AA Cars Dealership Website Privacy Notice

This privacy notice lets you know what happens to the personal data we use and hold when you interact on one of our Dealer websites. You can use the links below to find out more about how the AA use your personal information:

• Personal data we hold and use
• Sources of personal data
• Reasons for using of your personal data
• Sharing and disclosures of your personal data
• Withdrawing your consent
• Transfers outside of the UK or EEA
• Use of automated decisions
• Changes to your data
• Monitoring communications
• Retention of your data
• Your data protection rights
• Your right to object
• Changes to this privacy notice
• Contact Us or our DPO

The AA and our Data Protection Officer

We are Used Car Sites Limited, known as AA Cars. Our main address is Fanum House, Basing View, Basingstoke, Hampshire, England, RG21 4EA. We are a data controller of your personal data. We have a dedicated data protection officer ("DPO"). You can contact the DPO using the details at the bottom of this notice.

The Dealership, whose website you visited, is a separate data controller. Please contact the them for further information on how they process your personal data.

Personal data we hold and use

The list below sets out the types of personal information that we hold and use about you:

• Personal and contact details, such as title, full name, contact details and contact details history
• Your date of birth, gender and/or age
• Records of your contact such as via our phone number and, if you get in touch with us online using our online services, details such as IP address
• Vehicle information, such as make and model, faults, repairs and repair costs. Offers may include the AA's car, insurance, financial services, connected car, travel and any of The AA's other products and services. Also, any products that this dealer may feel appropriate.
• Information about your use of products or services held with our business partners, such financial services and products
• Information we obtained from third parties, such as the dealership

We may be unable to provide you with our products or services if you do not provide certain information to us. In cases where providing some personal information is optional, we'll make this clear.

Sources of personal data

The information we hold comes from different sources. These are:

• From you directly
• Information generated about you when you use our products and services
• From a broker or other intermediary (for example, comparison site) who we work with to provide products or services or quote to you
• Business partners (for example, financial services institutions, insurers), account beneficiaries, or others who are a part of providing your products and services or operating our business

Reasons for using of your personal data

The information we use is used by us and the dealership. The reasons we use your information are below. We have arranged them according to the lawful basis that allows us to use the data. This list applies to the AA:

1. To provide you with our products or services or decide whether to do so:

1. Assessing an application for a product or service, including considering whether or not to offer you the product or service, the price, the risk of doing so, availability of payment method and the terms
2. Managing the product or service you have with us, or an application for one
3. Managing any aspect of the product or service
4. To monitor and to keep records of our communications with you and our staff (see below)
5. To administer our good governance requirements and those of The AA and other members of the AA Group, such as internal reporting and compliance obligations or administration required for Annual General Meeting ("AGM") processes
6. For market research and analysis and developing statistics
7. To develop new products and services and to review and improve current products and services
8. To comply with legal and regulatory obligations, requirements and guidance
9. To provide insight and analysis of our customers both for ourselves and for the benefit of business partners either as part of providing products or services, helping us improve products or services, or to assess or improve the operating of our businesses
10. To share information, as needed, with business partners (for example, financial services institutions, insurers), account beneficiaries, service providers or as part of providing and administering our products and services or operating our business
11. To facilitate the sale of one or more parts of our business
12. To enable us, The AA or other AA Group companies to perform any of the above purposes

2. For our legitimate interests:

1. To perform and/or test the performance of, our and our business partners' products, services and internal processes
2. To follow guidance and recommended best practice of government and regulatory bodies
3. For management and audit of business operations including accounting
4. To carry out searches at Credit Reference Agencies pre-application, at the application stage, and periodically after that. Where you have been introduced to us by a broker or other intermediary they may do these searches on our behalf
5. To carry out monitoring and to keep records of our communications with you and our staff (see below)
6. To administer our good governance requirements and those of other members of our Group, such as internal reporting and compliance obligations or administration required for AGM processes
7. For market research and analysis and developing statistics
8. For direct marketing communications and related profiling to help us to offer you relevant products and services, including deciding whether or not to offer you certain products and service. We will send marketing to you by SMS, email, phone, post and social media and digital channels (for example, using Facebook Custom Audiences and Google Custom Match
9. Subject to the appropriate controls, to provide insight and analysis of our customers to business partners either as part of providing products or services, helping us improve products or services, or to assess or to improve the operating of our businesses
10. Where we need to share your personal information with people or organisations in order to run our business or comply with any legal and/or regulatory obligations

