Loughton Self Drive Ltd – Privacy Notice for Clients

Who we are:

We are Loughton Self Drive. For the purposes of this notice, the term ‘we’ encompasses all those employed by us to carry out our business, either directly or as external contractors

Our Contact Details:

If you have any questions about this Privacy Notice, please contact:

info@loughton-selfdrive.co.uk

+44(0)20 8508 0888

1.    Privacy laws

The processing of your personal data is governed by the General Data Protection Regulations (GDPR), enacted in the UK by the Data Protection Act 2018.

2.    The capacities in which we process data

In providing you with our services, we act as a controller of personal data (as defined by Article 4(7) GDPR) with respect to any processing for which we determine the purpose and means. This includes data that is processed on our behalf by a third party, including as part of our online booking process. Where such processing occurs, your rights and freedoms as a data subject (see below) will be subject to contractual safeguards between us and the data processor.

1.    The purposes of this privacy notice are;

  1. To inform you about our processing of your data as a controller, in accordance with the ‘transparency’ requirement of Article 13 GDPR.

2.    The types of personal data we collect

The personal data we use may include, but is not limited to:

  • Your name, address and contact details, including email address and home and mobile telephone numbers;
  • Identification data, including driving licence;
  • Financial data including bank account and payment card details;
  • Date of birth and gender;
  • The terms and conditions of your contract with us for the provision of our services.

We may also collect Special Category Personal Data;

  • Personal identification documents that may reveal race, religion or ethnic origin.

3.    How we collect the personal data

Data might be collected through:

  • Our online contact forms or rental reservation process;
  • Electronic, written or verbal correspondence with you;
  • Meetings in person, or;
  • External sources such as DVLA, industry RISC databases or public registers.

4.    Providing your personal data

We will tell you if providing some personal data is optional, including if we ask for your consent to process it. In all other cases, we need you to provide your personal data so we can provide services to you.

5.    What we use your personal data for

Provision of vehicle rental services

  • To ensure the legality of your use of a vehicle rented from us;
  • As necessary to support the contract with you and to allow us to receive full payment for those services;

Business purposes

  • As necessary for our own legitimate interests or those of other persons and organisations, subject to your rights and freedoms as a data subject;
  • For good governance, accounting, and managing and auditing our and business operations both internally and by third parties;
  • Subject to your consent, for marketing purposes including emails to you containing details of our services;
  • For surveys of client experience and quality of our services;
  • To monitor emails, calls, other communications;
  • For market research, other surveys and analysis and developing statistics for improving business performance.

To comply with a legal obligation:

  • When you exercise your rights under data protection law;
  • For the establishment and defence of legal rights;
  • For activities relating to the prevention, detection and investigation of crime;
  • To investigate complaints, legal claims and data protection incidents.

6.    The legal basis for processing

In providing you with our services, we will process your personal data under Article 6 (1)(b) of the General Data Protection Regulations, on the legal basis that processing is necessary for the performance of a contract for the provision of our services, or in order to take steps at your request prior to entering into a contract, or in order to fulfil your instructions during the execution of that contract.

In addition, we may process your personal data on the following legal bases;

  • Consent: where you give your consent for the processing – Article 6 (1)(a);
  • Legal obligation: the processing is necessary for compliance with a legal obligation – Article 6 (1)(c);
  • Vital interests: the processing is necessary to protect someone’s life – Article 6 (1) (d);
  • Public interest: the processing is necessary to perform a task in the public interest – Article 6(1)(e);
  • Legitimate interests: the processing is necessary for an organisation’s legitimate interests or the legitimate interests of a third-party – Article 6 (1) (f). In such cases, the legitimate interest of the processor will be balanced against the rights and freedoms of the data subject to ensure no detriment is caused to the latter.

Where we process special category data, we do so on the basis of your consent – Article 9(2)(a)

In addition, we may process your special category data on the following legal bases;

  • Vital interests of the Data Subject – Article 9 (2) (c);
  • Substantial public interest (the prevention and detection of unlawful acts)– Article 9 (2) (g) and paragraph 10, Schedule 1, Data Protection Act 2018;
  • Public interest in the area of public health such as protecting against serious cross border threats to health – Article 9 (2) (i).

7.    Sharing of your personal data

Subject to applicable data protection laws we may share your personal data with:

  • Other organisations necessary for the provision of our services and who require your data in order to meet that requirement;
  • Our legal and other professional advisors;
  • Law enforcement agencies;
  • Fraud prevention agencies, credit reference agencies, and debt collection agencies;
  • Government bodies and agencies in the UK and overseas (e.g. HMRC) who may in turn share it with relevant overseas tax authorities and with regulators including the Information Commissioner’s Office;
  • Courts, to comply with legal requirements, and for the administration of justice;
  • In an emergency or to otherwise protect your vital interests;
  • To protect the security or integrity of our business operations and other clients;
  • Payment systems and providers; and
  • Anyone other party where we have your consent or as required by law

8.    Transfer of personal data

We do not routinely transfer data to other countries. Should we do so, and such processors are located in a country which is outside the European Union (a ‘third country’) and is not deemed by the United Kingdom to have adequate privacy standards (as defined within the Data Protection Act 2018), the transfer will be subject to a legal instrument providing appropriate safeguards in accordance with Article 46 GDPR or will take place with your explicit consent.

9.    How long do we keep your data?

We will take steps to erase payment data held by us as soon as it is no longer required. Data relating to taxation will be kept for five years from the end of the tax year to which the data relates. Other information will be kept for a period of three years from the last date on which we provide services to you, but may be held for longer periods where any of the following apply:

  • Retention in case of queries. We will retain your personal data as long as necessary to deal with any outstanding queries you may have;
  • Retention in case of claims. We will retain your personal data for as long as you might legally bring claims against us or, in the event of such a claim, until that matter is complete; and
  • Retention in accordance with legal and regulatory requirements.

10. Your rights under applicable data protection law

Your rights are, where applicable:

  • The right to be informedabout processing of your personal data;
  • The right to have your personal data corrected if it is inaccurate and to have incomplete personal data completed;
  • The rightto object to processing of your personal data;
  • The rightto restrict processing of your personal data;
  • The right to have your personal data erased (the “right to be forgotten”);
  • The right to request accessto your personal data and information about how we process it;
  • The right to move, copy or transfer your personal data(“data portability”); and
  • Rights in relation to automated decision-makingincluding profiling

You may exercise these rights by contacting us using the details given at the top of this Notice. You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

11. How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us using the details given at the top of this Notice.

You can also complain to the Information Commissioner’s Office if you are unhappy with how we have used your data;

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk