Chief Vehicle Rentals Ltd
Privacy Policy

Chief Vehicle Rentals Ltd (CVR) is committed to protecting privacy and keeping your personal information secure. When you use our services, you agree to us collecting and using your personal data or personal information and this policy explains how we collect and use your personal data or personal information.

Personal data, or personal information, means any information about a living individual from which that person can be identified. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (the GDPR).

CVR complies with its obligations under the GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data and personal information.

CVR is the data controller (collectively referred to as “Chief Vehicle Rentals Ltd”, “we”, “us” or “our” in this privacy policy) – and responsible for your personal data and how your personal data is processed and used. We have appointed a Privacy and Compliance Manager (PACMAN) who is responsible for overseeing questions in relation to this policy. If you have any questions, including any requests to exercise your legal rights, please contact the PACMAN using the details set out below.

Contact Details:
Chief Vehicle Rentals Ltd, The Coachworks, Roundham Road, Paignton, TQ4 6DS
Privacy and Compliance Manager
By phone: 01803 663838
By email: compliance.officer@chiefrentals.com

Security, Integrity and Confidentiality
We are committed to protecting the confidentiality and security of the information you provide to us and we put in place appropriate technical, physical and organisational security measures to protect your data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a legitimate business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put into place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach when we are legally required to do so.

The Data we collect about you
We will collect personal data, or personal information about you when you contact CVR directly or through our websites, by telephone, post, e-mail, or through any other means for the following purposes:-
 

• To hire/lease/buy a vehicle

• Claim management

• Dealing with complaints

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to have with you (for example, to provide goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

The information we collect may include basic personal details such as your name, address, email address, telephone number, date of birth, emergency contact details, National Insurance number, driving licence, proof of address. All copies of such data are stored electronically and by hard copy and be kept in a locked office, drawer or filing cabinet where unauthorised people cannot see it. Copies of personal data such as these are shredded and disposed of securely when no longer required.

We also gather data from a variety of other sources, for instance through in vehicle dash cams, and in vehicle telematics devices. These provide us with the use of or access to location information, crash notification and related crash detail, operational condition, mileage, diagnostic and performance reporting of vehicles.

We may receive personal data about you from various third-parties and publicly available sources for instance; Companies House, when setting up an account with us.

What is the legal basis for processing your personal data?
We will only use your personal data when we have a lawful reason to do so. If we hold personal information about you, we will only use this for the purposes you have agreed to and for a specified, legitimate and explicit purpose and will not further process in a way that this is incompatible with this purpose. We will only hold personal data that is relevant, adequate and limited to what is necessary in relation to the purposes for which that data is processed. The processing of the personal data is necessary for the performance of the task to be carried out.

Sharing your data
Your personal data will be treated as strictly confidential, and will only be shared within the organisation to those who require if for the purpose of the carrying out the task for which the data was collected for.

Your personal data will only be shared with third parties on a need to know basis, and for them to carry out the task for which the personal data was collected for i.e. to check for driving endorsements, claim liaison with external bodies etc. Examples of third parties we may share your data with:
 

• Liaising with insurance companies and their representatives, third parties, garages, engineers, solicitors

• Local Authorities/Police when dealing with Penalty Charges

• Regulatory bodies such as FOS, LO & BVRLA when dealing with Complaints

• Small Claims Courts/Debt Recovery Agencies when Recovery of vehicles/equipment or monies is required

• Merchant Services when handling payments

• Service Providers if a vehicle outside our fleet is required to fulfil a booking

• Any person or organisation where we are required to because of a Court order, legal duty, or statutory obligation

• Credit reference, and fraud prevention, agencies in order to help prevent and detect fraud, or as part of our debt collection process o Like many Credit Hire Organisations, Accident Management businesses, and Insurers, we pass information relating to claims to the VBASE database (VBASE), which is operated by Verius Risk Solutions Limited. The aim is to help us check information provided and to also prevent fraud. We will pass information relating to Your incident to Verius Risk Solutions Limited for analysis as part of its risk appraisal business. In dealing with Your incident we may search VBASE. VBASE is also accessible by other clients of Verius Risk Solutions Limited and third parties with whom Verius Risk Solutions Limited contracts, other providers of data to VBASE, financial service providers and insurance industry in general for the purposes of risk assessment, identification, prevention, detection and management of fraud and other associated law enforcement purposes.

