1 Introduction

This Policy sets out the obligations of the Marriott Motor Group, a company registered in England under number 03723299 whose registered office is at Wolsey House, Sproughton Road, Ipswich, Suffolk, IP1 5AN regarding retention of personal data collected, held, and processed by the Company in accordance with EU Regulation 2016/679 General Data Protection Regulation ("GDPR").

This statement describes what types of information we collect from you, how it is used by us, how we share it with others, how you can manage the information we hold and how you can contact us.

We will always give you the option not to receive marketing communications from us. We will never send you unsolicited ‘junk’ email or communications, or share your data with anyone else who might. We do not sell your information to third parties, but we do work closely with selected partners who help us to provide you with the information, products and services that you request from us. For example, the AA who provide roadside assistance on our behalf.

The contents of this statement may change from time to time so you may wish to check this page occasionally to ensure you are still happy to share your information with us. Where possible, we will also contact you directly to notify you of these changes.

2 What information do we collect?

We collect information about you and your vehicle when you engage with our website, applications or authorised repairer network. We only collect information which is necessary, relevant and adequate for the purpose you are providing it for.

We collect information about you or your vehicle when you use the Marriot Motor Groups’ websites, applications or when you visit one of our showrooms, service or parts departments. Some of this information does not identify you personally, but provides us with information about how you use our services and engage with us (we use this information to improve our services and make them more useful to you). The information we collect includes some or all of the following:

1. Name (including title);
2. Address;
3. Phone number;
4. Date of birth;
5. Email address;
6. Vehicle information (including registration number, VIN, service reminders, mileage and warranty repair information);
7. The date and time you used our services;
8. The pages you visited on our website and how long you visited us for;
9. Your IP address;
10. Your GPS location (where you have permitted access to this);
11. The internet browser and devices you are using;
12. Cookie, Pixels or Beacon information (for more information please see our Cookie Policy);
13. The website address from which you accessed our website;
14. Details of any transactions between you and us or any authorised repairer;
15. Where you engage with us in a business context, we may collect your job title, company contact details (including email addresses), fleet size and company details;
16. Voice recordings of calls including voicemails:
17. Any information within correspondence you send to

3 How do we use this information?

The Marriott Motor Group will only process information that is necessary for the purpose for which it has been collected. You will always have the option not to receive marketing communications from us (and you can withdraw your consent or object at any time). We will never send you unsolicited ‘junk’ email or communications, or share your personal information with anyone else who might.

Website Marketing

Our website is powered by G Forces Web Management Limited (“GForces”), our third party web services provider. GForces is committed to ensuring that data is processed in accordance with applicable data privacy laws, and is kept secure. GForces is certified to the standard of ISO27001 (an international standard for information security). GForces uses Amazon Web Services, Inc. as its cloud platform provider. All data processed by GForces is stored on Amazon’s web servers in the EEA. GForces' wholly owned overseas subsidiaries sometimes need to access Personal Data in order to provide certain support and development services on behalf of GForces. Please see GForces’ privacy policy at https://www.gforces.co.uk/privacy-policy for more details on its overseas subsidiaries and the protections in place.

When someone visits our website, GForces collects standard internet log information (your IP address, browser, and type of device) and details of visitor behaviour patterns (where you joined our site from, the path you take through our site, the searches you conduct and where you leave). These are stored against unique ids (which are strings of numbers). GForces collects this information for the legitimate business purpose of monitoring the number of visitors to the various parts of the site, the general geographic location of visitors and engagement levels, which in turn enables it to make improvements to its websites and services, and provide business intelligence. This information is only processed in a way which does not identify anyone. It is kept indefinitely if you visit our website.

If you conduct a vehicle search on our website, GForces deposits a record of the search on your device. If you visit our website again, GForces accesses that record and offers you the option to replicate your previous search to save you time repeating it. It also uses that record to present recommended alternatives to the vehicles you previously viewed. In order to do this, GForces sends details of your previously viewed vehicles (without any personal information) to Amazon Web Services, which produces the recommendations using machine learning. If you don’t want search records to remain on your device, you can clear local storage in your browser. To find out how to manage website data (Local Storage) on popular browsers, see the links below. For information relating to other browsers, visit the browser developer's website.

