This policy applies to the processing of customer personal data by the Griffin Mill (referred to as "Griffin Mill" or "we").
The purpose of this policy is to provide our current, former and potential customers (jointly referred to as "customers" or you) with a general understanding of:
- The circumstances under which we collect and process your personal data
- The types of personal data we collect
- The reasons for collecting your personal data
- How we handle your personal data.
The processing of your personal data forms an important part of our provision of products and services to you. We appreciate the trust you place in us when providing us with your personal data, and consider your privacy an essential part of the services we offer.
Freedom of Choice
Your personal data belongs to you. We strive not to make any assumptions regarding your privacy preferences and aim to design our services so that you can choose whether to share your personal data with us.
How We Use Your Information
We collect information about you so that we can:
- Identify you and manage any accounts you hold with us
- Process your order
- Maintain a service record for your vehicle, conduct research, statistical analysis and behavioural analysis
- Carry out customer profiling and analyse your purchasing preferences
- Let you know about other products, services or events that may be of interest to you
- Detect and prevent fraud
- Send MOT and Service reminders
- Verify your identity and carry out anti-fraud checks
- Provide you with payment options
- Assess your application for a product, service or quote
- Ensure that you can afford any financial agreement offered
- Ensure that any insurance products are suitable for you
- Administer your any finance agreements including updating you on and delivering our services
- Monitor your use of our websites and any response to advertising campaigns.
Where your vehicle manufacturer maintains an electronic service record of your vehicle, we may share details of any work with your manufacturer so that an accurate record can be kept.
We may use and process your personal information where this is necessary to perform a contract with you and to fulfil and complete your orders, purchases and other transactions entered into with us (or one of our authorised dealers or selected partners).
We may use and process your personal information as set out below where it is necessary for us to carry out activities for which it is in our legitimate interests as a business to do so. Processing necessary for us to support customers with sales and other enquiries:
- To respond to correspondence, you send to us and fulfil the requests you make to us (for example: test drives, service requests, brochure requests or information about specific vehicles)
- To provide vehicle support and services (for example warranty services)
- To analyse, evaluate and improve our products and services so that your visit and use of our website, applications and dealerships are more useful and enjoyable (we will generally use data amalgamated from many people so that it doesn’t identify you personally).
- To undertake market analysis and research (including contacting you with customer surveys) so that we can better understand you as a customer and provide tailored offers, products and services that we think you will be interested in.
- We collect and analyse this information in this way so that we can deliver the most appropriate customer experience to you by tailoring and making relevant all our service and communications (for example, when your mileage suggests your vehicle is due for a service).
- To send/contact you with marketing information after you have purchased a product or service from us or made a purchasing enquiry, we will only contact you with information about our own products and services (and in ways the law allows). You have the right to object to us sending you this information at any time.
- To contact you from time to time with marketing information (unless you object) if you have expressly indicated to us that you are acting on behalf of a business or where we have obtained your business contact details from our authorised dealer network or an online or public business directory. In relation to any such information we send by email or SMS, we will include an option allowing you to object to receiving future messages by unsubscribing.
- To contact you with targeted advertising delivered online through social media and other platforms operated by other companies, unless you object. You may receive advertising based on information about you that we have provided to the platform or because, at our request, the platform has identified you as having similar attributes to the individuals whose details it has received from us. To find out more, please refer to the information provided in the help pages of the platforms on which you receive advertising from us.
- To administer competitions and promotions that you enter with us from time to time and to distribute prizes.
Where you have provided your consent, we may use and process your information to contact you from time to time about promotions, events, products, services or information which we think may be of interest to you. You can withdraw or update this consent at any time by contacting the dealership.
Vital Interests & Third Parties
Sometimes we will need to process your personal information to contact you if there is an urgent safety or product recall notice and we need to tell you about it.
We do not sell your information to third parties, but we do work closely with our automotive manufacturer partners and with third party suppliers who fulfil business activities for us (like providing vehicle finance, insurance & warranty products, marketing, events and market research etc). Details on how our manufacturers use your information can be found here:
We also have an approved panel of lenders who provide Finance for vehicle sales, and should you with so take out a finance product, your information is shared with the lender to facilitate this. Information about specific lenders and their privacy policies can be requested from our sales staff.
