Stellantis &You UK Privacy Statement

This Privacy Statement sets out all the information that we are required, by UK Data Protection laws, to provide to you about how Stellantis &You Sales & Service (trading as Stellantis &You UK) (hereinafter referred to as “Stellantis &You UK”, "we" or "us") will process your personal data.

1. What purposes does Stellantis &You UK process your personal data for and what is the legal justification for this processing?

	*The purposes for which we collect and process your personal data are:*	*We are lawfully permitted to use your personal data for this purpose because:*
1	To fulfil your order, deliver or service your vehicle.	It is necessary to enable us to perform or contractual commitments to you.
2	To book any test drive or provide any brochure you request or to respond to any query you might have.	It is necessary in our legitimate interests to serve our customers properly.
3	To provide, manage and respond to any requests you have made to us	It is necessary in our legitimate interests to ensure that we serve our customers properly.
4	To help us identify you when you contact us.	It is necessary in our legitimate interest to ensure that we serve our customers properly and provide you with a personalised service.
5	To manage safety recalls and quality campaigns	It is necessary to do this in order to comply with legal requirements.
6	To provide you with service/MOT reminders	It is necessary in our legitimate interests to ensure that our customers are aware of when their vehicle is due a service or MOT.
7	To provide you with the most user-friendly online navigation experience.	It is necessary in our legitimate interest to improve our websites and provide you with the best possible experience when you visit our websites.
8	For general administration, reporting, audit and analysis purposes and to manage our relationship with you	It is necessary in our legitimate interests and to ensure the effective management of our business.
9	For market research purposes, customer satisfaction surveys and to carry our mystery shopping exercises. This helps us improve the quality of our products and services we provide.	It is necessary in our legitimate interest to manage our business effectively and to improve our offering to you.
10	To market to you and, where appropriate, to invite you to any events that we might organise	You have consented for us to contact you for these purposes. We will not contact you for these purposes unless you have consented.
11	To help us detect and prevent fraud and money laundering and to recover any debts owed to us.	It is necessary in our legitimate interests to protect our business.
12	To comply with law for example if we are required by any law enforcement agency, court, regulator, government authority or other third party.	It is necessary to comply with a legal obligation
12	Pass on to any third party that purchases, or to which we transfer, all or substantially all of our assets or business. Should such a sale or transfer occur, we will use reasonable efforts to try to ensure that the entity to which we transfer your personal information uses it in a manner that is consistent with this Policy,	This is necessary in our legitimate interests in order to manage our business.
13	To carry out analysis and customer profiling. We may combine and analyse your personal information to help us develop and improve our products and services, understand our customers better; and to manage and improve our relationship with you. This could include, for example, informing our distribution strategy, evaluating the effectiveness of our marketing and customer service, conducting market analysis and identifying products or services which may be of interest to you.	It is necessary in our legitimate interests to ensure that we personalise the service we provide to you and interact with you in the way that suits you best.
14	To help you understand whether or not you are likely to be successful securing finance if you require finance to support your purchase	It is necessary in our legitimate interests to help you proceed with your purchase. It is also necessary in your legitimate interests for us to support you as part of this process.
15	To take a deposit payment from you when you place an order for a vehicle online	It is necessary for the performance of a contract where you order a vehicle from us online.
16	We may also record calls you make tour customer service team or that we make to you for training and monitoring purposes.	It is necessary in our legitimate interests to ensure that our staff are trained and t ensure that we are dealing with your queries efficiently and effectively.

2. Who do we share your personal data with?

The personal data we process will be shared by Stellantis &You, on a need to know basis to a restricted number of third parties, depending on the purpose of the processing, as follows:

