Privacy & Legal Notice | Hampshire | Winchester Motor Company

Winchester Motor Group Privacy Notice

Please read this privacy notice carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or the UK data protection authority (the Information Commissioner’s Office or the ICO) in the event you have a complaint.

We collect, use and are responsible for certain personal data about you. When we do so we are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This privacy notice covers the following companies:

Winchester Motor Company Limited (trading as Petersfield Used Car Centre, South Downs Motorcycles, Solent Used Car Centre and Winchester Skoda)
Garland Motors Limited (trading as Garland Skoda)

It is important that you read this privacy notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your personal data. This privacy notice supplements the other notices and is not intended to override them.

Our Websites (as defined below) are not intended for children and we do not knowingly collect data relating to children.

The following are some key terms used in this privacy notice and an explanation of what those key terms mean:

Group	Means together Winchester Motor Company Limited and Garland Motors Limited
Group company	Means any company in the Group
Winchester Motor Company	Means Winchester Motor Company Limited (a company registered in England and Wales under company number: 01033289)
Garland Motors	Means Garland Motors Limited (a company registered in England and Wales under company number: 05199857)
We, us, our	Means the relevant company in the Group responsible for processing your personal data
Our Websites	Means www.winchestermotorgroup.co.uk, www.wmgusedcars.co.uk and www.southdownsmotorcycles.co.uk
Personal data	Means any information relating to an identified or identifiable individual
Special category personal data	Means data revealing racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or trade union membership, genetic and biometric data (when processed to uniquely identify an individual) and data concerning health, sex life or sexual orientation

Under data protection law, a controller determines the purpose and means of the processing of your personal data.

If you are a customer or prospective customer of Winchester Motor Company (trading as Petersfield Used Car Centre, South Downs Motorcycles, Solent Used Car Centre and Winchester Skoda), then Winchester Motor Company will be a controller of your personal data.

If you are a customer or prospective customer of Garland Motors, (trading as Garland Skoda), then Garland Motors will be a controller of your personal data.

If you are a representative of a supplier, you may engage directly with either of the Group companies. The company you engage with will be a controller of your personal data.

For marketing purposes Winchester Motor Company and/or Garland Motors will be a controller of your personal data. The company you engage with will be a controller of your personal data.

For personal data collected via the www.winchestermotorgroup.co.uk website, this may be collected by Winchester Motor Company (Petersfield Used Car Centre, South Downs Motorcycles, Solent Used Car Centre and Winchester Skoda) or Garland Motors (Garland Skoda). The company that collects your personal data will be a controller of your personal data.

For personal data collected via the www.wmgusedcars.co.uk website, this will be collected by Winchester Motor Company (Petersfield Used Car Centre and Solent Used Car Centre) which will be a controller of your personal data.

For personal data collected via the www.southdownsmotorcycles.co.uk website, Winchester Motor Company will be a controller of your personal data.

Please see below: [‘What we use your personal data for’] for further information about the purposes for which the Group uses your personal data.

The table below sets out the personal data we may collect about you:

Identity personal data	Name
	Title
	Username/similar identifier
	Date of birth, if we ask for this or you choose to give this to us
	Gender or pronouns, if you choose to give this to us
	Marital status, if we ask for this or if you choose to give this to us
	Job title
	Name of your employer or the organisation you represent
	National insurance number
	Driving licence information
Contact personal data	Work/personal email address
	Work/home postal address
	Work/home telephone number(s) (landline and/or mobile)
Contract personal data	Information relating to your contract(s) with us including transaction information and vehicle information
Financial personal data	Billing information and payment card information
	Information to enable us to undertake credit and other financial checks on you
IT Systems personal data	CCTV footage
	Call recordings
	‘Live chat’ recordings
Marketing personal data	Marketing and communications information, which may include information about your personal interests, your preferences in receiving marketing from us and your communication preferences
Technical personal data	Information from when you visit our Websites, including your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our Websites
Usage personal data	Information about how you use our Websites including the full Uniform Resource Locators (URL) clickstream to, through and from our Websites (including date and time), page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs) and methods used to browse away from the page
Website enquiry personal data	This includes information you provide when you fill in forms on our Websites, subscribe to our services, request further services, make an enquiry on our Websites, request a call back, sign up for newsletters, complete surveys undertaken by us for research purposes and report a problem with our Websites
Other personal data	Information we ask for or that you volunteer to us when you correspond with us by email, post, telephone or text, or via our Websites or information from social media accounts when interacting with us via a personal profile (e.g. Facebook, Instagram, X or LinkedIn)

We collect and use this personal data for the purposes described in the section: ‘[How and why we use your personal data]’ and ‘[How and why we use special category personal data ]’ (see below).

