The purpose of this policy is to provide you with a clear and transparent understanding of how we process your personal information and in turn, to demonstrate that all personal data handled by SG Fleet UK is controlled and processed in accordance with the Data Protection Act 2018 and the General Data Protection Regulation 2016 as it forms part of domestic law in the UK by virtue of section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”).

SG Fleet UK is part of the SG Fleet Group which offer a range of services, principally fleet management, corporate leasing, employee benefit solutions and vehicle tracking services.

“SG Fleet Group” means an entity that controls, is controlled by, or is under common control with, directly or indirectly, SG Fleet UK including the following:

• SG Fleet Group Limited, registered in Australia under ACN 167 554 574. The registered office is situated at Level 2, Building 3, 20 Bridge Street, Pymble, NSW, 2073, Australia.
• SG Fleet Australia Pty Limited, registered in New South Wales Australia under ABN 15 003 429 356. The registered office is situated at Level 2, Building 3, 20 Bridge Street, Pymble, NSW, 2073, Australia.
• SG Fleet NZ Limited, registered in Auckland under company number 1920318. The registered office is situated at Level 3, 632 Great South Road, Ellerslie, Auckland, 1051, New Zealand.

SG Fleet Solutions UK Limited and SG Fleet UK Limited are data controllers of your personal information in relation to the processing activities described below:

A “data controller” is an organisation that decides why and how your personal information is processed. Where this policy refers to “we”, “our” or “us” below, unless it mentions otherwise, it’s referring to the particular SG Fleet company that is the controller of your personal information.

3. The personal information we collect

Information provided by you

You may provide us with your personal information where you enter your personal information in a form on our website, engage with us in respect of our vehicles, products or services, or correspond with us by phone, email or otherwise or complete an application. It is provided entirely voluntarily.

The information you give us may include:

We may also ask you for information about your vehicle and information about your driving history including information about insurance policies or claims.

We may also be required to collect your name, address, date of birth and other verification information to comply with the requirements of the Proceeds of Crime Act 2002 and the Money Laundering Regulations 2017 (and any laws that replace or amend these) and we will be using a third-party provider to conduct verification searches using this information.

Information we collect by automated means

We may automatically collect technical information about you including anonymous data collected by our hosting server for statistical purposes, the Internet protocol (IP) address used to connect your computer or device to the internet, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform. We may also collect information about your vehicle and/or its location and vehicle behavioural data, e.g. revving, idling, speeding through our tracking services. 

Information provided by a third party

We may receive information about you from third parties in connection with our vehicles, products, or services. For example, we may:

Where it is in your VITAL INTEREST: where we have supplied you with a vehicle, or any other product or service, we may use your personal information to contact you if there are any urgent safety or product recall notices to communicate to you.

Where there is a LEGAL REQUIREMENT: we will use your personal information to comply with our legal obligations including: (i) to assist the Driver and Vehicle Licensing Agency, FCA, HRMC, the ICO or other public authority or criminal investigation body; (ii) to verify your identity when you contact us to protect the security of your information we hold about you ; or (iii) to verify the accuracy of data we hold about you or to perform our obligations under relevant data protection laws.

Information on applications will be sent to CRAs and will be recorded by them. Where you hire from us, we will give details of your accounts and how you manage such accounts to CRAs. If you do not make payments in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs and FPAs to perform similar checks and to trace your whereabouts and recover debts that you owe. Records remain on file for 6 years after they are closed, whether settled by you or defaulted.

If you give us false or inaccurate information and we suspect identify fraud we will record this and may also pass this information to FPAs and other organisations involved in crime and fraud prevention.

We may disclose your personal information to:

SG Fleet Group as identified in section 2 above. A simple backup is shared, to allow us to replicate the customer database in a disaster recovery situation.

Our suppliers, service providers and contractors: including website hosting providers, IT system administrators and digital transaction management provider. When we use third-party service providers, we will contract with them to keep your information secure and to only use it in accordance with our specific instructions.

