Access Information
Access to Your Personal Information, Your Rights, Data Retention and Security
You have the right to request confirmation of whether Vines Limited processes your personal information and, where we do, to request access to that information. This is commonly known as a Data Subject Access Request (DSAR).
In most circumstances, we will provide a copy of your personal information free of charge. However, we may charge a reasonable fee or refuse a request where it is manifestly unfounded, excessive, or repetitive, as permitted by applicable data protection legislation.
If you wish to exercise your rights or update your personal information, please contact our Group Data Compliance Executive using the details below.
Write to
Group Data Compliance Executive
Vines of Guildford BMW
Slyfield Estate
Guildford
Surrey
GU1 1RD
Correcting or Erasing Your Personal Information
We are committed to ensuring that the personal information we hold is accurate and up to date.
You have the right to request that we:
- Correct inaccurate or incomplete personal information.
- Erase your personal information where the legal requirements for erasure are met.
- Restrict the processing of your personal information in certain circumstances.
- Object to certain types of processing.
- Receive your personal information in a portable format where applicable.
Please note that these rights are not absolute. We may be required to retain certain information to comply with legal, regulatory, contractual, or legitimate business obligations, including obligations relating to taxation, accounting, financial services regulation, fraud prevention, warranty administration and the establishment, exercise or defence of legal claims.
Your Data Protection Rights
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you may have the right to:
- Be informed about how your personal information is used.
- Request access to your personal information.
- Request correction of inaccurate or incomplete information.
- Request erasure of your personal information where applicable.
- Request restriction of processing.
- Object to processing carried out under legitimate interests or for direct marketing purposes.
- Withdraw your consent at any time where processing is based on your consent.
- Request the transfer of your personal information to another organisation where technically feasible.
- Request that decisions are not made solely by automated means where applicable.
Complaints
If you have any concerns about how Vines Limited has handled your personal information, we encourage you to contact us in the first instance so that we can investigate and attempt to resolve your concerns promptly.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
Information Commissioner’s Office (ICO) via www.ico.org.uk
Vines Limited ICO Registration Number: Z5951049
How Long We Keep Your Personal Information
We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, accounting, taxation, and business requirements.
Where information is processed for more than one purpose, we will retain it for the longest applicable retention period.
When personal information is no longer required, it will be securely deleted, destroyed, or irreversibly anonymised in accordance with our Data Retention Policy.
Access to personal information is restricted to authorised employees, contractors, and service providers who require access in order to perform their duties.
Marketing Information
Where we process your personal information for marketing purposes, we will continue to do so only if we have an appropriate lawful basis.
You may withdraw your marketing consent or change your communication preferences at any time. Withdrawing consent will not affect the lawfulness of any processing carried out before your request was received.
International Transfers
Vines Limited primarily stores and processes personal information within the United Kingdom and the European Economic Area (EEA).
Some of our carefully selected suppliers and service providers operate outside the UK or EEA. Where personal information is transferred internationally, we ensure appropriate safeguards are in place in accordance with UK data protection legislation. These safeguards may include:
- The UK International Data Transfer Agreement (IDTA).
- The UK Addendum to the EU Standard Contractual Clauses (SCCs).
- Adequacy Regulations issued by the UK Government.
- Other lawful transfer mechanisms recognised under UK GDPR.
We take appropriate technical and organisational measures to ensure your personal information remains secure wherever it is processed.
Legal Bases for Processing
We process your personal information only where we have a lawful basis to do so under the UK GDPR.
These lawful bases include:
- Performance of a contract with you.
- Compliance with our legal and regulatory obligations.
- Our legitimate business interests, provided these do not override your rights and freedoms.
- Your consent, where required.
- The establishment, exercise or defence of legal claims.
Examples of our legitimate interests include:
- Providing and improving our products and services.
- Customer relationship management.
- Preventing fraud and financial crime.
- Creditworthiness assessments.
- Business administration.
- Product quality improvement and research.
- Information security and cyber protection.
- Protecting our legal rights.
Sharing Your Information
We may share your personal information where necessary with:
- Employees, officers, and authorised representatives of Vines Limited.
- BMW Group companies.
- Professional advisers.
- Service providers are acting on our behalf.
- Finance providers.
- Credit reference agencies.
- Fraud prevention agencies.
- Payment service providers.
- Insurance providers.
- Vehicle manufacturers.
- Government bodies and regulators where required by law.
- Law enforcement agencies where legally authorised.
We will only share personal information where there is an appropriate lawful basis, and appropriate contractual and security measures are in place.
Information Security
Vines Limited takes the security of your personal information seriously and maintains appropriate technical and organisational measures designed to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
Although we use industry-standard security measures, no method of transmitting information over the internet or storing information electronically can be guaranteed to be completely secure. We therefore cannot guarantee the absolute security of information transmitted electronically.
Where a personal data breach is likely to result in a risk to your rights and freedoms, we will manage the incident in accordance with our Data Breach Procedure and notify the Information Commissioner’s Office and affected individuals where required by law.
Fraud Prevention
If you believe you have been the victim of fraud or identity theft, you should report the matter to Report Fraud, the UK’s national reporting centre for fraud and cybercrime, and consider notifying the Information Commissioner’s Office if your personal information has been compromised. Relevant contact points are www.actionfraudpolice.co.uk or by calling 03001 232040 or www.ico.gov.uk
Changes to this Privacy Policy
We may update this Privacy Policy occasionally to reflect changes in legislation, regulatory guidance, technology, or our business practices.
Any changes will be published on this website together with the date of the latest revision. We encourage you to review this Privacy Policy periodically so that you remain informed about how we protect your personal information.