Carsa Limited's Privacy Notice

1. Introduction

Carsa Limited (“Carsa”) is committed to protecting your privacy.

This Privacy Notice sets out the basis on which any personal data is collected from you and processed by Carsa, including how we protect your data.

For the purpose of the General Data Protection Regulations 2018, the Data Controller is Carsa, a company registered in England under company registration number 12805624 and whose registered office address is at Carsa, Unit 7 Barton Park Industrial Estate, Chickenhall Lane, Eastleigh, Southampton, SO50 6RR.

Revisions to this Notice will be updated here so you will always be aware of what information we collect and the legal basis for our processing.

The Privacy Notice was last updated on 27 April 2021.

2. What is personal data?

Personal data is data that relates to a living individual who can be identified directly or indirectly either:

• From that data; or

• From that data and other information, which is in our possession, or is likely to come into our possession.

3. What is our legal basis for processing your data?

The normal legal basis for us processing your data is that it is necessary for the legitimate interests of Carsa. We have carefully assessed these interests and balanced them with the interests of our customers to ensure fair processing e.g. processing data to facilitate the car buying journey and aftersales customer care as efficiently as possible.

If you are making a finance application another legal basis is relied upon; that it is necessary for the entering into and the performance of a contract.

Upon purchasing a vehicle your personal data will be stored for up to 6 years, the legal basis being that it is a necessary for compliance with a legal obligation, as the HMRC require this for accounting purposes.

Reason for Retention Sale of a vehicle General Enquiries Request for valuation Staff Applications

For more examples of how your personal data may be processed and the legal basis for doing so please see the separate headed section below.

4. Examples of how your personal data may be processed & the legal basis for doing so

Below are some of the reasons for processing customer data in-line with the legitimate interests of Carsa:

• Supplying goods and services to our customers.
• Improving existing products and services and developing new products and services.
• Handling customer contacts, queries, complaints or disputes.
• Understanding our customers’ behaviour, activities, preferences, and needs in order to provide a tailored service.
• Considering job applications.
• Fulfilling our duties to our customers, colleagues, shareholders and other stakeholders.
• Allowing our advisers to follow up our service, either by email, telephone, SMS or mail, as part of our customer care procedures.
• Promoting, marketing and advertising our products and services
• Sharing your data with selected third-party partners whose products and services support and describe our sales, customers, traffic patterns and other site information to prospective partners, advertisers, investors and other reputable third parties and for other lawful purposes (these statistics will include no personally identifying information).
• For the purpose of detecting fraudulent activity: data that identifies computers or other devices you use to connect to the Internet. This includes your Internet Protocol (IP) address.

In particular circumstances we will also process and share your personal data in order to comply with a legal obligation, for example:

• Preventing, investigating and detecting crime, fraud or anti-social behaviour including but not limited to prosecuting offenders, including working with law enforcement agencies.
• Effectively handling legal claims or regulatory enforcement actions taken against Carsa.
• Protecting Carsa, its employees and customers, by taking appropriate legal action against third parties who have committed criminal acts or are in breach of legal obligations. Length of Time 6 years 2 years 1 year 6 months Up to 1 Year 2
• Protecting customers, employees and other individuals and maintaining their health and safety.
• Complying with any other legal and regulatory obligations that may arise. Lastly, we will process and share your data in the following ways on the condition that your consent has been given:
• Sending promotional, offers and news related communications that are relevant and tailored to you.
• Sharing your data with third parties so that they can communicate related products and services that may be of interest to you.

5. How do we use your personal data?

A. Collected on carsa.co.uk website Registering for a Carsa Account

In order to register for a Carsa Account, a self-service user profile which allows you to manage vehicles you are interested in, you will be required to supply your full name, email address, password, postcode and mobile telephone number. Your contact details are collected to enable us to contact you directly depending on one or more of the below requests.

Call Back, Test Drive, Enquiries, Shortlists and eStock Alerts

If you would like to request a call back, book a test drive, submit an enquiry, add cars to your shortlist to compare or sign up for eStock alerts you will be required to register for a Carsa Account.

Valuation

If you would like to apply online for a free valuation of your car you will be required to supply: your vehicle registration number, approximate mileage, postcode, name, mobile number (we need this to send you a validation code to reveal your valuation) and email address. Your details will be used to provide an estimated online valuation, which is based on our assumptions and the limited details about your car that you have shared with us. We always carry out a full inspection on-site before we offer to either part exchange a vehicle or to buy it. If we think that anything in the car’s history or condition will affect its value, including damage, unusual features or customisation, the price that we offer for it will be different to the valuation we gave you online.

Finance Applications

If you would like to apply for finance online you will be required to supply your name, email address, telephone number, date of birth, marital status, driving license type, residential status, monthly income, employment type and duration. If you make an application, your details will be held and used in a credit scoring or other automated decision-making process when assessing your application, multiple finance companies on our lending panel may receive this information in order to consider it. Their Privacy Notices are listed below and can be viewed on the website link provided, alternatively you may wish to call them for more information. If your finance application is incomplete or incorrect, we will contact you to offer assistance.

Santander Consumer Finance - 0800 085 1759 – website: https:// www.santanderconsumer.co.uk/your-data/privacy-policy/

MotoNovo Finance - 033 200 0030 – website: https:// customer.motonovofinance.com/privacy

MK Finance Tel: 03333 110088 – website: https://www.mkcarfinance.co.uk/privacy- notice-mkcf/

Recruitment

If you use our recruitment platform and decide to apply for a role at Carsa you will be asked to give some personal information (e.g your name, email, telephone number, address and employment history and salary expectations). You will also be asked to upload your CV. This information is collected to enable us to contact you directly and consider your application

for the role you applied for, or in respect of other roles. We will also request information regarding your eligibility to work in the UK, Equal Opportunities Monitoring information and depending on the role; your driving licence and experience. The recruitment platform offers a self-service tool, where you can access and amend your profile and set up job alerts. Your personal information will be securely retained for a period of up to 12 months as per the data storage within your application. This is dictated by you.

Live Chat and Online Form

If you use the chat service to communicate with our customer service team, you may disclose personal information in the course of using the service. All conversations and email exchanges are recorded. Any personal information that you disclose during a live chat or via an online form will be accessible to and processed by and made available to Carsa.

By submitting personal information to us, you are deemed to have agreed to the terms set out above regarding the use of your personal information.

B. Collected at Carsa’s Sales Support Centre & Showrooms Registering with us and viewing vehicles

We collect the following information by creating or updating your unique Customer Record Form (“CRF”) on our dealer management system: name, telephone number, email, postcode, gender, your thoughts on the vehicles you have viewed, proposed method of funding the vehicle purchase, whether you require finance or part exchange and your driver’s licence details.

Due to our belief that customers should be able to view cars by themselves at their own leisure, customer’s contact details and identifying information are required to establish a record and track the possession of keys, what cars are being viewed and when.

In order to facilitate a test drive, your driver’s licence number will also be recorded. If a passport or driver’s licence is scanned to auto-populate the CRF your image will be cropped onto the form. Our system will also automatically flag if your driver’s licence details do not meet our test drive requirements by checking the length the licence has been held by you and also your age.

Information recorded will be primarily used to help support your car buying journey. This includes contacting you following your visit to offer assistance in the event that you have been unsuccessful in finding the right car.

Your CRF will also be relied upon in the event that a Health and Safety or Security matter requires it, where necessary CCTV operated on the Carsa premises will be used in conjunction. This may include contacting you or passing on your details in the event of the emergency services requiring access to them.

Please note that most service related conversions at our service desks and on the phone are recorded for Training and Compliance purposes and are utilised in the event of addressing a complaint and to providing feedback to staff where applicable.

