We are dedicated to ensuring that all personal data that we process is done so in a fair, lawful and transparent manner. We take the security of your data very seriously and adhere to all relevant data protection legislation including the Data Protection Act 2018, the General Data Protection Regulation (‘GDPR’) and The Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”).
Post: FAO Data Protection Team, First Floor, Unit 3140 Park Square, Solihull Parkway, Birmingham Business Park, Birmingham, B37 7YN
Telephone: 0333 130 0108
You are important to us, and so is protecting your personal information. We have high standards when it comes to collecting and using personal information. For this reason, we take any complaints we receive from you about our use of your personal information very seriously and request that you bring any issues to our attention.
Where you are communicating with us for the purpose of making a complaint, we will only use your personal information to handle, investigate and respond to the complaint and to check on the level of service we provide. Where the complaint is about a member of our team, we may have to disclose your identity to whoever the complaint is about. You may let us know that you don't want information that identifies you to be disclosed and we will try to respect your request; however, it may not always be possible to handle a complaint on an anonymous basis.
If you are unhappy with our use of your personal data or our response to the exercise by you of any of your rights, then you have the right to complain the UK’s data protection authority the Information Commissioner's Office (ICO) (www.ico.org.uk).
It is our intention to provide you with as much information as possible about what we do with that personal data, so that when you provide your personal data to us, you do so with an awareness of how it will be used.
If you provide us with personal data on behalf of someone else, for example if you provide your spouse’s details in connection with the purchase of a vehicle, you confirm to us that you have their permission to do so. The exercise of any further rights in connection with such personal data will need to be done by the relevant individual.
We are not interested in collecting every personal detail about you. Our main reason for collecting your personal information is to provide and improve the service, products and experiences that our customers expect from us.
We will need to collect personal information about you in order for us to be able to carry out the service you have requested or accessed. We will only collect the information that we need.
We collect your personal information in a number of different ways which we have explained in this section.
Information that you share with us
We collect personal information that you share with us when you contact or interact with us. For example, where you provide it to us:
- by entering personal data via our website, www.bravoauto.co.uk, live chat boxes or social media platforms and testimonials and opinions you may have posted publicly
- when you contact our customer service teams and our call centre
- if you make an enquiry or register your interest in a vehicle in a showroom or at an event we, a manufacturer or third party have held
- when you place an order, purchase or book an appointment for a vehicle or for any parts, goods or any other products or services
- where you make an appointment for a vehicle service or MOT
- when you apply for a loan, personal contract purchase or lease agreement from one of our accredited finance providers to purchase your vehicle
- when you part exchange your vehicle or where you provide any service history relating to your vehicle or provide any information to evidence that you are insured to drive a vehicle
- by corresponding with us by phone, email, in person or any other means for any reason
Information that we receive from third parties
We may also receive your personal information from third parties, such as:
- if you have requested a brochure, test drive, details about a vehicle or registered an interest in a vehicle
- to provide vehicle support services or in the event of a safety or product recall
- if you exercise your data subject rights and we receive notification from the manufacturer
Finance providers and brokers
- where you have engaged a third party broker to act on your behalf to administer the purchase of a vehicle
- where we are provided with your personal information by our approved finance providers to allow us to contact you during the term of your contract. For example, we may contact you towards the end of your Personal Contract Purchase (PCP) contract to discuss your options before and at the end of the contract
- when we are required to carry out repairs on your vehicle as part of a claim you have made through your insurance
Regulatory and supervisory bodies
- such as the Driver and Vehicle Licensing Agency (DVLA) where we need to confirm if you hold a valid driving licence for the purposes of providing a courtesy or loan car or a test drive
- if you apply for a role with us through a recruitment agency or job board provider then we will need your personal information for the purposes of assessing your application
Where required to perform a contract with you. Where it is necessary to process your personal data for the performance of a contract with you or in order to take steps at your request before entering into a contract with you.
Where there is a legal or regulatory obligation. Where we need to process your personal data to comply with our legal obligations such as assisting the ICO, DVLA, DVSA, FCA, HMRC, the police or any other public authority or criminal investigation body. We may also need to process your personal data to identify you when you contact us or to verify the accuracy of the data that we hold about you.
Legitimate interest. We may process your personal data where it is in our legitimate interests (or that of a third party) and those interests do not override your rights and freedoms. For example, we may contact you to notify you about your vehicle’s servicing or MOT requirements.
Vital interests. Where it is necessary to process your personal data to protect your vital interests or those of another person. For example, we may contact you to notify you about safety or product recalls relating to your vehicle.
Consent. We may rely on your consent to send you direct marketing communications. Details on how you can change the way we contact you are set out in section 11.
Please refer to the download at the bottom of this page, which describes in more detail the ways in which we may process your personal information and which of the legal means we rely on to do so.
We will only use personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. Please contact us using the details set out in section 2 if you need details about the specific legal ground on which we are relying to process your personal data.
If you ever decide you want to change your marketing preferences or no longer wish to receive our marketing communications, you can do so at any time by using the unsubscribe link provided in the marketing communications email, or by using the contact details in section 2 above. If you do unsubscribe, please note that we will still keep your email in a separate secure list so that we can make sure that you do not receive our marketing communications again in the future.
