Privacy Policy

CARVADO

PRIVACY POLICY

Document ID:

CAR-LGL-007

Version:

1.0

Classification:

Public

Status:

Draft for Final Legal Review

Document Owner:

Carvado Membership Team

Effective Date:

[To be completed]

Review Date:

[To be completed]

Last Updated:

[To be completed]

ABOUT THIS DOCUMENT

This Privacy Policy forms part of the Carvado Membership Legal Centre.

This document should be read together with the Terms & Conditions.

Where any inconsistency exists between this document and the Terms & Conditions, the Terms & Conditions shall take precedence unless applicable law requires otherwise.

This Privacy Policy explains how Carvado collects, uses, stores, protects and shares personal information in connection with Membership services, the website and related services.

CONTENTS

1 Introduction

2 Who We Are

3 Information We Collect

4 How We Collect Information

5 Lawful Bases for Processing

6 How We Use Information

7 Sharing Information

8 Data Security

9 Data Retention

10 Your Rights

11 International Transfers

12 Contact Details

13 Changes to this Policy

14 Governing Law

15 Version History

Carvado is committed to protecting the privacy of every Member, customer and website visitor.

We recognise the importance of handling personal information responsibly, securely and transparently.

This Privacy Policy explains how personal information is processed whenever individuals interact with Carvado, including through Membership services, our website, our Member Dashboard and associated communications.

This Privacy Policy applies to personal information processed by Carvado in connection with:

• Membership enquiries;
• Membership purchases;
• Member Accounts;
• Insurance Reviews;
• website use;
• referral programme participation;
• customer support;
• events;
• communications;
• payment administration;
• any other services operated by Carvado.

This Privacy Policy should be read together with:

• Terms & Conditions;
• Cookie Policy;
• Referral Programme Terms;
• Fair Use Policy;
• Complaints Policy;
• any other applicable Membership documentation.

For the purposes of applicable data protection legislation, Carvado is the Data Controller in relation to the personal information described within this Privacy Policy unless expressly stated otherwise.

Questions regarding this Privacy Policy or the way personal information is processed may be directed to the Carvado Membership Team using the contact details published on the Carvado website.

Carvado is committed to complying with applicable UK data protection legislation including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable privacy legislation.

Depending upon your interaction with Carvado, we may collect information including:

• name;
• email address;
• telephone number;
• postal address;
• date of birth;
• Membership information;
• account credentials;
• payment information;
• communication preferences;
• referral information;
• support enquiries.

Where relevant to Membership services, we may also collect information relating to Vehicles including:

• registration number;
• make;
• model;
• year;
• modifications;
• insurance renewal dates;
• other information voluntarily provided by the Member.

Where Members create an account, we may collect:

• login information;
• account activity;
• Dashboard usage;
• downloaded resources;
• Membership status;
• referral history;
• communication history.

When using our website or online services, technical information may be collected including:

• IP address;
• browser type;
• operating system;
• device information;
• pages visited;
• website interactions;
• diagnostic information;
• security logs.

Some of this information may be collected automatically through cookies or similar technologies.

Most personal information is collected directly from you when you:

• complete Membership forms;
• create an account;
• purchase Membership;
• request an Insurance Review;
• contact Carvado;
• complete online forms;
• participate in events;
• use the Member Dashboard.

Certain information is collected automatically when using our website and online services.

Examples include website usage statistics, security logs and technical information necessary to operate our services securely.

We may also receive limited information from trusted third parties including:

• payment providers;
• authentication providers;
• insurers or insurance intermediaries where relevant;
• fraud prevention providers;
• technology partners;
• other organisations where authorised by you or permitted by law.

Much of the personal information we process is necessary in order to provide Membership services and fulfil our contractual obligations.

We may process information where necessary for our legitimate business interests provided those interests are not overridden by your rights and freedoms.

Examples include:

• improving Membership services;
• fraud prevention;
• security monitoring;
• customer support;
• service development;
• operational management.

Certain information must be processed to comply with legal or regulatory obligations.

Where required by law, we will request your consent before processing information for specific purposes.

Where processing relies upon consent, you may withdraw that consent at any time, although this will not affect processing carried out before consent was withdrawn.

Personal information may be used to:

• administer Membership;
• verify identity;
• process payments;
• manage Member Accounts;
• provide Member Benefits;
• deliver Welcome Packs;
• process referrals;
• communicate with Members.

Where requested, personal information may be used to assist with Insurance Reviews and related Membership services.

We may communicate with Members regarding:

• Membership status;
• payment information;
• renewal reminders;
• service updates;
• security notifications;
• support enquiries;
• important operational information.

Marketing communications will only be sent where permitted by law and in accordance with your communication preferences.

Carvado does not sell Members' personal information.

Personal information will only be shared where reasonably necessary to provide Membership services, comply with legal obligations, protect legitimate interests or where the Member has requested or authorised such sharing.

