Privacy Policy

If you have any questions relating to this notice, your rights under data protection legislation or the processing of your personal data then you can contact us by:

• Email: dpo@group1auto.com

• Post: FAO Data Protection Team, First Point St. Leonards Road, Allington, Maidstone, Kent,
England, ME16 0LS

• Telephone: 01622 291 300

You are important to us, and so is protecting your personal information. We have high standards when it comes to collecting and using personal information. For this reason, we take any complaints we receive from you about our use of your personal information very seriously and request that you bring any issues to our attention.

Where you are communicating with us for the purpose of making a complaint, we will only use your personal information to handle, investigate and respond to the complaint and to check on the level of service we provide. Where the complaint is about a member of our team, we may have to disclose your identity to whoever the complaint is about. You may let us know that you don't want information that identifies you to be disclosed and we will try to respect your request; however, it may not always be possible to handle a complaint on an anonymous basis.

If you are unhappy with our use of your personal data or our response to the exercise by you of any of your rights, then you have the right to complain the UK’s data protection authority the Information Commissioner's Office (ICO) (www.ico.org.uk).

Personal data includes any information about an individual from which that individual can be
identified. Examples include your name, identification number, email or home address, photograph and bank account details, factors specific to an individual (such as your physical, physiological, mental, economic, cultural or social identity) and any data that would allow you to be identified when combined with other data.

It is our intention to provide you with as much information as possible about what we do with that personal data, so that when you provide your personal data to us, you do so with an awareness of how it will be used.

If you provide us with personal data on behalf of someone else, for example if you provide your spouse’s details in connection with the purchase of a vehicle, you confirm to us that you have their permission to do so. The exercise of any further rights in connection with such personal data will need to be done by the relevant individual.

We will collect, store, and use the following categories of personal information about you:

• Personal contact details such as name, title, addresses, telephone numbers, and personal
email addresses

• Date of birth

• Where you engage with us in a business context, your job title, company contact details
(including email addresses), fleet size and company details

• Where provided, information relating to your identity such as your National Insurance
Number and/or driving licence details

• Bank account details

• Where appropriate, information about your credit status for the purposes of undertaking a
credit check

• CCTV footage, when you visit any of our sites where CCTV is in operation

• Information obtained through electronic means such as photographs, video, and audio
recordings

• Where you have consented, your GPS location

• Recordings of telephone conversations you may make to our customer contact centre

We may also collect, store and use the following “special categories” of more sensitive personal information:

• information about your race or ethnicity or religious beliefs

• Information about your health, including any medical condition and/or disability

• Information about criminal convictions and offences

We are not interested in collecting every personal detail about you. Our main reason for collecting your personal information is to provide and improve the service, products and experiences that our customers expect from us.

We will need to collect personal information about you in order for us to be able to carry out the service you have requested or accessed. We will only collect the information that we need.

We collect your personal information in a number of different ways which we have explained in this section.

Information that you share with us

We collect personal information that you share with us when you contact or interact with us. For example, where you provide it to us:

• by entering personal data via our website https://www.group1auto.co.uk live chat boxes or
social media platforms and testimonials and opinions you may have posted publicly

• when you contact our customer contact centre

• if you make an enquiry or register your interest in a vehicle in a showroom or at an event we, a manufacturer or third party have held

• when you place an order, purchase or book an appointment for a vehicle or for any parts,
goods or any other products or services

• where you make an appointment for a vehicle service or MOT

• when you apply for a loan, personal contract purchase or lease agreement from one of our
accredited finance providers to purchase your vehicle

• when you part exchange your vehicle or where you provide any service history relating to
your vehicle or provide any information to evidence that you are insured to drive a vehicle

• when you register on the careers page of our website and when you apply for a role with us

• by corresponding with us by phone, email, in person or any other means for any reason
Information that we receive from third parties

We may also receive your personal information from third parties, such as:

Vehicle manufacturers:
• if you have requested a brochure, test drive, details about a vehicle or registered an interest
in a vehicle
• to provide vehicle support services or in the event of a safety or product recall
• if you exercise your data subject rights and we receive notification from the manufacturer

