About this policy.

This policy sets out how we, handle your personal information that we obtain when you use our site, including when and why it is collected, used and disclosed and how it is kept secure. Throughout the site, the terms "we," "us" and "our" refer to Genesis Finance and SCUK.

You can contact Genesis Finance's Data Protection Officer by writing to DPO@uk.hcs.com or Floor 2 London Court, 39 London Road, Reigate, Surrey RH2 9AQ. Please note that, where necessary, we will pass your query to SCUK, who will contact you about your query, or we may refer you directly to SCUK's Data Protection Officer or customer services department, as appropriate.

You can contact our Data Protection Officer if you have any questions about this policy, including how to update or access your personal information or to make a complaint.

This policy may change from time to time so please check this page occasionally to ensure that you're happy with any changes.

This policy was last updated on 11th May 2018.

Information we collect about you.

When you use this site, the categories of information that we may collect about you are as follows:

• Personal information you give to us: This is information about you that you give to us by entering information on this site or contacting us directly, including by submitting details via the "Managing My Account" section on the site (e.g. if you are updating your contact details), submitting an enquiry form, and from any other contact forms on the site or by corresponding with us by phone, email or otherwise. The information you give to us on the site may include your name, date of birth, contact details (such as phone numbers, email address and address), agreement number, vehicle registration number, your normal monthly instalment, bank account details and any information you provide to us in "free text" fields on the site.
• Personal information we collect about you: We may automatically collect the following information: your location if you use the 'search for a Genesis Studio' function on our site and allow us to see your location, details of your browser and operating system, the website from which you visit our site, the pages that you visit on our site, the date of your visit, and, for security reasons such as to identify attacks on our site, the Internet protocol (IP) address assigned to you by your internet service. We collect some of this information using cookies – please see our Cookie Policy for further information. We also use Google Analytics to collect tracking information about you; for more information about Google Analytics, please refer to Google's privacy policy.

Use of your information.

The purposes for which we use your information and the legal basis under data protection laws on which we rely to do this are as follows:

• It is necessary for the performance of the contract with you or to take steps to enter into it. This applies when we need to verify your identity. If you have an agreement with us, then we will also use your information for administering the agreement between us (including tracing your whereabouts to contact you and recover debt) and to provide you with the service under that agreement (i.e. managing your account, communicating with you, providing updates on the status of your account, mid and end agreement reviews, dealing with any complaints and notifying you of any changes to this statement).
• It is necessary for our legitimate interests or that of a third party. This includes:
• to enhance and personalise your customer or visitor experience;
• to identify you when you contact us and to correspond and communicate with you;
• for marketing research in order to continually improve the products and services that we and our authorised Genesis Product Assistants offer and deliver to you;
• to verify the accuracy of data that we hold about you and create a better understanding of you as a customer or visitor;
• contacting you to ask you to participate in customer satisfaction surveys and market research (by email, letter, SMS or phone) and to undertake and analyse those surveys and research, this is to allow us to benchmark our services and evaluate new and existing products and services;
• creating a profile of you, which enables us to identify and personalise what products and services to offer to you for marketing purposes;
• to administer our site, for website analysis and for internal operations, including troubleshooting, testing, statistical purposes;
• for network and information security in order for us to take steps to protect your information against loss or damage, theft or unauthorised access;
• for the prevention of fraud and other criminal activities;
• for efficiency, accuracy or other improvements of our databases and systems e.g. by combining systems or consolidating records we, our group companies or manufacturers hold about you;
• anonymising information we have about you and using that anonymised data for statistical purposes (you cannot be identified or re-identified from this data);
• for the purposes of a corporate restructure or reorganisation or sale of our business or assets;
• to enforce or protect our contractual or other legal rights or to bring or defend legal proceedings;
• for general administration including managing your queries, complaints, or claims, and to send service messages to you; and
• It is necessary for compliance with a legal obligation. This includes when you exercise your legal rights under data protection law, to verify your identity, for the establishment and defence of our legal rights, for activities relating to the prevention, detection and investigation of crime, to conduct credit, fraud prevention and anti-money laundering checks and for compliance with our legal and regulatory responsibilities. This may also include processing special categories of data about you, for example for our compliance with our legal obligations relating to vulnerable people.
• You have given us your consent to use it in certain ways including when you request that we disclose it to a third party and for direct marketing communications (by us and the third parties named when we asked for your consent). You have the right at any time to ask us, or the third parties notified to you, to stop contacting you or passing your details to others for marketing purposes. Please refer to our Use of Your Information Booklet or contact our customer services department on 0800 085 2054 or write to us at customerservices@genesisfinanceuk.co.uk or 86 Station Road, Redhill RH1 1SR.

