Privacy Statement

This is the Privacy Statement of Spirit Motor Group Limited Trading as Spirit Jaguar and Spirit Land Rover (“SJLR”) In this statement we use the terms “we,” “our” and “us” to refer to SJLR.

The purpose of this Privacy Statement is to outline SJLR procedures concerning the collection, use, retention, disclosure, and transfer of Personal Data which is gathered and processed by SJLR. This statements also sets out the SJLR information management practices.

SJLR respects the privacy of all those individuals whose Personal Data it comes into contact with, which in particular includes the following:

• All users of the SJLR Websites including www.spiritjaguar.ie & www.spiritlandrover.ie(“SJLR Websites” or “Website”) andsocial media pages;
• SJLR employees and contractors (including applicants for employment with SJLR);
• All members (including former employees) of SJLR sponsored pension schemes;
• SJLR business contacts and suppliers;
• All Customers or prospective customers of SJLR.

For each of these categories of individuals, this Privacy Statement will explain why we collect and how we use the Personal Data we collect. SJLR will ensure that it keeps all Personal Data provided to it in accordance with our obligations under applicable data protection laws. We will update this Privacy Statement from time to time to reflect any material changes in technology, legislation or data use practices which may materially affect the way in which we process Personal Data.

This is not an exhaustive statement of all our data protection practices and we may apply specific policies within certain environments. We might include a separate privacy statement at the point of capturing data on a new service and any specific consents obtained or information provided in this way will apply specifically to that service and will supplement this Statement. Further statements that include SJLR can be found here Site Pages | Spirit Motor Group

1.What is Personal Data

Personal Data is any information relating to a living individual that allows for the identification of that individual. Personal Data can include a name, address, contact details, an identification number, IP address, CCTV footage, accesses cards/co-tags, audio-visual or audio recordings of a person, details about an individual's location or any other detail(s) specific to that individual. 

2.Who we are and how to contact us

In circumstances where SJLR controls Personal Data by deciding why and how that Personal Data is processed, we will be a "Data Controller". Any entity that processes Personal Data controlled by SJLR and does so on our behalf, is a "Data Processor". Data Processors may include third party service providers engaged by us (for example communications providers, payroll, marketing, or recruitment agencies). As required by applicable data protection law, when we appoint a Data Processor, we will ensure that appropriate contractual protections are in place.

If you have any questions about this data protection statement, including any request to exercise your legal rights, please contact us by writing to our Data Compliance Officer, Arena Road, Sandyford Business Park, Dublin 18 or emailing us at dco@ohm.ie

3.Categories of personal data and how we use it

This section of the Privacy Statement sets out the type of Personal Data collected by us, the purposes for which such Personal Data is collected and processed and the lawful justifications for such processing in the context of our Websites. We may collect, use, store and transfer various kinds of personal data about you which we have grouped together as follows;

• Identity Data includes first name, last name, username or similar identifier, title, and gender.
• Contact Data includes email address, telephone number and postal address.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, cookies, chosen language, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
• Profile Data includes your interests, preferences, and feedback.
• Usage Data includes information about how you use our website and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences

We also collect, use, and share aggregate data such as statistical or demographic data. Aggregate data is information gathered and expressed in a summary form for purposes such as statistical or demographic analysis. Aggregate data may be derived from your personal data but is not data that directly or indirectly reveals your identity. For example, we may aggregate your usage data of our website to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregate data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this data protection statement.

It is not our intention to collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor is it our intention to collect any information about criminal convictions and offences. However, if it is necessary to collect special categories of personal information and/or criminal conviction data, we will only do so with your explicit consent and we will explain the purpose for which the information will be used at the point when we ask for your consent.

4.How we obtain your information

We use different methods to collect data from and about you including through:

Direct interactions

You may give us your Identity and Contact Data by filling in forms or by corresponding with us by email or otherwise. This includes personal data you provide when you:

• request our services; (booking a test drive or vehicle service)
• subscribe to our service or publications;
• request marketing to be sent to you;
• provide feedback;
• apply for a job with the Business;
• entering competitions;
• attendance at brand or lifestyle events;
• CCTV;
• manage your personal data preference

Automated technologies or interactions

As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this personal data by using cookies, server logs, and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. All cookies apart from strictly necessary cookies will require your consent.