We also collect, use and share aggregated data, such as statistical or demographic data for any purpose. Aggregated data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate the data about how you use our Websites to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

If you do not provide personal data

For customers and suppliers who are individuals (this includes sole traders and traditional/unlimited partnerships), where we need to collect personal data to enter into a contract with you and you fail to provide that data when requested, we may not be able to enter the contract with you. This personal data may include your name and contact details. For customers, if you thereafter do not provide personal data we ask for, this may delay or prevent us from providing our goods and/or services to you.

We collect most of your personal data directly from you – in person, by telephone, text or email and/or via our Websites. However, we may also collect information:

Directly from a third party, e.g.

Credit reference agencies.

Car/motorcycle manufacturers.

Used and new third party car advertising platforms.

An employee or representative of the organisation you represent.

Finance providers (when you use finance in relation to a contract with us).

Warranty or finance providers.

From cookies and similar technologies used on our Websites, see our [cookie policy] for further details.

Via our IT systems, e.g.:

Through automated monitoring of our Websites and other technical systems, such as computer networks and connections, CCTV and access control systems, call recording, communication systems, email and instant messaging.

Winchester Motor Group may also collect personally identifying information using cookies. Sometimes cookies are required as part of this site’s operation. We will not collect personal data about you using cookies outside of this purpose. If you prefer not to allow the use of cookies, you can change the configuration of your browser to either warn you when you receive a cookie, or to automatically reject them. You may find, however, that disabling cookies means certain areas of the site do not function correctly.

Under data protection law, we can only use your personal data if we have a proper reason (i.e. a lawful basis) for doing so, for example:

For the performance of our contract with you or to take steps at your request before entering into a contract;
To comply with our legal and regulatory obligations;
For our legitimate interests or those of a third party (a legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests);
For the purposes of a recognised legitimate interest; or
Where you have given consent.

The table below explains what we use your personal data for, how we use your personal data, our lawful basis for doing so and the categories of personal data we use.

