We will only collect information from you that is necessary for the relevant processing activities but is likely to include the following (although the list is not exhaustive):

• Name
• Postal address
• Previous postal addresses
• Email address
• Mobile number (personal and/or work)
• Landline numbers (home and work)
• Bank account information
• Employment information (for finance applications)
• Date of Birth
• Nationality
• Photo ID (including passport and driving licence)
• National Insurance Number
• Vehicle details
• Purchase history
• Social media logins/identifiers

We may also receive this information about you from other sources such as:

• Feedback, such as ratings or compliments
• Through our business partners, such as payment providers, social media services, apps and/or websites
• Insurance administrators or providers
• Finance companies and/or credit brokers
• Financial service providers
• Partner transportation companies
• Publicly available sources
• Marketing service providers
• Manufacturers
• Vehicle Brokers and/or Introducers

Special category data

We only collect special category data in very limited and specific circumstances, such as processing an order through Motability or identifying you as a vulnerable customer. If we do need to collect special category data we will obtain your explicit consent to process this information.

Special category data is defined as personal data relating to an individual’s:

• Race or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data
• Health
• Sex life or sexual orientation

Similar extra conditions and safeguards also apply to the processing of the personal data relating to criminal convictions.

You are likely to provide personal information to us in a number of circumstances which will include the following:

• When you make an enquiry at the dealership to us about a new or used motor vehicle, van or motorcycle
• When you talk with us on the phone, calls may be recorded and notes taken
• In emails and letters
• In customer surveys
• If you take part in competitions or promotions
• When you use our websites, mobile devices, apps, web chat or other digital services
• When you take a test drive or are provided with a courtesy vehicle
• When you visit one of our dealerships and you feature in our CCTV footage
• When you place an order for a new or used vehicle, van or motorcycle
• When you make an enquiry or booking relating to a service, MOT, vehicle repair or similar
• When you wish to apply for finance through us. In acting as a credit broker we provide information to third party finance companies who may conduct searches with a credit reference agency or other organisation before deciding on your application
• When you decide to purchase one or more regulated insurance products through us. In acting as an ancillary insurance intermediary, we provide information to the third party claims administrator and/or insurance undertakings who will administer claims and/or underwrite the policies
• When you decide to purchase one or more non-regulated add-on-products such as paint protection and/or accessories and when acting as an intermediary, we may provide information to a third party in order to provide the product, accessory or service to you
• When you are entitled to a manufacturer’s warranty and/or other manufacturer benefits and in order to receive the benefits under the warranty or other products it will be necessary to provide your information to the relevant manufacturer
• When you make an enquiry or place an order for other goods and services that we offer such as parts and other similar products
• When you make a post-sale enquiry or want to make a complaint or otherwise provide us with feedback or information
• When you respond to an advertisement or other promotional communication that we issue or send to you.

MMG collects and uses information to efficiently process the sale and supply of new and used motor vehicles to our customers and in the provision of aftersales services. You are not under an obligation to provide this information; however, we may not be able to offer our services to you without this. We carry out a range of processes and procedures connected with the effective and efficient running our business. We can only use your personal information for these purposes if we have a proper and lawful reason for doing so. This is known in data protection law as a ‘lawful basis’.

We use the following lawful bases in the course of our business:

• Contract
• Legal Obligation
• Consent
• Vital interests (i.e. to safeguard against serious harm)
• Legitimate interests

1. Performance of a contract

We may use and process your personal information where it is necessary for the negotiation or performance of a contract with you for the following purposes:

• for the purchase of a motor vehicle
• for the purchase of our paint protection product, the Marshall Care Warranty and other similar products and accessories
• for service plans, MOT, vehicle repairs and other similar after-sale products and services
• to enable transportation, delivery and other related services including the collection and delivery of your vehicle at point of sale or in connection with our after-sale services
• to process or facilitate payments for goods and services including the management of customer payments and refunds
• for the provision of third party breakdown services by our breakdown provider.

2. Compliance with legal obligations

We will use your personal information to comply with our legal and regulatory obligations which may include:

• providing information to the DVLA to register vehicles
• compliance with our regulatory obligations with the Financial Conduct Authority
• compliance with our regulatory obligations with the Information Commissioner’s Office
• compliance with money laundering and similar legislation
• to comply with our regulatory obligations with all other regulators such as the Trading Standards Service
• to verity your identity when you contact us
• to verify the accuracy of the information we hold on you.

