Privacy Notice

INTRODUCTION

In this Privacy Notice, “CMAC Group”, “we”, “us” and “our” refers to CMAC Group Ltd, which is situated in the UK, and each of its wholly owned subsidiaries, which are situated throughout the UK and the European Union (EU) (individually referred to as a “Group Company”).

CMAC Group takes your privacy very seriously. Please read this privacy notice carefully as it contains important information on who we are and how and why we collect, store, use and share any information relating to you.

It also explains:

• what personal information we collect about you;
• where we get personal information from;
• how we keep your personal data secure;
• how long we keep your personal data for;
• who we share information with;
• your rights in relation to your personal data;
• how to contact us or the relevant supervisory authority, should you have a complaint.

In this policy, please note the use of the following terms:

The principles established in this Privacy Notice are based on European data protection and privacy laws and take into account the requirements of the EU General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR), the provisions of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (together “Data Protection Laws”). They apply generally to all CMAC Group companies.

Deviations from these principles are possible only where applicable local law defines stricter or alternative data protection and privacy requirements than this Privacy Notice. In this case, a Group Company must also ensure compliance with the local law requirements.

When we collect, use or process personal information we must comply with Data Protection Laws. In some cases we will be the ‘controller’ of that personal information, which means that we are primarily responsible for that data - we decide what data to collect and when, what we do with it, how we process it, who we share it with and how long to keep it. For example, we are the controller of our employees’ personal data.

In some cases, we will be the ‘processor’ of personal information, which means that we are processing personal data on behalf of an external third party or a different company within the CMAC Group who is the controller. For example, we are the processor of the personal data of our Service End-Users e.g. passengers, where we process this information on behalf of our Customer, who is the controller.

Whether we act as the controller or processor of your data, we are committed to preserving the privacy of it so that we can:

• deliver services of a high quality to our Customers and Service End-Users;
• comply with the law and the various regulations that we are subject to;
• meet the expectations of our Customers, Service End-Users and other third parties; and
• protect our reputation.

We do not target our services at children, and we do not knowingly collect or use personal information relating to children. If you are aged under 18, we recommend that you speak to an adult that you trust if you have any difficulties reaching an informed decision regarding the activation of any use of your information or our treatment of your information.

Your personal data

Collection

We may collect personal data from:

• you directly
• our customers and suppliers
• publicly available sources e.g. Companies House
• providers of marketing lists
• third parties e.g. credit reference agencies or sanctions screening providers

Personal data is collected either directly (i.e. information you knowingly choose to disclose to us, for example when you register with us, contact us by telephone, email or via our website or portal and purchase services from us) or indirectly (i.e. data we collect automatically, for example when you are browsing one of our websites, through the use of ‘cookies’).

How we collect and use your personal data depends upon how you access our services and your relationship to us, for example:

• Where we supply services to you under a contractual relationship, you are our Customer;
• Where you supply services to us, you are our Supplier;
• Where you are an employee of our Customer or Supplier, you are a Third Party Employee;
• Where you provide transport services to us on behalf of a Supplier on a self-employed, agency or otherwise on a non-employed basis, you are a Driver;
• Where you are a user of the transport and/or accommodation service provided to our Customer, you are a Service End-User;
• Where you are visiting our website or using our apps and portals, you are a Digital-User;
• Where you apply to work for a Group Company, you are a Prospective Employee.

In general, the data we collect may include:

To provide our services

• name and contact information, including email address and telephone number;
• gender (if you choose to give this to us);
• journey details (e.g. pick-up and drop-off locations and times etc);
• details of any special requirements for your journey or accommodation (this could include information relating to health);
• card payment details;
• call recordings;
• information relating to feedback, compliments or complaints - this may be by phone, email, post or via social media;
• motor vehicle details e.g. make, model, colour, registration plate number (Supplier Third Party Employees and Drivers only);
• details of your location with a high degree of precision (when you permit the collection of location data) (Supplier Third Party Employees and Drivers only).

