Vital Interest

• We may use your personal information to contact you if there is an urgent safety notice or vehicle recall to communicate to you or where we otherwise reasonably believe that the processing of your personal information will prevent or reduce any potential harm to you. It is in your vital interests for us to use your personal information in this particular way.

Processed where there is a Legitimate Interest

We will use and process your personal information where it is entirely necessary for us to pursue our legitimate interests as a business for the following purposes:

• for the prevention of fraud and other criminal activities;
• to correspond and communicate with you;
• for network and information security in order for us to take steps to protect your information against loss or damage, theft or unauthorised access;
• to comply with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes;
• to enforce or protect our contractual or other legal rights or to bring or defend legal proceedings and;
• for general administration including managing your queries, complaints, or claims, and to send service, MOT and accumulated Mileage reminders to you.
• to bring or defend legal claims to enable us recover debts due to us by you

Who we will share your personal data with

We do not share your data with any other third parties except where:

• you have expressly given your consent.
• it is necessary to enable the provision of third party services you have requested (for example to facilitate warranty, insurance or finance quotes or agreements).
• we are under a duty to comply with any legal obligation.

We will share your information with other companies within the Vansco group;

• They will only use your personal information in the ways already set out in this policy, in connection with other services that complement our own.
• Where telematics software (e.g. tracker) is installed in a vehicle, the telematics services provider will share vehicle data with Vansco in order to satisfy internal asset audit requirements concerning vehicle mileage allowance tracking; all such personal data collected is protected by secure VPN network from the provider and we will not share any other telematics data with a third party.

Third party recipients of your data

Data processors are third parties who provide elements of our business management services for us, who process or store personal data on our behalf. The categories of these recipients are accounting, marketing, software, and website providers.

• We have contracts in place with our data processors to ensure they are looking after your data to GDPR standards, which means they cannot use, share or do anything with your personal data unless we have instructed them to do so.

Vehicle documents

• We can show, albeit briefly, a vehicle's registration document (form VSc) which accompanies a vehicle when it is taken into stock to a potential buyer to support the provenance of the vehicle, however;
• We will not reveal any previous owners personal information shown on the VSc (3) form
• We will not provide any potential buyer of your vehicle or hand to a new owner any other documents pertaining to the vehicle if in doing so will provide personal information in an identifiable format concerning other individuals. Owner's handbooks are an exemption.

Retention periods

• Unless otherwise stated, your personal data will be kept for a period of 7 years, except where you have purchased a product and the transaction is regulated by the FCA, which will then be 10 years from the date you bought that product.
• We do not retain personal information in an identifiable format for longer than is necessary.
• Personal data processed under consent will be kept for as long as you consent to its processing. We will seek to refresh your consent at appropriate intervals.

Your rights regarding your personal data

• By law you have certain rights in regard to your personal data we hold, which you should be aware of.

The law gives you certain rights in respect of the personal data that we hold, which you should be aware of:

• You have the right to ask for a copy of the information that we hold about you by emailing or writing to us at the address at the end of this policy. We may not provide you with a copy of your personal information if this involves other individuals or we have another lawful reason to withhold that information. Where we provide it, the first copy will be free of charge, but we reserve the right to charge a small fee for additional requests.
• You have the right to require us to rectify any inaccurate personal data we hold concerning you.
• Taking into account the purposes of the processing, you may also have the right to have incomplete personal data completed, by means of providing a supplementary statement or otherwise.
• You have the right to require us to erase your personal data on certain limited grounds (including where they are no longer necessary for the purpose for which they were collected or where you withdraw your consent and there is no other legal ground for the processing).
• Where we process personal data either on the basis of consent or contractual necessity, you provided the personal data to us or we process that personal data by automated means, you have the right to require us to give you your data in a commonly used electronic format.
• You have the right to object to our processing of personal data which we process on the grounds of our legitimate interests, although we do not always have to honour your objection. For more information see the section above titled "Withdrawing your consent and/or objecting to our processing".
• You have the right to require us to restrict the processing of your personal data on certain grounds, including where:
• you contest the accuracy of the personal data and want us to restrict processing of your personal data while we verify its accuracy;
• the processing is unlawful, but you request a restriction of the processing rather than erasure;
• we (as controller) no longer need the data for the purposes of the processing, but you have told us you require us to retain that personal data for you to establish, exercise or defend legal claims; or
• you have objected to us processing your personal data on grounds of legitimate interests and want us to restrict processing of your personal data while we consider your objection.
• We will respond to you within 30 days after we have received this information or, where no such information is required, after we have received your request.

