Zenith PCO Privacy Notice

Welcome to Zenith’s PCO PRIVACY NOTICE.

Zenith respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data when you visit our websites and driver portals or contact us directly, and tells you about your privacy rights and how the law protects you. 

Click on the links above to view the applicable section of this notice. Please also use the glossary to understand the meaning of some of the terms we have used. 

Purpose of this privacy notice

This privacy notice provides information on how Zenith collects and processes your personal data via your use of our website, including any data you may provide when you register or login to our website, sign up to a newsletter, take part in a prize draw, competition, promotion or survey, order a new vehicle, or access and request certain services from us.

It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them.

Controller

Zenith Vehicle Contracts Limited is the controller for www.pwcpartners.zenith.co.uk

We have appointed a data protection officer (DPO) who is responsible for overseeing this privacy notice and answering any questions you may have. If you would like to discuss any aspect of this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details set out below.

Contact details

Our full details are: Zenith Vehicle Contracts Limited

DPO: Andrew Morton 

Email: [email protected]

Post: Number One, Great Exhibition Way, Kirkstall Forge, Leeds, LS5 3BF

Telephone: 0370 333 1135 (Option 3)

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance and we'd be happy to help.

Changes to the privacy notice and your duty to inform us of changes

This version 2.0 was last updated on 19th June 2019 and historic versions can be obtained by contacting us via the methods set out above.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us – for example if you change your name, address or telephone number.

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit. 

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed, for example anonymous data.

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• “Identity Data” includes your first name, middle name, surname, previous surname, personnel / employee number, marital status, title, date of birth, gender, driving licence number, insurance documentation.
• “Contact Data” includes your home address, previous addresses, residential status, email address and telephone numbers. We may also need this information in relation to additional named drivers as applicable.
• “Financial Data” includes your bank account and payment card details, current income and financial history.
• “Employment data” includes your current job.
• “Transaction Data” includes details about payments to and from you and other details of products and services you have ordered from us or that you are receiving.
• “Technical Data” includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
• “Profile Data” includes your username and password, quotes or orders made by you, your interests, preferences, feedback and survey responses. 
• “Usage Data” includes information about how you use our website, products and services.
• “Marketing and Communications Data” includes your preferences in receiving marketing from us and whether you have ‘unsubscribed’ to marketing.

Special Categories of Personal Data 

Where we provide accident management services, we may collect a limited amount of health information should you be involved in a vehicle incident. We call this the ‘first notification of loss’ and is where (if you are receiving these kind of services) our representatives will record information from you about the incident. If you wish to make a personal injury claim we can, always at your request, refer your details to our preferred specialist law firms, who will then contact you directly and handle the claim on your behalf. We will ensure that any information obtained is limited to what is necessary in order to, for example, administer an insurance or injury claim.

We may collect driving related convictions and offences when we administer fines and traffic offences on behalf of you and your employer.

You may tell us about certain health information (for example, vulnerabilities) and we will use that information to ensure that we can support you to the best of our ability and act fairly and responsibly. We will always ask for your consent and remove this data once it is no longer necessary, for example once your vulnerability ends. This data will only be made available to staff who need to see it.

We do not collect any other Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health other than referenced above and genetic and biometric data). Nor do we collect any information about non-driving related criminal convictions and offences.

If you fail to provide personal data

Where we need to collect personal data and you fail to provide that data when requested, we may not be able to provide a quote for your vehicle, deliver it or provide other services to you that you have requested. In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.  

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us – for example if you change your name, address, or telephone number. 

We use different methods to collect data from and about you including through:

• Direct interactions. You may for example give us your Identity, Contact and Profile Data by filling in forms on our sites or by corresponding with us by post, phone, email, live chat or otherwise. This includes personal data you provide when you:
  • apply for or request our products and services;
  • create an account on our website;
  • submit a finance application on our website;
  • have ordered a vehicle which is due for delivery;
  • apply for or request our services after delivery;
  • enter a competition, prize draw, promotion or survey; or
  • give us some feedback.

• Your Employer. Your employer may give us certain Identity Data about you so that we can ensure that you have access to the correct products and services. We call this an ‘Eligibility File’ and is limited to such Identity Data that we need to ensure that you have access to the right products and services when you access the website. Your employer may also give us certain Identity Data about you so that we can track when you leave your employer. We call this a “Leavers File”. To manage the scheme, we will also share fleet data back with your employer.
• Automated technologies or interactions. As you interact with our website, we may automatically collect Technical Data about your computer equipment, browsing actions and patterns. We collect this personal data by using cookies, and other similar technologies. Please see our Cookie Policy for further details.
• Third parties or publicly available sources. We may receive personal data about you from various third parties as set out below.
• Technical Data from analytics providers.

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. 
• Where it is necessary for the performance of the contract with you, or to take steps to enter into it. 
• Where we need to comply with a legal or regulatory obligation.
• Where we need to verify your identity and your creditworthiness, as well as to prevent money laundering. As a finance provider, we do this to protect our business and obey any laws that apply to us. 
• Where you have given us consent to market to you.

