This policy outlines the principles governing the collection, processing and use of any personal data you provide to us or that we gather from you. Please read the following information carefully to understand our perspectives and practices regarding your personal data and how we will handle it. By visiting our websites, you agree to and accept the practices described in this policy
For the purposes of the European Data Protection Regulations (GDPR) and the Data Protection Act 2018 (the Act), the data controller is PDC Vehicles Ltd.
This Privacy Statement details how we process your information and your rights under both the DPA and GDPR.
We are delighted by your interest in our company. Data protection is a particularly high priority for PDC Vehicles. The use of PDC Vehicles' internet pages is possible without providing any personal data; however, if a data subject wishes to use special enterprise services via our website, the processing of personal data may become necessary. If the processing of personal data is required and there is no statutory basis for such processing, we generally obtain consent from the data subject.
The processing of personal data, such as the name, address, email address or telephone number of a data subject, will always be in line with the General Data Protection Regulation (GDPR) and in accordance with the country specific data protection regulations applicable to PDC Vehicles. Through this data protection declaration, our enterprise aims to inform the general public about the nature, scope and purpose of the personal data we collect, use, and process. Furthermore, data subjects are informed of their rights through this data protection declaration.
As the controller, PDC Vehicles has implemented numerous technical and organisational measures to ensure the most complete protection of personal data processed through our website and our Customer Relationship Management systems. However, internet based data transmissions may have security gaps, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transfer personal data to us via alternative means, such as by telephone, if they wish.
Information we may collect from you
We may collect and process the following data about you:
We store your data securely and only for the relevant period of time, which is deemed reasonable and directly related to one of the following:
We do not retain documents such as bank statements or utility bills beyond the credit application stage and such documents are deleted automatically.
Further information about the period of time your data is stored can be found later in this policy.
*Full details can be provided upon request.*
Our website uses cookies to differentiate you from other users. This helps us provide you with a better browsing experience and allows us to improve our site. For detailed information on the cookies we use and their purposes, please see our Cookie Policy below.
We use the information we hold about you in the following ways:
Information you provide to us. This can include sensitive personal and financial data.
We may share your personal information with our funders (if you proceed with an order, this is the finance company you enter into an agreement with) and other third parties such as vehicle manufacturers. This is for purposes such as the credit proposal stage and to progress with an order, including communication related to your order/transaction and arranging delivery and/or collection.
We may share your information with selected third parties, including:
We may disclose your personal information to third parties:
The data we collect from you may be transferred to and stored at, a destination outside the European Economic Area (EEA). It may also be processed by staff operating outside the EEA who work for us or one of our suppliers. Such staff may be engaged in, among other things, fulfilling your order, processing your payment details and providing support services. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.
All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using SSL technology. Where we have given you (or where you have chosen) a password that enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
The data protection declaration of PDC Vehicles is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). Our data protection declaration should be legible and understandable for the general public, as well as our customers and business partners. To ensure this, we would like to first explain the terminology used.
In this data protection declaration, we use, among others, the following terms:
Personal data refers to any information related to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
A data subject is any identified or identifiable natural person whose personal data is processed by the controller responsible for the processing.
Processing refers to any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
Restriction of processing is the marking of stored personal data with the aim of limiting their processing in the future.
Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, particularly to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.
Pseudonymisation is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
The controller or controller responsible for the processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
A recipient is a natural or legal person, public authority, agency or another body to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.
A third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
Consent of the data subject is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
You have the right to request that we do not process your personal data for marketing purposes. We will inform you (before collecting your data) if we intend to use your data for such purposes or if we plan to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data. You can also exercise this right at any time by contacting us at [email protected].
Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies, and we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.
We operate under the Data Protection Act 2018 (DPA) and the European General Data Protection Regulation (GDPR).
The DPA and GDPR apply to the 'personal data' we process and outline the main responsibilities we are accountable for.
We must ensure that personal data shall be:
We ensure lawful processing of personal data by obtaining consent; or where there is a contractual obligation to do so in providing appropriate products and services; or where processing the data is necessary for the purposes of our legitimate interests in providing appropriate products and services.
In most cases, we process personal data based on your contract with us. In other cases, we process personal data only where there are legitimate grounds for doing so.
To meet our Data Protection obligations, we have established comprehensive and proportionate governance measures.