If you would like to exercise any of these rights, please contact us using the contact details at the top of this policy.

Right to withdraw consent

• Where we have processed your personal data on the lawful basis of consent, you have the right to withdraw this consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Erasing your personal information or restricting its processing {The right to be forgotten)
• In certain circumstances, you may ask for your personal information to be removed from our systems without undue delay, by emailing or writing to us at the address at the end of this policy. Unless there is a reason that the law allows us to use your personal information for longer, we will make reasonable efforts to comply with your request.

You may also ask us to restrict processing your personal information in the following situations:

• where you believe it is unlawful for us to do so, .
• you have objected to its use and our investigation is pending or you require us to keep it'in connection with legal proceedings.
• In these situations, we may only process your personal information whilst its processing is restricted if we have your consent or are legally permitted to do so, for example for storage purposes, to protect the rights of another individual or company or in connection with legal proceedings.

Right to complain

• If you have any concerns about how we have handled your personal data, please contact us in the first instance so that we may address them.
• You also have the right to lodge a complaint with the supervisory authority, (the Information Commissioner's Office) online at Information Commissioner's Office, about how we manage your data.

Provision of data

• In most cases, you will have voluntarily provided us with your personal data to enter into a contract with Vansco to enable us to provide you with our range of services as necessary.
• We will automatically collect personal information from our web servers which store details of your browser and operating system, the website from which you visit our website, the pages that you visit on our website, the date of your visit, and, for security reasons, e.g. to identify attacks on our website, the Internet protocol (IP) address assigned to you by your internet service. We collect some of this information using 'strictly necessary cookies' (small pieces of information sent to your device and stored on its hard drive to allow our websites to recognise you when you visit, and to track you as you move through the site and are deleted once a user closes the browser). We may also collect any personal information which you allow to be shared that is part of your public profile on a third party social network.

CCTV

Our policy is to use CCTV cameras which are installed at our Customer Centres. Video and audio recordings of you will be made when you visit one of these centres.

Fixed, external cameras are positioned to capture the optimum surveillance images without overlooking spaces that are not intended to be viewed. Their presence is clearly identified by GDPR compliant signage which includes a statement of the purpose of the camera and contact details where data privacy information on their use can be obtained

How we use the data: We use this information to protect you, other customers, our property and our team. If there is a safety incident, accident or a crime, we will view the footage to investigate, and share it with relevant authorities.

Legal basis: We use CCTV surveillance to enhance security, health & safety and to protect our business interests in accordance with our CCTV Policy. This interest isn't outweighed by your rights or any negative impacts on you.

Transfers of personal data to third countries or international organisations

General principles of transfer

• In the event that your personal information can be transferred outside of the UK, we wil( take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this policy. These steps include imposing contractual obligations in the form of non-negotiable Data Protection Agreement (DPA) using Statutory Contractual Clauses (SCCs) which are standardised and pre-approved contractual clauses ensuring the protection of personal data when it is transferred to non-adequate third countries (e.g. USA). UK SCCs have been approved by the Information Commissioner's Office (the data protection regulator in the UK) for transfers of UK personal data.

Information security

Vansco Limited use technical and organisational security measures to protect the personal information supplied by you and managed by us against manipulation, loss, destruction, and access by third parties. We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

In the interests of transparency, however, we should advise however, that no method of transmission of information over the internet or electronic media platforms is 100% secure, we therefore cannot guarantee the security of your information whilst in transit to our website and any transmission is at your own risk.

Changes to this policy

• We will review this policy where legislation is changed and any changes will be notified to you by posting an updated version on our website and/or by contacting you by email.
• If you do not agree with any aspect of the updated policy, you must promptly notify us and confirm your request to withdraw your consent and cease using our services.
• This UK GDPR policy was last updated in November 2022.

Data Protection Registration

Vansco Ltd are registered with the Information Commissioner's Office-Registration No: 23466829