Disclosure to and use by third parties.

We disclose your information to the following third parties:

• When you update your details via the "Managing My Account" portal on the site, your account with us will be updated. This updated information will be provided to your intermediary (or any intermediary that acquires your intermediary's business, as applicable) to assist us with administering your agreement (including conducting mid and end agreement reviews with you) and for them to send you marketing communications about their products and services if you have consented to this.
• If applicable, the vehicle manufacturer referred to within your customer agreement, whom will use your information to better understand you as a customer and for reporting and analysis purposes to assist in the development and improvement of existing and new products and services. The manufacturer will also use your information to send you marketing communications if you have consented to this.
• Law enforcement agencies in order to detect, investigate and prevent crime (we or any fraud prevention agency may pass your information to law enforcement agencies).
• Third party debt collecting agencies engaged by us to recover monies owed to us.
• If you are a customer, any third party to whom we sell your debt. If we do this, you will be notified and that third party will become the data controller of your information.
• Third parties acting on our behalf (such as service providers, agents, subcontractors and other organisations for the purposes of providing services to us or directly to you on our behalf), these parties may include back-up and server hosting providers, IT software and maintenance providers, third parties that provide income verification services and affordability checks, claims management companies, communication fulfilment services, marketing research organisations and Google Analytics.
• Courts in the United Kingdom or abroad as necessary to comply with a legal requirement, for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations.
• Any third party who is restructuring, selling or acquiring some or all of our business or assets or otherwise in the event of a merger, re-organisation or similar event.

Data anonymisation and use of aggregated information.

Your information may be converted into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from it. Aggregated data cannot be linked back to you as a natural person. We may use this data to conduct research and analysis, including to produce statistical research and reports.

Retention of your information.

The length of time we retain your information is determined by a number of factors including the purpose for which we use that information and our obligations under other laws. We do not retain personal information in an identifiable format for longer than is necessary.

Where you are a customer, we hold your information for 7 years from the date at which your agreement is closed, where settled by you or upon default or as long as necessary thereafter to deal with any queries you may have.

We may hold your information for a longer or shorter period from that described above where:

• the law requires us to hold your personal information for a longer period, or delete it sooner;
• you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law; and
• in limited cases, the law permits us to keep your personal information indefinitely provided we put certain protections in place.

Transfers to third parties / where we store your information.

We store your information on servers located within the European Economic Area (EEA). The third parties listed under Disclosure to and use by third parties may be located outside of the EEA or they may transfer your information outside of the EEA. Those countries may not have the same standards of data protection and privacy laws as in the UK. Whenever we transfer your information outside of the EEA, we impose contractual obligations on the recipients of that information to protect your personal data to the standard required in the UK. We may also require the recipient to subscribe to 'international frameworks' intended to enable secure data sharing. Any third parties transferring your information outside of the EEA must also have in place appropriate safeguards as required under data protection law.

If you use our services whilst you are outside of the EEA, your information may be transferred outside of the EEA in order to provide you with those services.

Please note that, as we use Google Analytics, Google may transfer your information outside of the EEA and we recommend that you read Google's privacy notice for further information.

Your rights.

You have a number of rights in relation to your personal information under data protection law. In relation to certain rights, we may ask you for information to confirm your identity and, where applicable, to help us to search for your personal information. Except in rare cases, we will respond to you within 30 days after we have received this information or, where not required, after we have received your request.

