Legal and Privacy

Privacy Notice

(“Kerr & Smith”, “we”, “us”, “our”) take the issue of security and data protection very seriously and comply with all UK data protection legislation. We are notified as Data Controllers with the Information Commissioner’s Office and we are the data controller of any personal data that you provide to us.

The following policy details the personal data we collect from you or from third parties, the purpose it is collected for and which third parties your details may be passed to.

The law says that the personal information we hold about you must be:

• used lawfully, fairly and in a transparent way;
• collected only for legitimate purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
• relevant to the purposes we have told you about and limited only to those purposes;
• accurate and kept up to date;
• kept only for as long as is necessary for the purposes we have told you about; and
• kept securely.

This policy amounts to a privacy notice for the purposes of the Data Protection Act 2018 and contains all of the information which we are required to provide to you under data protection legislation.

Any questions relating to this policy and our privacy practices should be sent to sales@kerrandsmith.co.uk

Personal information that we collect:

We may obtain information about you when you contact us in branch, over the telephone, by email, on-line or through any other medium. we may also be provided with information about you from third party organisations including, but not limited to, our manufacturer partners, vehicle finance providers, and insurance companies.

We may collect the following categories of data:

• Identity information - Such as name, date of birth, driving licence details, any identity proofs provided to us, employment details, etc;
• Contact information - Your address, telephone, email details, etc;
• Transaction and claims data - Information about your vehicle including registration number, payment and financial information, details of previous insurance claims;
• Location information
• CCTV images
• Correspondence from or to you
• Call recordings
• Technical data - IP address, the type of device you use to interact with us, details of how you interact with our sites, etc.

In very limited circumstances we may also collect special category, or sensitive, data in the form of limited health information.

The lawful bases we use to process data

Whenever we process your personal information, we need to be able to demonstrate that we have a lawful basis to do so. The lawful bases that we rely on when processing your information are:

• Contract - Where we need to process your personal information in order to perform our obligations to you in respect of any contract, or anticipated contract, we enter into with you;
• Legal Obligation - Where we are required to process your information by law;
• Vital Interests - Where processing is necessary to protect your, or someone else’s, life;
• Legitimate Interest - Where processing is necessary for us to conduct our business, but not where our interests are overridden by your interests or rights;
• Consent - Where you have provided your explicit consent.

How we use your information

We will use the personal data that you provide, or that we collect, as follows:

To provide you with goods or services (contract)

We will use your identity, contact and transaction data to contact you regarding the goods and services you have requested, to provide you with these goods and services, to take payment for them, and to personalise the service we offer to you.

We may also use these details to help you source finance for the associated goods and/or services from a number of the finance companies on our carefully selected panel of lenders. Our finance partners will, in turn, share the details with one or more of the main credit reference agencies. Details of our finance partners’ privacy policies and the Credit Reference Agency Information Notices (CRAINs) can be found in the links below.

We may share some of these details with your vehicle manufacturer to enable them to process any warranty or service records, to enable them to send important recall information to you, and so that they can contact you regarding your experience with us. Details of their use of your data can be found in their privacy policies, which can be found using the links below.

To source insurance products for you (contract)

We will use your identity, contact, transaction and claims data to source insurance products for you. We may use the same information if we assist you to make a claim on any of the insurance products that we have sourced for you.

We will retain this information for 6 years after the contract of insurance has ended.

To inform you about products and services that may interest you (consent)

It is your choice whether we keep you up to date with news, updates, promotions and events by the types of communication that you have asked us to. We will not contact you for these purposes unless you have given your prior consent. We may also ask for your explicit consent for your vehicle manufacturer to contact you for marketing purposes. Details of how to amend this consent can be found in the relevant manufacturer’s privacy policy using the links noted below.

To ensure our website and apps operate properly and provide the best possible user experience (legitimate interest)

We use cookies and other similar technologies to keep track of your preferences when using our site.

We use other cookies and similar technologies to help us understand how you use the site; this allows us to optimise your experience and continually improve our site.

We gather information about the devices you use to access our sites (desktop and mobile) for example your IP address and device type, to ensure the site is secure and works across multiple platforms.

For further details, please refer to the sections on Cookies below.

To monitor and improve our products and services (legitimate interest)

We record calls to and from our customer-facing telephone numbers. We also keep details of any correspondence you may have with customer service team or of any interaction you have with us on social media and when you use our live chat and chatbot functionality. We use these records to manage your queries or complaints effectively, for quality monitoring and to continually improve our services.

We will use your contact and transaction information to invite you to take part in customer satisfaction surveys. We will use the information you return to us to help monitor our performance and to improve our level of service to our customers.

To prevent and detect crime (legitimate interest)

We will use your identity, contact and transaction data to assist in monitoring for fraudulent transactions or suspected money laundering. We may also obtain information about your current vehicle from our third-party suppliers for these purposes.

We use CCTV monitoring, including vehicle mounted dashcams, bodycams and ANPR technology, to help protect our customers, staff and property.