Third parties or publicly available sources

We may receive personal data about you from various third parties such as;

• the Manufacturer of your vehicle
• the importer of your vehicle
• advertising networks which we utilise and to which you might engage with
• interactions with Social Media sites

Vehicle Tracking/Telematics

We operate vehicle telematics on our vehicles, such tracking data maybe collected when we loan you a vehicle.Please also note that the location of the vehicle is tracked via GPS and driver performance maybe logged.

SJLR is not responsible for the privacy practices of any external websites, manufacturers or platforms which may be accessed or used in connection with a person’s use of our websites or social media pages. They are subject to their own privacy statements which may materially differ from those of SJLR so users should review them for further information.

5.What Personal Data does SJLR collect and use online

SJLR collects various types of Personal Data when a person uses our website or SJLR social media. The following are examples of Personal Data collected by SJLR:

• Competitions: When a person enters a competition, we may collect and use the entrant’s name and contact details (including postal address, email address, telephone number) in connection with the competition (including mobile competitions). Where we operate competitions in conjunction with a third-party commercial partner, subject to the competition rules and notices, that partner may collect and use the data.
• We may collect your personal data from Contact Forms, (such as booking a test drive, arranging a vehicle service) this enables us to deal with your request in a timely manner.
• Our website uses cookies, web beacons, device identifiers, social plugins, tracking pixels, etc. “Cookies” these are small pieces of information stored by your internet browser that collect data such as your browser type, your operating system, web pages visited, time of visits, content viewed, advertisements viewed, and other click stream data. We use cookies to help us tailor our websites to your needs, to deliver a better, more personalised service and to remember certain choices you have made so you do not have to re-enter them. Cookies also enable us to identify traffic to our website including pages visited, visitor numbers and traffic paths taken. We do not deploy un-necessary cookies, such as analytics, marketing, targeting, or profiling cookies without your consent. Our website may also include links to third party websites, plugins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy statement of every website you visit. Please see our Cookie Policy for further details COOKIES | Spirit Motor Group Land Rover (spirit-landrover.ie)Cookies | Terms & Conditions | Jaguar's Cookie Tracking Policy | Jaguar
• Social Media Pages: Content such as messages and photographs, which is posted on social media pages on which we have a presence may be made publicly available and may be used in connection with the operation and promotion of our social media pages, services, and our website. If content is posted that is deemed to be in breach of this Privacy Statement or the policies operated by such websites or social media platforms, such content may be removed by or at the request of SJLR or the operators of those social media websites. If such inappropriate content is posted to a social media page that is under our control, you can report it at the following address dco@ohm.ie and we will endeavor to ensure that appropriate action is taken in accordance with our policy’s and those of the relevant social media platforms.
• SJLR may use advertising networks to help present advertisements or other content on our website and other websites that display our advertisements. Advertising networks use cookies, web beacons, or similar technologies on your computer or mobile or other device to serve you advertisements or content tailored to interests you have shown by building a profile of your internet browsing on this website and other websites you have visited.

6.The purpose and legal basis for processing your information

SJLR collects and processes the Personal Data described above for a variety of purposes. Below is a brief summary and table of these purposes, and the lawful justifications that support them:

a)To enter into and perform a contract with you

We may process your information in order to enter into a contract with you or to provide you with a service which you have requested from us. For example, we need to process your personal information in order to enable you to purchase a car or to manage the warranty which we have provided in respect of your vehicle from the manufacture or to provide you with a brochure or information about a product where you have requested it.

b)To comply with our legal obligations

We are required to process your personal information to comply with certain legal and regulatory obligations to which we are subject. For example, we are required to obtain certain business records in accordance with company and revenue law which may include your personal information. We are also required under European Union Law to share information regarding the fuel consumption of your vehicle for the purpose of monitoring CO2 emissions to the manufacturer of your vehicle.

c)For our legitimate business interests

We may use your personal information for the purposes of conducting activities that are in our legitimate interests (or those of a third party). Where we process your information for our legitimate interests, we ensure that there is a fair balance between our legitimate interest and your fundamental rights and freedoms.