To operate Customer accounts

• information to check and verify identity of business owners and persons with significant control e.g. copies of identity documents, such as a passport
• signatures;
• bank account payment details;
• key person contact information, including names, addresses, email addresses and telephone numbers;
• credit checks;
• marketing preferences.

To onboard Suppliers

• information to check and verify identity of business owners and persons with significant control e.g. copies of identity documents, such as a passport
• registered address and operating address;
• copies of insurance documents;
• copies of operator licences;
• signatures;
• payment information e.g. bank account or other financial details;
• fleet motor vehicle details e.g. make, model, colour, registration plate number.

To provide service updates or for marketing purposes

• Names and contact details;
• Marketing preferences;
• Records of consent, where appropriate.

To comply with legal requirements

• Name and contact information;
• Identification documents;
• Financial transaction information;
• Criminal offence data (including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks);
• Any other personal information required to comply with legal obligations;
• Health and safety information.

To deal with queries, complaints or claims

• Names and contact details;
• Address;
• Call recordings;
• Correspondence.

To provide our website, apps and portal service

• Contact information, including name, address, email address, telephone number;
• account details, such as username and password;
• replies to security questions;
• details of your location (see ‘Location Services/Data’ below);
• IP address, device type, IMEA numbers, MAC address of networks, other unique device identification, device operating system, browser type, mobile network information, app version number, storage usage, data usage, time zone settings etc;
• the pages of our website, or other resources on our website, that you have accessed and when you accessed them;
• details of any documents or other resources that you have downloaded from our website.
• your activities on, and use of, our website which reveal your preferences, interests or manner of use of the website and the times of use.

For recruitment purposes

• Name and contact details, including address, telephone number and personal email address;
• Date of birth;
• National Insurance number;
• Copies of passports or other photo ID;
• Details of your qualifications, experience, employment history (including job titles and working hours) and interests;
• Details of your referees;
• Right to work information;
• Details of any criminal convictions (e.g. Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks).

Please note that our websites and apps may link to other third-party websites that may also gather information about you. Third-party websites will operate in accordance with their own separate privacy policies, and we have no control over any personal data that they may acquire, store and use. For privacy information relating to these other third-party websites, you should consult their privacy policies, as appropriate.

Our websites and apps are not intended for use by children, and we do not knowingly collect or use personal information relating to children.

Use

In general terms, we may use this personal data to:

Customers, Suppliers, Service End-Users, Third Party Employees, Drivers and Digital-Users

• Provide our services;
• communicate with you;
• monitor the progress of a journey;
• customise our website and its content;
• notify you of any changes to our services that may affect you;
• improve our services;
• perform customer service functions;
• for marketing and promotional purposes.

Customers and Suppliers only

• create and manage your account with us;
• verify your identity;
• conduct due diligence checks;
• provide or request services to/from you;
• receive and process invoices.

Prospective Employees

• communicate with you;
• make informed decisions about candidates;
• to comply with our legal obligations.

Sometimes you can choose if you want to give us your information and let us use it. Where that is the case we will tell you and give you the choice before you give the information to us. We will also tell you whether declining to share the information will have any effect on your use of our services.

By providing us with someone else’s personal data, you confirm you’ve either got their permission to give it to us, or permission from their parent or guardian (if the person is under 16).

Please note that it is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal details change during your relationship with us.

Location services/data

If you use one of our apps, we may request your consent to use location services to precisely identify your location. If applicable, your consent will be requested each time the app is opened.

If you do not provide your consent, you may still use the app but that will mean that the feature enabling your location to be monitored will not be available. To withdraw your consent at any time you can either uninstall the app or stop tracking. Please note, that will not affect the lawfulness of our use of that data in reliance on your consent before it was withdrawn.

We will not process your location data other than as strictly required e.g. to enable the progress of your journey to be monitored.

The location services in the app will not operate unless location services/data are generally enabled on your device. You may disable such functionality at any time by using the settings on your device to disable access to your location data.