• Google Chrome - https://support.google.com/chrome/answer/2392709
• Microsoft Edge - https://support.microsoft.com/en-gb/help/4468242/microsoft-edge-browsing-data-and-privacy
• Mozilla Firefox - https://support.mozilla.org/en-US/kb/storage
• Microsoft Internet Explorer - https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies
• Apple Safari - https://support.apple.com/en-gb/guide/safari/sfri11471/mac

Email Marketing

Sendinblue is the email marketing software used. This means your information is transmitted to Sendinblue Inc. Sendinblue is prohibited from selling your data and from using it for purposes other than sending email. Sendinblue is a certified email marketing software provider, working in accordance with the European directive 95/46, as well as the German Federal Data Protection Act (BDSG).

More Info: https://www.sendinblue.com/legal/responsible-disclosure/

When you give a company permission to store your personal information and email address and to send you marketing emails, you can revoke this consent at any time via the unsubscribe link in every mailing.

Data protection measures are always subject to technical innovations. For this reason, we ask you to inform yourself about our data protection measures at regular intervals by consulting our data protection policy.

There are various ways in which we may use or process your personal information. We list these below:

a) Consent:

Where you have provided your consent, we may use and process your information to:

1. Contact you from time to time about promotions, events, products, services or information which we think may be of interest to you.
2. To share your personal information with our recommended third party partners, so that they can contact you with marketing information about their products and services (we will, of course, give you details about these third parties before you give your permission for us to send information to them).

You can withdraw your consent at any time by contacting us using the e-mail address, GDPRadmin@marriottmotorgroup.co.ukor, in relation to any marketing messages you receive, by using the unsubscribe option included in those messages.

b) Contractual performance

We may use and process your personal information where this is necessary to perform a contract with you and to fulfil and complete your orders, purchases and other transactions entered into with one of our groups’ dealerships.

c) Legitimate Interests

We may use and process your personal information as set out below where it is necessary for us to carry out activities for which it is in our legitimate interests as a business to do so.

Processing necessary for us to support customers with sales and other enquiries

1. To respond to correspondence you send to us and fulfil the requests you make to us (for example: test drives, service requests, brochure requests or information about specific vehicles);
2. To provide vehicle support and services (for example warranty services and MOT reminders);

Processing necessary for us to respond to understanding customers ‘needs

1. To analyse, evaluate and improve our products and services so that your visit and use of our website, applications, showrooms, service or parts departments are more useful and enjoyable. (Generally we will only use pseudonymised data so that individuals are not identifiable).
2. To undertake market analysis and research (including contacting you with customer surveys) so that we can better understand you as a customer and provide tailored offers, products and services that we think you will be interested in. We will only send marketing communications to you if you have provided your consent for us to do so or which we have obtained in the ways mentioned in the paragraph above;
3. In some cases we may use automated methods to analyse, combine and evaluate information that you have provided to us. We collect and analyse this information in this way so that we can deliver the most appropriate customer experience to you by tailoring and making relevant all our service and communications (for example, when your mileage suggests your vehicle is due for a service);

Processing necessary for us to promote our business, brands and products and measurethe reach and effectiveness of our campaigns

1. To send you marketing information from time to time after you have purchased a product or service from us or made a purchasing enquiry, closed your browser with items in your shopping basket or requested a test drive, brochure or other information of interest. We will only contact you with information about our own products and services (and in ways the law allows), which we hope you will like. You have the right to object to us sending you this information at any time;
2. To contact you from time to time with marketing information (unless you object) if you have expressly indicated to us that you are acting on behalf of a business or an online or public business directory. In relation to any such information we send by email or SMS, we will include an option allowing you to object to receiving future messages by unsubscribing;
3. To identify and record when you have received, opened or engaged with our website or electronic communications (please see our Cookie Policy for more information);
4. To administer competitions and promotions that you enter with us from time to time and to distribute prizes;

Processing necessary for us to operate the administrative and technical aspects of ourbusiness efficiently and effectively

1. To verify the accuracy of information that we hold about you and create a better understanding of you as a customer;
2. For network and information security purposes i.e. in order for us to take steps to protect your information against loss, damage, theft or unauthorised access;
3. To comply with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this on our suppression lists in order to be able to comply with your request);
4. To inform you of updates to our terms and conditions and policies.

d) Legal Obligation

We may process your personal information to comply with our legal requirements (for example to register your car with the DVLA).

e) Vital Interest

Sometimes we will need to process your personal information to contact you if there is an urgent safety or product recall notice and we need to tell you about it.

How do we share this information?

We do not sell your information to third parties, but we do work closely with our authorised repairer network and with third party suppliers who fulfil business activities for us (like roadside assistance, marketing, events and market research etc.)