Finance providers and brokers:
• where you have engaged a third party broker to act on your behalf to administer the
purchase of a vehicle
• where we are provided with your personal information by our approved finance providers to
allow us to contact you during the term of your contract. For example, we may contact you
towards the end of your Personal Contract Purchase (PCP) contract to discuss your options
before and at the end of the contract

Insurance providers:
• when we are required to carry out repairs on your vehicle as part of a claim you have made
through your insurance

Regulatory and supervisory bodies:
• such as the Driver and Vehicle Licensing Agency (DVLA) where we need to confirm if you
hold a valid driving licence for the purposes of providing a courtesy or loan car or a test drive

Recruitment:
• if you apply for a role with us through a recruitment agency or job board provider then we will need your personal information for the purposes of assessing your application

We will only process your data where the law allows. Your personal data will, most commonly, be processed in the following circumstances:

Where required to perform a contract with you. Where it is necessary to process your personal data for the performance of a contract with you or in order to take steps at your request before entering into a contract with you.

Where there is a legal or regulatory obligation. Where we need to process your personal data to comply with our legal obligations such as assisting the ICO, DVLA, DVSA, FCA, HMRC, the police or any other public authority or criminal investigation body. We may also need to process your personal data to identify you when you contact us or to verify the accuracy of the data that we hold about you.

Legitimate interest. We may process your personal data where it is in our legitimate interests (or that of a third party) and those interests do not override your rights and freedoms. For example, we may contact you to notify you about your vehicle’s servicing or MOT requirements and/or to send you direct marketing communications (where an opt-out option was provided, and you did not select to opt-out of such communications).

Vital interests. Where it is necessary to process your personal data to protect your vital interests or those of another person. For example, we may contact you to notify you about safety or product recalls relating to your vehicle.

Consent. Where we have previously asked you for, and you have provided your explicit consent for us to send you direct marketing communications. Details on how you can change the way we contact you are set out in section 8).

Please refer to the download here for Group 1 Automotive UK Limited and here for Group 1 Assured, which describes in more detail the ways in which we may process your personal information and which of the legal means we rely on to do so.

We will only use personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. Please contact us using the details set out in section 2 if you need details about the specific legal ground on which we are relying to process your personal data.

We have a separate cookie policy that explain how we use cookies. Please contact dpo@group1auto.com for further information. You can read our cookie policy here.

If you have made an enquiry into our products or services, we may use the personal details (name, postal address and email address) and vehicle details (make and model) you provided to send you direct marketing communications either:

(a) where we are relying on your consent, where we have given you a clear choice to opt-in to receiving such communications; or

(b) where it is in our legitimate interests and those interests do not override your rights and
freedoms, by giving you an option to opt-out of receiving such communications (which relate to our own products and services which are similar to those you enquired about).

If you ever decide you want to change your marketing preferences or no longer wish to receive our marketing communications, you can do so at any time by using the unsubscribe link provided in the marketing communications email, or by using the contact details in section 2 above. It may take up to 30 days for this to take effect. If you do unsubscribe, please note that we will still keep your email in a separate secure list so that we can make sure that you do not receive our marketing communications again in the future.

We may share your personal data with carefully selected third parties in order to make certain services available to you and we have explained those types of scenarios in the table in section 5.

We only share the minimum amount of data required and our third party suppliers only have rights to use your personal data for the purpose of fulfilling the service required from them.