We ensure data protection compliance across the organisation through:
Under the GDPR, you have the following specific rights in respect of the personal data we process:
Additional information and clarification on your rights:
Every data subject has the right, as granted by the European legislator, to obtain confirmation from the controller as to whether or not personal data concerning them is being processed. If a data subject wishes to exercise this right of confirmation, they may contact our Data Protection Officer or another employee of the controller at any time.
Every data subject has the right, as granted by the European legislator, to obtain from the controller free information about their personal data stored at any time and a copy of this information. Furthermore, the European directives and regulations grant the data subject access to the following information:
Furthermore, the data subject has the right to obtain information as to whether personal data are transferred to a third country or to an international organisation. Where this is the case, the data subject has the right to be informed of the appropriate safeguards relating to the transfer.
If a data subject wishes to exercise this right of access, they may contact our Data Protection Officer or another employee of the controller at any time.
Every data subject has the right, as granted by the European legislator, to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
If a data subject wishes to exercise this right to rectification, they may contact our Data Protection Officer or another employee of the controller at any time.
Every data subject has the right, as granted by the European legislator, to obtain from the controller the erasure of personal data concerning them without undue delay, and the controller has the obligation to erase personal data without undue delay where one of the following grounds applies, as long as the processing is not necessary:
If one of the aforementioned reasons applies and a data subject wishes to request the erasure of personal data stored by PDC Vehicles, they may contact our Data Protection Officer or another employee of the controller at any time. The Data Protection Officer of PDC Vehicles or another employee shall promptly ensure that the erasure request is complied with immediately.
Where the controller has made personal data public and is obliged pursuant to Article 17(1) to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested erasure by such controllers of any links to, or copy or replication of, those personal data, as far as processing is not required. The Data Protection Officer of PDC Vehicles or another employee will arrange the necessary measures in individual cases.
Every data subject has the right, as granted by the European legislator, to obtain from the controller a restriction of processing where one of the following applies:
If one of the aforementioned conditions is met, and a data subject wishes to request the restriction of the processing of personal data stored by PDC Vehicles, they may contact our Data Protection Officer or another employee of the controller at any time. The Data Protection Officer of PDC Vehicles or another employee will arrange the restriction of the processing.
Every data subject has the right, as granted by the European legislator, to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine readable format. They have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, as long as the processing is based on consent pursuant to point (a) of Article 6(1) of the GDPR or point (a) of Article 9(2) of the GDPR, or on a contract pursuant to point (b) of Article 6(1) of the GDPR, and the processing is carried out by automated means, as long as the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Furthermore, in exercising their right to data portability pursuant to Article 20(1) of the GDPR, the data subject has the right to have personal data transmitted directly from one controller to another, where technically feasible and when doing so does not adversely affect the rights and freedoms of others.
To assert the right to data portability, the data subject may contact the Data Protection Officer designated by PDC Vehicles or another employee at any time.
Every data subject has the right, as granted by the European legislator, to object, on grounds relating to their particular situation, at any time, to the processing of personal data concerning them, which is based on point (e) or (f) of Article 6(1) of the GDPR. This also applies to profiling based on these provisions.
PDC Vehicles shall no longer process the personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise, or defence of legal claims.
If PDC Vehicles processes personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for such marketing. This applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to PDC Vehicles processing for direct marketing purposes, PDC Vehicles will no longer process the personal data for these purposes.
Additionally, the data subject has the right, on grounds relating to their particular situation, to object to the processing of personal data concerning them by PDC Vehicles for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
To exercise the right to object, the data subject may directly contact the Data Protection Officer of PDC Vehicles or another employee. Additionally, the data subject is free, in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to use their right to object by automated means using technical specifications.
Every data subject has the right, as granted by the European legislator, not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them, or similarly significantly affects them, as long as the decision (1) is not necessary for entering into, or the performance of, a contract between the data subject and a data controller, or (2) is not authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or (3) is not based on the data subject's explicit consent.
If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and a data controller, or (2) it is based on the data subject's explicit consent, PDC Vehicles shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express their point of view, and contest the decision.
If the data subject wishes to exercise the rights concerning automated individual decision-making, they may contact our Data Protection Officer of PDC Vehicles or another employee of the controller at any time.
Every data subject has the right, as granted by the European legislator, to withdraw their consent to the processing of their personal data at any time.