We do not sell your information to third parties. However, we may from time to time disclose your information to the following categories of companies or organisations to which we pass the responsibility to handle services on our behalf: roadside assistance service providers, customer contact centres, mobility and car hire providers, direct marketing communications agencies and consultants, market research and market analytics service providers, our legal and other professional advisors.

We take steps to ensure that any third party partners who handle your information comply with data protection legislation and protect your information just as we do. We only disclose personal information that is necessary for them to provide the service that they are undertaking on our behalf. We will aim to anonymise your information or use aggregated none specific data sets where ever possible.

Due to the nature of our business, there may be some instances where your information is processed or stored outside of the EU. In those instances, we will ensure that appropriate safeguards are in place for that transfer and storage as required by applicable law.

There are circumstances where we share your information in order to fulfil orders, transactions, handle complaints or provide you with a service or information that you have requested. For example we will share information with Volkswagen Financial Services UK Limited where you enquire about their services through us or where you make a complaint to us and later make the same or similar complaint to them. Volkswagen Financial Services UK Limited may use your information to provide you with information and carry out their obligations arising from contracts you enter into with them. For more information, please see their privacy statement. Below we have provided you with web links to VWFS and other Finance Companies we may contact and share your personal data as part of this process.

Privacy Statement Links

Volkswagen Financial Services

https://www.vwfs.co.uk/en/home/legal_notice.html

Alphera Financial Services

https://alphera.co.uk/privacy-policy

Evolution

https://web.evolutionfunding.com/privacy-policy

How long do we keep your information for?

We will not hold your personal information in an identifiable format for any longer than is necessary. If you are a customer or otherwise have a relationship with us we will hold personal information about you for a longer period than if we have obtained your details in connection with a prospective relationship.

We do not retain personal information in an identifiable format for longer than is necessary.

If we have a relationship with you (e.g. you are a customer or the registered driver of a leased or other vehicle purchased from us or an authorised repairer), we hold your personal information for 6 years from the date our relationship ends. We hold your personal information for this period to establish, bring or defend legal claims. Our relationship may end for a number of reasons including where the vehicle warranty or lease expires, or we have been made aware that you no longer own or drive that vehicle.

The only exceptions to the period mentioned above are where:

• the law requires us to hold your personal information for a longer period, or delete it so
• Where you have raised a complaint or concern regarding a product or service offered by us, in which case we will retain your information for a period of 6 years following the date of that complaint or query; or
• you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law (see further How can I manage the information we hold about you);

How can I manage the information we hold about you

You have the right as an individual to access your personal information we hold about you and make corrections if necessary. You also have the right to withdraw any consent you have previously given us and ask us to erase information we hold about you. You can also object to us using your personal information (where we rely on our business interests to process and use your personal information).

You have a number of rights in relation to your personal information under data protection law. In relation to most rights, we will ask you for information to confirm your identity and, where applicable, to help us search for your personal information. Except in rare cases, we will respond to you within 30 days after we have received any request.

You have the right to:

• Ask for a copy of the information that we hold about you;
• Correct and update your information;
• Withdraw your consent (where we rely on it).
• Object to our use of your information (where we rely on our legitimate interests to use your personal information) provided we do not have any continuing lawful reason to continue to use and process the information. When we do rely on our legitimate interests to use your personal information for direct marketing, we will always comply with your right to object;
• Erase your information (or restrict the use of it), provided we do not have any continuing lawful reason to continue to use and process that information;
• Transfer your information in a structured data file (in a commonly used and machine readable format), where we rely on your consent to use and process your personal information or need to process it in connection with your

You can exercise the above rights and/or manage your information by contacting us using the details below:

Post: Wolsey House, F.a.o. GDPR, Sproughton Road, Ipswich, IP1 5AN

Email: GDPRadmin@marriottmotorgroup.co.uk

If you have any specific data protection concerns or a complaint, you can address it to our Data Protection Administrator at (GDPRadmin@marriottmotorgroup.co.uk)

If you are unhappy, you have the right to lodge a complaint with a data protection regulator in Europe, in particular in a country you work or live or where your legal rights have been infringed. The contact details for the Information Commissioner’s Office, the data protection regulator in the UK, are below:

Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK95AF

Call: 0303 123 1113

Email: casework@ico.org.uk.

Data protection measures are always subject to technical innovations. For this reason, we ask you to inform yourself about our data protection measures at regular intervals by consulting our data protection policy.