Third parties who provide products and services to you: we work closely with various third parties to bring you a range of products and services that are complementary to those that we provide. In particular, we may offer finance or insurance products, or maintenance, repair or recovery services in relation to your vehicle. When you enquire about or purchase one or more of these products or services through us, the relevant third party service provider may use your details to provide you with information about the complementary product or service and to carry out their obligations arising from any contracts you have entered into with them. These third-party product providers may share your information with us, which we will use in accordance with this policy. [Where you receive the third party product or service as part of your contract with us, the third party may only use your information to provide the product or service to you and in accordance with our instructions. If the third party agrees a separate contract with you then we advise you to read their privacy policy which should detail how they manage your information].

For our consumer sector we work with Close Brothers Finance, who may receive your personal information:

• Close Brothers - Leasing Privacy Policy 

Other third parties may include:

• third parties including government agencies or toll road operators where required or allowed by law or court or tribunal order or in order to register or to protect our interests or to deal with infringements;
• any party acting on your behalf (e.g. financial advisers, lawyers, or accountants);
• your employer or your guarantor;
• organisations to whom we outsource functions including professional advisers (e.g. our legal advisors, auditors and accountants) and collection and mercantile agents for debt recovery and tracing purposes;
• you have given us permission to conduct business with you by electronic means then your personal information may be stored by our third-party document handler, DocuSign but for no longer than 6 months; and
• to a third party as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation;
• as part of our duty to the authorities comply with any legal or regulatory disclosure obligation for the purposes of detecting or reporting a crime;
• to the authorities, our legal advisors and the courts to enforce or apply the terms of our contracts;
• to the authorities, investigators or insurers to protect our rights, property and the rights, property or safety of our employee’s visitors and customers; and
• when required to do so by law, for example under a court order, or in response to properly made demands under powers contained in legislation.

All information you provide to us may be transferred to countries outside the UK. By way of example, this may happen in the following circumstances:

• where we share your information with our group companies outside of the UK (see Section 2 for details of these companies);
• where our servers are located outside the UK; or
• where the parties to whom we share your information (see Section 6) are located in a country outside of the UK.

These countries may not have data protection laws that protect your data as robustly as the UK data protection laws. Therefore, we maintain the appropriate safeguards such as: 

• international Data Transfer Agreements (IDTA) with our group companies outside of the UK (see Section 2 for details of these companies).SHA-256 hashing for data in transit
• Data encryption for data at rest with several encryption protocols.
• ISO27001 and cyber security certification across the group companies.

All SG Fleet suppliers are based in the UK/Europe and are governed by GDPR.

If we transfer your information outside of the UK in this way, we will take the above steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this policy. These steps allow us to impose contractual obligations on the recipient of your personal information or ensuring that the recipients are subscribed to ‘international frameworks’ that aim to ensure adequate protection.

Please contact us using the details at the end of this policy to obtain a copy of the relevant documents.

We may need your personal information to establish, bring or defend legal claims. For this purpose, we will always retain your personal information for up to 7 years. We may retain the information for a longer period where the claim is unresolved beyond the initial 7 years.

The only exceptions to this are where:

• you make an enquiry with us but do not contract with us for any vehicle, product or service, in which case we will hold your information for no longer than 12 months;
• the law requires us to hold your personal information for a longer period, or delete it sooner;
• you exercise your right to have your information erased (where it applies) and the law does not give us an exceptional reason to retain it (see further  ’Your Rights’ below); or
• in limited cases, the law permits us to keep your personal information indefinitely provided we put certain protections in place.

Once we have received your personal information, we put in place reasonable and appropriate controls to ensure that it remains secure against accidental or unlawful destruction, loss, alteration, or unauthorised access.

When you log into the secure section of our website we use a secure server. Any data you give us when you are logged into the secure section of our website, is encrypted using a Secure Socket Layer (SSL) session. SSL is an industry standard and is one of the best ways to ensure Internet messages are not intercepted. You should be aware, however, that some older browsers cannot use SSL. If your browser does not support 128 bit encryption (or higher) you will not be able to log into or use our secure website services.