If the data subject wishes to exercise the right to withdraw consent, they may contact our Data Protection Officer of PDC Vehicles or another employee of the controller at any time.
The controller for the purposes of the General Data Protection Regulation (GDPR), other applicable data protection laws in the Member States of the European Union, and other data protection provisions is:
PDC Vehicles
32 Eyre Street
Sheffield
S1 4QZ
United Kingdom
Phone: 0330 165 9527
Email: [email protected]
Website: pdcvehicles.co.uk
Any data subject may contact our Data Protection Officer directly at any time with all questions and suggestions concerning data protection.
The website of PDC Vehicles collects a range of general data and information whenever a data subject or automated system accesses the website. This general data and information are stored in the server log files. The data collected may include (1) the types and versions of browsers used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrers), (4) the sub websites, (5) the date and time of access to the website, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) any other similar data and information that may be used in the event of attacks on our information technology systems.
When using this general data and information, PDC Vehicles does not draw any conclusions about the data subject. Instead, this information is needed to (1) deliver the content of our website correctly, (2) optimise the content of our website as well as its advertising, (3) ensure the long term viability of our information technology systems and website technology and (4) provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber attack. Therefore, PDC Vehicles analyses anonymously collected data and information statistically, with the aim of increasing the data protection and data security of our enterprise and to ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.
Data subjects have the option to register on the website of the controller by providing personal data. The specific personal data transmitted to the controller is determined by the respective input mask used for the registration. The personal data entered by the data subject are collected and stored exclusively for internal use by the controller and for their own purposes. The controller may request transfer to one or more processors (e.g., a parcel service) that also use personal data for an internal purpose attributable to the controller.
By registering on the website of the controller, the IP address—assigned by the Internet service provider (ISP) and used by the data subject—along with the date and time of the registration are also stored. This data storage is necessary to prevent the misuse of our services and if necessary, to make it possible to investigate committed offences. Therefore, the storage of this data is necessary to secure the controller. This data is not passed on to third parties unless there is a statutory obligation to pass on the data, or if the transfer serves the aim of criminal prosecution.
The registration of the data subject, with the voluntary indication of personal data, is intended to enable the controller to offer the data subject content or services that may only be offered to registered users due to the nature of the matter in question. Registered persons are free to change the personal data specified during the registration at any time or to have them completely deleted from the data stock of the controller.
The data controller shall, at any time, provide information upon request to each data subject as to what personal data are stored about the data subject. In addition, the data controller shall correct or erase personal data at the request or indication of the data subject, insofar as there are no statutory storage obligations. A Data Protection Officer particularly designated in this data protection declaration, as well as the entirety of the controller’s employees, are available to the data subject in this respect as contact persons.
The website of PDC Vehicles contains information that enables an enquiry on a vehicle to be submitted, as well as direct communication with us, which also includes a general address for electronic mail (e-mail address). If a data subject contacts the controller by e-mail or via an enquiry form, the personal data transmitted by the data subject are automatically stored. This may include electronic mail (using the email(s) provided by the data subject), direct mail, telephone (using the relevant telephone number(s) provided), SMS/MMS or other digital messages, instant messaging, or other communication methods. Such personal data transmitted on a voluntary basis by a data subject to the data controller are stored for the purpose of processing or contacting the data subject. There is no transfer of this personal data to third parties.
If you submit an enquiry or order form, all the personal data transmitted by the data subject are automatically stored. Such personal data transmitted on a voluntary basis by a data subject to the data controller are stored for the purpose of processing or contacting the data subject. This may include electronic mail (using the email(s) provided by the data subject), direct mail, telephone (using the relevant telephone number(s) provided), SMS/MMS or other digital messages, instant messaging or other communication methods. Please note that as part of the process to order a vehicle, we are required to request personal data for the purpose of a credit proposal.
If you do not intend to proceed with an order of a car, then all personal data from the submission of an enquiry form by a data subject will be retained for a reasonable time, after which we will delete the data subject’s details. Within this timeframe, we will contact the data subject for all reasons relating to the enquiry of a car, including a short survey detailing reasons for not proceeding with an order.
As we are a broker and not a lender, we will ask for your express consent to submit your data to a third party, being the lender. The lender will be one of our partner funders (the finance company with whom you will enter into an agreement should you proceed with an order). Further information regarding this process and our funders can be requested directly from the Data Protection Officer. Vehicles are ordered through one of the UK Automotive dealer networks. Therefore, to progress with the order of a vehicle, we must share relevant information with a dealer. Personal information shared with a dealer will include sensitive data such as your address and contact details to progress the order.
