Privacy and Data Protection Policy
Vantage Leasing Solutions Ltd
This Policy is in line with requirements set out under the Data Protection Act 2018 which implemented the General Data Protections Regulation. (GDPR). Our firm’s lawful basis for processing your personal data is done so under a Legitimate Interest -Article 6(1)(f) –“the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.”
Types of personal information we hold
If you are a registered user of our website, you will have provided various pieces of data on the registration form. These may be used by Vantage Leasing Solutions Limited for marketing purposes. You can choose not to receive marketing at any time by letting us know by phone, fax or e-mail. Some pages contain a link which allows you to register to receive regular updates from us. This information will be used by Vantage Leasing Solutions Limited for marketing purposes. When using our online chat facility, the chat messages content is relayed to a third party, Chattra. We will never pass your information to a third party for marketing purposes. When submitting an enquiry through our website, individuals will be provided with the opportunity to ‘opt in’ to our services, including marketing offers and mailing campaigns. An individual’s data will not be collected as a result of pre-ticked boxes or inactivity. Individuals also have the opportunity to withdraw their consent of providing their information at any point from enquiry. If you wish to withdraw your consent, you can do so verbally or in writing to [email protected] you make a financial application to us, we will need to collect personal information from you to complete the finance application. In processing your finance application, we will provide your details to one or more lenders for the sole purpose of considering your application. Our supplying dealerships will be provided with limited data, to provide quality service and delivery of your vehicle.
Your data will be stored mainly on Vantage Leasing’s CRM system and server database. Both storage facilities are given strong security including password protections and offsite backups.
Under GDPR we have a duty to report certain types of data breaches to the Information Commissioners Office (ICO) and to the individual. In the unlikely event of a data breach, the entire situation will be thoroughly evaluated and Vantage Leasing will assess whether there is likely a risk to the rights and freedom of the individuals as a result of the breach. If we find there is a likely risk, we will file a report to the ICO and contact the individuals involved.
The Data Protection Act requires further protection for information which is seen as more sensitive than regular information. This includes data which reveals racial or ethnic origin, political opinion, religious or philosophical beliefs, or trade union membership and the processing of genetic data, for purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. Although it is incredibly unlikely that Vantage Leasing will possess ‘special data’, we will process ‘Special Data’ in line with GDPR. Article 9 of. Article 9 of GDPR provides 10 conditions for processing special category data. The condition will be determined prior to the processing of the special data and it will be documented. Conditions:
(a) Explicit consent
(b) Employment, social security and social protection (if authorised by law)
(c) Vital interests(d) Not-for-profit bodies(e) Made public by the data subject
(f) Legal claims or judicial acts
(g) Reasons of substantial public interest (with a basis in law)
(h) Health or social care (with a basis in law)
(i) Public health (with a basis in law)
(j) Archiving, research and statistics (with a basis in law)
Requests for information
When an individual requests for access to the personal we hold there are certain requirements we must follow. The information can be requested verbally or in writing, (including social media). We must be able to identify the person who is requesting for the data. We will request a form of ID and proof of address dated within the last 3 months from the individual and, if a third party is requesting on their behalf, a letter of authority. We must supply the data requested within one month. If the request is large or complex in nature, we can request for an extension of a further two months. The time limit does not begin until the individual has supplied their ID which will be requested promptly. In most cases a fee will not be charged for an information request; however, where the data is manifestly unfounded or excessive, or further copies of data are requested, we may charge a reasonable fee. Information will be provided to the individual in an easily accessible and clear format. We will aim to follow the individual requests with regards to the formatting of the information. A request for information may be refused if it is found to be manifestly unfounded or manifestly excessive. If we refuse your request, we will provide our explanation. You have the right to make a complaint regarding your personal data to the ICO -https://ico.org.uk/make-a-complaint/. ICO Helpline:-0303 123 1113.Our refusal does not restrict an individual’s rights to request for information through the Courts. In addition, you are entitled to receive a copy of the information any lender holds about you, and details of those lenders to whom we have provided your information for a finance application, and those Credit Reference and Fraud Prevention Agencies used in considering any application. If you are unsure which lender you have been provided, contact our offices.
We retain your personal date up to a total of six years from the end date of your Credit Agreement. If you do not proceed with finance through Vantage Leasing, it is likely your personal data will be subject to a shorter retention period as per GDPR guidelines relating to ‘data minimisation’ and purpose for obtaining data.
Right to Erasure
The broad principle underpinning this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing. The right to erasure does not provide an absolute ‘right to be forgotten’. Individuals have a right to have personal data erased and to prevent processing in specific circumstances:
• Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
• When the individual withdraws consent.
• When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.
• The personal data was unlawfully processed (ie otherwise in breach of the GDPR).
• The personal data must be erased in order to comply with a legal obligation.
• The personal data is processed in relation to the offer of information society services to a child.
Under the GDPR, this right is not limited to processing that causes unwarranted and substantial damage or distress. However, if the processing does cause damage or distress, this is likely to make the case for erasure stronger.