If you are a customer of SJLR, we may use your information to send you communications on products and service that may interest you and that you would reasonably expect to receive, you can at any stage easily opt out of these communications by contacting us on dco@ohm.ie

We may use your personal information to send you service reminders or vehicle health check reminders, in our legitimate interest. Our legitimate interest is connecting with our customers and informing them about their vehicle.

We may also contact you in the event of updates about our business such as opening hours, change in address, updates about our site etc. We do this in our legitimate interest in order to keep our customers updated of changes within our organisation.

We may use your personal information in an aggregate form to classify our customers and to acquire an aggregated overview of our customer base in our legitimate interest. Such processing does not assess individual characteristics. Our legitimate interest is to grow our business, understand our customer base and provide products and services of interest to our customer base as a whole.

We may use your personal information to manage our everyday business needs, including accounting, internal reporting needs, and market research, to progress and respond to legal claims, security of our premises and staff through use of CCTV, to process claims, to ensure appropriate IT security and to prevent fraud, to monitor and audit warranty claims. Our legitimate interest is the effective management of our business

We may use your information which we collect, including personal information we obtain from publicly available sources such as social media, to help us understand our customers and provide products or services which may be of interest to them, in our legitimate interest. You have the right to object to this at any time.

We may obtain information about your finance arrangements in respect of your vehicle from your finance provider in order to arrange buy back of the vehicle. We do this in our business legitimate interest of arranging the reconciliation of finance agreements.

SJLR uses vehicle tracking in all our fleet vehicles and courtesy cars. The purpose of installing and using telemetric tracking systems is our legitimate interest in the efficient management of our business assets and ensuring the security and safety of employees, customers, the public, and the assets of our business.

You have the right to object any of the above processing scenarios by contacting us on dco@ohm.ie

d)With your consent

We will request your consent for the use of all cookies on our websites, outside of strictly necessary. You can withdraw this consent at any time by clicking “cookie settings” at the bottom of your webpage, for further information on cookies please see our cookie policy www.spirit-jaguar.ie/cookie-policy or www.spirit-landrover.ie/cookies

If you are a prospective customer, we will request your consent for all digital direct marketing communications.

You can revoke your consent at any time by writing to us at Data Compliance Officer, Arena Road, Sandyford Business Park, Dublin 18 or emailing us at dco@ohm.ie

e)To protect your vital interests

We will in certain circumstances use your personal information to protect your vital interests, for example we will contact you in the event of a recall or safety issue with your vehicle.

7.Your information and Third Parties

Third party service providers:We disclose Personal Data to third parties in certain instances. For example, we use third party service providers for the processing of Personal Data for a number of purposes, including, Security service providers, consultant advisors, IT service providers, printers, debt collection agencies, valuers, marketing companies who conduct marketing campaigns, market research and providers of security and administrative services. These service providers are subject to a contractual obligation to only process Personal Data obtained for purposes for which it was obtained and for the fulfillment of the services. We share your information with organisations who provide services for you to avail of warranty or if requested roadside assistance.

We will not provide your Personal Data to third parties or partners for direct marketing or promotional purposes unless you have consented to SJLR disclosing your Personal Data to such third parties for that purpose. If a user opts-out from receiving communications from third parties or partners, we will no longer share that user’s contact details with our partners or third parties. However, users will still need to directly opt-out from communications from the partners to whom we have already given their information

In certain circumstances we will disclose personal data to other external third parties such as its professional advisors as necessary in the context of the performance of their services. Such recipients may include external legal advisors, auditors, actuaries, pension and tax advisors, pension administrators and other professional advisors. Disclosure of such data will take place for a variety of reasons including in order to ensure that SJLR meets its tax and other statutory obligations. We may also disclose personal data to its insurance providers in connection with legal claims and prospective legal claims or proceedings.

Vehicle Registration: When you purchase a new motor vehicle or a used vehicle not previously registered in the State from us, we will use your personal information to register the motor vehicle with the Revenue Commissioners to pay any VRT and VAT on the vehicle or, where applicable to apply for a VRT, VAT and/or motor tax exemption on your behalf, as required by law. Where you purchase a used previously registered vehicle, we will use your personal information to transfer the ownership of the vehicle to you as required by law.