Some of our vehicles may be fitted with tracker or locator devices to assist with their recovery.

To fulfil our legal obligations (legal obligation)

We will use your contact and transaction information to enable us to comply with our legal obligations including the need to keep proper books and records for accounting, tax and regulatory purposes.

We will also use the information you provide to identify you when you contact us and, to comply with our data protection obligations, we may ask for further proof of identity before sharing any personal data with you.

To remind you of your Service and MOTs due on your vehicle (legitimate interest)

We will remind you about vehicle services and MOTs which are due to ensure (where applicable) the continued validity of any warranty, that your vehicle remains safe and legal to drive and to maintain our customer relationship with you.

To verify the accuracy of the personal data we hold on you (legitimate interest)

We may check the accuracy of the data which we hold about you and create a better understanding of you as a customer and to ensure we meet our obligations to keep data as accurate as possible during you time with us as a customer.

Finance renewals/options at end of term (legitimate interest)

We will remind you that your finance term is due to come to an end and present you with your options exercisable at the end of a finance agreement. We may also advise you of options available to you which we believe you will find beneficial during the course of your finance agreement.

Market Research/Analysis (legitimate interest)

We may undertake market analysis and market research (including sending you customer surveys) to enable us to improve the service we offer to our customers.

Special category data

Where we use special category data, we must have a lawful reason for doing so and must also meet one of the specific exceptions provided. We will use the special category data that you provide as follows:

To provide you with goods and services (contract - consent)

Where applicable, we may use limited health information that you provide to us for the purposes of providing you with goods or services. This will only be done where strictly necessary, for instance for the purposes of adapting vehicles to your specific needs or where the information is required as part of an insurance application or claim. This information will only be used with your specific consent.

To fulfil our legal obligations (legal obligation – social protection law)

In the unlikely event that you have an accident on our premises, we are required to maintain appropriate records of the incident, and any injury sustained, under Health & Safety legislation.

To resolve any claim or dispute (legitimate interest – legal defence)

Similarly, we may use details of any incident to resolve any legal claim or dispute involving you or us.

To provide you with a service that meets your specific needs (legal obligation - consent)

As a regulated firm, we are required to keep details of any potential customer vulnerabilities, where this is relevant, we will only process this information with your explicit consent.

How long we keep your data for

We will generally retain information while you are a current or previous customer of Kerr & Smith. We consider you to be a current or previous customer if you have transacted with us in the past 7 years.

We are, however, required to keep information about applications for finance or insurance products for 7 years from the end of the associated agreement, which in some cases may be longer than the default position.

Limited amounts of information may need to be kept for longer periods to enable us to comply with relevant legislation, particularly in relation to accidents or injuries that have occurred on our premises.

CCTV images are generally overwritten within 30 days and call recordings will be deleted after 36 months.

Sharing your information

We may share your information with the vehicle manufacturers or one of our partner finance companies for the provision of goods or services to you whilst you are a customer.

We may also disclose your personal data to third parties in certain circumstances, including:

• where it is necessary to use a third-party processor to carry out one of our processing activities including direct marketing communications agencies and consultants, communication platform providers, data storage and destruction companies and market research and market analytics service providers;
• where we use a third-party supplier to provide you with the goods or services;
• when we have a legal obligation to share your information with a third party including, but not limited to, government agencies, local authorities, the police or the courts;
• if we sell any business or assets, in which case we may disclose your personal data to the prospective buyer of such business or assets;
• if Kerr & Smith or substantially all of our assets are acquired by a third party, in which case personal data held by us will be one of the transferred assets.

Your rights in relation to your information

Data protection law gives you specific rights in respect of the personal information which we hold about you. Your rights include the following:

Your right of access

You may request, at any time, a copy of the personal information the Company holds about you. This right always applies but there are some exceptions, which means in some limited circumstances you may not receive all the information which we process.

Your right to rectification

You have the right to ask us to rectify the information, which you believe to be inaccurate. Furthermore, you also have the right to ask us to complete information you believe to be incomplete. This right always applies.

Your right to erasure

In certain circumstances you may be entitled to request the erasure of personal information that we hold about you but only if:

• the personal data is no longer required for the purposes for which it was obtained;
• where data is being processed on the basis of consent, you withdraw consent to the processing and no other lawful basis exists;
• where the data is processed on a legitimate interests basis, you object to the processing of personal data and there are no overriding legitimate grounds for the processing;
• if your personal data requires deletion in line with legal requirements.

Your right to restriction of processing

In certain circumstances, you may ask that we continue to store your Personal Data but not use it. For example, if you consider that we hold Personal Data relating to you that you may need for legal purposes, you can request us to not delete this information.

Your right to object

You have the right to object to the processing of your personal data. However, the processing must have been undertaken on the basis of legitimate interest by us, as outlined in ‘How we use your information’. We will then stop processing your personal data unless it is required for legal proceedings.

