What personal data do we collect?

We will collect, store, and use the following categories of personal information about you:

• Personal details: name, date of birth, national insurance number, award type and bank details;
• Contact details: address, telephone number (including mobile number) and email address;
• Driver licence details;
• Your communication and marketing preferences;
• Your correspondence and communications with Motability Operations Ltd;
• Your online browsing activities on Motability Operations Ltd websites.
• Other publicly available personal data, including any which you have shared via a public platform (such as a Twitter feed or public Facebook page).

We also receive personal data from trusted third parties who provide services to our customers, such as the Department for Work and Pensions, Veterans UK, Social Security Scotland, Driver Vehicle Licensing Agency, manufacturers, supplying dealers, any service agent, accident manager, Motability (registered Charity) and service providers.

How we use it

Motability Operations Ltd (and trusted partners who provide services to our customers) uses your personal data:

• To provide the Vehicle or Product and services to you;
• To verify your identity and manage service interactions with you;
• For customer insight, internal analysis and research;
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests:
• To comply with legal and regulatory requirements;
• For crime and fraud prevention, detection and related purposes;
• With your consent, to contact you with details of Scheme news and changes to and developments within the Motability Scheme;

We may also use your personal data in the following situations, which are likely to be rare:

• Where we need to protect your interests (or someone else's interests).
• Where it is needed in the public interest or for official purposes.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Who we share it with

We may share your personal data with third party providers as set out below:

• Companies or organisations that we have engaged to provide services on our behalf (e.g. the providers of insurance, accident manager, roadside assistance, replacement tyres, replacement windows, the supplying dealer or manufacturer of the vehicle, research agencies);
• Dealers and manufacturers where it is necessary to provide you with a vehicle, product or service;
• Providers of back-up and storage services;

All our third party service providers are required to take appropriate security measures to protect your personal information. We do not allow our third party service providers to use your personal data for their own purposes. We only permit them to process your personal information for specified purposes and in accordance with our instructions.

We may also share your personal data with the third parties as set out below:

• Department for Work and Pensions, Veterans UK or Social Security Scotland (as relevant);
• Driver Vehicle Licensing Agency;
• Motability, the registered charity;
• Any law enforcement agency, court, regulator, government authority or third party where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise protect our rights or the rights of any third party;
• In the event of termination of the Scheme agreement between us and Motability (the registered Charity), we will disclose your personal information to Motability or the newly appointed service provider.

Transferring information outside the United Kingdom (“UK”)

We may transfer your personal information to countries outside of the UK, where this is necessary for the purposes for which we collected it. Whenever we transfer your personal data outside of the UK, we ensure a similar degree of protection afforded to it by implementing at least one of the following safeguards:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission and/or the UK Data Protection Authority.

Where we use certain service providers, we may use specific contracts approved by the European Commission and/or the UK Data Protection Authority which give personal data the same protection as it has in the UK or obtain contractual assurances from the third party given access to your personal information that your personal information will be protected by standards which are equivalent to those that protect your personal information when it is in the UK .”

How we protect your data

Motability Operations is committed to keeping your personal data safe and secure. Our security measures include:

• Security controls which protect Motability Operations Ltd infrastructure from external attack and unauthorised access;
• Regular cyber security assessment and business continuity exercises to ensure we are ready to respond to cyber security attacks and data security incidents;
• Internal policies and procedures relevant to data and data security.

In addition, we limit access to your personal information to those employees, agents, contractors and third party service providers who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

Data retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting purposes and in line with our internal policies.

Your rights relating to your personal data

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

You have the following rights:

• the right to ask what personal data we hold about you at any time;
• the right to ask us to update and correct any out-of-date or incorrect personal data that we hold about you;
• the right to object to processing of your personal information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground.

Right to withdraw consent

In general, we only rely on consent as a legal basis for processing your personal data, in relation to sending you Scheme news and updates as per your contact preferences. You have the right to withdraw this consent at any time.

To withdraw your consent please contact us on 0300 456 4566. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purposes you originally agreed to.

Data protection officer

We have appointed the Head of Legal & Secretariat to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the Data Protection Officer (DPO) by writing DPO at Motability Operations Limited, City Gate House, 22 Southwark Bridge Road, London SE1 9HB.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.