3. Consent

When you have provided consent, we may use and process your personal information for the following purposes:

• to return calls, text messages, emails and other similar communications that you have specifically requested from us
• to supply brochures and other marketing material you have specifically requested from us
• to contact you via email, text message, post or telephone with marketing information about our vehicles and other products and services
• to carry out organised marketing campaigns including competitions, promotional events and special offers
• to arrange finance, insurance and other non-regulated add-on products and accessories for you
• to share your personal information with our authorised manufacturers, finance companies and brokers, insurance administrators and/or our recommended third party partners for them to contact you with marketing information about their products and services. You can find a list of these partners at the end of this Privacy Notice.
• You have the right to withdraw your consent at any time.

4. Vital Interests

We may use your personal information to contact you if there are any urgent safety or product recall notices to communicate to you or where we reasonably believe it is necessary to prevent or reduce any potential harm to you. It is in your vital interests for us to use your personal information in this way.

5. Legitimate Interests

A legitimate interest is when we have a business or commercial reason to use your information. You have a right to object if we rely on our legitimate interests and we have a duty to properly consider that objection.

We may use and process your personal information where it is necessary for us to pursue our legitimate interests as a business and/or you as a customer for the following purposes:

• to provide customer support, after-care and dispute resolution
• to assess your eligibility for insurance products and their suitability for you
• to provide you with reminders regarding your vehicle such as when your vehicle is due to have a service or MOT
• to notify you in relation to MOTs, services and other general vehicle safety related matters that we are or become aware of
• to manage our relationship with you and our business partners
• to contact you during the term of your finance agreement to discuss renewal, voluntary termination, balloon payments, early settlement and the options available at the end of a finance agreement (including Personal Contract Purchase) and similar financial or hire products
• for the purposes of corporate restructure or reorganisation or sale of our business or assets
• to undertake and process credit checks in relation to finance
• to communicate and correspond with you
• to prevent, detect, investigate and report fraud, money laundering and other financial crime
• to improve our customer service delivery and the overall customer experience
• to enable you to purchase and register a new or used vehicle with the DVLA
• to enable better communications between us and our customers and any related third party
• for the efficiency, accuracy or other improvements of our databases and systems such as the combination of systems or consolidating records we or our group companies hold about you
• for network and information security purposes in order for us to take adequate steps to protect your personal information against loss or damage, theft or unauthorised access
• to provide, personalise, maintain, recommend and improve our portfolio of add-on products and services
• to conduct data analysis, testing and research and to monitor and analyse usage, vehicle interest and activity trends
• to understand and collect your marketing preferences
• to improve our marketing and promotional activities
• for research and analysis purposes including profiling to inform our marketing strategy
• for general market research in order to continually improve the products and services that we offer and deliver to you
• for the administration of our websites and for internal operations, including troubleshooting, testing and statistical purposes
• for compliance with an express request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this on our suppression lists in order to be able to comply with your request)
• to exercise our rights set out in agreements and contracts and in connection with the performance of contracts
• to collect and recover money that is owed to us
• to respond to, enforce or protect our contractual or other legal rights or to bring or defend legal proceedings
• to assist the police and other public authorities with their enquiries and/or investigations
• for the general administration of our business including processing orders, conduct credit-broking and insurance mediation activities, managing your queries, complaints, or claims, and to send messages to you.
• to run our business in an efficient and proper way. This includes managing our financial position, business capability, planning, communications, corporate governance, compliance and audit.
• to manage risk for the business and for our customers.
• Specific circumstances in which we use your personal information

Booking a test drive

If you book a test drive, we will retain your details in case of a speeding, parking or other motoring offence that may occur or to defend ourselves against legal claims.

Making an enquiry or showing an interest

As you gather more information about MMG you may visit our website or physically visit a dealership that we own. Examples include browsing our website, calling our in-house sales representatives, visiting one of our dealerships or attending a promotional event. To learn more about our goods and services, you may voluntarily provide personal information, such as your name and email address during these interactions. You may also provide information online via cookies or similar technologies when you visit our website.

If you request a vehicle is moved to a different more convenient location, we will require your name, address and contact details. We will contact you to confirm the transfer of your chosen vehicle to your selected dealership.

Selling your vehicle

If you request a valuation for your current vehicle then we will require your vehicle details including registration number, mileage plus your name, email address and telephone number so that we can send to you your indicative valuation. If you decide not to proceed with your valuation we will delete your details after 3 months after the expiration of your valuation.