We previously passed information relating to claims to the Netfoil database (Netfoil), which was owned and operated by Hill Dickinson LLP. Any information passed to
Netfoil between November 2012 and November 2017 will be transferred to VBase.

International Transfers
We generally do not transfer your personal data outside of the European Economic Area (EEA). If there were a need, we would obtain your specific consent prior to doing so. In this circumstance, we would only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries.

Accuracy
We will take reasonable steps to ensure the accuracy of personal data, that it is kept up to date and that actions are taken to avoid storing old or redundant data. We will ensure that the source of personal data is clear. We will take action to ensure that inaccurate personal data with regard to the purposes for which they are processed should be erased or rectified without delay.

Storage/Retention
We will ensure that personal data is kept in a form that permits identification of data subjects for no longer than necessary, to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.
We will archive personal data as we are required to do so by law as outlined in the CVR Data Retention Policy. We will securely delete and/or destroy information that is no longer needed.

Your rights and your personal data
Under certain circumstances, you have rights under data protection laws in relation to your personal data:
 

• Request access to your personal data (data subject access request)

• Request correction of your personal data

• Request erasure of your personal data

• Object to processing of your personal data

• Request restriction of processing your personal data

• Request transfer of your personal data

• Right to withdraw consent

See Appendix 1 for further information on your rights. If you wish to exercise any of the rights set out above, please contact the Compliance Officer.

You will not have to pay a fee to access your personal data (or to exercise any of your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information form you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. We will try to respond to all legitimate requests within one month. It may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Log Data
We may also collect information that your browser sends whenever you visit our websites, this may include information such as your computer’s Internet Protocol (“IP”), address, browser type, browser version, the pages of our website that you visit, the time and date of your visit, the time you spent on those pages etc. In addition, we may use third party services such as Google Analytics that collect, monitor and analyse this type of information in order to increase our Service’s functionality. These third-party service providers have their own privacy policies addressing how they use such information.

Cookies
Cookies are files with small amounts of data, which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your computer’s hard drive. We use Cookies to collect information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some aspects of the website.

Links to other sites
Our website may contain links to other websites, plug-ins and applications that are not operated by us. If you click on a third-party link you will be directed to that third party’s site. We strongly advise that you review the Privacy Policy of every site you visit. We have no control over, and assume no responsibility for the content, privacy policies or practices of any third-party websites.

Marketing
We may provide you with updates and offers for CVR products and services via marketing tailored you through online digital services (e.g. online advertising, social media communications, mail chimp) or by direct marketing (e.g. email or text). We will always give you the opportunity to ‘opt out’ or ‘unsubscribe’ to direct marketing when you complete a rental agreement or receive any email, text or other direct marketing communication.

We will never release information about our customers or business partners to any other person or organisation for marketing purposes unless we have your permission to do so.

To update your information or change your marketing preferences please contact the Compliance Officer:

By phone: 01803 663838
By email: compliance.officer@chiefrentals.com
By post: Chief Vehicle Rentals Ltd, The Coachworks, Roundham Road, Paignton, TQ4 6DS

To request a copy of all the information we hold about you, please write to us on the above address F.A.O. The Compliance Officer.

You have the right to make a compliant at any time to inform the Information

Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org). We would however, appreciate the chance to deal with any concerns you have before you approach the ICO so please contact us in the first instance.

Changes to this Policy
We may amend this policy from time to time, for example, to keep it up to date or to comply with legal requirements. It is advisable to review this policy periodically for any changes. Changes to this Privacy Policy are effective when posted on this page. If we make any changes to this Privacy Policy, we will notify you either through the email address you have provided us with or by placing a prominent notice on our website.

Appendix 1
Your Legal Rights – you have the right to:

Request access to your personal data (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Request correction to the personal data we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your data unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have legitimate grounds to process your information which overrides your rights and freedoms.
Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (A) if you want us to establish the data’s accuracy; (b) where our use of data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Request the transfer of your personal data to you or a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you with withdraw your consent. If you withdraw your consent, we may not be able to provide you with certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.