This policy applies to the processing of customer personal data by the Griffin Mill (referred to as
"Griffin Mill"or "we").
The purpose of this policy is to provide our current, former and potential customers (jointly referred
to as "customers" or you) with a general understanding of:
- The circumstances under which we collect and process your personal data;
- The types of personal data we collect;
- The reasons for collecting your personal data; and
- How we handle your personal data.
The processing of your personal data forms an important part of our provision of products and
services to you. We appreciate the trust you place in us when providing us with your personal data,
and consider your privacy an essential part of the services we offer.
Freedom of Choice
Your personal data belongs to you. We strive not to make any assumptions regarding your privacy
preferences and aim to design our services so that you can choose whether to share your personal
data with us.
How We Use Your Information
We collect information about you so that we can:
- Identify you and manage any accounts you hold with us;
- Process your order;
- Maintain a service record for your vehicle, conduct research, statistical analysis and
- Carry out customer profiling and analyse your purchasing preferences;
- Let you know about other products, services or events that may be of interest to you;
- Detect and prevent fraud;
- Send MOT and Service reminders;
- Verify your identity and carry out anti-fraud checks;
- Provide you with payment options;
- Assess your application for a product, service or quote;
- Ensure that you can afford any financial agreement offered;
- Ensure that any insurance products are suitable for you;
- Administer your any finance agreements including updating you on and delivering our
- Monitor your use of our Websites and any response to advertising campaigns.
Where your vehicle manufacturer maintains an electronic service record of your vehicle we may
share details of any work with your manufacturer so that an accurate record can be kept.
We may use and process your personal information where this is necessary to perform a contract
with you and to fulfil and complete your orders, purchases and other transactions entered into with
us (or one of our authorised dealers or selected partners).
We may use and process your personal information as set out below where it is necessary for us to
carry out activities for which it is in our legitimate interests as a business to do so.
Processing necessary for us to support customers with sales and other enquiries:
- To respond to correspondence you send to us and fulfil the requests you make to us (for
example: test drives, service requests, brochure requests or information about specific
- To provide vehicle support and services (for example warranty services)
- To analyse, evaluate and improve our products and services so that your visit and use of our
website, applications and dealerships are more useful and enjoyable (we will generally use
data amalgamated from many people so that it doesn’t identify you personally).
- To undertake market analysis and research (including contacting you with customer surveys)
so that we can better understand you as a customer and provide tailored offers, products
and services that we think you will be interested in.
- We collect and analyse this information in this way so that we can deliver the most
appropriate customer experience to you by tailoring and making relevant all our service and
communications (for example, when your mileage suggests your vehicle is due for a service).
- To send/contact you with marketing information after you have purchased a product or
service from us or made a purchasing enquiry, We will only contact you with information
about our own products and services (and in ways the law allows). You have the right to
object to us sending you this information at any time.
- To contact you from time to time with marketing information (unless you object) if you have
expressly indicated to us that you are acting on behalf of a business or where we have
obtained your business contact details from our authorised dealer network or an online or
public business directory. In relation to any such information we send by email or SMS, we
will include an option allowing you to object to receiving future messages by unsubscribing.
- To contact you with targeted advertising delivered online through social media and other
platforms operated by other companies, unless you object. You may receive advertising
based on information about you that we have provided to the platform or because, at our
request, the platform has identified you as having similar attributes to the individuals whose
details it has received from us. To find out more, please refer to the information provided in
the help pages of the platforms on which you receive advertising from us
- To administer competitions and promotions that you enter with us from time to time and to
Where you have provided your consent, we may use and process your information to contact you
from time to time about promotions, events, products, services or information which we think may
be of interest to you. You can withdraw this consent at any time by contacting the dealership.
Sometimes we will need to process your personal information to contact you if there is an urgent
safety or product recall notice and we need to tell you about it.
We do not sell your information to third parties, but we do work closely with our manufacturer
partners and with third party suppliers who fulfil business activities for us (like warranty products,
marketing, events and market research etc).