What we use your personal data for

Our purpose for using your personal data	What we do with your personal data	Lawful basis relied on under the UK GDPR	What personal data we use
For individual customers (including prospective customers) – to correspond with you about the goods and/or services we offer, provide a quotation, to respond to your queries and provide our goods and/or services to you	We will collect personal data and use it to provide a quotation, to respond to your enquiries about a potential contract and fulfil the terms of the contract with you. We will store your personal data on our IT systems and destroy it in accordance with our data retention and other business policies	Necessary for the performance of our contract with you or to take steps at your request before entering into a contract with you: Article 6(1)(b) UK GDPR	Identity personal data Contact personal data Contract personal data Financial personal data Other personal data
For individuals who represent corporate customers with whom we have contracts - to provide the organisation you represent with our goods and/or services	We will collect your personal data and use it to correspond with you about the contract involving the organisation you represent. We will store your personal data on our IT systems and destroy it in accordance with our data retention and other business policies	Necessary for the legitimate interests of the organisation you represent and our legitimate interests e.g. to provide the organisation you represent with our goods and/or services: Article 6(1)(f) UK GDPR	Identity personal data Contact personal data Other personal data
For individuals who represent prospective corporate customers e.g. for corresponding with you about the products and/or services we offer, to provide a quotation and to respond to your queries	We will collect your personal data and use it to correspond with you about e.g. the services we offer and quotations, and to respond to your queries about the contract involving the organisation you represent. We will store your personal data on our IT systems and destroy it in accordance with our data retention and other business policies	Necessary for the legitimate interests of the organisation you represent and our legitimate interests e.g. to deal with pre-contractual enquiries or issues: Article 6(1)(f) UK GDPR	Identity personal data Contact personal data Other personal data
For other individuals with whom we have contracts e.g. suppliers, for corresponding with you and for taking steps under the contract with you	We will collect your personal data and use it for entering into and managing the contract with you. We will store your personal data on our IT systems and destroy it in accordance with our data retention and other business policies	Necessary for the performance of our contract with you or to take steps at your request before entering into a contract with you: Article 6(1)(b) UK GDPR	Identity personal data Contact personal data Contract personal data Financial personal data Other personal data
For other individuals who represent organisations with whom we have contracts e.g. suppliers, for corresponding with you and for taking steps under the contract with your organisation	We will collect your personal data and use it to correspond with you about the contract involving the organisation you represent. We will store your personal data on our IT systems and destroy it in accordance with our data retention and other business policies	Necessary for the legitimate interests of the organisation you represent and our legitimate interests e.g. to manage and take steps under the contract with your organisation: Article 6(1)(f) UK GDPR	Identity personal data Contact personal data Other personal data
For other individuals who represent organisations with whom we do not have contracts e.g. prospective suppliers, for corresponding with you about the services your organisation offers and to obtain a price quote	We will collect your personal data and use it to correspond with you about e.g. the services your organisation offers and to obtain a price quote. We will store your personal data on our IT systems and destroy it in accordance with our data retention and other business policies	Necessary for the legitimate interests of the organisation you work for and our legitimate interests e.g. to raise pre-contractual enquiries or issues: Article 6(1)(f) UK GDPR	Identity personal data Contact personal data Other personal data
To undertake credit reference checks via external credit reference agencies	We will collect your personal data and pass it to external credit reference agencies for the purposes of a credit reference check	Necessary for our legitimate interests or those of a third party i.e. to ensure our customers are likely to be able to pay for our goods and services: Article 6(1)(f) UK GDPR	Identity personal data Contact personal data Financial personal data Other personal data
To assist customers with obtaining finance where this is a condition of us entering into a contract with you	We will collect your personal data and use it to correspond with you about the obtaining of finance for your contract/the contract involving the organisation you represent. Any personal data collected will be stored on our IT systems and destroyed in accordance with our data retention and other business policies	Necessary for your legitimate interests/the legitimate interests of the organisation you represent i.e. to assist with securing finance: Article 6(1)(f) UK GDPR	Identity personal data Contact personal data Financial personal data Other personal data
To deal with manufacturer warranty issues	We will collect your personal data and use it to correspond with you and the manufacturer to resolve the warranty issue. Any personal data collected will be stored on our IT systems and destroyed in accordance with our data retention and other business policies	Necessary for the performance of our contract with you: Article 6(1)(b) UK GDPR Necessary for the legitimate interests of the organisation you represent and our legitimate interests i.e. to ensure that any issues are resolved: Article 6(1)(f) UK GDPR	Identity personal data Contact personal data Contract personal data Other personal data