OHM Group and other OHM Group entities: We are part of the OHM Group, and we may pass your information on to OHM Group entities, for the purpose of administrative efficiencies, for fulfillment of a contract and for storing your data in central IT Systems. https://www.ohm.ie/brands/ We may also convert your information, such as information you provide during a customer satisfaction survey, into statistical or aggregate data in such a way as to ensure that you are not identified or indefinable from it, we may pass this information on to OHM Group and other OHM Group entities, for analytical and statistical purposes.

Jaguar Land Rover Limited, Jaguar Land Rover Ireland Limited (Importer) and entities within Jaguar Land Rover Network: We may pass your personal information on to the manufacturer of the vehicle and/or their appointed distributor in Ireland for the purposes of warranty, recall and service issues and customer satisfaction surveys. If you consent, we will also pass your information to the manufacturer and/or the distributor of the vehicle in Ireland for marketing activities. You can withdraw this consent at any time from the manufacturer or the distributor. The manufacturer and/or distributor may contact you separately regarding their use of your information.

Fuel Consumption Data: We are obliged under European union law to collect certain data from your vehicle regarding CO2 emissions. We will collect this data and the VIN of your vehicle and transfer it to the manufacture of your vehicle unless you tell us not to. The Manufacturer is obliged under EU law to report this data to the European Commission for the purpose of monitoring CO2 emissions from vehicles. We will delete this data once it is transferred to the Manufacturer. For more information please refer to the regulation published on the EU web site. You can opt-out of your specific vehicle data being shared with the Commission. Please contact us if you wish to opt out by providing the VIN of your vehicle and registration number.

Finance companies, leasing companies, brokers, and other third-party providers: Where you have asked for a quote or to arrange any third-party products such as finance, leasing, or any other third-party service, we may pass your personal information to that third party in order to obtain a quotation on your behalf.

Insurance Companies/Motor Accessors: We may pass your information to insurance companies and/or any motor assessor appointed by you or an insurance company, where any portion of the cost of the repairs or work being conducted by us on your vehicle is being covered under an insurance policy. We may disclose personal data to our insurance providers in connection, with legal claims and prospective legal claims or proceedings. We may also pass on your personal details onto insurance companies for the purpose of providing unaccompanied test drives and courtesy cars/loan cars and rental cars.

Garda Síochána, Government or Quasi-Government Bodies, Courts, and Tribunals: We may share your personal information with these organisations and bodies, where required to do so by law.

8.What type of personal information is collected?

As a vehicle retailer and repairer we need to collect many categories of personal data (about you and other parties) for the purposes set out in this Privacy Statement. The following table is a non-exhaustive list and provides an indication of the categories and types of personal data we use to perform our duties.

9.Storage Periods

The period for which we will keep your personal information will depend on the type of service you have requested from us. The retention period may be longer than the period for which we are providing services to you where, for example, we have a legitimate interest in retaining such information that is not outweighed by your fundamental rights and freedoms, where we have statutory or regulatory obligations to retain personal information for a longer period, or where we may need to retain the information in the event of a legal claim.

We endeavor to ensure that Personal Data is retained for an appropriate period and no longer than necessary. Retentions of data is detailed in our Data Retention Policy.

10.Transfers outside the European Economic Area

We may transfer, store, or process your personal information to countries outside the European Economic Area. Where the laws of such countries do not afford an equivalent level of protection of personal information as the laws of Ireland, we take specific steps in accordance with data protection law to protect your personal information and we will use one of these following safeguards:

• Transfer it to a non-EEA country with privacy laws that give the same protection as the EEA.
• Put in place a contract (in a form that is approved by the European Commission) with the recipient of the personal information that means they must protect it to the same standards as the EEA.
• Transfers to organisations that are part of an EU Framework that sets privacy standards for data sent between countries. These frameworks make sure those standards are similar to what is used within the EEA.

11.How we use automated processing

We may analyse your personal information by automated means for the purposes of market research, analysing our customer database and for our marketing activities.You have the right to object to this at any time.

12.Marketing communications

If you are not a customer of SJLR and you provide consent for marketing communications we may use your name, address, email address, postal address and/or telephone number for marketing communications. We will not contact users by email, phone, or SMS for direct marketing purposes unless the users have consented to be contacted for such purposes as required by data protection laws. Where you are a customer of SJLR, a legitimate interest assessment will be conducted to ensure there is an appropriate balance between our interests and your rights and freedoms , the right to object will be presented in all marketing communications. Customers can opt-out of receiving direct marketing communications from us by following the unsubscribe link in the relevant marketing message.