We do not sell your information to third parties. However, we may from time to time disclose your
information to the following categories of companies or organisations to which we pass the
responsibility to handle services on our behalf: warranty providers, customer contact centres,
mobility and car hire providers, direct marketing communications agencies and consultants, market
research and market analytics service providers, our legal and other professional advisors.
We take steps to ensure that any third party partners who handle your information comply with
data protection legislation and protect your information just as we do. We only disclose personal
information that is necessary for them to provide the service that they are undertaking on our
behalf. We will aim to anonymise your information or use aggregated non-specific data sets where
Whilst our business is UK based there may be some instances where your information is processed
or stored outside of the EU. In those instances, we will ensure that appropriate safeguards are in
place for that transfer and storage as required by applicable law.
We may process your personal information to comply with our legal requirements (for example to
register your car with the DVLA).
We endeavour to only process customer personal data that is adequate, relevant and not excessive
in relation to the purpose for which it has been collected.
We aim to anonymize your personal data when a function or service can be achieved with
anonymized data. If we combine anonymized or non-personal data with your personal data, it will be
treated as personal data for as long as it remains combined.
On request, we will provide customers with further information regarding our processing of your
personal data, which may include excerpts from internal directives and guidelines.
It is Griffin Mill’s policy to comply with the applicable laws, rules and regulations governing privacy
and data protection in each and every country where we operate. Where necessary, we will adjust
our processing of your personal data as described in this policy to ensure legal compliance.
You may provide us with information about you or your vehicle when utilising Griffin Mill’s services
in or outside a vehicle or in other contacts with Griffin Mill, for example through our websites or
customer centres (in this context, please note that phone calls may be recorded for quality
assurance purposes). We may also obtain such data from our authorised dealers and repairers and
other third parties.
We are particularly careful and apply additional measures if and when collecting and processing
sensitive personal data, as required by applicable law.
Where reasonably practical or as required by applicable law, we will, in collecting or registering your
personal data, provide you with (i) specific information as to the purposes of the processing of your
personal data, (ii) the identity of the data controller, (iii) the identities of any third parties to whom
the data may be disclosed and (iv) other information which may be necessary to ensure that you are
able to safeguard your rights.
We will only retain your personal data for as long as it is necessary to fulfil the purposes outlined in
this policy or the purposes of which you have otherwise been informed.
This means that once you have consented to our processing of your personal data, we will retain
your data in accordance with the consent given and/or until you revoke your consent. If you have
revoked your consent, we may nevertheless retain certain personal data for the period required in
order for us to meet our legal obligations and defend ourselves in legal disputes. If we have not
obtained your consent to the processing, the data will only be retained for as long as such a period
of time as permitted by law.
Where we process your personal data, we strive to ensure that it is accurate and up-to-date. We will
seek to erase or rectify personal data that is inaccurate or incomplete. For more information
regarding your right to ensure the accuracy of your personal data held by us, please see the
"Information and Access" section below.
Information and Access
As stated in the "Notice" section above, we may provide you with specific information concerning
our processing of your personal data when collecting or registering such data.
Once per year you have the right to request, and receive free of charge, information on (i) what
personal data relating to you we process, (ii) where the personal data is collected, (iii) the purpose of
the processing, and (iv),with which recipients or categories of recipients the personal data is shared.
Requests for such information must be made in writing and be personally signed by you, and include
information on name, address and, preferably, your e-mail address. You also have the right to
request that we rectify any incorrect information we hold for you, the right to request that we erase
data held on you (please note exemptions may apply under the GDPR or for legal purposes), the
right to data portability and the right to restrict the processing of your information. Requests should
be sent to: Data Protection Officer, Griffin Mill, Upper Boat, Pontypridd, CF37 5YE.
Your requests will be dealt with in a prompt and proper manner. Requests to delete personal data
will be subject to any applicable legal requirements. Where the applicable law provides for an
administrative fee for complying with such a request, such a fee may be charged by Griffin Mill.
Griffin Mill strives to implement appropriate technical and organisational measures in order to
protect your personal data against accidental or unlawful destruction, accidental loss or alteration,
unauthorised disclosure or access and any other unlawful forms of processing. We aim to ensure
that the level of security and the measures adopted to protect your personal data are appropriate
for the risks presented by the nature and use of your personal data.