Date of issue: 22 May 2018
MSL Motor Group sells and services Mercedes-Benz, Mazda and ŠKODA vehicles. We also service Volkswagen and SMART vehicles.
We have Mercedes-Benz sales dealerships at MSL Ballsbridge Motors, MSL Grange Motors, MSL Park Motors and a sales and service centre at MSL Cork. MSL Park Motors is also home to a Mazda showroom and a ŠKODA showroom. We have two service centres in Dublin; MSL Service Centre (North Dublin) and MSL Service Centre (South Dublin).
MSL Motor Group is committed to protecting all personal and special categories of data (also referred to as sensitive personal data) held on our customers and visitors to our dealerships, service centres or website.
Our mission is to manage the processes related to the sales of cars, parts and accessories, as well as servicing and complementary services, such as roadside assistance. We collect, process and store quantities of personal data from our customers on an ongoing basis.
We also want you to be clear as to what rights you can invoke to help you to protect your privacy.
In this regard, it is important that you read this Privacy Notice and understand our use of your personal data.
References to “MSL”, “us”, “our”, “the dealers” and “we” mean MSL Motor Group, and any associated companies from time to time.
Rest assured that all personal data we gather will be processed in accordance with all applicable data protection laws and principles, the EU General Data Protection Regulation 2018 and the Data Protection Acts 1988 and 2003.
If you are unhappy with the way we have handled your personal information and wish to complain, or if you wish to update your personal information which we hold on you, or your preference for communication (eg: SMS, Email, Post, Phone), or if you simply want further information about the way your personal data will be used, please contact us by any of the following options below;
Davy McFeely, Data Champion
MSL Motor Group, Naas Road, Dublin 12, D12VF67
You have the right to lodge a complaint with the Office of the Data Protection Commissioner. To contact the Office of the Data Protection Commissioner, please use the following details:
Data Protection Commissioner
Telephone: +353 (0)761 104 8000
Telephone: +353 (0)57 868 4800
LoCall Number: 1890 252 231
Fax: +353 57 868 4757
Please note that we will take all appropriate steps to keep your personal data safe. In the unlikely event that we have a security breach, we will notify you without undue delay about the circumstances of the incident in accordance with our legal obligations.
We collect personal data to provide our services to you. This data may be collected directly by our staff, our website, any applications used by us, or indirectly through a third-party service provider on our behalf.
The personal data we collect will be gathered and stored as set out in this Privacy Notice. This will be done directly by our Sales, Administration, Service, Parts and Technical staff. The categories of personal data that we gather are listed in Section 5 ‘Type of Data’ below.
We primarily use your personal information to provide you with car sales and services, together with finance and leasing services’ options when requested by you.
We will always give you the option not to receive marketing communications from us. We will never send you unsolicited ‘junk’ email or communications, or share your data with anyone else who might. We do not sell your information to third parties, but we do work closely with selected partners who help us to provide you with the information, products and services that you request from us.
However, more specifically, we may use the personal data we gather for any or all the following purposes:
|Process||Description||Lawful Basis for Processing|
|Purchasing a Vehicle or Part / Booking Vehicle Service||When a customer books a vehicle service, and / or orders a vehicle or motor part from us, we obtain and enter the relevant personal data into our Dealer Management System (DMS).
These details are not directly stored by us – but order reference number is maintained on the DMS.
|The processing is necessary for the performance of a contract to which the data subject is a party|
|Car Financing / Leasing||We assist customers in obtaining car financing and/or leasing from a variety of third parties such as Allied Irish Finance, Alphera Financial Services, Bank of Ireland Finance, Bluestone Finance, First Auto Finance, First Citizen Finance, Volkswagen Bank, Leaseplan, Merrion Fleet, Hertz, Avis, Archer Sheriden, Hi-Line, Johnston & Perrot.||The processing is necessary for the performance of a contract to which the data subject is a party|
|Marketing to Potential Customers||Information is collected by our Sales, Service and/or Marketing staff when any customer, or potential customer, contacts the dealership.
We record this data in our Customer Relationship Management System and use the data to market to you.
This data could be shared with third party service providers such as Sharpspring, Cemac Consulting, Citnow, or Phonovation.
This data may be used for email marketing, SMS, direct mail or phone calls
|Where you are a potential customer:
The data subject has given their consent.
|Customer Satisfaction Survey||We and the manufacturer send out customer satisfaction surveys based on the personal data, which is extracted nightly from our DMS. This is to ensure the quality of services provided by our staff.
This includes customers who are inputted into the DMS.
|Where you are a potential customer: The data subject has given their consent.
