Privacy Notice

1.1 Carique Ltd is responsible for the personal information described in this notice (we are its "controller"). We are a company registered in England and Wales with company number 15803929. Our registered office and workshop are at Unit 2, Station Lane, Thetford, Norfolk, IP24 1ND.

1.2 For anything about your personal information, including using your rights in section 9, contact us by email to [email protected], by message to 07356 177303, or by post to the address above.

1.3 This notice covers everyone whose personal information we hold because of our business: customers and people who ask us for a price, people on a business account, people who buy a vehicle from us, people who contact us or use our website, and people whose details a customer gives us, such as someone collecting a vehicle. It applies however we collect the information: online, by message, email or phone, or in person.

2.1 Depending on how you deal with us, we collect:

• Identity and contact details: your name, email address, phone numbers and postal addresses. For a business account, the business's name, its company registration and VAT numbers if given, and the role of each person on the account.
• Account details: your password, which we store only in a scrambled form that cannot be turned back into your password; when you confirmed your email address; invitations to join a business account, including the email address invited and who sent the invitation; and the sign-in records in clause 2.3.
• Vehicle details: registration numbers (including earlier and private plates), VIN, make, model and specification, colour, mileage, condition and service history; photographs and video of the vehicle; and information read from its control units, such as fault codes, settings, the data needed to program keys and, for a remap, its original software.
• Details of the work: your requests for prices, with the descriptions, photos, videos and files you send and your answers to our questions; our estimates, the jobs you accept or decline and any reason you give; deposits; your drop-off day and how you leave your vehicle, including the exact wording you confirmed and when; our job records and staff notes, including what you told us about the fault; inspection reports; parts ordered for your vehicle; and invoices and credit notes.
• Payments and refunds: amounts, how and when you paid, payment references, and refunds with their reasons. For a card payment made online, the references our card payment provider gives us and a link to your receipt. We never see or keep your card number or security code. If we refund you by bank transfer, the bank details you give us to make it.
• Messages: copies of the emails and texts we send you and of your messages to us, notes of calls and visits, and the email reports in clause 2.4.
• Enquiries: what you send through the enquiry form on our website (your name, email address, phone number, vehicle and message), the page you sent it from, and how we followed it up.
• Buying a vehicle from us: the details of the sale, any part exchange (including finance owed on it), the warranty and any claims under it, and any written agreement to pay in parts.
• Test drives: a copy of your driving licence and of any proof of address you show us, and the date, time and vehicle of the drive.
• Proof of identity and ownership: before we program a key, and when someone collects a vehicle, we may ask to see photo ID and proof of ownership such as the V5C. We look at them to check who you are and that you are entitled to the vehicle. We do not keep a copy unless we tell you why we need one, as we do for a test drive.

2.2 We do not ask for information about your health, beliefs, ethnic origin or any other sensitive matter, and we ask you not to send it to us.

2.3 Sessions. When you send an enquiry, register or sign in, our systems record your IP address and the type of browser and device you use, to keep your session working and secure. If our staff view your account as you see it in order to help you, we record which member of staff did so and when.

2.4 Our emails. The service that sends our emails (section 6) tells us whether each email was delivered, bounced or was marked as spam, so we know that important messages, such as estimates, reminders and notices about collecting your vehicle, have reached you. We do not track whether you open our emails or click the links in them.

2.5 Photos and videos. Photos and videos taken on a phone can carry details the phone adds, such as when and where they were taken. We keep the files you send us exactly as you send them, so turn off location tagging, or remove it, before sending if you do not want us to have it.

2.6 Information about other people. If you give us information about someone else, for example the person collecting your vehicle, someone you invite to your business account, or the vehicle's owner or keeper, make sure they know you are giving it to us and that this notice explains how we use it.

2.7 Visits to our website. Unless you switch analytics off, our website statistics service records how our website is used: the pages you look at and for how long, how you found us, your general area (town or country) and the type of device and browser you use. We see this only as totals, and use it to improve the website. Our Cookie Policy explains it.

3.1 Most of it comes from you: through your account, our website, by message, email or phone, or in person. Some of it comes from:

• the owner or a manager of a business account, when they invite you or add your details;
• whoever brought the vehicle to us or asked us to work on it, if that was not you;
• our own staff, when they inspect and work on the vehicle, and the vehicle itself;
• our card payment provider, which tells us that a payment or refund has gone through, and our email service, which reports on delivery (clause 2.4);
• our own records of the sale, if you bought the vehicle from us;
• public sources, such as Companies House for a business; and
• the DVLA, if a vehicle is left with us and we need the registered keeper's details to contact them about it.