View our Glossary section below to find out more about the types of lawful basis that we will rely on to process your personal data.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you would like to discuss this further.

We may transfer information about your arrangements with us to our third party funders and financiers (Funders), including in connection with transferring our interest, financial or otherwise, in our arrangements to those Funders. We will not transfer personal data to the Funders unless it is absolutely necessary for us to do so however if you are a Director of our corporate customer then we may send your Identity and Contact Data to Funders so that they may complete a credit and fraud check as applicable. In the event of our insolvency, then we may transfer your personal data to those Funders so that they may collect any remaining payments from you and to continue to manage any existing arrangements. Those Funders will provide you with their relevant Privacy Notice at that time and following receipt of your data from us.

Marketing 

We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing). 
We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We have established the following personal data control mechanisms.

Invitation to participate in your employer’s chosen scheme or access to services

You will receive communications from us and in certain cases your employer to advise you that the vehicle scheme and website is open. These communications will be sent to you if you are eligible for the scheme as determined by your employer from time-to-time and with their collaboration. 
We won’t spam you with emails and if you aren’t interested in the scheme you can stop receiving such emails by clicking the unsubscribe link any time. 

Promotional offers from us 

You will receive marketing communications from us and via your employer (if applicable) if you have requested information from us, have obtained a vehicle or services from us or if you provided us with your details when you entered a competition, prize draw or promotion and, in each case, you have not unsubscribed to receiving that type of marketing.

Third-party marketing 

We will get your express opt-in consent before we share your personal data with any company outside the Zenith group of companies for marketing purposes. 

Unsubscribing

You can ask us or third parties to stop sending you marketing messages at any time by following the unsubscribe links on any marketing message sent to you or by contacting us. 
Where you unsubscribe to receiving these marketing messages, this will not apply to personal data provided to us as a result of a product or service experience or other transactions and services required to be fulfilled such as delivering your vehicle or arranging ‘in-life’ services for that vehicle.

Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website and our portals may become inaccessible or not function properly. For more information about the cookies we use, please see our Cookie Policy.

Automated Decisions

We may sometimes use systems to make automated decisions based on personal data we have about you. This helps us to make sure are decisions are quick, fair, efficient and correct based on what we know. These automated decisions can affect the products and services we may offer you or the price that we charge. We may for example place you in groups with similar individuals to learn about our customer’s needs and to make decisions on what we learn. 

You have rights over automated decisions. You can ask us at any time not to make our decision based on an automation, and you can object to an automated decision and ask that a person reviews it. 

If you want to know more about these rights please contact us.

Change of purpose 

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. 

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required and permitted by law.

We may share your personal data with a number of third party partners. We’re unable to name all of them here, due to commercial confidentiality and the large number that we work with. Instead, we’ve provided the categories of partner that we use, and the services that they will provide. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

Scheme launch

We will advise you that the PCO scheme is live and provide instructions to you on how to access the website and register your details.

Finance application stage 

To provide you with a vehicle, we need to run a number of checks to verify your identity and your creditworthiness. We also need to prevent fraud and money laundering. We recommend that you read all the following information carefully. 

Fraud prevention agencies

We will disclose your personal data to fraud prevention agencies.

When we and fraud prevention agencies process your personal data, we do so on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested. If you have requested services and financing from other providers, fraud prevention agencies may receive your personal data from those providers too.

We, and fraud prevention agencies, may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.

If we, or fraud prevention agencies, determine that you pose a fraud or money laundering risk - we may refuse to provide the services or financing you have requested or to employ you, or we may stop providing existing services to you

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details provided below.

Fraud prevention agencies can hold your personal data for different periods of time and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

Our fraud prevention agency is Cifas.

Credit reference agencies

In order to process your application, we will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”).

To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

We will use this information to:

• Assess your creditworthiness and whether you can afford to take the product;
• Verify the accuracy of the data you have provided to us;
• Prevent criminal activity, fraud and money laundering;
• Manage your account(s);
• Trace and recover debts; and
• Ensure any offers provided to you are appropriate to your circumstances.

We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail at the “CRAIN” which is accessible from each of the three CRAs – clicking on any of these three links will take you to the same CRAIN document: Callcredit https://www.callcredit.co.uk/crain; Equifaxhttps://www.equifax.co.uk/crain.html; Experian https://www.experian.co.uk/crain/index.html.

If you make a large number of credit applications within a short period of time, the multiple footprints on your file could affect your ability to obtain credit.

If we determine that the finance may not be affordable to you - we may not approve your application. On request, we can inform you of the CRA from which we obtained your credit file. 

PLEASE NOTE

We may have to run a second finance application check (including fraud, identity and creditworthiness) in the following circumstances:

• If you amend your order and the repayments are higher
• If you amend your order to select another vehicle If there is a delay of 90 days or more between the date of the initial finance application check and delivery of the vehicle

Other

We’ll use a card payment provider to take your processing fee. We will also use an e-signature supplier to complete the agreement. Where you are eligible to use a demonstration vehicle, we will also share your data with motor dealerships and manufacturers.