Your right to data portability

You have the right to request that some of your personal data is provided to you, or to another data controller, in a commonly used, machine-readable format.

Your right to revoke consent

If you have provided your consent to the collection, processing and transfer of your personal data, you have the right to fully or partly withdraw your consent. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you originally consented unless there is another legal ground for the processing.

If you wish to exercise any of these rights, we would ask that you please contact our sales@kerrandsmith.co.uk

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights).

If you are concerned that we are not using your information in accordance with the law or are not satisfied with our response to a request made above, then you can complain to the Information Commissioner’s Office. Details of how to complain are available at ico.org.uk.

Data security

Once we have received your information, we will use strict procedures and security features to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal information to those employees and third parties who have a genuine need to know.

We store your data on secure servers inside the European Economic Area (EEA).

Some of our third-party contractors are based outside of the EEA however, we have strict control over how and why your data can be accessed. By submitting your personal data, you are consenting to this transfer, storing or processing. If we transfer your data outside the EEA we will take steps to ensure that appropriate security measures with the aim that your rights continue to be protected as set out in this policy.

How we use cookies

Kerr & Smith use cookies to help improve our websites and make your browsing experience more useful, more relevant and tailored to you.

Cookies are small text files, placed on your hard disk by a web page server. They are uniquely assigned to you and can only be read by a web server in the domain that issued the cookie to you.

We will use encrypted information gathered from the cookies to improve your online experience with Kerr & Smith.

Some of the cookies we use will expire after you close the browser window. These are called session cookies. Some cookies last longer than this, because they are used to identify return visits to the website.

After browsing our website, you may receive personalised advertisements whilst browsing other reputable websites and media. We are committed to providing you with information on products and offers which are relevant to you. Any advertisements you receive will relate to products which have been viewed whilst browsing this website on your computer or other device. This service is provided by Kerr & Smith via reputable third-party specialist providers, through the use of cookies placed on your device. All cookies listed below will be enabled while you use our website, and they will operate as established below. Please note that cookies do not harm your computer or any software you may have.

What cookies we use and why

Types of cookies:

• Session cookies are deleted when you leave our websites. They help keep track of your progress, so you don't have to enter the same information more than once.
• Persistent cookies stay on your device after your browsing session has ended. They will remember settings, preferences and details for the next time you use the websites.
• First party cookies are set by the website owner, i.e. Kerr & Smith.
• Third party cookies are set by other parties, such as Google and Twitter.
• Necessary cookies are required for the operation of our website.
• Performance or analytical cookies allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
• Functionality cookies are used to recognise you when you return to our website. This enables us to personalise our content for you, for example, remember your preferences or your postcode in Find a Dealer search.

This section is a table which explains why we use certain cookies and what they do.

Necessary Cookies

Session Cookies

Performance Cookies

Functional Cookies

Third Party Cookies

To find out even more about cookies, visit: http://www.aboutcookies.org.

IP Addresses

The additional cookies that run during your session will collect information about your computer in the form of server logs, including where available your IP address, operating system and browser type, for system administration. This is statistical data about our users' browsing actions. Disabling cookies ensures that your IP address will not be recorded.

Kerr & Smith recommend that you accept cookies, as we use them to:

• customise elements of our website’s layout and content, and test different designs of our websites to improve your experience;
• recognise when a user has visited before, meaning we can see how many unique visits we receive. We can then make sure the websites are easy to use and have enough capacity;
• remember your preferences and settings, such as text size and language;
• recognise your device so you don't have to provide the same information during your visit, or on subsequent visits;
• help us identify errors and resolve them effectively;
• establish what information is relevant to you while you are browsing our websites;
• collect statistical, anonymous information about how our visitors use/interact with our digital services so we can improve them;
• learn which parts of our websites are most popular and improve them;
• see how effective our online messages are.

However, you can choose to decline cookies by changing your browser settings.

Third party sites and social networking

Our website may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Our website may offer you the opportunity to share or follow information about us (or the website or our services) using third party social networking functionality (such as through "share this", "like" or "follow" buttons).

We offer this functionality in order to generate interest in us, the website and our services among the members of your social networks, and to permit you to share and follow opinions, news and recommendations about us with your friends. However, you should be aware that sharing personal or non-personal information with a social network may result in that information being collected by the social network provider or result in that information being made publicly available, including through Internet search engines.

Please note that we do not endorse or control the policies or practices of any third-party social network whose functionality you may access through the website. You should always read the privacy policy of any social network through which you share information carefully in order to understand their specific privacy and information usage practices.

• Trustpilot
• Twitter
• Facebook/Instagram
• Pinterest
• Google/YouTube
• TikTok

Finance company privacy policies

• CA Auto Finance

Credit Reference Agency Information Notices (CRAINs)

• Experian
• Equifax
• Transunion

Out trading address is:

Kerr and Smith (CUMNOCK)
Riverside Garage
Ayr Road
Cumnock
Ayrshire
KA18 1BJ
UNITED KINGDOM