If a customer signs up to receive marketing communications from our Partners and provide their contact details to us for such purposes, we may provide your name and contact details (e.g., email or mobile number) to our commercial partners (such as manufacturers or importers that are partnering with SJLR) so that they can send you marketing communications. We will not provide such information to third parties for direct marketing purposes unless the users have consented to us giving their Personal Data to third parties for that purpose. If a user opts-out from receiving communications from our partners, we will no longer share that user’s contact details with our partners. However, users will still need to directly opt-out from communications from the partners to whom we have already given their information.

We use third party service providers to help deliver its marketing communications. Those third-party data processors are subject to contractual and legal restrictions in relation to any unauthorised use of your information.

13.Processing for Security Purposes

We operate closed circuit television cameras ("CCTV") located throughout its premises covering buildings, internal spaces, car parks, roads, pathways, and grounds. SJLR CCTV system is implemented in a proportionate manner as necessary to protect our property against theft or pilferage and for the security of employees, customers, and visitors to our premises (to protect their vital interests). Whilst CCTV footage is monitored by our security staff or contractors, access to recorded footage is strictly limited to authorised personnel. Footage is retained for 60 days, except where incidents or accidents have been identified in which case such footage is retained specifically in the context of an investigation of that issue. CCTV footage may be used in the context of disciplinary proceedings involving our employees and to detect, establish and/or defend legal proceedings (to protect the vital interests of SJLR, staff and affected individuals). CCTV footage is not disclosed to third parties except where disclosure is required by law (such as for the purpose of preventing, detecting, or investigating alleged offences) and in such instance’s disclosure is based on a valid request. Signage indicating that CCTV is in use is displayed throughout the SJLR premises.

14.If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with a test drive). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

15.Information Security

In accordance with applicable laws, we aim to ensure that all Personal Data controlled by us is held securely using appropriate security measures including the following:

• Physical measures such as locked filing cabinets and offices containing Personal Data;
• IT security systems;
• Restricted access to Personal Data subject to approvals;
• Time limits on retention of personal data;
• Provision of targeted data protection training to employees, contractors and other staff who have access to and process Personal Data;
• Password restrictions on access to Personal Data; and
• Technical measures including:
  • Encryption on all laptops/portable devices; and
  • Logging mechanisms to record certain access to Personal Data and alteration and other processing of Personal Data.
  • Encrypted e-mail services

In the event of a personal data breach, we will comply with applicable reporting and notification obligations under data protection law. SJLR has in place a Breach Notification Policy.

16.Your Rights

In certain circumstances, you have the following rights under data protection law in relation to your personal data:

A right to access Personal Data held by SJLR

• Any individual has a right to make an access request under data protection law for a copy of their Personal Data held by us. We may ask for further identification details to confirm your identity before the relevant information is provided.
• It should be noted that there may be specific exemptions relating to accessing Personal Data. If we utilise any of the exemptions, we will provide you with details and our justification for their use.

Other data protection rights

• Rectification of inaccurate personal data;
• Erasure of personal data (also known as the "right to be forgotten");
• Restriction of processing of persona data;
• Right to data portability;
• Right to object to processing of personal data.

However, under data protection law, these rights are available only in certain circumstances.

If you wish to exercise any of these rights, exercise any of your data protection rights, please contact dco@ohm.ie or by us using the contact details below. We will endeavor to respond to your request within a month. If we are unable to deal with your request within a month, we may extend this period by a further period of two months, and we will explain why. Please provide as much detail as possible to enable us to respond to your request and to locate relevant personal data about you.

• By Post:DCO, Arena Road, Sandyford Business Park, Dublin 18
• By Email: dco@ohm.ie
• By Phone: +353 (0) 1 489 3760

You also have the right to lodge a complaint to the Office of the Data Protection Commission. For further information please see www.dataprotection.ie

17.Updates

This policy [“version 4”] was updated and deemed effective on the 30^th of November 2022. We will update this data protection statement from time to time. Any updates will be made available on our website at www.spiritjaguar.ie and www.spiritlandrover.ie. and we would ask that you check regularly.