Personal information may be shared with carefully selected service providers who assist Carvado in operating its Membership services.

Examples may include:

• payment providers;
• website hosting providers;
• cloud infrastructure providers;
• authentication providers;
• customer communication platforms;
• delivery providers;
• customer support software providers;
• analytics providers;
• fraud prevention providers.

Each provider is expected to process personal information only for authorised purposes and with appropriate security measures.

Where a Member requests an Insurance Review or another insurance-related service, relevant personal information may be shared with insurers, insurance brokers or other authorised intermediaries where necessary to provide the requested service.

Only information reasonably necessary for the relevant service will normally be shared.

Carvado may disclose personal information where required or permitted by law, including where reasonably necessary:

• to comply with legal obligations;
• to respond to court orders;
• to cooperate with regulators;
• to prevent or investigate fraud;
• to protect Members or staff;
• to establish, exercise or defend legal claims.

If Carvado undergoes a merger, acquisition, investment, restructuring, sale of assets or other business reorganisation, personal information may be transferred as part of that transaction where permitted by law.

Appropriate safeguards will be implemented where required.

Carvado takes the protection of personal information seriously and implements reasonable technical and organisational measures designed to safeguard personal information against accidental or unlawful loss, misuse, unauthorised access, alteration or disclosure.

Security measures may include:

• encrypted communications;
• secure authentication systems;
• role-based access controls;
• monitoring of account activity;
• audit logging;
• secure cloud infrastructure;
• regular software updates;
• access controls for administrative systems;
• security testing and operational monitoring.

The exact security measures used may evolve over time to reflect technological developments and emerging risks.

Members also play an important role in protecting their personal information.

Members should:

• choose strong passwords;
• keep login credentials confidential;
• avoid sharing authentication codes;
• sign out from shared devices;
• promptly notify Carvado of suspected unauthorised access;
• keep account information accurate and up to date.

Although Carvado aims to protect all personal information, no internet-based system can guarantee absolute security.

Where a personal data breach occurs that requires notification under applicable law, Carvado will take appropriate action in accordance with its legal obligations.

Carvado retains personal information only for as long as reasonably necessary for the purposes for which it was collected, including the provision of Membership services, compliance with legal obligations, dispute resolution, fraud prevention and the protection of legitimate business interests.

The length of time information is retained may depend upon factors including:

• the nature of the information;
• whether Membership remains active;
• legal or regulatory obligations;
• taxation and accounting requirements;
• limitation periods for legal claims;
• fraud prevention needs;
• operational requirements.

Where personal information is no longer required, Carvado will take reasonable steps to securely delete, anonymise or otherwise dispose of that information in accordance with applicable law and operational requirements.

Subject to applicable law, individuals may have rights regarding their personal information.

These rights may include the right to:

• request access to personal information;
• request correction of inaccurate information;
• request deletion of personal information in certain circumstances;
• request restriction of processing;
• object to certain processing activities;
• request data portability where applicable;
• withdraw consent where processing relies upon consent.

Requests relating to personal information should be submitted using the contact details published by Carvado.

Carvado may request reasonable information to verify the identity of the individual before responding.

Carvado aims to respond to valid requests within the timescales required by applicable data protection legislation.

Certain requests may be refused or limited where permitted by law.

If an individual believes that Carvado has not handled personal information appropriately, they are encouraged to contact Carvado first so that the matter can be investigated.

Nothing within this Policy affects the right to raise concerns with the relevant supervisory authority where applicable.

Carvado primarily seeks to process personal information within the United Kingdom or other jurisdictions that provide an appropriate level of protection.

Where personal information is transferred internationally, Carvado will take reasonable steps to ensure appropriate safeguards are in place in accordance with applicable data protection legislation.

Such safeguards may include contractual protections, adequacy regulations or other recognised legal mechanisms.

Questions regarding this Privacy Policy or the processing of personal information may be directed to the Carvado Membership Team using the contact details published on the Carvado website.

To protect personal information, Carvado may request reasonable evidence of identity before disclosing personal information or acting upon certain requests.

Carvado may update this Privacy Policy from time to time to reflect:

• changes in legislation;
• regulatory guidance;
• technological developments;
• operational improvements;
• new Membership services;
• changes to data processing activities.

Where required by law, Members will be notified of material changes before those changes take effect.

The latest version of this Privacy Policy will be published within the Membership Legal Centre.

Document:

Privacy Policy

Document ID:

CAR-LGL-007

Version:

1.0

Classification:

Public

Status:

Draft for Final Legal Review

Effective Date:

[To be completed]

Review Date:

[To be completed]

Last Updated:

[To be completed]

Document Owner:

Carvado Membership Team

Review Cycle:

Annual or earlier where required by changes in legislation, regulation or operational changes affecting personal information.

Revision History

Version 1.0

Initial publication.

END OF PRIVACY POLICY