To manage our relationship with you or the organisation which you represent, which may include (where appropriate) notifying you about changes to our terms of business or privacy notice	We will use your personal data to correspond with you where appropriate	Necessary for our legitimate interests i.e. to manage our relationship with you or the organisation you represent, and to analyse and improve the goods and/or services we offer: Article 6(1)(f) UK GDPR	Identity personal data Contact personal data Contract personal data Financial personal data
To prevent and detect fraud against you or us	We will check and monitor the security of our email and IT systems which hold your personal data and undertake other verification checks of your personal data (as necessary)	Necessary for your and our legitimate interests i.e. to minimise fraud that could be damaging for us and for you: Article 6(1)(f) UK GDPR	Potentially any personal data held
For audits, enquiries or investigations by regulatory bodies (e.g. the Information Commissioner’s Office) or law enforcement agencies	We will extract your personal data from our IT systems and disclose it as required by law or further to a court order	Necessary for compliance with a legal obligation to which we are subject (e.g. data protection law or a court order): Article 6(1)(c) UK GDPR Necessary for the purposes of a recognised legitimate interest (e.g. detecting, investigating or preventing a crime): Article 6(1)(ee) UK GDPR	Potentially any data held
To ensure our business policies are adhered to e.g. policies covering security	We will check our use of your personal data against our business policies	Necessary for our legitimate interests i.e. to make sure we are following our own internal procedures so we can deliver the best service we are able to: Article 6(1)(f) UK GDPR	Potentially any personal data held
For operational reasons, such as improving efficiency, financial performance and quality control	We will use relevant personal data in data analysis software and also for manual analysis	Necessary for our legitimate interests or those of a third party e.g. to be as efficient as we can so we can deliver the best service for you or the organisation you represent, at the best price: Article 6(1)(f) UK GDPR	Identity personal data Contract personal data Financial personal data Technical personal data Usage personal data Website Enquiry personal data Other personal data
To ensure the confidentiality of commercially sensitive information	We will put in place reasonable and appropriate security measures to protect the integrity of our systems that hold your personal data	Necessary for our legitimate interests i.e. to protect trade secrets and other commercially valuable information: Article 6(1)(f) UK GDPR	Potentially any personal data held
To prevent unauthorised access and modifications to our systems	We will put in place reasonable and appropriate security measures to protect the integrity of our systems that hold your personal data	Necessary for compliance with a legal obligation to which we are subject (e.g. data protection law): Article 6(1)(c) UK GDPR Necessary for our legitimate interests or those of a third party i.e. to prevent and detect criminal activity that could be damaging for us and for you: Article 6(1)(f) UK GDPR	Potentially any personal data held
To update and maintain our customer and supplier records	We will enter and hold your personal data in the relevant parts of our IT systems and we may hold your personal data in manual records	Necessary to take steps at your request before entering into a contract with you: Article 6(1)(b) UK GDPR Necessary for compliance with a legal obligation to which we are subject (e.g. data protection law): Article 6(1)(c) UK GDPR Necessary for our legitimate interests or those of a third party i.e. to make sure we can keep in touch with you where necessary: Article 6(1)(f) UK GDPR	Potentially any personal data held
For staff management, training and administration	We will access and use your personal data held in our IT systems and may use it in emails between our staff and for training purposes	Necessary for our legitimate interests i.e. to make sure we are following our own internal procedures and working efficiently so we can deliver the best service that we are able to: Article 6(1)(f) UK GDPR	Potentially any personal data held
To deal with complaints or legal claims against us	We will review your personal data in our IT systems and may collect other information relevant to the complaint/legal claim. We will review any information collected and assess the merits of any complaint or legal claim. We may also communicate with third parties as necessary to seek advice/representation and/or in connection with legal or prospective legal proceedings. Any personal data collected will be stored on our personal data on our IT systems and destroyed in accordance with our data retention and other business policies	Necessary for our legitimate interests i.e. to ensure that we are able to respond to any complaints or legal claims made against us: Article 6(1)(f) UK GDPR	Potentially any personal data held
For the external audit of our accounts	We will provide access to such personal data held in our IT systems as is required by our auditors in connection with their audit of financial transactions	Necessary for compliance with a legal obligation to which we are subject (section 475 Companies Act 2006): Article 6(1)(c) UK GDPR	As required by our auditors in connection with the statutory audit of our accounts
To keep you updated of special offers and general information via a newsletter	We will use your personal data to send you a newsletter	With your consent: Article 6(1)(a) UK GDPR	Identity personal data Contact personal data Other personal data