Our general email enquiry forms are not sent via an encrypted channel and for this reason we ask that you do not include confidential information or sensitive personal information when using them.

Where we have given (or where you have chosen) a password which enables you to access an account, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

11. Use of cookies

We use cookies to gather information on IP addresses, to analyse trends, administer the site, track users' movements on the site and gather broad demographic information for aggregate use. IP addresses are not linked to other personally identifiable information and will not be used to deliver targeted marketing messages.

We may work with third parties to research certain usage and activities on our website. In the course of conducting this research we, and these third parties may place a unique "cookie" on your browser which will enable the third party to track your use of our website on our behalf for our own business purposes.

12. Marketing 

We may collect your preferences to receive marketing information directly from us by email in the following ways:

• if you register an account with us online, we will ask you if you would like to provide your consent to receive marketing information directly from us by email or other electronic means; or,
• if you make an enquiry or place an order for a vehicle, product or service, we may contact you by email or other electronic means with marketing information about similar vehicles, product or services, except where you indicate you would prefer otherwise as set out below; or,
• if you enter a competition prize draw promoted by SG Fleet, we will ask you if you would like to provide your consent to receive marketing information regarding our products and services directly from us by email or other electronic means.

From time to time, we may ask you to refresh your marketing preferences by asking you to confirm that you consent to continue receiving marketing information from us. You can withdraw your consent to marketing communications or adjust your preferences for who we deliver marketing messages to you at any time free of charge by clicking on the link in any individual marketing communication that we send you or by contacting us using the details in Section 15 above.

Under data protection law, you have a number of rights in relation to your personal information including;

• Accessing your personal information: You have the right to ask for a copy of the information that we hold about you. We may not provide you with a copy of your personal information to that extent that it contains information about other individuals whose identity we need to protect and/or if we have another lawful reason to withhold that information.
• Correcting and updating your personal information: The accuracy of your information is important to us. If you change your name, address, email address or contact telephone number, or you discover that any of the information we hold about you is inaccurate, out of date or incomplete, please let us know using the contact details in Section 15 below.
• Withdrawing your consent: Where we rely on your consent as the legal basis for processing your personal information, as set out above, you may withdraw your consent at any time free of charge. If you would like to withdraw your consent to receiving any direct marketing to which you previously opted-in, you can do so using our unsubscribe tool. If you withdraw your consent, our use of your personal information before you withdraw is still lawful.
• Objecting to our use of your personal information: Where we rely on legitimate business interests as the legal basis for processing your personal information, you may object to us using your personal information for these purposes. We will temporarily stop processing your personal information until we have investigated the matter, and if we agree that your objection is justified in accordance with your rights under data protection laws, we will permanently stop using your data for those purposes. Otherwise, we will provide you with our justification as to why we need to continue using your data. You may object to us using your personal information for direct marketing purposes and we will automatically comply with your request. If you would like to do so, please use our unsubscribe tool.
• Erasing your personal information or restricting its processing: In certain circumstances, you may ask for your personal information to be removed from our systems. Unless there is a lawful reason that we must continue to use or retain your personal information, we will make reasonable efforts to comply with your request. You may also ask us to restrict processing of your personal information where you believe it is unlawful for us to do so, you have objected to its use and our investigation is pending or you require us to keep it in connection with legal proceedings.
• Transferring your personal information in a structured data file (“data portability”): Where we rely on your consent as the legal basis for processing your personal information or need to process it in connection with your contract, you may ask us to provide you with a copy of that information in a structured data file so that it can be transferred to an alternative provider. We will provide this to you electronically in a commonly used and machine-readable format, such as a CSV file. You can ask us to send your personal information directly to another service provider, and we will do so if this is technically possible.

14. Complaints

You have the right to complain to the UK Data Protection Regulator, the Information Commissioner’s Office (ICO) if you are concerned about the way we have processed your personal information. You can do so by one of the following methods.

15. Contact us