Privacy Statement and Privacy Notice

Our Privacy Statement
At John Clark (Holdings) Limited and all subsidiaries i.e. (1) John Clark (Aberdeen) Limited, (2) Specialist Cars (Aberdeen) Limited, (3) Pentland Motor Company Limited, (4) Clark Commercials (Aberdeen) Limited, (5) Motorchoice (Scotland) Limited, (6) Morrisons Garage Limited, (7) Morrisons (Land Rover) Limited which trades as John Clark Motor Group (JCMG) we will keep you informed of how we collect, store and process your personal data with security being a primary factor in everything we do.

As you know we have to keep a little bit of your personal data, such as your name, email address, payment details and driving licence details to enable us to sell a vehicle to you or carry out some aftercare work, such as warranty.

Your personal data is managed securely and is not sold to any third parties. We only pass personal data to businesses that need your personal data for legitimate reasons, such as the DVLA or the manufacturer. Further information on this can be seen in the privacy policy below.

Finally, we will always give you the option not to receive marketing communications from us and you can always update your marketing preferences through our Customer Data Hub.

The contents of this statement may change from time to time so you may wish to check this page occasionally to ensure you are still happy to share your personal data with us. Where possible we will also contact you directly to notify you of any changes.

Below is our detailed Privacy Notice which is live from 12th June 2018

Privacy Notice
JCMG ("we, “us” or “our”) are committed to protecting and respecting any personal data that our current, former and potential customers (jointly referred to as “customers” or “you”) share with us.
This statement describes what types of personal data we collect from you, or that you provide to us, how it is used and processed by us, how we share it with others, how you can manage the personal data we hold and how you can contact us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
When visiting www.john-clark.co.uk (and any sub-domains unless expressly excluded), www.johnclarkleasing.co.uk or websites of our dealerships (“our websites”), our social media pages, for example our Facebook page (https://www.facebook.com/johnclarkmotorgroup/?fref=ts) or using our live chat available through those websites you will be asked whether you accept and consent to the practices described in this notice.
It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data and what your rights are.
For the purpose of the Data Protection Act 2018 (the Act) the new General Data Protection Regulation (GDPR), the Data Controller is John Clark (Holdings) Limited (Company No: SC098411) of Alliance Centre, Greenwell Road, Aberdeen, United Kingdom, AB12 3AX. If you have any questions about how we process your personal data please contact crm@john-clark.co.uk.

WHAT PERSONAL DATA DO WE COLLECT FROM YOU AND FROM WHERE?
We will collect personal data about you and your vehicle when you use JCMG websites, complete forms on our social media pages, use our live chat facility, visit our dealerships, correspond with us over the phone, email or otherwise contact our Customer Engagement Centre. We may also collect personal data about you from third parties e.g. G Force/Autotrader if you submit an enquiry to them about our services. We will collect some or all of the following data about you:
- Name (Including Title) - Address - Phone Number - Date of Birth - Email Address - Vehicle Information (including registration number, VIN, service reminders, mileage and warranty repair information) - The date and time you used our services - Your IP Address - The internet browser and devices you are using - Cookie Information (please see section on Cookies for further information) - The website address from which you accessed our site - Details of any transaction in our dealership - Voice recordings of calls you make to our dealerships or Engagement Centre - “Live Chat” Records - Marketing and communications data which includes your communication preferences in receiving marketing from us.
HOW DO WE USE THIS PERSONAL DATA?
We use personal data held about you in the following ways and on the following legal bases:

 Consent
o As a business we will not rely on consent as a legal basis for processing your personal data except in relation to third party direct marketing communication to you via email or text message.
o You can amend your preferences at any time by clicking unsubscribe with any marketing communication from us, by using the Customer Data Hub to change your preferences or at the time you provide us with your information.