The purposes for which your information is used

Data Protection Law requires that we only use your personal data for the purposes for which it was acquired, or where we have a proper reason for using it. Those reasons may include the following:

• Where you have given consent to the use of your personal data for one or more specific purposes.
• Where the use is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract.
• Where the use is necessary for compliance with a legal obligation that we are subject to.
• Where the use is necessary in order to protect your vital interests or those of another person.
• Where the use is necessary for the performance of a task carried out in the public interest, or in the exercise of official authority vested in us.
• Where the use is necessary for the purposes of our legitimate interests or those of a third party. A legitimate interest is where we are collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own. You can obtain details of this assessment by contacting us (see ‘How to contact us’ below).

The reasons referred to above set out the purposes for which data may generally be used. The specific position in relation to your personal data, however, is that we may use it for the following purposes:

Customers, Suppliers, Service End-Users, Third Party Employees, Drivers and Digital-Users

Customers and Suppliers only

Prospective Employees

The purposes set out above will not apply to what is termed ‘special category personal information’. This includes personal information revealing racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs, or trade union membership, genetic and biometric data, and data concerning health, sex life or sexual orientation. We will only ever process information of that nature where we are permitted to do so under Data Protection Laws, for example:

• where we have your explicit consent; or
• the processing is necessary to protect your (or someone else’s) vital interests where you are physically or legally incapable of giving consent; or
• the processing is necessary to establish, exercise or defend legal claims.

Marketing

We will use your information to send you updates (by email, text message, telephone or post) about our services, including new services.

We have a legitimate interest in using your information for marketing purposes (see above ‘How and why we use your information’). This means we do not need your consent to send you marketing information. If we change our marketing approach in the future so that consent is needed, we will ask for this separately and clearly.

You have the right to opt out of receiving marketing communications at any time by contacting us – please see ‘How to contact us’ below.

We will always treat your information with the utmost respect and never sell or share it with other organisations outside the CMAC Group for marketing purposes.

For more information on your right to object at any time to your information being used for marketing purposes, see ‘Your rights’ below.

Sharing your data with others

Notwithstanding the fact that we will not share your personal data for marketing purposes, it may be necessary for us to share your personal data with others in order to perform our services for you, to comply with our contractual obligations to you, to comply with our legal or regulatory obligations to you, or to comply with any contractual, legal or regulatory obligations that we are subject to.

We routinely share personal data with:

• other companies within the CMAC Group, for the purposes of effective business operations;
• third party service providers, customers and business partners, professional advisors, contractors, and other third parties that provide us with support services, such as payment processing, website hosting, information technology, sales, email and postal delivery, location mapping, product and service delivery;
• service end-users e.g. sharing driver and vehicle information with a Service End-User or Customer, so that they can track the progress of their journey;
• other third parties we use to help us run our business, e.g. marketing agencies;
• credit reference agencies;
• our bank;
• publicly on our website, social media or other marketing and information media.

We occasionally share personal data with:

• professional or legal advisors;
• government, law enforcement and relevant regulatory authorities in order to comply with our legal and regulatory obligations;
• external auditors or inspectors;
• third party platforms and social media sites, when you interact with us or post content about us on third-party social media platforms.
• other parties that have or may acquire control or ownership of our business (and our or their professional advisers) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency—usually, information will be anonymised but this may not always be possible. The recipient of any of your personal data will be bound by confidentiality obligations

More details about who we share your personal data with and why are set out in our List of Sub-processors.

When sharing your personal data, we will ensure at all times that those with whom it is shared process it in an appropriate manner and take all necessary measures in order to protect it. We will only ever allow others to handle your personal data if we are satisfied that the measures which they take to protect that personal data are satisfactory.

Other than as set out above, we will not share your personal data with any other third party.

Transferring your personal data out of the UK or EEA

Countries outside the UK and the European Economic Area (EEA) have differing data protection laws, some of which may provide lower levels of protection of privacy.

It is sometimes necessary for us to transfer your personal data to countries outside the UK or EEA. More details about the countries outside the UK to which your personal data is transferred are set out in our List of Sub-processors.