Vehicle Valuation

Alongside a physical inspection, information about your current vehicle is required in order to provide a valuation of the vehicle. The information we require includes the car registration plate, make, model, vehicle mileage, price required and whether the vehicle has had paint protection applied to it.

Finance Applications

In addition to information collected when registering and updating your CRF, in order to complete a finance proposal, the following information is required: date of birth, nationality, residence status, marital status, number of dependent children, ID type available, address, current employment details, proof of employment and previous employment details. Financial details also required include: bank details, income, expenditure, home valuation, assets valuation, whether this is a replacement loan, whether a change in your circumstances is currently expected and also the purpose of the vehicle under consideration for purchase is recorded. In submitting a finance application, your details are held and used in credit scoring or other automated decision-making processes. Your application may be submitted to multiple finance companies, their Privacy Notices are listed below and can be viewed on their website link or you may wish to call them for more information.

Santander Consumer Finance - 0800 085 1759 – website: https:// www.santanderconsumer.co.uk/your-data/privacy-policy/

MotoNovo Finance - 033 200 0030 – website: https://customer.motonovofinance.com/ privacy

MK Finance - Tel: 03333 110088 – website: https://www.mkcarfinance.co.uk/privacynotice- mkcf/

Other services

We provide a number of specialised communications at your request to assist in the car buying process such as call backs, test drive bookings and eStock alerts. These and any similar processes will be saved on your CRF. We may require further information from you to be able to complete and provide the service requested. Please get in touch with a member of our team for more information.

Post-sale

In addition to the data collected initially via your CRF, your address, the registration number of the vehicle purchased along with any additional products or services required is also collected. Your address is used to verify your identity alongside bills and other methods of identification. Any correspondence received in the course of facilitating an after-sale service will also be recorded.

For marketing communications

We will automatically contact you with regard to your services, for example, with updates to your requested alerts, applications or appointments.

Subject to your consent, we will use your personal information to contact you with information about offers, news and promotions.

When you register with carsa.co.uk or create a CRF in our showroom, we ask you whether you would like to receive offers, news or promotional marketing communications from Carsa that we feel may be of interest to you and if you would like to receive third party information. In order to receive these communications, you will need to opt in during registration.

If you no longer wish to receive marketing communication from us you can write to the Data Controller at

Carsa, Unit 7 Barton Park Industrial Estate, Chickenhall Lane, Eastleigh, Southampton, SO50 6RR.

or email customercare@carsa.co.uk

Remember that if you say you do not wish to receive any promotional material from us, this will preclude you from receiving any of our offers, news or promotions that may be of interest to you.

6. How do we protect your information?

Carsa will take all reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy.

Our team constantly review and improve our measures to protect your personal information from unauthorised access, accidental loss, disclosure or destruction.

Our security measures include:

• Regular scenario planning and crisis management exercises to ensure we are ready to respond to cyber security attacks and data security incidents.
• Daily testing of our security and IT systems.
• Security controls which protect the entire Carsa infrastructure from external attack and unauthorised access.
• Carsa policies outlining our data security approach and training for employees.

It is important for you to protect against unauthorised access to your password and to your personal computer. Be sure to sign off when you finish using a shared computer. We can’t accept responsibility for any unauthorised access or loss of personal information that is beyond our control.

All information (except Payment Card information) you provide to Carsa is stored on Carsa’s servers and/or on a leading technology providers.

Our security procedures mean that we may request proof of identity before we disclose personal information to you.

7. How may we disclose your data to third parties?

In order to deliver a high standard of support we will provide information about you:

• To employees and agents of Carsa to deal with your accounts, products and services related to Carsa.
• With your agreement, to additional service providers whose products and services may be of interest to you, such as mechanical breakdown insurance or exterior and interior car protection products.
• To third parties using aggregate information and statistics for the purposes of monitoring usage of our services in order to help us develop our services, for example, to additional service partners and advertisers. These statistics do not include information that can be used to identify any individual.

