Please note that if you purchase a vehicle from a manufacturer franchised dealership that is not Central Garage (Uppingham) Limited t/a buyanymotorbike.com or give your information to such a dealership, or direct to a manufacturer then you will have a separate relationship with that organisation in respect of the use of your data and you will need to contact the organisation concerned in relation to any request you may have.
In this data protection declaration, we use, inter alia, the following terms:
Personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
Consent of the data subject is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Name and Address of the data controller
The Data controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member states of the European Union and other provisions related to data protection is:
Name and Address of the Data Protection Officer
Any data subject may, at any time, contact our Data Protection Officer directly with all questions and suggestions concerning data protection.
Your data and how we use it
We may collect and process the personal data as set out in the below table, which covers off the purpose, lawful basis and the time scale.
Type of data
Lawful basis for
Length of time we
Your name, contact details, your purchase history and records of communication you have had with us
For administrative purposes if you are a current or past customer, including to:
Necessity to perform our contract with you. Failure to provide such data where we request it may mean
we are unable to
Seven years from the date on which we supply goods or services to you.
If you do not purchase
supply you with the requested product or service.
from us, 12 months from your last interaction with us.
To carry out credit checks where you are
purchasing products on credit terms.
Our legitimate interest in preventing default.
Seven years from the date on which we
supply goods or services to you.
To help us recover debts due to us from you.
Our legitimate interest of recovering money due to us.
Seven years from the date on which we supply goods or
services to you.
To bring or defend legal claims.
Our legitimate interest of bringing or defending legal claims.
Where you purchased a product regulated by the FCA, 10 years from the date you bought that product. Otherwise, seven years from the date
you last dealt with us.
To contact you about products and services offered by us, using one or more of:
Two years from the date on which you last gave your consent to marketing, although we may retain limited records to the extent required to maintain suppression lists.
warranties and motor insurance
Your purchase history. History about email or website content you have previously engaged with.
Market research, which may include customer analysis and profiling.
To help us improve our content, products and services, which
may include profiling.
Our legitimate interest of researching what content, products and services is/are popular, and to help us improve our content, products and
We only retain market research in an anonymised form.
To identify other products or services you might be interested in for the purpose of direct marketing, which may include profiling.
Seven years from the date on which you last gave your consent to marketing, although we may retain limited records to the
extent required to maintain suppression
Your IP address, the web site from which you visit us, the web pages you actually visit and the date and
length of your visit.
To help us secure and manage the performance of our websites.
Our legitimate interest of securing and managing the performance of our websites.
This data is only stored anonymised.
Your name, contact details, and personal documents enabling us to prove your identity, which may include your passport, driving licence, and/or national insurance
To help us detect and prevent fraud.
Our legitimate interest of preventing loss.
Seven years from the date on which we supply goods or services to you.
All relevant documents demonstrating the provenance of any values of cash you pay us in excess of £1,000. This is likely to include your name, contact details, bank details, and key information and documents in respect of your
To help us detect and prevent money laundering.
Necessary for us to comply with a legal obligation.
Failure to supply this information where we request it may result in us being unable to sell you the requested product or service.
Seven years from the date on which we supply goods or services to you.
Where multiple retention periods apply to one category of data, the retention period will be the longest one (although we will stop using that category of data when the retention period for that purpose expires).
With regards to the items with a green background either: (a) you may have the right to object to processing; or (b) you have the right to withdraw your consent. For details on how to exercise either, please see the section below titled “Withdrawing your consent and/or objecting to our processing”.
Withdrawing your consent and/or objecting to our processing
Where we originally relied on consent to process your personal data, you will always have the right to withdraw that consent.
Similarly, where we originally relied on our legitimate interests to process your personal data, you always have a right to object to our processing of that personal data. However, we do not have to stop processing that personal data following your objection where we are able to demonstrate either:
Your right to object to legitimate interests processing is however absolute if it relates to processing for marketing purposes.
We highlight where these rights apply in the table of data processing activities above, and below we set out the easiest way to withdraw your consent to, or opt-out from, marketing communications.
If we are not yet processing your personal data (i.e. because this is your first contact with us):
You can opt out of receiving marketing communications from us by ticking the appropriate box on the form which you complete (whether on our website or via a paper form), or by contacting us at any time using the details set out within this document.
If you previously opted-in to marketing or did not opt-out at the time you gave us your details (as the case may be):
You can withdraw your consent or opt-out by clicking the unsubscribe link which we include on all of our electronic marketing communications, or by contacting us at any time using the details set out within this document.