We use a large number of suppliers so we have not provided a full list in this Privacy Notice. We can confirm that the categories of third party that we may share your personal data with in order to provide our products and services include:

Vehicle Manufacturers

We share your personal data with the manufacturers listed below and a copy of their privacy policy can be found by clicking on their name:

• Audi UK
• BMW Group UK
• BMW Motorrad
• Citroën
• Cupra
• Daimler Group (UK) Ltd (see privacy link for Mercedes-Benz and Smart)
• Ford
• Jaguar Land Rover
• Kia
• MINI
• Porsche
• SEAT
• Skoda
• Toyota GB
• Lexus UK
• Volkswagen UK
• Volkswagen Commercial Vehicles

We share data with the manufacturers for the following purposes:

• to fulfil your order for a vehicle

• for warranty, registration and safety/product recall purposes relating to your vehicle

• to diagnose and fix problems with your vehicle

• to manage complaints relating to your vehicle

• to send you a customer survey following your vehicle purchase

• or, where you have provided consent, for marketing communications

Finance Providers

If your enquiry leads to the purchase of a vehicle with a finance agreement, we will disclose your information to our selected finance partners. If you are accepted for finance, the finance company with become the data controller for your information and we recommend that you read their privacy policy to see how they will use your data. A copy of their privacy policy can be found by clicking on their name:

• Alphera Financial Services (specific to Group 1 Assured)
• Black Horse (specific to Group 1 Assured)
• BMW Financial Services (GB) Limited
• DSG Financial Services Ltd
• Evolution Funding
• FSE Bank PLC t/a Ford Credit
• Jaguar and Land Rover Financial Services
• Mercedes-Benz Financial Services UK Ltd
• Redline Finance (specific to Group 1 Assured)
• Santander Consumer (UK) plc
• Stellantis Financial Services
• Toyota Financial Services (UK) PLC
• Volkswagen Financial Services (UK) Ltd

Service Plans
If we provide you with a Service Plan quote we will disclose your information to our Service Plan partners. If you decide to purchase a Service Plan from us then our partner will act as a data processor on our behalf.

Other Third Parties
We may also provide your personal information to our customer contact centres, mobility and car hireproviders, insurance administrators, IT providers, service, maintenance and repair providers, vehicle breakdown and recoveries providers, accident and incident management providers, risk management and driving licence checking providers, market research and market analytics service providers, financial organisations, accountancy service providers, banks and credit brokers, credit reference agencies, marketing agencies, other companies in our group and legal, governmental and regulatory authorities.

Some of our third party suppliers will be data controllers in their own right. If they are in receipt of your personal data or they collect it from you directly they will provide you with a copy of their individual privacy notices.

We will not usually disclose your personal information other than as already explained in Section 9 above. However, there may be circumstances where we need to share personal information other than as anticipated. These include:

• where we are legally required to disclose the information. This includes sharing the personal information with tax authorities and law enforcement agencies for the purposes of the prevention and detection of crime

• where we need to disclose the personal information for the purpose of resolving a complaint or in connection with any legal proceedings, or for the purpose of obtaining legal advice, or the disclosure is otherwise necessary for the purposes of establishing, exercising or defending legal rights

• disclosure is required to protect our interests, or someone else's interests (for example, to prevent fraud)

• disclosure is necessary to protect your vital interests (for example if you are unwell at our
premises, we may need to seek medical assistance)

• it is to a third party for the purposes of providing administrative or processing services on our behalf. If such disclosure is required we will take steps to ensure that the third party protects the personal information in the same way that we do and notify you of any changes to this privacy notice

• Any prospective purchaser or of our business assets or organisation. Group 1 Automotive UK Limited may choose to buy or sell assets (including the whole or part of its company or
business operations). If our company or all of its assets are purchased by another company, customer data (including your personal data) would be one of the assets transferred as part of that acquisition. When you give consent to Group 1 Automotive UK Limited for the use of your personal data (including for marketing purposes), this consent applies to our company and any subsequent purchasers of our company or business. After the sale has completed the purchaser will let you have its own privacy notice, and any marketing communications you receive from them will include the option to unsubscribe.