Under data protection laws, we can only transfer your personal data to a country outside the UK or EEA where:

• the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy regulation’) further to Article 45 of GDPR.
• there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you, or
• a specific exception applies under relevant data protection law.

Where we transfer your personal data outside the UK or EEA we will comply with applicable laws designed to ensure the privacy of your personal data.

How long personal data is kept

Personal data that is processed by us will not be retained for any longer than is necessary for that processing, or for purposes relating to or arising from that processing.

Where your personal data is retained after we have finished providing our service to you, or where the contract with you has ended in any other way, this will generally be for one of the following reasons:

• so that we can respond to any questions, complaints or claims made by you or on your behalf;
• so that we are able to demonstrate that your matter was dealt with adequately and that you were treated fairly; or
• in order to comply with legal and regulatory requirements.

In general, we will retain your data for only so long as is necessary for the various objectives and purposes contained in this Privacy Notice. Generally, we will retain personal data for up to 7 years after the end of any business relationship we have with you. Please note, however, that different periods for keeping your personal data will apply depending upon the type of data being retained and the purpose of its retention.

Your rights in relation to your data

You generally have the following rights, which you can usually exercise free of charge:

You can exercise these rights by contacting us and specifying which GDPR privacy right you wish to exercise. We must verify your identity in order to honour your request, which we will respond to within one month.

For further information on each of those rights, including the circumstances in which they do and do not apply, please contact us. You may also find it helpful to refer to the guidance from your local data protection authority on your rights under the GDPR.

About cookies

We use cookies in connection with the operation of our websites. A cookie is a small file that is sent by a web server (where we host our website) to a web browser (from where you view our website) and which is then stored by the browser. The cookie contains an identifier which is stored in your browser and then sent back to our server each time your browser accesses our website. These cookies may either be ‘persistent cookies’ (in which case they will continue to be held by your browser until they are deleted, or until a specified event/date) or they will be ‘session cookies’ which expire when you close your browser.

Usually, cookies do not hold any data by which you can be identified, although if we do hold personal data about you (for example, because you have subscribed to a service that we offer) the cookie may be linked to that data.

In addition to cookies used by us, our service providers may also use cookies, and those cookies may also be stored in your browser when you visit our website.

If you wish to do so then, usually, you can prevent cookies from being downloaded to your browser and can delete those that have already been downloaded. How this may be achieved varies between different browsers. Consult the website of your browser provider for more details.

However, you should be aware that if you block or delete cookies this may have a detrimental impact upon your ability to access our websites and the services that we provide. It may mean that not all of the facilities on our website will be accessible by you, or it may mean that you are unable to access any member services which we provide.

Keeping your data secure

In order to ensure that your personal data is kept secure, and to prevent there being any breach of confidentiality, we have put in place security measures which are intended to prevent your personal data from being accidentally lost or used, or accessed unlawfully. Access to your personal data is restricted to those with a need to access it, and regard will be had to the need for confidentiality when that personal data is processed.

Our systems are subject to rigorous testing; and we observe industry standards for information security.

In the event that there is a suspected data security breach you will be notified. Where relevant we will also inform the appropriate data protection authority of a suspected data security breach where we are legally required to do so.

If you want further guidance on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org Get Safe Online is supported by the UK Government and leading businesses.

Making a complaint

If you have any queries or concerns as to the acquisition, use, storage or disposal of any personal data relating to you please contact us

Notwithstanding our best efforts, inevitably sometimes things do go wrong. If you are unhappy with any aspect of the use and/or protection of your personal data, you have the right to make a complaint to the relevant data protection authority

How to contact us

If you have any queries as to the acquisition, use, storage, or disposal of any personal data relating to you please contact your local CMAC Group company, using the contact details below:

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us (see ‘How to contact us’ above).

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to your relevant data protection authority.

This policy

The terms and provisions of this privacy policy may be changed, updated and amended from time to time.

If you would like this policy to be supplied to you in another format (for example audio, large print, braille) please contact us.