Purchasing a vehicle and using our other services

Once you have decided to buy our goods such as a vehicle, van or motorcycle we can offer various ways for you to fund your purchase. When you buy from us, you may be asked to provide information so that we can complete your purchase. Information may include your name, phone number, email, postal address, and payment information. We will also need to collect proof of your identity for the purpose of avoiding fraud and other types of financial crime.

If you want us to arrange finance for you then we may need to collect further information and send this to one of our finance providers. If, for any reason, your finance application is declined, then we can send your application to other lenders for consideration. However, we will always seek your consent before passing your application on to other lenders or credit brokers.

Our finance providers will conduct a credit check and affordability assessment on you before making a decision whether to offer you finance to fund your vehicle purchase.

We may collect your name, phone and mobile number, email address, postal address, and payment information. We may also have to collect bank statements, wage slips and recent utility bills to support your finance application. We will ask for proof of your identity such as your driving licence and/or passport. We use this information to complete your transaction, follow up with you about your purchase, help with any delivery issues, process your finance application, and other issues related to the purchase of your goods and services. Please note, we may store your payment or credit card information but we will ensure that we anonymise the long card number (except the last 4 digits) and the security code. We only use payment information in connection with the purchase of our goods and services.

Registering your vehicle with the manufacturer

Once you receive your vehicle, you will be required to register any new or remaining warranty that you are entitled to with the relevant manufacturer. We will do this for you on your behalf and will pass your personal information to the manufacturer. This will include your name, postal address, phone and mobile numbers, email address and details of your vehicle purchase. As part of their service to you, the manufacturer may contact you from time to time and ask you to confirm and update your marketing preferences with them. As part of the registration process you may be required to set up a separate account directly with the manufacturer. If this is the case, we will advise you on what to do. We collect this information to help put your warranty in place and registered for you as soon as possible so that you can utilise the benefits to which you are entitled.

DVLA registration

Certain categories of the data that we collect are necessary for the registration of your vehicle with the DVLA and you will not be able to opt out from this data collection, sharing and/or processing. This data includes your name, postal address, email address, vehicle registration number and chassis number. We collect this information to help ensure that your vehicle is properly registered with the DVLA before delivery and that you are registered with the correct road fund licence applicable to your vehicle.

We may also share your details with third parties in the event that the vehicle that we have sold or supplied is the subject of a parking fine, speeding fine, bus lane fine, any other road traffic offence and/or breach of a lawful obligation. These third parties may include the police, local authorities, councils, government departments, private parking companies and/or their appointed agents.

Aftersales

When buying your vehicle, you may decide to purchase one or more of our after-care services including our Service Plans. We may contact you on the basis of our legitimate interests to remind you of your MOT and compliance with service requirements so that you can keep your vehicle in a roadworthy condition, adhere to safety standards and comply with the terms of a manufacturer’s (or other warranty provider) product unless you have objected and have requested that we do not do this. We may also make contact with you based on our legitimate interests associated with other aftersales services such as vehicle health checks, vehicle repairs, manufacturer recalls and other similar services. The legal responsibility for looking after your vehicle, meeting all the necessary safety and legal requirements and complying with any associated contractual obligations, rests with you.

Arranging a loan vehicle

If we agree to provide you with a loan vehicle then we will retain your personal information in case of a speeding, parking or other motoring offence that may occur or to defend ourselves against legal claims. Please note that some of our loan vehicles may be fitted with dashcams. Please speak to your dealership if you have any concerns or questions about how to use or disable the dashcams.

Photographs

If you agree, we may take photographs of you buying your vehicle and based on our legitimate interests use these on our website and/ or for other promotional purposes. If at any time you would like us to stop using your photographs on our website and/or for other marketing and promotional purposes please let us know and we will action your request within a reasonable period of time.

If you use our LiveChat service

We use a third-party provider Talkative Ltd to supply our LiveChat service (Talkative). If you use the LiveChat service, we will collect any personal information that you volunteer to us. This is used for the legitimate business purpose of handling customer enquiries in real time and then following up in order to resolve them. This data is stored for 6 months by Talkative Ltd to enable us to access the information and deal with your enquiry.

We use a third-party provider, ICX Limited to support our Talkative chat service. Personal information that you volunteer to us via the Talkative service may be shared with ICX Limited for the legitimate business purpose of assisting with the handling of customer enquiries and follow ups. Personal information will be stored by ICX Limited for a maximum of 6 months to enable us to access the information and deal with your enquiry.