Order & delivery stage
Once we’ve accepted your credit application we can proceed to order your car. At this stage your personal data will be shared with:

• Motor dealerships, manufacturers and delivery agents to process and deliver new vehicle orders.

Services you receive after delivery
Once your car has been delivered we’ll need to share your personal data with partners who will help to deliver our services. In most instances the data that is shared will be no more than your name, contact details and address. This may include:

• Tyre suppliers – for tyre repairs or replacements
• A vehicle recovery specialist – for vehicle recovery or roadside assistance
• An inbound contact services centre – for out-of-hours assistance
• A customer experience research provider - to monitor customer satisfaction
• Solicitors and a collection agent - to recover debts and collect vehicles when in default
• Tracing agents - to locate a customer or vehicle addresses when in default
• Manufacturers, franchises and approved independent garages - where you are eligible for our maintenance services, and for warranty work and recalls
• Hard and soft copy document archiving specialists – to hold copies of our paperwork
• An automotive data management specialist – to register our interest in the vehicle
• Remarketing agents – to collect and remarket vehicles
• A card payment provider – to take payments from you
• Third party platforms - to co-ordinate and communicate with our supply chain
• IT and system administration service providers – to provide additional services
• A rewards partner – where you sign-up for give-aways, competitions and promotions
• Bodyshops – where you are eligible for our accident management services
• To issuing authorities, the police, private parking companies and third-party notice processing companies – to administer notices of intended prosecutions, penalty charge notices and private parking charge notices
• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

In the majority of cases it will not be necessary for us to transfer your personal data outside the European Economic Area.

If we do need to share your personal data outside of the European Economic Area, we will make sure it is secured to the same high levels required in the EEA – including appropriate transfer risk assessments to ensure data is transferred securely and using appropriate contractual clauses and/or wording.

Whenever fraud prevention agencies transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA as applicable.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

How long will you use my personal data for?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

By law we have to keep basic information about our drivers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for insurance, accident management or tax purposes.

In some circumstances we may anonymise or pseudonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes and we may also put your personal data beyond use. In these instances we may use or hold this information indefinitely without further notice to you.

Under certain circumstances, you have rights under data protection laws in relation to your personal data. Please refer to the following in our Glossary below to find out more about these rights:

• Request access to your personal data.
• Request correction of your personal data.
• Request erasure of your personal data.
• Object to processing of your personal data.
• Request restriction of processing your personal data.
• Request transfer of your personal data.

If you wish to exercise any of the rights set out above, please contact us.

No fee required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights) but see further below.

Refusal

We may refuse to comply with your request if it is clearly unfounded, repetitive or excessive. In these circumstances we will confirm your right to complain to the Information Commissioner’s Office (ICO), and to a judicial remedy, as quickly as we can - but at the latest within one month. We may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

What we need from you

We may need to confirm your identity before we can action any request. This is a security measure to ensure that your personal data is protected from inappropriate use. You will need to provide a copy of your photo driving licence or passport, plus a copy of a utility bill or bank statement within the last 3 months.  We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

LAWFUL BASIS

Legitimate Interest means the interest of Zenith in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us

Performance of the Contract means the processing is necessary for the contract we have with you, or because we have asked you to take specific steps before entering into a contract.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

THIRD PARTIES

Internal Third Parties

Other companies in the Zenith Group acting as joint controllers or processors and who are based in the United Kingdom and provide IT and system administration services and other services.

External Third Parties

• Service providers acting as processors based in the United Kingdom who provide IT and system administration services.
• Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers based in the United Kingdom who provide consultancy, banking, legal, insurance and accounting services.
• HM Revenue & Customs, DVLA, regulators and other authorities acting as processors or joint controllers based in the United Kingdom who require reporting of processing activities in certain circumstances.
• Other third parties acting as processors or joint controllers based in the United Kingdom to whom we subcontract certain services to.

YOUR LEGAL RIGHTS

You have the right to:

Request access: You have the right to be aware of the personal data that we or our partners hold about you, and to verify the lawfulness of the processing. This is formally known as a “Subject Access Request”. When submitting your request, it would assist us if you could specify what information or processing activities you’d like to see.

Request correction: You have the right to have your personal data corrected if it is inaccurate or incomplete. This includes the data that we and our partners hold on you. In many instances you can simply call or email our customer teams, who can make most changes immediately, however you can also send us a formal written request.

Request erasure: In certain circumstances you are entitled to have your personal data erased (also known as “the right to be forgotten”). This includes the personal data that we hold on you and also the data which our partners process (see Third Parties above). Please note that where you are using a vehicle under our fleet management services we have a legitimate interest to continue processing your personal data and we will be unable to erase your data.

Object to processing: You have the right to object where we are processing your personal data for direct marketing purposes. We will remove you from our mailing list.

Request restriction of processing: You have the right to restrict or ‘block’ the processing of your personal data. This might be where you contest the accuracy of the personal data that we hold on you, and require us to restrict any further processing until the personal data has been verified.

Request the transfer: You have the right to receive your personal data in a format that can be easily transferred to, and used by, an alternative service provider. This is formally known as “Data Portability”. We will provide you with a CSV or Excel format file.