	Type of third party	Reason for sharing
1	Third parties who provide our Contact Centre services.	To answer general queries and action brochure & test drive requests.
2	PSA Financial Services	For any questions about your existing finance agreement.
3	Finance Companies	To enable them to assess your application and, where appropriate, to offer you a finance package to support your purchase
4	Payment Providers	To facilitate the taking of deposit payments where you order a vehicle online.
3	Marketing & Advertising Agencies	To enable them to create our advertising campaigns, emails, newsletters, letters, brochures & social media posts.
4	Print & Fulfilment Partners	To enable them to send material such as letters and brochures.
5	Data Management Partners	To securely manage data.
6	Media Partners (such as Google, Facebook, Quantcast and AdRoll).	To advertise our products and services.
7	Technology Partners and IT service providers	To manage services on our websites, for example Part Exchange Valuation and to help us maintain our IT systems.
8	Analysis Partners	Analyse how our websites are navigated how effective our advertising campaigns are and which products and services are of most interest.
9	Market Research Partners	To research how you use your vehicle, what you like and what you dislike and what we need to do in order to increase your satisfaction and improve our products and services going forward.
10	Credit Card Payment Processors	To securely process credit card payments.
11	Driver & Vehicle Licencing Agency (DVLA)	Organisation that keeps a register of licenced vehicles in the UK.
12	Citroën UK Ltd / Peugeot Motor Company PLC / Citroën UK Ltd t/a DS Automobiles / Vauxhall Motors Limited	We will share your information with the vehicle manufacturer and they will process it in order to process vehicle sales, replacement parts and accessory sales, manufacture and deliver your vehicle, for servicing, to manage warranty claims, for analysis, reporting and to record vehicle history. For more information about how the manufacturer will use your information you can access their full Privacy Policy by clicking here: Peugeot, Citroen, DS Automobiles or Vauxhall.
13	Third parties who provide marketing services to us	To contact you on our behalf
14	Stellantis Europe S.p.A	We share personal data relating to our customers and prospective customers with our group company in order to enable them to perform customer relationship and marketing activities as data controller on behalf of the entire Stellantis group of companies. You can find our more about how Stellantis Europe processes your personal data for these purposes by reading their privacy policy which is available here.

3. Are your personal data transferred outside the EU?

We may transfer your Information to a country outside the European Economic Area ("EEA"), provided that the country to which the personal data are transferred ensures an adequate level of protection for your rights and freedoms. If this country does not offer the same level of data protection as the European and local data protection legislation, Stellantis &You UK will take adequate measures to ensure that the collected personal data is processed in accordance with the applicable legislation relating to data protection.

Personal data we hold may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. That staff maybe engaged in, among other things, the fulfilment of contracts with you, the processing of payment details and the provision of support services. By submitting Information to us, you agree to this transfer, storage and processing.

4. How long do we keep your personal data for?

The length of time we will keep your personal data for will depend on the purpose we are processing it for. However, in deciding how long we need to keep it for, we will apply the following criteria:

we will keep personal data for the minimum period we need to for the purpose(s) we collected it for as described in Article 1 above.;
Your personal data are then archived as required by law for the length of time we are legally required to keep it for
Your personal data are then anonymized or deleted.

For more information, You can also refer to our Data Protection Co-ordinator by email to pcrukdataprotectionofficer@mpsa.com or by post to the Data Protection Co-ordinator, Stellanits &You UK Head Office, Pinley House, 2 Sunbeam Way, Coventry, CV3 1ND.

5. How do we use cookies on our website and other digital media?

'Cookies' are small pieces of information sent to your device and stored on its hard drive to allow our websites to recognise you when you visit.

When you visit our website or use our applications or other digital media, we may, subject to your consent, use cookies, pixel tags, and other technologies to collect the following data:

IP address, login information, browser type, location, time zone, operating system, and other technical information
Information about your visit, including the websites you visit before and after our website and products you viewed
Length of visits to pages on our website, and page interaction information
Please see Our cookies policy for further information [https://www.stellantisandyou.co.uk/cookies].

6. What are your rights and how can you exercise them?

Data Protection laws give you a number of rights in relation to the personal data we hold about you. In particular, you have the right to access your personal data, to have it corrected (where it is inaccurate or incomplete) and, in certain circumstances to have it erased, restricted or transferred to a third party. You also have the right to object to it being processed. You should be aware that not all of these rights apply in every instance therefore, in some cases, we would not have to comply. If you are unhappy about how Stellantis &You has handled (or is handling) your personal data, you have the right to complaint to the Information Commissioner’s Office (“ICO”). You can do this by visiting www.ico.gov.uk. The ICO can investigate your claim and take action against anyone who’s misused personal data.

You can unsubscribe from marketing communications by completing the Contact Preferences form. Your request will be actioned within 14 working days.

You can also withdraw your consent at any moment if the processing is based on your consent.