We may share your personal data with carefully selected third parties in order to make certain services available to you and we have explained those types of scenarios in this table.
We only share the minimum amount of data required and our third party suppliers only have rights to use your personal data for the purpose of fulfilling the service required from them.
We use a large number of suppliers so we have not provided a full list in this Privacy Notice. We can confirm that the categories of third party that we may share your personal data with in order to provide our products and services include:
We share your personal data with the manufacturers listed below:
BMW Group UK
Daimler Group (UK) Ltd (see privacy link for Mercedes-Benz and smart)
Jaguar Land Rover
Volkswagen Commercial Vehicles
We share data with the manufacturers for the following purposes:
- to fulfil your order for a vehicle
- for warranty, registration and safety/product recall purposes relating to your vehicle
- to diagnose and fix problems with your vehicle
- to manage complaints relating to your vehicle
- or, where you have provided consent, for marketing communications
If we provide you with a Service Plan quote we will disclose your information to our Service Plan partners. If you decide to purchase a Service Plan from us then our partner will act as a data processor on our behalf.
Other Third Parties
We may also provide your personal information to our insurance administrators, IT providers, service, maintenance and repair providers, vehicle breakdown and recoveries providers, accident and incident management providers, risk management and driving licence checking providers, financial organisations, banks and credit brokers, credit reference agencies, marketing agencies, the Inchcape group and legal, governmental and regulatory authorities.
Some of our third party suppliers will be data controllers in their own right. If they are in receipt of your personal data or they collect it from you directly they will provide you with a copy of their individual privacy notices.
We will not usually disclose your personal information other than as already explained in Section 8 above. However, there may be circumstances where we need to share personal information other than as anticipated. These include:
- where we are legally required to disclose the information. This includes sharing the personal information with tax authorities and law enforcement agencies for the purposes of the prevention and detection of crime
- where we need to disclose the personal information for the purpose of resolving a complaint or in connection with any legal proceedings, or for the purpose of obtaining legal advice, or the disclosure is otherwise necessary for the purposes of establishing, exercising or defending legal rights
- disclosure is required to protect our interests, or someone else's interests (for example, to prevent fraud)
- disclosure is necessary to protect your vital interests (for example if you are unwell at our premises, we may need to seek medical assistance)
- it is to a third party for the purposes of providing administrative or processing services on our behalf. If such disclosure is required we will take steps to ensure that the third party protects the personal information in the same way that we do and notify you of any changes to this privacy notice
- to any prospective purchaser of our business assets or organisation
Transferring Personal Data outside of the European Economic Area
We do not routinely transfer your personal data outside of the European Economic Area (“EEA”) and we use all reasonable endeavours to select suppliers who provide assurances that personal data is stored and processed within the EEA. With any international cloud technology providers however (such as Microsoft and Salesforce) there is a small possibility that personal data that is stored within the EEA is accessed outside of the EEA for technical support or account assistance. We therefore ensure that where we use technology providers or similar suppliers who potentially access personal data from outside of the EEA we ensure that we put in place adequate measures to ensure the protection of such personal data (such as using standard contractual clauses).
The right to request correction of the personal data we hold about you. You can have any incomplete or inaccurate data we hold about you corrected, although we may need to verify the accuracy of any new information you provide.
The right to withdraw your consent where we are relying on your consent to process your personal data. If you would like to withdraw your consent to receiving any direct marketing, you can do so at any time by using the unsubscribe link provided in the marketing communications email. If you simply want to change your marketing preferences (for example, the method of communication), you can do so by using the contact details in section 2 above.
Where you have explicitly consented to us processing special categories of data, you can withdraw consent to our processing the special categories of data at any time during the application process. If you wish to withdraw consent, please do so by sending your request in writing to our contact details below.
The right to request access to your personal data. You can contact us at any time to ask whether we process any personal data about you and to be provided with a copy of that data. This will be provided free of charge. We may not provide you with a copy of some of this information if it also concerns other individuals or we have another lawful reason to withhold it.
The right to request erasure of your personal data. You can ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to request that we delete or remove your personal data where you have successfully exercised your right to object to processing, where we have processed your personal data unlawfully or where we are required to delete your data by operation of law. We may not always be able to completely comply with your request where we have specific legal reasons which will be notified to you.
The right to object to processing of your personal data where we are relying on our legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on the grounds it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your data for direct marketing purposes. In some instances we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
The right to transfer your personal data to you or another party. We will provide you or the third party with your personal data in a structured and commonly used machine-readable format.
Exercising your rights.
If you wish to exercise any of your rights then please contact us using the details set out in section 2. You will not normally have to pay a fee to exercise your rights but we may charge a reasonable fee if your request is unfounded, repetitive or excessive. We may also refuse to comply with your request. We endeavour to respond to all legitimate requests within one month. If we will need longer than a month to respond to your request then we will let you know and keep you updated.
All electronic and hard copy files, relating solely to purchase information, will be destroyed after 7 years.
If we have anonymised or pseudonymised your personal data (so you can no longer be identified by it) we may use or hold the information for longer periods without notice.