 Contractual
o To carry out our obligations arising from any contracts entered into between you and us and to provide you with the information, products and services that you request from us, such as a service plan. We may also rely on this basis to legitimise any processing of your personal data that is necessary to take steps at your request to enter into a contract with you e.g. discuss payment plans.
 Legitimate Interests
o We may use and process your personal data as set out below where it is necessary for us to carry out activities for which it is in our legitimate interests as a business to do so.
A. Processing data to contact customers with marketing information that we believe the contents are relevant, appropriate and would benefit the customer.
B. Processing is necessary for us to support customers with sales and other enquiries:
a. To respond to correspondence you send to us and fulfil the requests you make to us (for example test drives, service requests, brochure requests or information about specific vehicles);
b. To provide vehicle support and services (for example warranty services, service reminders, product recalls).
C. Processing necessary for us to understand customers’ and drivers’ needs with a view to continually improving services:
5
a. To analyse, evaluate and improve our products and services so that your dealership experience, website experience, customer engagement centre and bodyshop centre can be improved. (This will generally involve multiple participants and it does not identify you personally);
b. To undertake market analysis to help us understand you better as a customer and tailor our marketing information to be more relevant to you as an individual;
c. In some case we may use automated methods to analyse, combine and evaluate. For example, when your mileage suggests you are due a service – we will send you tailored communication to the effect.
D. Processing necessary for us to promote our business, brands and products and measure the reach and effectiveness of our campaigns:
a. Holding personal data for marketing purposes;
b. Obtaining your marketing preferences and/or marketing choices that you have provided to any of our dealerships for the purposes of sending you e-marketing communications. We will only contact you from the dealership you have an existing relationship with.
c. Contacting you with marketing information by phone or post from time to time. We will only contact you with information about our own products and services and you can ask us to stop at any time. We will not contact you in this manner if you are registered on the Telephone Preference Service or Mail Preference Services (as applicable) or have asked us not to;
d. To contact you from time to time with marketing information (unless you object) if you have expressly indicated to us that you are acting on behalf of a business or where we have obtained your business contact details. You can ask us to stop at any time. In relation to any such information we send by
6
email or SMS, we will include an option allowing you to object to receiving future messages by unsubscribing;
e. To contact you with targeted advertising delivered online through social media and other platforms operated by other companies, unless you object. You may receive advertising based on information about you that we have provided to the platform or because, at our request, the platform has identified you as having similar attributes to the individuals whose details it has received from us. To find out more please refer to the information provided on the help pages of the platforms on which you receive advertising from us;
f. To identify and record when you have received, opened or engaged with our website or electronic communications (please see our Cookie Policy for more information);
g. To administer competitions and promotions that you enter with us from time to time and to distribute prizes.
E. Processing necessary for us to operate the administrative and technical aspects of our business efficiently and effectively:
a. To verify the accuracy of information that we hold about you and create a better understanding of you as a customer;
b. For network and information security purposes i.e. in order for us to take steps to protect your information against loss, damage, theft or unauthorised access;
c. To comply with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes we will keep a record of this on our suppression lists in order to be able to comply with your request).
d. To inform you of updates to our terms and conditions and policies.
7
 Legal Obligation
o We may process your personal data to comply with our legal obligations (for example to register your car with the DVLA).

 Vital Interest
o On occasions we will need to process your personal data to contact you if there is an urgent safety or product recall notice and we need to inform you about it.

HOW DO WE SHARE THIS PERSONAL DATA
We will not sell your personal data to third parties. However it may be necessary, from time to time, to share your personal data within the JCMG group of companies in order to achieve the purposes noted above. In addition, we may from time to time disclose your personal data to the following categories of companies or organisations to which we pass the responsibility to handle services on our behalf.
 Selected third parties including:
 business partners, suppliers and sub-contractors for the performance of any contract we enter into with you, which includes car manufacturers, finance companies, Motability;
 analytics and search engine providers that assist us in the improvement and optimisation of our site e.g. Google Analytics, SEM Rush, Screaming Frog and Buzzumo Pro;
 credit reference agencies such as Experian for the purpose of assessing your credit score where this is a condition of us entering into a contract with you;
 suppliers of our internal IT infrastructure e.g. supplier of a CRM system.
We will also disclose your personal data to third parties for the following reasons:
 In the event that we sell or buy any business or assets, in which case we will disclose your personal data to the seller or buyer (or prospective seller or buyer) of such business or assets;
 If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use https://www.john-clark.co.uk/site/terms-and-conditi... and other agreements we have with you; or
 to protect the rights, property, or safety of JCMG, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
Where the transfer is within JCMG, we will do so in accordance with GDPR. In relation to sharing outwith JCMG, we take steps to ensure that any third party partners who handle your personal data comply with data protection legislation and protect your personal data just as we do. We only disclose personal data that is necessary for them to provide the service that they are undertaking on our behalf and we ensure we have in place appropriate agreements and measures designed to provide appropriate organisational and technical measures with the aim of keeping your data safe.
IF YOU FAIL TO PROVIDE PERSONAL DATA Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to comply with our legal obligation or perform the contract we have or are trying to enter into with you (for example, to provide you with hire purchase agreement). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

CHANGE OF PURPOSE
We will only use your personal data for the purposes for which we collected it as explained above, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

WHERE WILL WE STORE YOUR PERSONAL DATA?
We hold your personal data in the UK, however some third party service providers store data in the US. Where we transfer data with third parties based in the US, we ensure that adequate safeguards are put in place to protect your personal data or we otherwise meet the requirements of GDPR for international transfers.

HOW DO WE KEEP YOUR DATA SECURE?
Once we have received your personal data, we will use strict procedures and security features to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your computer or browser and therefore when your data is transmitted to our site; any transmission is at your own risk.
HOW LONG DO WE KEEP YOUR PERSONAL DATA FOR?
We will not hold your personal data in an identifiable format for any longer than is necessary. If you are a customer or otherwise have a relationship with us we will hold personal data about you for a longer period than if we have obtained your details in connection with a prospective relationship.