We will obtain your consent to conduct marketing and promotional activities. This will be by opt-in. We will never assume that you will want to receive marketing from us. We will always obtain your consent to marketing activities. You will be given the choice as to which marketing mediums you would like to receive.

Please note, we will continue to communicate with you for significant safety information about a vehicle that you own for a safety related issue such as a manufacturer recall. We may be legally obliged to do so and/or we may believe it to be in your vital interests that we do so. We do not classify this type of communication as marketing.

You have a right to withdraw your consent for marketing purposes at any time. You can do this by:

Using our Request Form

• Using our Request Form
• Following the instructions in the message to “unsubscribe”
• Sending an email to data@marshall.co.uk
• Writing to the Data Team, Marshall Motor Group, The Quorum, Barnwell Drive, Cambridge, CB5 8RE

We will process your request to update your marketing preferences as soon as possible and within 5 working days. Please note, it may take up to 21 days for all marketing and promotions to completely stop.

Personal data collected by MMG may be electronically stored and processed in your region, in the UK or EU where MMG or its companies, subsidiaries or service providers maintain facilities. All information you provide may be transferred or accessed by entities in the UK or EU as described in this Privacy Notice.

We may transfer the Personal Data we collect about you outside the UK and/or the EEA, in order to provide our services to you. Some countries are deemed to have adequacy as they provide an adequate level of protection for your Personal Data, other countries require additional measures.

When a country is not deemed as having an adequate level of protection, we have put in place appropriate measures to ensure that your Personal Data is treated by those third parties in a way that is consistent with and which respects Data Protection Laws; for example we mainly rely on the EU Standard Contractual Clauses (SCCs) with the UK Addendum or the UK International Data Transfer Agreement (IDTA). If you require further information about these protective measures, you can request it by contacting us at DPOOffice@marshall.co.uk.

We store manual data at our dealerships, offices and premises as well as placing it in long term secure external storage facilities.

MMG retains personal data for as long as necessary to provide goods and services, support your vehicle purchase and fulfil the transactions you have requested, or for other essential purposes such as complying with our legal obligations, and resolving disputes and enforcing our agreements. Because these needs can vary for different data types in the context of different goods or services, actual retention periods can vary significantly.​​

Your personal information may also be used by our employees, contractors or agents and disclosed to third parties in accordance with this Privacy Notice either with your consent or on another lawful basis.

Who do we share it with?

MMG does not and will not sell personal information about its customers. We only disclose your data as described in this Privacy Notice. We may share information with the following types of third parties:

• Agents and advisers who we use to help us deliver our products and services (such as delivery agents)
• Where you have purchased goods and/or services or expressed an interest in any of the brands we represent, we may share your Personal Data with the relevant brand partner or manufacturer in our capacity as their authorised retailer
• HM Revenue & Customs, regulators and other authorities
• Credit reference agencies
• Fraud prevention agencies
• Any party linked with your products and services
• Companies we have a joint venture or agreement with
• Organisations that introduce you to us or companies that we introduce you to
• Marketing companies (but only to act on our behalf)
• Companies that you ask us to share your data with
• Manufacturers.
• to prevent harm to MMG employees or its customers
• for the prevention and detection of crime or the apprehension or prosecution of offenders
• to maintain the security of our goods and/or services
• to protect the rights or property of MMG.

We will share your personal information as set out in this Privacy Notice but in please note the specific circumstances listed below:

Third Party Agents

MMG uses a variety of third party agents to carry out services like website management and hosting, credit card processing, marketing companies (acting strictly on our behalf) and email communications. We only share your personal data as is necessary to complete a transaction, provide goods or services you have requested or authorised and only with vendors or agents working on our behalf for the purposes described in this Notice. In this case, your personal information will be shared with these agents or contractors but only for the purpose of performing services on behalf of MMG and in accordance with this Privacy Notice.

Payment Services

If you pay by debit or credit card with us we will share transaction details with companies which help us provide this service (such as Visa and MasterCard). We do not charge any processing fees or charges.

If you pay using a pay-by-bank service (or a similar electronic payment service), we will share transaction details with companies which help us provide this service. We do not charge any processing fees or charges.

Direct Debits

If you set up a direct debit payment (for example to pay for a Service Plan) we will share your data with the Direct Debit Scheme.