3.2 If you contact us through social media, such as our Facebook page, or through a messaging app, that service also handles your messages, under its own privacy terms.

4.1 We only use personal information where the law allows us to, for one or more of these reasons:

• Contract: we need it to make or carry out a contract with you, or to do what you ask before one is made;
• Legal duty: the law requires it;
• Legitimate interests: it is needed for a genuine purpose of our business, and that purpose is not outweighed by your interests and rights;
• Consent: you have agreed to it.

4.2 We use it:

• to answer enquiries and requests for prices and to prepare estimates (contract; legitimate interests where you contact us for a business or for someone else);
• to run your account and show you your vehicles, requests, estimates, invoices and reports (contract);
• to carry out and record work, order parts, book vehicles in and hand them back (contract);
• to take payments, deposits and refunds and keep track of what is owed (contract);
• to send you messages about your work and your account: estimates, confirmations, deposit reminders, parts arriving, drop-off, your vehicle being ready, storage charges and notices about uncollected vehicles (contract);
• to sell you a vehicle and deal with any part exchange, warranty and warranty claims (contract);
• to keep accounts and tax records, and to tell the DVLA about a change of keeper (legal duty);
• to keep a record of what was agreed and done, including what you confirmed, the condition of your vehicle when it arrived and the photos we take, and to use that record to deal with questions, complaints, warranty claims and disputes and to bring or defend legal claims (legitimate interests: being able to show what was agreed and what happened);
• to recover money owed to us, including keeping, selling or disposing of a vehicle as our Terms and Conditions allow (contract and legitimate interests);
• to check that our emails have been delivered (legitimate interests: knowing that important messages have reached you);
• to count visits to our website and see which pages are useful (legitimate interests: improving our website; you can switch this off at any time with Cookie settings at the foot of our website);
• to let you test drive a vehicle, and to deal with any fine, penalty, charge or damage from the drive (legitimate interests: protecting our vehicles and passing a fine to the driver responsible for it);
• to check photo ID and proof of ownership before programming a key or handing over a vehicle (legitimate interests: preventing vehicle theft and fraud, and protecting you);
• to keep our systems and your account secure, to prevent and detect fraud and misuse, and to record when staff view an account (legitimate interests: security; legal duty where it applies);
• to help you through your account as you see it, when you ask for help (legitimate interests: helping you);
• to answer the police, courts and other authorities when the law requires us to (legal duty).

4.3 We do not send marketing. If we ever want to, we will only do so with your consent, which you can withdraw at any time. We do not use photos of your vehicle in our advertising, website or social media unless you agree, and never with its number plate readable.

4.4 You do not have to give us any information, but we need your name, contact details and your vehicle's details to price and carry out work, to sell you a vehicle and to contact you about it. Without them we cannot do those things.

4.5 Decisions made by our systems. We do not make decisions about you by automated means alone that have a legal or similarly significant effect on you. Some things happen automatically: an estimate can no longer be accepted after its valid until date, deposit reminders are sent on a timetable, and the drop-off days offered depend on how busy the workshop is. Decisions such as keeping a deposit, calling off work, charging for storage or selling an uncollected vehicle are always made by a person.

5.1 We never sell personal information. We share it only as follows:

• Service providers that run parts of our business for us (section 6). They receive only what they need to provide their service.
• People on a business account. Everyone on a business account can see the names, email addresses and roles of the others on it, and the account's vehicles, requests and work. Owners and managers can also see prices, invoices and payments, and our messages about money go only to them.
• The person collecting a vehicle: what they need to collect it.
• Parts suppliers and manufacturers: the vehicle's details, such as its registration or VIN, to order the right parts, and what is needed to claim under a part's warranty.
• Specialists we use for part of a job: the vehicle's details and the work needed.
• Our bank: what is needed to make and receive payments and refunds.
• The DVLA: when a vehicle we sell changes keeper; when we sell or dispose of an uncollected vehicle; and when we ask for a registered keeper's details.
• A finance company with an interest in a vehicle: when the vehicle is left uncollected, or to settle finance owed on a part exchange.
• Our professional advisers and insurers, such as an accountant, a solicitor or our insurer if there is a claim, when they need it.
• Debt recovery: if money owed is not paid, a debt collection agency, solicitor or court.
• The police, courts, HM Revenue and Customs, Trading Standards and other authorities, when the law requires us to, or to prevent or detect crime.
• A buyer of our business: if all or part of our business is sold, the buyer, who may use the information in the ways this notice describes.