If we have a relationship with you, (for example you are a customer or the registered driver of a leased or other vehicles purchased from us, a service customer of one of our dealerships, a customer or one of our approved Bodyshops) we will ultimately hold your data as follows:

- Customer data will be held while you are an active customer with one of our dealerships or service centres and a vehicle is attached to your customer record. - If you no longer have a relationship with a dealership and no vehicle is attached we will hold your record for 7 years from the date our relationship ends. We hold your personal data for this period to establish, bring or defend legal claims. - All vehicle data will be held for 7 years from the date our relationship ends. - Where we have obtained your personal data following a request for information, test drive, brochure, valuation, quotation or other information on any of our products or services, we will hold your data 3 years from the date we collect the information. Unless during that period we form a relationship with you e.g. you purchase or lease a vehicle. - In relation to a new prospect, your chosen dealership will contact you for up to 45 days from the initial request by all methods of communication with information relating to your enquiry that will be of benefit to you. Beyond 45 days if we have received consent we can contact you for up to 3 years.

The only exception to the periods mentioned above are where:

- The law requires us to hold your personal data for a longer period, or delete it sooner; - Where you have raised a complaint or concern regarding a product or service offered by us, in which case we will retain your personal data for a period of 6 years following the date of that complaint or query; - You exercise the right to have the personal data erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law.

YOUR RIGHTS?
You have certain rights as an individual under data protection law. These are set out below. In relation to most rights, we will ask you for personal data to confirm your identity and, where applicable, to help us search your personal data. Except in rare cases we will respond to you within one month after we have received any request (including any identification documents requested).

You have the right to: • You can change your marketing preferences at any time, at which point we shall stop processing your personal in that way. Please note this does not affect the legality of our processing up to the date of your preference updates. • You can seek to restrict our processing of your personal data or ask us to rectify any personal data we hold about you.  You can object to us processing your personal data where we are relying on legitimate interest and we will cease processing for the purpose you object to. An exception to this would be where we have compelling legitimate grounds for processing which override your interests, rights and freedoms or where it is necessary for the establishment, exercise or defence of legal claims. You can also object to our processing your personal data for direct marketing, after which we will stop immediately • You have the right to lodge a complaint with the Information Commissioners Office (ICO) if you think that we have infringed your rights. You can find more information about reporting a matter to the ICO at the following link: https://ico.org.uk/" class="redactor-linkify-object">https://ico.org.uk/ • You have the right to access personal data held by us about you. • In certain circumstances you have the right to ask us to provide you with your personal data in a structured, commonly used and machine-readable format to allow you (or us on your behalf) to transmit this information to another party. More information can be found at https://ico.org.uk • In certain circumstances you have the right to ask us to erase the personal data we hold about you. Such circumstances include (a) where we no longer need your personal data for the purposes set out above; (b) if you withdraw your consent to our processing; (c) if you object to our processing based on our legitimate interest and we have no overriding legitimate grounds to continue processing your personal data; (d) if we process the data unlawfully; or (e) where the personal data has to be erased to comply with legal obligation to which we are subject. We will consider any such request in line with GDPR. Please note this is not an absolute right and there may be circumstances where we choose not to delete all of the personal data we hold about you. More information about your right of erasure can be found at https://ico.org.uk  We do not undertake automated individual decision-making or profiling.

You can exercise the above rights and/or manage your personal data e.g. Rectification or Portability at our Customer Data Hub at https://www.johnclark.co.uk/data-preferences or by contacting us as below:

Post: John Clark Motor Group, Alliance Centre, Greenwell Road, Aberdeen, AB12 3AX Email: CRM@john-clark.co.uk Tel: 1224 407 407

If you have any specific data protection concerns or a complaint, you can address it to our CRM Team at CRM@john-clark.co.uk.

WHAT WE MAY NEED FROM YOU

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

YOUR DUTY TO INFORM US OF CHANGES

It is important that the personal data we hold about you is accurate and current. Please help us by keeping us informed if your personal data changes during your relationship with us.

COOKIE POLICY
What are cookies?
Cookies are small text files that are stored on your computer or mobile device when you visit a website. They allow the website to recognise your device and remember if you’ve been to the website before.
Cookies are very common web technology most websites use cookies and have done for years. Cookies are widely used in order to make websites work more efficiently, as well as providing information to the owners of websites.
Cookies are used to measure which parts of the website people visit and to customer your experience. Cookies also provide information that helps us monitor and improve the website’s performance. For detailed information on the cookies we use and the purposes for which we use them see our Cookie policy https://friend.netdirector.co.uk/3A8ANAQU8EPHENEC/j...
LINKING
Our sites may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.
This version was last updated on 17th May 2018 and historic versions can be obtained by contacting us