The website of PDC Vehicles provides information that enables quick electronic contact and direct communication with us, including a general email address. If a data subject contacts the controller by email or via a contact form, the personal data transmitted by the data subject are automatically stored. Such personal data, provided voluntarily by a data subject to the data controller, are stored for the purpose of processing or contacting the data subject. This personal data is not transferred to third parties.
You will receive marketing communications from us if you have provided your consent during the order process or opted in to receive our marketing communications via our website. You can withdraw your consent at any time using the link at the bottom of our communications.
You will receive marketing communications from us if you have requested information from us and have not opted out of receiving that marketing. If you are a business enquirer or customer (with or without a live enquiry or contract on our systems) and have provided us with an email address (i.e., you deal with us as a representative of a registered company or other corporate body, excluding sole traders and partnerships), we may contact you regarding our deals and marketing offers. This is based on the ICO Electronic Mail Marketing guidance, which states that “you can email or text any corporate body.” We will email anyone connected to your business account, except those who have unsubscribed. You have the right to opt out of receiving these communications at any time.
You can opt out at any time using the link at the bottom of our communications. As clearly detailed on our website forms, we use ICO and PECR opt-in and soft opt-in guidance and rules as the basis for sending these communications.
Our website uses cookies to distinguish you from other users. This helps us provide you with a good experience when you browse our website and allows us to improve our site.
Cookies are text files stored on a computer system via an Internet browser. Cookies contain information that is transferred to your computer's hard drive.
We use the following cookies:
Strictly necessary cookies: These are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website.
Analytical or performance cookies: These allow us to recognize and count the number of visitors and see how visitors move around our website when using it. This helps us improve the way our website works, for example, by ensuring that users find what they are looking for easily.
Functionality cookies: These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name, and remember your preferences (for example, your choice of language or region).
Targeting cookies: These cookies record your visit to our website, the pages you have visited, and the links you have followed. We use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.
Many websites and servers use cookies. Many cookies contain a so called cookie ID, a unique identifier of the cookie. It consists of a character string through which Internet pages and servers can be assigned to the specific Internet browser in which the cookie was stored. This allows visited Internet sites and servers to differentiate the individual browser of the website visitor from other Internet browsers that contain other cookies. A specific Internet browser can be recognised and identified using the unique cookie ID.
Through the use of cookies, PDC Vehicles can provide users of this website with more user friendly services that would not be possible without the cookie setting.
By means of a cookie, the information and offers on our website can be optimised with the user in mind. Cookies allow us to recognise our website users. The purpose of this recognition is to make it easier for users to utilise our website. The website user that uses cookies does not have to enter access data each time the website is accessed, because this is taken over by the website, and the cookie is thus stored on the user's computer system. Another example is the cookie of a shopping cart in an online shop. The online store remembers the articles that a customer has placed in the virtual shopping cart via a cookie.
You can find more information about cookies at www.allaboutcookies.org and www.youronlinechoices.eu. For a video about cookies, visit www.google.com/intl/en-GB/policies/technologies/cookies/.
Cookies we use are detailed below:
We use Google Analytics log cookies (such as _utma, _utmv, _utmc, _utmz, and _utmb) to identify user activities such as which pages are being visited and for how long. This helps us analyse data about webpage traffic and user behaviours to improve our website and tailor it to customer needs. We only use this information for statistical analysis purposes, and then the data is removed from the system. You can find more details about Google Analytics cookies here.
Overall, cookies help provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.
Google Analytics places a cookie on the information technology system of the website visitor. With the setting of the cookie, Google is enabled to analyse the use of our website. With each call up to one of the individual pages of this website, which is operated by the controller and into which a Google Analytics component was integrated, the Internet browser on the device used by the website visitor will automatically submit data through the Google Analytics component for the purpose of online advertising and the settlement of commissions to Google. During the course of this technical procedure, Google gains knowledge of personal information, such as the IP address of the website visitor, the access time, the location from which the access was made, and the frequency of visits to our website by the website visitor, which serves Google, inter alia, to understand the origin of visitors and clicks, and subsequently create commission settlements.
These personal data are stored by Google in the United States of America. Google may pass these personal data collected through the technical procedure to third parties.