In addition, we will disclose your personal data to third parties if required as follows:

• For the purposes of the prevention or detection of offences, and/or the apprehension or prosecution of offenders, we may share any information that we collect with the police, other public or private sector agencies, governmental or representative bodies in accordance with the relevant legislation. This may also include public authorities, insurance companies, finance companies, automotive advertising companies and/or other agencies.
• In order to comply with any legal or regulatory requirements.
• To finance companies, if making a finance application through Carsa.
• To credit reference agencies, if making a finance application through Carsa.

We will not pass on your personal information to third parties except in accordance with this policy and our Terms and Conditions.

8. What are your rights?

Depending on the legal basis we have relied upon to process your data you have various rights you can choose to exercise.

All requests will be considered by the Data Controller or relevant Department Management and responded to within 28 days of receipt. Requests can be made either in person or by email customercare@carsa.co.uk.

Erasure

If you feel that there is no compelling reason for your personal data to continue to be processed you can request erasure. If consent was originally obtained this can simply be withdrawn. In other circumstances the request will be considered by the Data Controller.

Portability

In event that data has been processed on the basis of consent or for entering into or the performance of a contract you may request to have the data provided to you in a structured, commonly used and machine readable form (usually in CSV format).

Object

If you no longer wish your data processed due to grounds relating to your particular situation, where we are relying upon legitimate interests, you can exercise your right to object. Where this is concerned with direct marketing it will be stopped immediately.

Customers have the right to withdraw consent given to communications at any time.

Consent Necessary for performance of a contract Compliance with a legal obligation Necessary for the purposes of the legitimate interests

Right to erasure

Right to portability

Right to object

But right to withdraw consent

You also have the right to access your personal data, to request a copy of your personal data please write to Data Controller, Carsa, Unit 7 Barton Park Industrial Estate, Chickenhall Lane, Eastleigh, Southampton, SO50 6RR or request via email customercare@carsa.co.uk.

Other rights include the right to be informed about how your personal data is processed, to request rectification if you feel data is inaccurate or incomplete and related to automated decision making including profiling. You also have the right to have processing restricted in the event of contesting the accuracy of your personal data, where you have objected to processing and if you require the data to establish, exercise or defend a legal claim. Please visit the Information Commissioner’s Office website if you require more information: https://ico.org.uk/

If you are unhappy with the response following your request or you would like to make a complaint about how your data has been processed please refer to the Information Commissioner’s Office who are the supervisory authority in this area: https://ico.org.uk/ make-a-complaint/

9. How do we use cookies & how they benefit you?

Our website uses cookies, as almost all websites do, to help provide you with the best experience we can. Cookies are small text files that are placed on your computer or mobile phone when you browse websites.

Our cookies help us:

• Make our website work as you would expect.
• Save you having to register every time you visit your Carsa online account.
• Remember your settings during and between visits.
• Improve the speed and security of the website.
• Allow you to share pages with social networks, like Facebook.
• Continuously improve our website for you.
• Help our marketing be more targeted to your needs.

We do not use cookies to:

• Collect any personally identifiable information (without your express permission).
• Collect any sensitive information (without your express permission).
• Pass personally identifiable data to third parties.
• Pay sales commissions.

10. Granting us permission to use cookies

If the settings on your software to view this website (your browser) are adjusted to accept cookies we take this, and your continued use of our website, to mean that you have accepted the use of our cookies. Should you wish to remove or not use cookies from our website you can learn how to do this below. However, doing so will likely mean that our site will not work as you would expect.

11. More about Carsa Cookies Strictly Necessary Website Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services such as:

• Determining if you are logged in or not.
• Remembering your search settings.
• Remembering if you have accepted our terms and conditions.
• Remembering your preferences such as layout.

You can set your browser to block or alert you about these cookies, but some parts of the website will not then work. These cookies do not store any personally identifiable information.

Cookies don't harm your computer. Like other online companies, we use cookies to provide you with more relevant and useful information. We don't store personally identifiable information such as credit card details, but we do use information gathered from cookies to help improve your experience of the Carsa website.