• To be informed about the processing of your information. This is what this privacy notice sets out to do.
• Accessing your personal information. You have the right to ask for a copy of the information that we hold about you by emailing or writing to us at the address at the end of this policy. We may not provide you with a copy of your personal information if this concerns other individuals or we have another lawful reason to withhold that information.
• Correcting and updating your personal information. The accuracy of your information is important to us. You can update your information by visiting the "Managing Your Account" section on our site. Otherwise, if you change your name or address/email address, or you discover that any of the other information we hold is inaccurate or out of date, please let us know by contacting us on any of the details described at the end of this policy.
• Withdrawing your consent. Where we rely on your consent as the legal basis for processing your personal information, as set out under Use of your information, you may withdraw your consent at any time by contacting us using the details at the end of this policy. If you withdraw your consent, our use of your personal information before you withdraw is still lawful.
• Objecting to our use of your personal information and automated decisions made about you. Where we rely on our legitimate business interests as the legal basis for processing your personal information for any purposes, as set out under Use of your information, you may object to us using your personal information for these purposes by emailing or writing to us at the address at the end of this policy. Except for the purposes for which we are sure we can continue to process your personal information, we will temporarily stop processing your personal information in line with your objection until we have investigated the matter. If we agree that your objection is justified in accordance with your rights under data protection laws, we will permanently stop using your data for those purposes. Otherwise we will provide you with our justification as to why we need to continue using your data. You may object to us using your personal information for direct marketing purposes and we will automatically comply with your request. If you would like to do so, please refer to our Use of Your Information Booklet, if applicable. You may also contest a decision made about you based on automated processing by emailing or writing to us at the address at the end of this policy.
• Erasing your personal information or restricting its processing. In certain circumstances, you may ask for your personal information to be removed from our systems by emailing or writing to us at the address at the end of this policy. Provided we do not have any continuing lawful reason to continue processing or holding your personal information, we will make reasonable efforts to comply with your request. You may also ask us to restrict processing your personal information where you believe it is unlawful for us to do so, you have objected to its use and our investigation is pending or you require us to keep it in connection with legal proceedings. We may only process your personal information whilst its processing is restricted if we have your consent or are legally permitted to do so, for example for storage purposes, to protect the rights of another individual or company or in connection with legal proceedings.
• Transferring your personal information in a structured data file. Where we rely on your consent as the legal basis for processing your personal information or need to process it in connection with a contract with have with you, you may ask us to provide you with a copy of that information in a structured data file. We will provide this to you electronically in a structured, commonly used and machine readable form, such as a CSV file.
• You can ask us to send your personal information directly to another service provider, and we will do so if this is technically possible. We may not provide you with a copy of your personal information if this concerns other individuals or we have another lawful reason to withhold that information.
• Complaining to the UK data protection regulator. If you have concerns about the way we have handled your personal information, we encourage you to contact us and we will seek to resolve any issues or concerns you may have. You will find our contact details at the end of this policy. You have the right to complain to the Information Commissioner's Office (ICO) if you are concerned about the way we have processed your personal information. Please visit the ICO's website for further details.

More information on your data subject rights and how to exercise these rights can be found on the website, or you can request a copy via email from customerservices@genesisfinanceuk.co.uk or by calling our customer services team on 0800 085 2054. If you would like to discuss or exercise any of these rights, please contact us by writing to, 86 Station Road, Redhill RH1 1SR or using the below contact information.

Contact us.

If you have any queries about our handling of your information, you can contact our Data Protection Officer via email at: DPO@uk.hcs.com or in writing to Floor 2 London Court, 39 London Road, Reigate, Surrey RH2 9AQ

Changes to this policy.

We may review this policy from time to time and any changes will be notified to you by posting an updated version on our site and/or by contacting you by email. Any changes will take effect immediately on the date on which we post the modified terms on our site or the date of our email, whichever is the earlier. We recommend you regularly check for changes and review this policy when you visit our site. If you do not agree with any aspect of the updated policy, you must promptly notify us and cease using our services.