3. To comply with our legal obligations

Sharing and disclosures of your personal data

We may share information with the following third parties for the purposes listed above:

• With AA Group and branded companies, in particular Automobile Association Developments Limited (including AA Breakdown Services), Automobile Association Insurance Services Limited, and Automobile Association Financial Services Limited
• Business partners (for example, financial services institutions, insurers
• Governmental and regulatory bodies such as HMRC, the Financial Conduct Authority, the Prudential Regulation Authority, the Ombudsman, the Information Commissioner's Office and under the Financial Services Compensation Scheme
• Other organisations and businesses who provide services to us such as debt recovery agencies, back up and server hosting providers, IT software and maintenance providers, document storage providers and suppliers of other back office functions
• Market research organisations who help us to develop and improve our products and services

Withdrawing your consent

If we rely on your consent, you can withdraw this at any time. Use the contact details below or on our website.

Transfers outside of the UK or EEA

Your personal information may be transferred outside the UK or European Economic Area, for example to service providers. If we do so, we'll make sure that suitable safeguards are in place where required, for example contractual agreements or other legal measures unless certain exceptions apply.

Changes to your data

You should tell us so that we can update our records via the contact details provided below. We'll then update your records if we can.

Monitoring communications

We may monitor, communications with you, where permitted by law. We do this for quality control and staff training purposes, to comply with regulatory rules, to prevent or detect crime, to protect the security of our communications and data to enforce compliance with business polices.

Use of automated decisions

We do not perform any automated decision making in providing the service.

Retention of your data

Unless we explain otherwise to you, we'll hold your personal information based on the following criteria:

• For as long as we have reasonable business needs;
• For as long as we provide products or services to you and then for as long as someone could bring a claim against us; or
• To comply with legal and regulatory requirements or guidance.

Your data protection rights

Here is a list of the rights that all individuals have under UK data protection laws. They don't apply in all circumstances so your request may not always be granted. If you wish to use any of them, we'll explain at that time if they apply or not, and if we will comply or not with your request, including the reasons why.

• The right to be informed about the processing of your personal information;
• The right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed;
• The right to object to processing of your personal information;
• The right to restrict processing of your personal information;
• The right to have your personal information erased;
• The right to request access to your personal information and how we process it;
• The right to move, copy or transfer your personal information; and
• Rights in relation to automated decision making which has a legal effect or otherwise significantly affects you.

You have the right to complain to the Information Commissioner's Office which enforces data protection laws. You can contact our DPO for more details on all the above.

Your right to object

You have the right to object to certain purposes for processing, in particular to data processed for direct marketing purposes and to data processed for certain reasons based on our legitimate interests. You can contact us via dataprotection@theaacars.com to exercise these rights.

Opting out of marketing

You can stop our marketing at any time by contacting us on the details below, emailing dataprotection@theaacars.com or following the instructions in the communication.

Changes to this privacy notice

We may change this privacy notice from time to time by updating this page to reflect changes in the law and/or our privacy practices. We encourage you to check this privacy notice for changes whenever you visit one of our Dealer websites.

Contact Us or our DPO

If you have any questions about this privacy notice, or if you wish to exercise your rights or contact the DPO, you can contact us by going to the Contact Us section of our website. Alternatively, you can write to AA PLC, Fanum House, Basing View, Basingstoke, Hampshire, RG21 4EA, marking it for the attention of the DPO or email dataprotection@theaacars.com