Where you are a SKODA or Mazda customer: The processing is necessary for the purposes of the legitimate interests pursued by the controller.
Where you are a Mercedes-Benz customer: The data subject has given their consent.
|Quality Improvement /Staff Training||All phone-calls, written communications and related details are stored on our internal server.
Similarly, all communications / queries received through our website are kept on our server.
These communications are stored for both quality improvement and staff training purposes.
|The processing is necessary for the purposes of the legitimate interests pursued by the controller.|
|CCTV||We operate a CCTV system on our premises to protect the safety and security of our staff and property and for operational reasons.||The processing is necessary for the purposes of the legitimate interests pursued by the controller.|
|Anti-Money Laundering||We use your personal data to comply with anti-money laundering regulations.||The processing is necessary for compliance with a legal obligation.|
|Change of Ownership Documentation||We process change of ownership documentation (i.e. vehicle registration certificates) for customers through the Revenue Online Service.||The processing is necessary for the performance of a contract to which the data subject is a party|
|Safety Incidents / Product recall||We may use your personal data to contact you regarding an urgent safety measure and/or a product recall.||The processing is necessary for compliance with a legal obligation.|
To support us in understanding customers’ and drivers’ needs;
Processing is necessary for us to promote our business, brands and products and measure the reach and effectiveness of our campaigns;
We may process your personal information to comply with our legal requirements (for example to register your car with the Vehicle Registration Office. (Driver and Vehicle Licensing Agency).
If you do not provide us with all the information we require, the resulting action may be that we are not able to fully offer you our services.
Furthermore, some services provided by us require certain categories of information, without which, we may not be able to provide you with the service.
There are various circumstances where we may share personal data with other parties. Generally, this includes your representatives and our representatives, and some pre-advised third parties.
We do not sell your information to third parties. However, we may from time to time disclose your information to the following categories of companies or organisations to which we pass the responsibility to handle services on our behalf:
We take steps to ensure that any third-party partners who handle your information comply with data protection legislation and protect your information just as we do. We only disclose personal information that is necessary for them to provide the service that they are undertaking on our behalf. We will aim to anonymise your information or use aggregated non-specific data sets wherever possible.
Sharing with our manufacturing partners;
There are circumstances where we share your information with the relevant manufacturer. For example: Volkswagen Ireland, Volkswagen AG and their Authorised Dealer or Authorised Repairer. Motor Distributors Limited (Mercedes-Benz Ireland), Daimler AG including Daimler AG’s Authorised Dealers and Authorised Service Partners, as well as Daimler AG’s Authorised Dealers and Authorised Service Partners, Mazda Ireland or Hyundai Ireland. This would be to fulfil orders, transactions, handle complaints or provide you with a service or information that you have requested.
Due to the international nature of our business, there may be some instances where your information is processed or stored outside of the EU. In those instances, we will ensure that appropriate safeguards are in place for that transfer and storage as required by applicable law.
Any party you have given us permission to speak to (such as a relative or friend), your motor insurance company and other people or companies associated with you.
Our employees and contractors including companies that provide services in relation to postage, data storage, document production and destruction, IT and IT security and customer loyalty programmes.
Other third parties:
Other motor insurance companies, external advisors (such as solicitors and accountants) and auditors and third parties with which we may choose to improve our processes, products or services. Or to investigate the possibility of new processes, products or services and prospective sellers or buyers if we decide to sell or buy any business or assets;
State or government departments, bodies or agencies.
The State department (i.e. The Irish Revenue) for the notification of change-of-ownership for a used vehicle, and/or transfer of leasing commitments. The Regulatory Authority, (i.e. the Financial Regulator) for anti-money laundering compliance.
Please feel free to contact us (details in Section 1 ‘General’ above) if you would like more details about the parties with whom we share your information.
Where we choose to have certain services provided by carefully selected third parties, we take precautions regarding the practices employed by the service provider to ensure your personal data is stored and processed legally and securely. We stipulate that such third parties shall have made every possible effort to achieve a state of readiness for GDPR.
Dependant on the activity we may act as Data Processor or the Data Controller for our partners. We will use every effort to protect your personal data and we will not sell your personal information to any third-party companies.
As a car dealership we need to collect many categories of personal data (about you and other parties) for the purposes set out in this Privacy Notice.
While the type of personal data may change occasionally, we believe it is important you are aware of the types of personal data we gather and use. The following table is a non-exhaustive list and provides an indication of the categories and types of personal data we use to perform our duties.