You can exercise these rights on simple request to our Data Protection Co-ordinator by email to pcrukdataprotectionofficer@mpsa.com or by post to the Data Protection Co-ordinator, Stellantis &You UK Head Office, Pinley House, 2 Sunbeam Way, Coventry, CV3 1ND.

PRIVACY POLICY

IMPORTANT LEGAL NOTICE

Stellantis &You UK are committed to protecting and respecting your privacy.

This policy (together with our Terms of Use and any other documents referred to within it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand how we use and protect the information that you provide to us in accordance with the General Data Protection Regulation (“GDPR”).

By visiting, using, or registering www.stellantisandyou.co.uk (the “Site”) or if you apply for a vacancy with us you agree that your personal information will be used by us as described in this policy

For the purposes of GDPR, the data controller is Stellantis &You UK Limited of Pinley House 2 Sunbeam Way, Coventry, West Midlands, CV3 1ND. For further information about how to contact us, please see the section headed Our Data Protection Officer and your queries and right to complain.

INTRODUCTION

This Privacy Policy sets out the information that we are required, by GDPR, to give you when we collect your personal information. It may change from time to time so please check it periodically. If you have an account with us and we plan to make any substantive changes to this policy, we will notify you by email.

DATA PROTECTION PRINCIPLES

We will comply with data protection law. It requires that the personal information we hold about you must be: -

Processed fairly, lawfully and in a transparent manner.
Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
Relevant to the purposes we have told you about and limited only to that which is necessary for those purposes.
Accurate and kept up-to-date.
Kept only for as long as necessary for the purposes we use it for and which we have told you about.
Kept securely.

PROCESSING YOUR PERSONAL INFORMATION

We will collect and process the following information (“Personal Information”) about you:

Information you give us. When you contact us via the "Email Us", “Register your Interest” and “Apply” links on the Site or contact us by telephone, text or email us we will collect personal data from you, as more particularly set out below in the section entitled “What kind of personal data to we collect from you”.

Information we collect about you. Personal data will also be obtained automatically by your internet browser including (without limitation) technical information such as your IP address and information about your visit to the Site such as page response times, download errors and length of visits to certain pages. For more information about the cookies we use on this Site, please visit our [Cookies policy].

WHAT KIND OF PERSONAL INFORMATION DO WE COLLECT FROM YOU?

You can have a look through the Site without giving us any of your Personal Information (other than as described above under “Information we collect about you”). We will make sure that we only collect the minimum information we need from you at each stage of this process. If you or any third party (e.g a recruitment agent) provides us with information that is irrelevant or excessive, we will dispose of it securely and will not keep a copy.

If you decide to apply for a position through the Site or an agency, we will need to collect and process Personal Information, including (without limitation):

At application stage we will collect the following information:

name, address, postcode and e-mail address;
contact telephone numbers and date of birth;
user name and password;
your application/CV, including (without limitation) details of your skills (education, professional qualifications and training), employment history and referees, previous salary, start date;
whether you are eligible to work in the UK and hold a full driving licence; and how you heard about us. If you do not provide us with this Personal Information we will not be able to consider your application.
Gender, nationality, sexual orientation and disability. These details will be kept confidential and will not affect your application. More so, this will not be shared with anyone who is part of the selection process and will only be used for monitoring purposes. There is no obligation on you to provide this information.

If you are invited to interview stage, we may collect the following personal data:

eligibility to work in the UK – copies will be taken; and
notes of your interview and appraising your performance

HOW WILL WE USE THE PERSONAL INFORMATION WE HOLD ABOUT YOU?

Personal Information you provide to us will be used to:

process your application;
consider you for the position you have applied for, and any upcoming vacancies that are suitable (if you have opted in to be contacted in respect of subsequent vacancies);
fulfil our legal obligations including (without limitation) to carry out our obligations arising from any contracts entered into between you and us to provide you with information that you request from us;
provide general information (which does not identify individuals) and statistics to help us develop our websites, services and recruitment processes;
make up part of your personnel records if your application is successful. However, this will only be for as long as it’s relevant to your employment;
approach your nominated referees for the purposes of obtaining references; and
carry out equal opportunities monitoring (see below).

Where you provide personal data about somebody else, like your referees, you should always ask them beforehand to get their consent.