Objecting to non-marketing legitimate interests processing
To object to any of our non-marketing processing based upon our legitimate interests (as highlighted in the processing activities table above), please contact us using the contact details at the top of this policy.
Where we obtain your personal data from
We obtain personal data from the following sources:
Persons with whom we may share your data
In general, access to your personal data will be restricted to those who have a need to access it in order to carry out their duties (for example, our customer service teams and finance teams).
However, we will also share your personal data with the following external third parties in some circumstances:
Transfers outside of the European Economic Area
In certain limited circumstances, we may export personal data outside of the European Economic Area for processing, and we may use third party service providers who do the same.
We only do that if there is a good reason to do it and where adequate safeguards (such as the appropriate contractual arrangements with suppliers, or adequacy decisions, depending on the destination country) are in place.
Your rights (with effect from 25 May 2018)
The law gives you certain rights in respect of the personal data that we hold, which you should be aware of:
If you would like to exercise any of these rights, please contact us using the details set out at the top of this policy.
What to do if we cannot resolve your issue
Should you have any complaints or issue with our treatment of your personal data, you may lodge a complaint with the Information Commissioner’s Office (https://ico.org.uk).
Central Garage (Uppingham) Limited t/a buyanymotorbike.com internet sites
We try to keep our websites secure. However, you recognise when providing your information to us through our websites, or when you send us or ask us to send you any of your confidential information by e-mail, that the internet and e-mail communications over the internet may not be secure. We cannot be responsible for any loss or unauthorised interception of information transmitted via the internet, which is beyond our control.
e.g. does not have to enter access data each time the website is accessed, because this is taken over by the website, and the cookie is thus stored on the user's computer system.
You may, at any time, prevent the setting of cookies through our website by means of a corresponding setting of the Internet browser used, and may thus permanently deny the setting of cookies. Furthermore, already set cookies may be deleted at any time via an Internet browser or other software programs. This is possible in all popular Internet browsers. If the data subject deactivates the setting of cookies in the Internet browser used, not all functions of our website may be entirely usable.
Subscription to our newsletters
On our website and within the dealership, you are given the opportunity to subscribe to our organisation's newsletter. The input mask used for this purpose determines what personal data are transmitted, as well as when the newsletter is ordered from the controller.
We will inform our customers and business partners regularly by means of a newsletter about various offers and upcoming events. The newsletter may only be received by the you if (1) you have a valid e-mail address and (2) you register for the newsletter. A confirmation e-mail will be sent to the e-mail address registered by you for legal reasons as part of the double opt-in procedure. This confirmation e-mail is used to prove whether the owner of the e-mail address is authorised to receive the newsletter.
During the registration for the newsletter, we also store the IP address of the computer system assigned by the Internet service provider (ISP) and used by you at the time of the registration, as well as the date and time of the registration. The collection of this data is necessary to understand the (possible) misuse of the e-mail address at a later date, and it therefore serves the aim of the legal protection of the controller.
The personal data collected as part of a registration for the newsletter will only be used to send our newsletter. In addition, subscribers to the newsletter may be informed by e-mail, as long as this is necessary for the operation of the newsletter service or a registration in question, as this could be the case in the event of modifications to the newsletter offer, or in the event of a change in technical
circumstances. There will be no transfer of personal data collected by the newsletter service to third parties. The subscription to our newsletter may be terminated by the data subject at any time. The consent to the storage of personal data, which the data subject has given for shipping the newsletter, may be revoked at any time. For the purpose of revocation of consent, a corresponding link is found in each newsletter. It is also possible to unsubscribe from the newsletter at any time directly on the website of the controller, or to communicate this to the controller in a different way.
The newsletter contains so-called tracking pixels. A tracking pixel is a miniature graphic embedded in such e-mails, which are sent in HTML format to enable log file recording and analysis. This allows a statistical analysis of the success or failure of online marketing campaigns. Based on the embedded tracking pixel, we may see if and when an e-mail was opened by a data subject, and which links in the e-mail were called up by data subjects.
Such personal data collected in the tracking pixels contained in the newsletters are stored and analysed by the controller in order to optimise the shipping of the newsletter, as well as to adapt the content of future newsletters even better to the interests of the data subject. This personal data will not be passed on to third parties. Data subjects are at any time entitled to revoke the respective separate declaration of consent issued by means of the double-opt-in procedure. After a revocation, the personal data will be deleted by the controller. We automatically regard a withdrawal from the receipt of the newsletter as a revocation.