• Our card payment provider takes card payments made online. You pay on its own secure page and type your card details there, not on our website. It receives your email address, what you are paying for (our references, and your vehicle's registration and description) and the amount, and also uses payment information for its own purposes, such as preventing fraud, under its own privacy notice.
• Our email service sends our emails. It receives your name, email address and each email in full, and reports back as in clause 2.4.
• Our text messaging service passes our texts to our business phone, which sends them over its mobile network. It receives your mobile number and each text in full.
• Our accounting software receives your name, email address and billing address, and the invoices, credit notes, payments and refunds for your work.
• Video services. If a page of our website shows a video, nothing is loaded from the video service until you press play. The video service then receives your IP address and browser details.
• Our website statistics service. Unless you switch analytics off, it receives information about your visits to our website, as in clause 2.7, including your IP address, which it uses to work out your general area and does not keep. Its advertising features, and its use of the information for its own purposes, are turned off. Our Cookie Policy names it.
• Hosting. The providers that host our website and systems store the information in this notice for us.

7.1 Some of the services in section 6 are based outside the UK, or keep information outside it, for example in the United States or the European Economic Area. When information goes outside the UK, it is protected as the law requires: either the UK recognises the country as protecting personal information properly, or the transfer is covered by contract terms approved for that purpose. Contact us if you would like details.

• Records of work, sales and money (estimates, job records, inspection reports, invoices, credit notes, payments and refunds, bookings and what you confirmed, warranties and warranty claims, forms you sign, and the messages, notes, photos and files that go with them): six years after the end of the financial year in which the work was finished, the sale was made or the last payment or refund was made, whichever is latest. We need them for our accounts and tax, and in case there is a question or claim about the work or the sale.
• Your account: while it is open. When it is closed you can no longer sign in, and we keep your account details with the records above for as long as we keep those, then delete them.
• Copies of emails and texts, and the delivery reports for them: for as long as we keep the record they are about.
• Test drive records: until any fine, penalty, charge or claim from the drive could no longer reach us, unless you buy the vehicle, when they are kept with the sale records.
• Website statistics: 14 months from your visit, then deleted by our website statistics service.
• System and security logs: only as long as we need them to keep our systems working and secure.
• Enquiries that do not lead to work or a sale, and the messages and notes about them: two years from when the enquiry is closed. We then delete them.
• Signing in: a session ends 2 hours after you last use it. If you choose to stay signed in on a device, that lasts until you sign out, or for up to 400 days.
• Links: password reset links stop working after 60 minutes, and invitations to a business account after 14 days.
• Complaints, claims and disputes: if there is one, we keep what we need until it has been resolved, even if that is longer than the times above.

When we no longer need information we delete it, or anonymise it so that it no longer identifies you.

9.1 You have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete. You can change most of your details yourself in your account;
• ask us to delete information we no longer need or have no other reason to keep;
• ask us to limit how we use it, for example while we check whether it is accurate;
• object to our using it where we rely on legitimate interests. We will stop unless we have compelling reasons to carry on, or need it for a legal claim;
• ask for the information you gave us, where we use it under a contract with you or with your consent, in a format you can take elsewhere;
• withdraw any consent you have given, at any time. This does not affect what we did before.

9.2 To use your rights, contact us as in clause 1.2. We may need to confirm who you are first. We reply within one month. If a request is complex, or you make several, we may take up to two months more, and we tell you within the first month if we need to. There is no charge, unless a request is clearly unfounded or excessive, when we may charge a reasonable fee or refuse it and tell you why.

9.3 Some rights have limits. For example, we cannot delete records we must keep for our accounts, or that we need for an unresolved claim.

10.1 We protect personal information with measures suited to the risks, including:

• passwords stored only in scrambled form;
• your records shown in your account only to you, and to the people on your business account, once you have signed in;
• the files you send us through your account, photos and videos we take of your vehicle, and documents we attach to your records, kept private: only our staff, and you where they are on your own records, can open them;
• access to our records limited to our staff, each through their own account;
• card details handled only by our card payment provider;
• password reset and email confirmation links that stop working after 60 minutes.

10.2 We will never ask for your password, and we will never change our bank details by email. If a message that seems to come from us asks for your password, or asks you to pay new bank details, do not act on it: check with us first on 07356 177303.

10.3 Keep your password private and tell us straight away if you think someone else has used your account. If your information is put at risk, we will take steps to limit the harm and tell you where we have to.

11.1 Our services and accounts are for people aged 18 or over, and we do not knowingly collect information about children. If you think we hold information about a child, please tell us.

12.1 Our website uses the cookies it needs to work and analytics cookies, which you can switch off. Our Cookie Policy explains them.

13.1 If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

14.1 We may update this notice. The version on this page is the current one, and the date at the top shows when it last changed. If a change significantly affects how we use information we already hold about you, we will tell you before it applies.