Equal opportunities – we’re required by law to make basic documentation checks on every candidate. Please note that we’ll ask you to provide documentation of your eligibility to work in the UK if you’re invited to attend the next stage of the recruitment process. Other Personal Information, for example, relating to your gender, race or ethnic origin, religion or belief, age bracket, details of any disability and sexual orientation may be requested for the purpose of monitoring the effectiveness of our equal opportunities policy. This Personal Information is requested purely for monitoring purposes.

HOW LONG WILL WE KEEP YOUR PERSONAL INFORMATION FOR?

We will keep Personal Information obtained via the “Apply” button for no longer than 12 months if your application is unsuccessful and you do not proceed to interview stage. If you proceed to interview stage, we will keep your Personal Information for 1 year unless you are successful in which case your Personal Information will be transferred to our HR Team who will retain it in line with our HR Retention Policy. If you provide Personal Information via the “Register your Interest” button, we will keep it for no longer than 12 months.

WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH?

We will share your Personal Information with third parties, including third-party service providers and, to the extent necessary, other entities in the PSA group of companies. We require that any third parties we share personal data with, respect the security of your Personal Information and treat it in accordance with the law.

In particular, we will disclose the Personal Information we hold about you to third parties where required by law, where necessary to administer our relationship with you or where we have another legitimate reason to do so.

Third parties include third party service providers. The following activities are carried out by third party service providers:

background checking service providers; and
companies we use to provide pre-employment checks

THE LAWFUL BASIS ON WHICH WE HANDLE YOUR PERSONAL INFORMATION

Data protection law sets out a number of conditions which organisations can rely on in order to lawfully handle personal information. The conditions we rely on are as follows: -

Legitimate interests

The law permits us to handle your Personal Information where necessary in our legitimate interests provided that this isn’t outweighed by your interests. Many of the purposes we handle your Personal Information, described above, fall into this category as they are essential activities which enable us to manage our recruitment process, to improve our website and to monitor our processes. We may, if necessary, also use your Personal Information to defend our legal rights or to obtain legal advice and to manage any complaint that you might have. We ensure that your rights and interests are protected when we do this.

Consent

We are permitted to use your Personal Information when you give us your consent for us to do so. We will only use your Personal Information to contact you for direct marketing purposes if you give us your consent to do so.

Required by law

We will, if required by law, disclose your Personal Information for example in response to a court order. We will disclose your Personal Information if requested by a law enforcement agency or where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person or as otherwise permitted or required by law and consistent with legal requirements.

WHERE WE STORE PERSONAL INFORMATION

All Personal Information you provide to us is stored on our secure servers. Where we have given you (or where you have chosen) a password which enables you to access certain parts of the Site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to the Site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

ACCURACY OF YOUR PERSONAL INFORMATION

It is your responsibility to ensure that the Personal Information you provide to us is accurate and up-to-date. If your information changes, you can let us know by contacting us using the methods described below.

YOUR RIGHTS

By law you have a right to require access to your Personal Information (commonly known as a “data subject access request”). This enables you to receive a copy of the Personal Information we hold about you;
Request correction of the Personal Information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;
Request the erasure of your Personal Information. This enables you to ask us to delete or remove Personal Information where there is no good reason for us continuing to process it
Ask us to stop processing Personal Information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground;
Request the restriction of processing of your Personal Information. This enables you to ask us to suspend the processing of Personal Information about you, for example if you want us to establish its accuracy or the reason for processing it;
Request the transfer of your Personal Information to a third party.

If you want to access, review, verify or request erasure of your Personal Information, object to the processing of your Personal Information or request that we transfer a copy of your Personal Information to another party, please contact data protectionuk@mpsa.com

RIGHT TO WITHDRAW YOUR CONSENT

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your Personal Information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact pcrukdataprotectionofficer@mpsa.com. Once we have received notification that you have withdrawn your consent, we will no longer process your Personal Information for the purpose or purposes originally agreed to, unless we have another legitimate basis for doing so.

Our Data Protection Officer and your queries and right to complain

We have appointed a Data Protection Officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your Personal Information, please contact our DPO on pcrukdataprotectionofficer@mpsa.com. You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO). You can do this via the ICO website at www.ico.gov.uk.