Marketing our goods and/or services to - existing and former customers third parties who have previously expressed interest in our goods and/or services	We will use your personal data to send you marketing material, including invitations to events	Necessary for our legitimate interests i.e. to provide you with information that we feel may interest you: Article 6(1)(f) UK GDPR Where needed, with your consent: Article 6(1)(a) UK GDPR	Identity personal data Contact personal data Other personal data
To contact prospective customers who have registered their interest in new motorbike models	We will use your personal data to contact you by telephone to arrange an appointment	Necessary for our and your legitimate interests i.e. to run our business and arrange an appointment with you	Identity personal data Contact personal data
To enforce or apply terms and conditions or any other agreements relating to our Websites	We will review your personal data held in our IT systems and, if appropriate, use it to take enforcement action, including legal proceedings	Necessary for our legitimate interests i.e. to enforce our legal rights and protect our business: Article 6(1)(f) UK GDPR Necessary for the performance of our contract with you: Article 6(1)(b) UK GDPR	Identity personal data Contact personal data Contract personal data Financial personal data Other personal data
To administer and protect our business and our Websites (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	We will use your personal data held in our IT systems	Necessary for our legitimate interests e.g. for running our business, network security and to prevent fraud: Article 6(1)(f) UK GDPR Necessary for compliance with a legal obligation to which we are subject (e.g. data protection law): Article 6(1)(c) UK GDPR	Potentially any personal data held
To improve our Websites and your experience (through the use of data analytics and other cookies)	We will use personal data collected via cookies and other similar technologies on our Websites. Any personal data collected will be stored on our IT systems and destroyed in accordance with our data retention and other business policies	For non-essential cookies: with your consent: Article 6(1)(a) UK GDPR	Technical personal data Usage personal data
For testimonials on our Websites	We may collect personal data and use it for publishing testimonials on our Websites. Any personal data collected will be stored on our IT systems and destroyed in accordance with our data retention and other business policies	Necessary for our legitimate interests e.g. to share customer experiences and to ensure a consistently high level of customer service: Article 6(1)(f) UK GDPR	Identity personal data Other personal data
To review our products and/or services	We may collect personal data and use it to analyse our products and/or services. Any personal data collected will be stored on our IT systems and destroyed in accordance with our data retention and other business policies	Necessary for our legitimate interests e.g. to share customer experiences and to ensure a consistently high level of customer services: Article 6(1)(f) UK GDPR	Identity personal data Other personal data
For training and monitoring service levels (call recording)	We will use personal data collected during telephone calls for analysis and to train staff We do not record customer payment details – whilst this information is being provided, all recording facilities are switched off	Necessary for our legitimate interests e.g. to ensure a consistently high level of customer service: Article 6(1)(f) UK GDPR	Potentially any personal data held
For the live chat function	We will use personal data collected during the live chat function to deal with your enquiries	Necessary for your and our legitimate interests i.e. to deal with your enquiries in live time: Article 6(1)(f) UK GDPR	Potentially any personal data held
For Skoda self-service check in	For Skoda customers, we will collect your personal data via our self-service check in stands to enable our staff to manage your after sales appointments	Necessary for your and our legitimate interests i.e. to manage after sales appointments: Article 6(1)(f) UK GDPR	Identity personal data Contract personal data
For crime prevention and detection purposes (CCTV)	We will collect personal data from CCTV and retain it in accordance with our data retention and other business policies	Necessary for our legitimate interests e.g. to ensure the safety of our visitors and staff and the protection of our business: Article 6(1)(f) UK GDPR	Identity personal data Other personal data
For recording and/or reporting accidents at our premises or connected with our services or business	We will use any personal data collected to (where appropriate) deliver first aid, call the emergency services and record/report the accident. Any personal data collected will be stored on our IT systems and destroyed in accordance with our data retention and other business policies	Necessary for compliance with a legal obligation to which we are subject (e.g. health and safety legislation): Article 6(1)(c) UK GDPR	Identity personal data Other personal data
To provide personal data to other third parties that have or may acquire control or ownership of our business or part of our business (and our or their professional advisers) in connection with a corporate transaction or restructuring, including a merger, acquisition or asset sale or in the event of our insolvency	We will extract your personal data from our IT systems and disclose it as necessary	Necessary for your and our legitimate interests (e.g. to ensure continuity of our business and services): Article 6(1)(f) UK GDPR	Potentially any personal data held Where possible information will be anonymised during a transaction and until completion of the transaction but this may not always be possible