Please note that information listed under one category may be used for the performance of a task or in relation to activities under another heading or as outlined under Section 3.
|Purpose||Type of Data|
|Sales of Products/Services||Name, Contact Details, Occupation, Car Details, Lease Operator Information, Bank Details, Service History, Gender|
|Customer Care||Name, Contact Details, Car Details, Phone Calls|
|Finance||Detailed Financial Information|
|Marketing||Name, Contact Details, Car Details, Gender, Service History|
Enquiry information (pre-sale / potential customer);
|Purpose||Type of Data|
|Vehicle/service enquiry||Name, Contact Details, Trade-in Details, Lease Operator Information, Service History.|
|Finance||Detailed Financial Information|
|Marketing||Name, Contact Details, Car Details, Gender|
We have a comprehensive record retention schedule. The retention periods differ depending on the purpose of the processing and the nature of the information. How long we keep data is primarily determined by how long we need it for the purposes we told you we were going to use it for, time periods set out in law and the period we need to keep it to defend ourselves against legal action.
Generally, we keep information for the periods set out in the table below:
|Type of Information||Retention Period|
|Name and Contact Details, Vehicle Details, Finance Applications, Service and Repair History.||7 Years + 1 Month|
|CCTV Footage||30 Days|
|Type of Information||Retention Period|
|Name and Contact Details, Vehicle Details, Finance Applications, Service and Repair History.||90 Days from enquiry*|
|CCTV Footage||30 Days|
All personal information will be deleted 90 days from when a non-customer enquired with MSL Motor Group. This will be deleted from the CRM system & emails (from web enquiries).
*If an agreement has been made between an MSL representative and the potential customer, that contact will be made at a later date, personal data will be maintained and deleted 90 days from next contact made (if enquiry has not turned into a sale).
However, in some cases we may need to keep personal data longer than the above periods. Examples of these situations include legal cases and system back-ups required for disaster recovery.
We also retain certain limited details beyond the above time periods to validate and handle any motor insurance claims we receive after the statute of limitations has expired (late claims) and any claims we receive where the claimant was not aware of the injuries until a long time after they were caused (latent claims).
After the periods set out above, we will anonymise or delete the personal data. Anonymisation means that we will delete certain aspects of the information we hold (such as name and street address) so that we can no longer determine who the data relates to.
Please feel free to contact us if you would like more information about data retention periods.
As a data subject, you will have the following rights, as outlined in this section. However, restrictions may apply in certain situations.
Please send all your requests to the contact details provided in Section 1, with as much detail as possible about your requirements to allow us to deal with your request efficiently. To answer your request, we may ask you to provide identification for verification purposes.
Upon receipt of a request, we will have 30 days to provide a response, with an extension of two further months if required. If we require more time to deal with your request, we will notify you of the delay, and the factors resulting in the delay, within 30 days of the receipt of the request. If we refuse your request, we will notify you within 30 days of the receipt of the request accompanied by the reason for refusal.
We will not charge a fee for any requests, provided we do not consider them to be unjustified or excessive. If we do consider these to be unjustified or excessive, we may charge a reasonable fee (also applicable for multiple copies) or refuse the request.
You are entitled to contact the Office of the Data Protection Commissioner if we refuse your request. See Section 1.
You have a right to know what personal data we hold on you, why we hold the data, and how we are processing the data.
When submitting your request by email for firstname.lastname@example.org, please provide us with information to help us verify your identity such as full name, registration number, mobile number, email address and as much detail as possible to help us identify the information you wish to access (i.e. date range, subject of the request).
Please note that an access request is free of charge, however, where we determine a request to be unjustified or excessive, we may charge you a reasonable fee.
You have a right to request that the personal data held in relation to you is up to date and accurate.
Where information is inaccurate or incomplete, we encourage you to contact us, by email to email@example.com, to have this information rectified. Upon receipt of request, we will ensure that the personal data is rectified and is up to date as is reasonably possible.
You have the right to seek the erasure of personal data relating to you in the following circumstances:
However, we will be unable to fulfil an erasure request if the processing of personal data is necessary for the following:
In certain circumstances we may need to retain some information to ensure your preferences are respected in the completion of our duties. For example, we cannot erase all information about you where you have also asked us not to send you marketing material. Otherwise, your preference not to receive marketing material would be erased.
When processing is restricted, your personal data will only be processed with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of other people; or for reasons important to public interest.
We will contact you to confirm where the request for restriction is fulfilled and will only lift the restriction after we have informed you that we are doing so.
You have the right to the provision of all personal data held in relation to you in a structured, commonly used and machine-readable format where:
You may also request that we send this personal data to another data controller where technically feasible.