To let us know whether you would like to receive the latest news and offers from our manufacturers please follow the information provided in the Consent section above.
We do not sell your information to third parties. However, we may from time to time disclose your information to the following categories of companies or organisations to which we pass the responsibility to handle services on our behalf: warranty providers, customer contact centres, mobility and car hire providers, direct marketing communications agencies and consultants, market research and market analytics service providers, our legal and other professional advisors.
We take steps to ensure that any third-party partners who handle your information comply with data protection legislation and protect your information just as we do. We only disclose personal information that is necessary for them to provide the service that they are undertaking on our behalf. We will aim to anonymise your information or use aggregated non-specific data sets where ever possible.
Whilst our business is UK based there may be some instances where your information is processed or stored outside of the EU. In those instances, we will ensure that appropriate safeguards are in place for that transfer and storage as required by applicable law.
We may process your personal information to comply with our legal requirements (for example to register your car with the DVLA).
We endeavour to only process customer personal data that is adequate, relevant and not excessive in relation to the purpose for which it has been collected.
We aim to anonymize your personal data when a function or service can be achieved with anonymized data. If we combine anonymized or non-personal data with your personal data, it will be treated as personal data for as long as it remains combined.
On request, we will provide customers with further information regarding our processing of your personal data, which may include excerpts from internal directives and guidelines.
It is Griffin Mill’s policy to comply with the applicable laws, rules and regulations governing privacy and data protection in each and every country where we operate. Where necessary, we will adjust our processing of your personal data as described in this policy to ensure legal compliance.
You may provide us with information about you or your vehicle when utilising Griffin Mill’s services in or outside a vehicle or in other contacts with Griffin Mill, for example through our websites or customer centres (in this context, please note that phone calls may be recorded for quality assurance purposes). We may also obtain such data from our authorised dealers and repairers and other third parties.
We are particularly careful and apply additional measures if and when collecting and processing sensitive personal data, as required by applicable law.
Where reasonably practical or as required by applicable law, we will, in collecting or registering your personal data, provide you with (i) specific information as to the purposes of the processing of your personal data, (ii) the identity of the data controller, (iii) the identities of any third parties to whom the data may be disclosed and (iv) other information which may be necessary to ensure that you are able to safeguard your rights.
We will only retain your personal data for as long as it is necessary to fulfil the purposes outlined in this policy or the purposes of which you have otherwise been informed.
This means that once you have consented to our processing of your personal data, we will retain your data in accordance with the consent given and/or until you revoke your consent. If you have revoked your consent, we may nevertheless retain certain personal data for the period required in order for us to meet our legal obligations and defend ourselves in legal disputes. If we have not obtained your consent to the processing, the data will only be retained for as long as such a period of time as permitted by law.
Where we process your personal data, we strive to ensure that it is accurate and up-to-date. We will seek to erase or rectify personal data that is inaccurate or incomplete. For more information regarding your right to ensure the accuracy of your personal data held by us, please see the "Information and Access" section below.
Information and Access
As stated in the "Notice" section above, we may provide you with specific information concerning our processing of your personal data when collecting or registering such data.
Once per year you have the right to request, and receive free of charge, information on (i) what personal data relating to you we process, (ii) where the personal data is collected, (iii) the purpose of the processing, and (iv), with which recipients or categories of recipients the personal data is shared. Requests for such information must be made in writing and be personally signed by you, and include information on name, address and, preferably, your e-mail address. You also have the right to request that we rectify any incorrect information we hold for you, the right to request that we erase data held on you (please note exemptions may apply under the GDPR or for legal purposes), the right to data portability and the right to restrict the processing of your information. Requests should be sent to: Data Protection Officer, Griffin Mill, Upper Boat, Pontypridd, CF37 5YE.
Your requests will be dealt with in a prompt and proper manner. Requests to delete personal data will be subject to any applicable legal requirements. Where the applicable law provides for an administrative fee for complying with such a request, such a fee may be charged by Griffin Mill.
Griffin Mill strives to implement appropriate technical and organisational measures in order to protect your personal data against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure or access and any other unlawful forms of processing. We aim to ensure that the level of security and the measures adopted to protect your personal data are appropriate for the risks presented by the nature and use of your personal data.