Under data protection law, we can only use special category data where:

We have a proper reason for doing so (see above: ‘[How and why we use your personal data]’); and
One of the ‘grounds’ for using special category data applies.

There are a number of potential grounds for using special category personal data under data protection law.

Generally, where we use special category personal data, we will do so on the grounds that this is necessary for establishing, exercising or defending legal claims. This includes using special category personal data, where necessary, for:

Actual or prospective court proceedings;
Obtaining legal advice; or
Establishing, exercising or defending legal rights in any other way.

Where this does not apply, we will only process special category personal data where processing is necessary for reasons of substantial public interest or with your explicit consent.

Where we rely on consent as a lawful basis to process your personal data, you have the right to withdraw your consent at any time. To do this, please telephone, email or write to us (see below: ‘[How to contact us]’).

Please note that we may process your personal data without your knowledge or consent where this is required or permitted by law.

We may use your personal data to send you periodic communications by email, post and text about our goods and/or services and/or events that might be of interest to you.

We have a legitimate interest in processing your personal data for marketing purposes (see above ‘How and why we use your personal data’). This means we do not usually need your consent to send you information about our products, services or events. However, where consent is needed, we will ask for this consent separately and clearly.

We will always treat your personal data with the utmost respect and save for when we obtain your express opt-in consent, we will never sell or share it with other organisations for marketing purposes.

You have the right to opt-out of receiving marketing communications at any time by:

Emailing us at informationofficer@winchester.skoda.co.uk
Writing to us at 43, St Cross Road, Winchester, Hampshire, SO23 9PU
Calling us on 01962 866331
Using the ‘unsubscribe’ link in our emails
Texting STOP (for marketing received by text)

We may ask you to confirm or update your marketing preferences if you instruct us to provide further goods and/or services in the future, or if there are changes in the law, regulation, or the structure of our business.

Third party marketing

We will get your express opt-in consent before we share your personal data with any other company outside of the Group for marketing purposes.

Using personal data for new purposes

This section explains how we may use your personal data for a new purpose, and the steps we implement before doing so.

Before we use your personal data for any new purpose, we will ensure the processing is fair and lawful. In particular, we will confirm that an appropriate lawful basis applies to the new purpose and (where relevant) that any additional requirements for special category personal data are met. We will carefully consider whether any new use is compatible with the original purpose for which your personal data was collected. In making that assessment, we take into account a number of factors, including: how closely connected the new purpose is to the original one, the context in which your personal data was collected (including your reasonable expectations at the time), the nature and sensitivity of the personal data involved, the potential impact on you and the safeguards we have in place to protect your personal data. We will not use your personal data in ways that are unexpected, unfair or that could have an unjustified negative impact on you.

Where we do intend to use your personal data for a new purpose, we will inform you and provide any relevant information before doing so. In some cases, you will have the right to object to that use, and we will make you aware of this right whenever it applies.

Depending on the circumstances, we may share your personal data with:

Category of recipient	Further details of recipients	Use by recipient	Relevant categories of personal data that may be shared with the recipient (depending on goods or service provided/reason for sharing)
Our insurers, brokers and professional advisers in the event of a complaint or legal claim against us or where we require external advice or assistance	Professional advisers e.g. solicitors, barristers, IT specialists	For assisting, advising and representing us as necessary	Potentially any personal data held
Credit check / identity check provider	Experian	To provide the results of a credit check / identity search	Identity personal data Contact personal data Financial personal data
Finance providers	VWFS Motonovo Octane Tandem Blue Bumper	To process your application for finance	Identity personal data Contact personal data Contract personal data Financial personal data
External auditors	Auditors of our accounts	For the statutory audit	As required by our auditors in connection with our audit (see above: ‘[What we use your personal data for]’)
Our bank	NatWest	For processing financial transactions	Identity personal data Contact personal data Financial personal data
Our regulator	Financial Conduct Authority	For assessing our compliance with our regulatory and professional obligations	Potentially any personal data held
External IT service providers	e.g. IT platform hosting provider, website hosting provider, IT support, email security, email service provider, document management providers, application software providers, aftersales (MOT/service reminder/advisory notices) provider, provider of self-service check in facilities	For providing the relevant IT service to us	Identity personal data Contact personal data Contract personal data Financial personal data IT Systems personal data Technical personal data Usage personal data Website Enquiry personal data Other personal data
Credit card payment facility provider		For providing the relevant service to us	Identity personal data Financial personal data
Other external service providers	e.g. event co-ordinator	For providing the relevant service to us	Identity personal data Contact personal data
Law enforcement/regulatory agencies	e.g. the Information Commissioner’s Office	For their investigations	Potentially any personal data held
Car manufacturers	Skoda (trading name of Volkswagen Group United Kingdom Limited) Please see Skoda’s privacy notice at skoda.co.uk/privacy Volkswagen Seat/Cupra Norton	For the purposes of our contract with you Volkswagen Group United Kingdom Limited reviews our calls on a monthly basis to ensure we are maintaining expected customer service standards	Identity personal data Contact personal data Contract personal data
Warranty companies	Autoprotect Limited VWFS Norton	To deal with warranty enquiries	Identity data Contact data Contract data
Companies within the Group		For the purposes of 1) our contract with you or the organisation you work for or represent 2) customer support 3) marketing	Identity personal data Contact personal data Contract personal data Financial personal data Marketing personal data Website Enquiry personal data Other personal data
Other parties that have or may acquire control or ownership of our business or part of our business (and our or their professional advisers) in connection with a corporate transaction or restructuring, including a merger, acquisition or asset sale or in the event of our insolvency			Potentially any personal data held Where possible information will be anonymised during a transaction and until completion of the transaction but this may not always be possible