Financial Services

We may share relevant Information with finance and insurance companies and other relevant parties in the transaction you have authorised in relation to your finance and/or insurance services.

Business Partners

Once you have purchased goods and/or services from us we may share relevant activity information with our business partners that you have authorised to interact with you in order to performance the service or contractual obligation.

Other Parties

Other parties with whom it might be necessary, when we reasonably believe it to be required by law or in connection with legal proceedings:

Corporate Transactions

Parties with whom it might be necessary to complete a financial or corporate transaction such as a merger or sale of assets.

Corporate reasons

If we choose to sell, transfer or merge parts of our business or our assets or we seek to acquire other businesses or merge with them then during this process we may share your data with other parties. We will only do this if they agree to keep your data safe and secure. If this happens then other parties may only use your data in the same way as set out in this Privacy Notice.

Our companies

We may share data with other companies within MMG and with the wider Constellation Automotive Group where this is necessary to conduct our business, such as maintaining the security of our network and information systems.

Personal data must be processed in accordance with the rights of individuals. If you would like to exercise a data subject right, please visit our Data Preferences Centre.

Your data subject rights are:

1. Right to be Informed

All data subjects have a right to be informed as to how their data is being processes and whether it is being transferred to any third parties. We inform data subjects of our processing activities through the provision of this Privacy Notice.

2. Right of Access (“Subject Access Request”)

This is a right for an individual to obtain confirmation whether a data controller processes personal information about them and if they do, to be provided with details of that personal information and access to it.

3. Right to Rectification

This is a right for an individual to obtain rectification without undue delay of inaccurate personal data that the data controller holds about them.

4. Right to Erasure (“Right to be Forgotten”)

This is a right for an individual to require a controller to erase personal information about them on certain grounds. This right does not apply when data is processed to meet a legal obligation or is necessary to fulfil a contract.

5. Right to Restrict Processing

This is a right for an individual to require a data controller to restrict processing of personal information about them on certain grounds.

6. Right to Data Portability

In certain limited circumstances, the data subject can request that all their data is transferred from one provider to another in a structured, commonly used and machine-readable format and to transmit the information to another controller.

7. Right to Object

This is a right for an individual to object to a controller’s processing of personal data in certain circumstances. You always have the right to object to direct marketing.

8. Rights in relation to Automated Decision Making and Profiling

If a decision has been made about a data controller using automated means or the data subject has been profiled, then they have the right to request the decision is reviewed by a human.

9. Your right to complain

If you are unhappy with the way we have handled your personal data, please contact the Data Protection Office using the details in the How to Contact Us section below.

You also have the right to complain to the supervisory body for data protection in the UK, the Information Commissioner’s Office (“ICO”):

Information Commissioner's Office:

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Website: www.ico.org.uk

MMG is committed to protecting the security of your personal data. We use a variety of security technologies and procedures to help protect your personal data from unauthorised access, use or disclosure. For example, we store the personal data you provide on computer systems that have limited access and are in controlled facilities.

While no service is completely secure, MMG takes precautionary measures to help prevent information about you from loss, theft, misuse and unauthorised access, disclosure, alteration and destruction. For example, we ensure that our third-party data centre vendors provide adequate security measures.​

Our website may contain links to other websites run by other organisations which we do not control. This policy does not apply to those other websites and Apps‚ so we encourage you to read their privacy statements. We are not responsible for the privacy notices and practices of other websites and Apps (even if you access them using links that we provide) and we provide links to those websites solely for your information and convenience. We specifically disclaim responsibility for their content, privacy practices and terms of use, and we make no endorsements, representations or promises about their accuracy, content or thoroughness. Your disclosure of personal information to third party websites is at your own risk. In addition, if you linked to our website from a third party website, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party website and recommend that you check the policy of that third party website.​​

MMG may modify or update this Privacy Notice when necessary to reflect customer feedback and changes in our goods and services so please review it regularly. If there are material changes to the Privacy Notice or in how MMG uses your personal data, we will notify you either by posting a notice of such changes before they take effect or by directly sending you a notification. We encourage you to regularly review this Privacy Notice to learn more how MMG is using and protecting your information. ​​

If you have any questions about the use of your personal information, you can contact us at DPOOffice@marshall.co.uk or write to us at Data Protection Office, Marshall Motor Group, c/o Marshall Volkswagen Milton Keynes, Greyfriars Court, Milton Keynes MK10 0BN