Anonymous Visitor Statistic & Performance Cookies

We use cookies to compile visitor statistics, such as how many people have visited our website, what type of technology they are using (e.g. Windows, Mac or Android) which helps us to identify when our website isn't working, how long our customers spend on our website, what page they look at etc and so forth. This helps us to continuously improve our website. These “analytics” programs also tell us, on an anonymous basis, how people reached our web site (e.g. from a search engine) and whether they have been here before, helping us to develop our services for our customers.

All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies on your browser we will not know when our customers visited our site, and will not be able to improve its performance.

Advertising

Cookies are widely used in online advertising. Neither us, advertisers or our advertising partners can gain personally identifiable information from these cookies. They will be used to build a profile of your interests and show you relevant adverts on other sites.

They do not store direct personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

You can learn more about online advertising at: http://www.youronlinechoices.com/ You can opt-out of almost all advertising cookies at: http://www.youronlinechoices.com/uk/ your-ad-choices

It is also worth noting that opting out of advertising cookies will not mean you won't see adverts, just simply that they won't be tailored to you any longer.

Third Party Cookies

Our website, like most websites, includes functionality provided by third parties. A common example is an embedded YouTube video or pulling through TrustPilot Reviews. Disabling these cookies will likely break the functions offered by these third parties.

Site Improvement

Cookies From time to time we test new designs or website features. We do this by showing slightly different versions of our website to different people and anonymously monitoring how our website visitors respond to these different versions. We might also use anonymised heat mapping software to understand popular pages and specific functionality on our website. This helps us to offer you a better user experience.

Google Site Stats

Please note that pages on our website may be tracked by Google site stats

Remarketing/Audience

Cookies You may notice that sometimes after visiting a website you see increased numbers of adverts from the site you visited. This is because advertisers, including ourselves, pay for these adverts. The technology to do this is made possible by cookies, and as such, we may place a so called “remarketing cookie” during your visit. We use these adverts to offer targeted messages to encourage you to come back to our site. However, we are unable to proactively reach out to you as the whole process is entirely anonymised and you can opt out of these cookies at any time as explained above and below.

If you wish to opt out you can do so by visiting Google’s Ads Settings:

https://myaccount.google.com/privacy#ads

Social Website Cookies

These cookies are set by a range of social media services that we have added to the website to enable you to share our content with your friends and other networks. They are capable

of tracking your browser across other websites and building up a profile of your interests. This may therefore impact the content and messages you see on other websites you visit.

If you do not allow these cookies you may not be able to use or see these sharing tools.

The privacy implications on this will vary from social network to social network and will be dependent on the privacy settings you have chosen on these networks.

Cookies used on our website:

A list of cookies used on our website (this is a current snapshot and cookie may change over time, especially those from third parties) is available to view here: https://bit.ly/ 2Kw1H8H

When do our cookies expire?

Except for essential cookies, most of the cookies on our websites expire at the end of your current session on our website. However, some of our cookies have an extended lifespan, which ranges from 1 day to 26 years. Some of our cookies are persistent and will never expire. If the cookie used is a flash cookie, please note that flash cookies do not expire.

12. Turning Cookies Off

You can usually switch cookies off by adjusting your browser settings to stop it from accepting cookies. Doing so however will likely limit the functionality of our's and a large proportion of the world's websites as cookies are a standard part of most modern websites.

Amending cookies setting in different types of browser:

Cookie settings in Edge: https://support.microsoft.com/en-us/help/196955

Cookie settings in Firefox: https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy

Cookie settings in Chrome: https://support.google.com/accounts/answer/61416

Cookie settings in Safari: https://support.apple.com/kb/ph21411

It may be that your concern around cookies relates to so called "spyware". Rather than switching off cookies in your browser, you may find that anti-spyware software achieves the same objective by automatically deleting cookies considered to be invasive. Learn more about managing cookies with antispyware software.