We are SOC 2 certified, and we have put in place appropriate security measures (including SSL and SMB technology and dual-factor authentication) to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Please contact our IT security team using the email if you require further information on our Security Policy and for the specific security measures we have in place.

DATA RETENTION

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

• Where we have entered into an agreement with you, we will generally retain your data for a period of 6 (six) years after a contract has ended, to ensure that we are able to assist you should you have any questions or feedback in relation to our vehicles and/or Finance Packages or to protect, or defend our legal rights, or for tax purposes.
• Where we have processed your personal data to provide you with marketing communications with consent, you will be regularly given the option to opt out of such marketing. If you tell us that you no longer wish to receive such communications, your personal data will be removed from our marketing lists (but will be added to a “do not contact” list).
• Where you have applied for a Finance Package with us but your application does not proceed, we will hold the data you have provided as part of that application for three (3) years from the date of the application withdrawal.
• Where you exercise your right to withdraw from an agreement with us within the first 14 (fourteen) days, we will hold your data for three (3) years from the date of withdrawal.
• Where we have processed your data for any other reason (such as where you have contacted us with a question in connection with services or in relation to recruitment), subject to the remainder of this section (‘ DATA RETENTION ‘), we will retain your data for 12 (twelve) months.

In some circumstances you can ask us to delete your data; please see section ‘ Request erasure of your personal data ‘ under ‘ YOUR LEGAL RIGHTS’ for further information.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

YOUR LEGAL RIGHTS

Under certain circumstances, you have rights under data protection laws in relation to your personal data. These rights are detailed below:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.