We only allow our service providers (who are processors of your personal data) to handle your personal data if we are satisfied they take appropriate measures to protect your personal data. We also impose contractual obligations on those service providers to ensure they can only use your personal data to provide services to us. Other recipients, such as our professional advisers who are controllers of your personal data due to the nature of the services they provide are bound by confidentiality obligations.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including:

To meet our obligations to you or to the organisation you represent in respect of goods and/or services you/ the organisation you work for or represent engage us to supply;
To respond to any questions, complaints or claims made by you/the company you represent;
To bring or defend legal claims;
To show that we treated you fairly; and
To keep records required by law to comply with our legal and regulatory obligations.

We will not retain your data for longer than necessary for the purposes set out in this privacy notice.

If you are a customer or the registered driver of a leased or other vehicle purchased from us, we will hold your personal data for six years from the date that our relationship ends.

Where we have obtained your personal data following a request for information, test drive, a brochure, quotation or any other information about our goods and/or services, we will hold your personal data for 18 months from the date we collect that information, unless during that time you become a customer.

Call recordings are retained for 30 days after which they are deleted.

It is sometimes necessary for us to share your personal data outside the UK e.g. with our service providers located outside the UK (see above: ‘[Who we share your personal data with]’).

We will ensure the transfer complies with relevant data protection law by ensuring that e.g.:

The country to which the personal data is being transferred is subject to an adequacy regulation i.e. it has been decided by the UK government that the particular country ensures a level of protection of personal data that is not materially lower than the UK law;
The transfer is necessary for the performance of a contract between you and us;
The transfer is necessary to establish, exercise or defend legal claims;
There are appropriate safeguards in place between us and the organisation receiving it together with enforceable rights and effective legal remedies for you; or
You have provided explicit consent to the proposed transfer after being informed of any potential risks.

Where we transfer your personal data outside of the UK, we do so on the basis of an adequacy regulation or (where this is not available) by way of standard data protection clauses (once we have concluded, having acted reasonably and proportionately, that the data protection test has been met). In the event that we cannot or choose not to continue to rely on either of those mechanisms at any time, we will not transfer your personal data outside the UK unless we can do so on the basis of an alternative mechanism or exception provided by data protection law and reflected in an update to this privacy notice.

Any changes in the transfer mechanisms we rely on to transfer personal data internationally will be notified to you in accordance with the section: ‘Changes to this privacy policy’ (see below).

Please contact us (see below: ‘[How to contact us]’) if you want further information on the specific mechanism used by us when transferring your personal data outside of the UK.

You have the following rights, which you can exercise free of charge:

Access	The right to be provided with a copy of your personal data
Rectification	The right to require us to correct any mistakes in your personal data
Erasure (also known as the right to be forgotten)	In certain situations, the right to require us to delete your personal data
Restriction of processing	In certain situations, the right to require us to restrict processing of your personal data e.g. if you contest the accuracy of the data. You can ask us to stop processing the personal data whilst we look into the accuracy issues
Data portability	In certain situations, the right to ask us to transfer any personal data you provided to us to another organisation
To object	The right to object at any time to your personal data being processed for direct marketing and in certain other situations to our continued processing of your personal data e.g. where processing is carried out for the purpose of our legitimate interests unless there are compelling legitimate grounds for the processing to continue or the processing is required for the establishment, exercise or defence of legal claims
Not to be subject to automated individual decision making	The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you
To withdraw consent	If you have provided us with a consent to use your personal data you have a right to withdraw that consent easily at any time. To do this, please email, write or telephone us (see below: ‘[How to contact us]’). Withdrawing a consent will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn.

Automated decision-making is the process of making decisions by automated means with or without any human involvement. We do not make decisions about you based solely on automated processing that would have legal, or similarly significant, effects for you. We will notify you if this position changes.