International Transfers of Personal Data

We do not routinely transfer your personal data outside of the UK or European Economic Area (“EEA”) and we use all reasonable endeavours to select suppliers who provide assurances that personal data is stored and processed within the UK or EEA. With any international cloud technology providers however (such as Microsoft and Salesforce) there is a small possibility that personal data that is stored within the UK or EEA is accessed outside of the UK or EEA for technical support or account assistance. We therefore ensure that where we use technology providers or similar suppliers who potentially access personal data from outside of the UK or EEA we ensure that we put in place adequate measures to ensure the protection of such personal data (such as ensuring such transfers
are based on adequacy decisions or putting in place an international data transfer agreement

We know that you provide your personal information in good faith and expect it to be looked after. This is why we take the security of your personal information seriously. This means that we have taken steps internally in order to ensure that our systems adequately protect your personal information, such as encrypting your personal data. Group 1 Automotive UK Limited is NIST accredited.

You have a number of rights in respect of your personal information which we have explained in a bit more detail below: If you would like more information about any of your rights, please contact us using the details set out in section 2 above.

The right to request correction of the personal data we hold about you. You can have any incomplete or inaccurate data we hold about you corrected, although we may need to verify the accuracy of any new information you provide.

The right to withdraw your consent where we are relying on your consent to process your personal data. As described in section 8) you can unsubscribe from direct marketing at any time by using the unsubscribe link provided in the marketing communications email. If you simply want to change your marketing preferences (for example, the method of communication), you can do so by using the contact details in section 2 above.

Where you have explicitly consented to us processing special categories of data, you can withdraw consent to our processing the special categories of data at any time. If you wish to withdraw consent, please do so by sending your request in writing to our contact details provided in section 2 above.

The right to request access to your personal data. You can contact us at any time to ask whether we process any personal data about you and to be provided with a copy of that data. This will be provided free of charge. We may not provide you with a copy of some of this information if it also concerns other individuals or we have another lawful reason to withhold it.

The right to request erasure of your personal data. You can ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to request that we delete or remove your personal data where you have successfully exercised your right to object to processing, where we have processed your personal data unlawfully or where we are required to delete your data by operation of law. We may not always be able to completely comply with your request where we have specific legal reasons which will be notified to you.

The right to object to processing of your personal data where we are relying on our legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on the grounds it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your data for direct marketing purposes. In some instances we may demonstrate that we have compelling legitimate grounds to process your
information which override your rights and freedoms.

The right to transfer your personal data (that you have provided) to you or another party, where we process the personal data based on your consent or because it is necessary for a contract with you. We will provide you or the third party with your personal data in a structured and commonly used machine-readable format.

Exercising your rights. If you wish to exercise any of your rights then please contact us using the details set out in section 2. You will not normally have to pay a fee to exercise your rights but we may charge a reasonable fee if your request is unfounded, repetitive or excessive. We may also refuse to comply with your request. We endeavour to respond to all legitimate requests within one month. If we will need longer than a month to respond to your request then we will let you know and keep you updated.

We will hold your personal data for no longer than is necessary for the purposes for which we are processing it. When it is no longer required, we will securely dispose of it.

If we have a relationship with you (e.g. you are a customer or the registered driver of a leased or other vehicle purchased from us), all electronic and hard copy files containing your personal information, will be destroyed after 7 years from the date our relationship ends. We hold your personal information for this period to establish, bring or defend legal claims. Our relationship may end for a number of reasons including where the vehicle warranty or lease expires, or we have been made aware that you
no longer own or drive that vehicle.

Where we have obtained your personal information following a request for information, test drive, brochure, quotation or any other information on any of our products or services, we hold your personal information for up to 3 years from the date we collect that information, unless during that period we form a relationship with you e.g. you purchase or lease a vehicle. We hold your personal information for this period to give us an opportunity to form a relationship with you.

The only exceptions to the periods mentioned above are where:

• the law requires us to hold your personal information for a longer period, or delete it sooner;

• Where we have anonymised or pseudonymised your personal information (so can no longer be identified by it) we may use or hold the information for longer periods without notice;

• Where you have raised a complaint or concern regarding a product or service offered by us, in which case we will retain your information for a period of 7 years following the date of that complaint or query; or

• You exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law.

We keep our privacy policy under regular review in order to ensure that it properly reflects our use of personal information. This privacy policy was last updated on 1 November 2024.