For further information on each of the above rights, including the circumstances in which they apply, please contact us or see the [Guidance from the UK Information Commissioner’s Office on individuals’ rights under the General Data Protection Regulation].

If you would like to exercise any of the above rights, please email, write or telephone us (see below: [‘How to contact us’]) and provide us with enough information to identify you as well as what right you want to exercise and the personal data to which your request relates.

We have put in place reasonable and appropriate security measures to endeavour to prevent personal data from being accidentally lost, used or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

For users of our Websites, unfortunately, the transmission of information via the internet is never completely secure. We cannot therefore guarantee the security of your data transmitted via our Websites; any transmission is at your own risk. Our Websites may, from time to time, contain links to other websites plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy notices / policies. When you leave our Websites, we encourage you to read the privacy notice / policy of every website you visit before you submit any data to these websites.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a data security breach where we are legally required to do so.

We hope that we can resolve any query or concern you may raise about our use of your personal data. If you want to complain about how we have used your personal data, please email us at: informationofficer@winchester.skoda.co.uk.

If we are not able to resolve your complaint to your satisfaction, you can complain to the UK’s data protection authority, the Information Commissioner’s Office (ICO). Further information about how to make a complaint to the ICO can be found on the ICO website www.ico.org.uk.

We may change this privacy notice from time to time and when we do so, we will inform you via our website. If any changes are likely to have an adverse impact on your rights under data protection law, we will use reasonable endeavours to notify you of the changes in advance in writing or by alternative means.

It is important that the personal data we hold about you is accurate and current.

Please let us know if you change your name, address or any other personal details (see below: ‘[How to contact us]’).

If you have any queries about this privacy notice or how we use your personal data, you can contact us as follows:

Email: informationofficer@winchester.skoda.co.uk

Telephone: 01962 866331

Post: 43, St Cross Road, Winchester, Hampshire, SO23 9PU

Do you need extra help?

If you would like this privacy notice in another format (for example large print) please contact us (see above: ‘[How to contact us]’).

[Date of privacy notice: 31/07/2026]

[Document Version Number: 1.0]

Monday - Friday	{{weekdays}}
Saturday	{{saturday}}
Sunday	{{sunday}}

Monday	{{monday}}
Tuesday	{{tuesday}}
Wednesday	{{wednesday}}
Thursday	{{thursday}}
Friday	{{friday}}
Saturday	{{saturday}}
Sunday	{{sunday}}

Call Us

Solent Used Car Centre

Petersfield Used Car Centre

Winchester Motor Company ŠKODA

Garland Motors ŠKODA Aldershot

Garland Motors ŠKODA Aldershot - NEW

Winchester Motor Company ŠKODA - NEW

Winchester SEAT/Cupra

Rent A Car

Winchester Volkswagen

South Downs Motorcycles

South Downs Motorcycles - New Bikes

Winchester Motor Group Privacy Notice

Key Terms

Overview of which Group company processes your personal data

Personal data we collect and use

How your personal data is collected

Data collection via cookies

How and why we use your personal data

How and why we use special category data

Marketing communications

Who we share your personal data with

How long your personal data will be kept

Transferring your personal data outside of the UK

Your rights

Keeping your personal data secure

How to complain

Changes to this privacy notice

Changes to your personal data

How to contact us

Vehicles

Quick Links

Legal

Financial Conduct Authority

Financial Conduct Authority

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Mandatory attributes :

Optional attributes :

Example:

{{title}}

{{title}}

{{title}}

Share this page

{{tab}}

{{tab}}

{{activeTab === 'tab1' ? firstTab : secondTab}}

From {{ prefix }}{{ price }}

{{ make }} {{ model }} {{ version }} {{ longVersion }}

{{dataValue}} {{dataUnit}}

{{dataTitle}}

{{dataValue}} {{dataUnit}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Used Car Shortlist

{{car.manufacturer}} {{car.model}}

{{car.version}}

{{manufacturer}} {{model}}

{{version}}

{{dataTitle}}

{{dataValue}} {{dataUnit}}

{{ title }}

From £{{price}} or £{{monthlyPrice ? monthlyPrice : 'POA'}} p/m

Select your model

Specifications

From
{{ prefix }}{{ price }}

{{ make }} {{ model }} {{ version }}
{{ longVersion }}