This notice explains how we use your personal data, describes the categories of personal data we process and for what purposes. It applies when you use this website or any of our apps or when you call for or use any of our products or services. We are committed to collecting and using personal data fairly and in accordance with the requirements of the General Data Protection Regulation (GDPR).
We are committed to ensuring that your information is kept safe, secure and used responsibly, and we have put in place appropriate technical and other security measures to protect it.
Who we are
Star Cars and Coaches Limited, of 718 Chester Road, Birmingham B23 5TE, Company Registration Number 4072203. You can get in touch with our Customer Services Department at this address or by telephone on 0800 6226611. We are open 24 hours a day, seven days a week, and calls are FREE.
What kind of personal information we use
We use many different kinds of personal information depending on the products and services we deliver or offer to you or how we otherwise interact with you. For all products and services we may need to use the following personal data: full name, address, email address, telephone number, date of birth, contact details, employment, , information about how you have used other products and services provided by us, information we receive from any fraud prevention agencies, or licensing agency or service, or from agencies employed to carry out the services you use and other information. Where you use our websites, we will collect your Internet Protocol (IP) address and information about your browsing behaviour.
We might also need health information to help us support our customers who have a vulnerability.
How we collect your personal data
We collect personal data:
• directly from you, for example when you fill out an application form either in paper or on our website or mobile app (at that stage we will tell you more about how your personal data will be used in relation to a particular product or service);
• by observing how you use our products and services, for example from the transactions and operation of your accounts and services, or your use of our websites;
• profile data and usage data which relates to the profile you create to identify yourself when you connect to our internet or mobile services and how you use those services;
• from other organisations such as fraud prevention and licensing agencies;
• from organisations to which you have given your consent (or there is an alternative legal basis) to share your personal data with us for specific purposes, such as for direct marketing;
• from other individuals who know you; and
• from public sources, such as the ‘Open Register’, which is an extract of the electoral register, but is not used for elections. You can opt out of being included in the register. Doing so, will not affect your right to vote. For more information, please go to: https://www.gov.uk/electoral-register/view-electoral-register
How we use your personal data
Data protection law says that we can only use personal data if we have a proper reason to do so. For example, these reasons include fulfilling a contract we have with you, when we have a legal duty, when it is in our legitimate interest or when you consent to its use. When data protection law allows us to process your personal data for our own legitimate interests, it is only allowed provided those interests do not override your own interests and/ or your fundamental rights and freedoms.
An example of where we would process your personal data for our legitimate interests would be where you believe you are the victim of fraud and in order to investigate your claim we may have to share your name and account number, payment and other details of the case with any other institution involved. Sharing personal data in these circumstances would not only be in our legitimate interest but also yours. An example of us using your personal data when we have a legal duty, is where we must do so in order to comply with the law.
Our purposes for processing your personal data
We will only ask you for your personal data where it is necessary to fulfil the following purposes. Where providing us with your personal data is optional, we will inform you of this. Our purposes are grouped under our legal bases for processing.
Entering into and fulfilling a contract between you and us
• To consider and process applications made by our customers and prospective customers for products and services we provide.
• To deliver the products and services we provide, including:
o Making and accepting payments, and receiving deposits on your behalf;
o Providing you with information, advice and guidance on the products and services you hold;
o This includes account statements, formal reminders and notices informing you of forthcoming changes, such as increasing or charges or fees to your account;
o determining fees and charges which may apply to your account; and
o To address enquiries or complaints we may receive from you or a representative appointed by you.
Fulfilling our legal obligations
• Checking your identity;
• Assisting you with managing the products and services you hold;
• Detecting, investigating and reporting financial crime, and taking measures to prevent this;
• Maintaining records of our business, as required by law – for instance, keeping records of our accounts and of journeys;
• Complying with laws which require us to provide information, directly or indirectly to any national or regional authority, for the purpose of calculating and collection of tax;
• To otherwise meet our obligations under all laws and regulations based on law which apply to our business activities;
• Responding to enquiries and requests for information by any of our Regulators;
• Creating and submitting reports required by any of our Regulators;
• Identifying and managing risks to our organisation; and
• Where we have a duty to protect vulnerable customers.
For our legitimate interests
• As a commercial organisation:
o Understanding how our customers use our products and services, so we can improve these.
o Developing new products and services and identifying which may be of interest to you;
o Where we have the relevant permissions, contacting you to make you aware of these products and services – note: we may contact you for a reasonable period after you cease your relationship with us;
o Sharing information with organisations who introduce you to us under a commercial agreement – for instance, where we pay them commission;
o Improving our systems and processes, which may include using your personal data to test the accuracy of these, but only where it is essential to do so;
o To recover money owed to us;
o To otherwise exercise our rights under our contracts with you for the provision of the products and services you hold;
o Sharing your personal data with other departments within the Company for business analysis, data verification and data enrichment purposes
o To invite you to participate in market research and customer surveys;
o Sharing your personal data with any person to whom we may transfer, or may consider transferring any of our rights or business; and
o To share information with third parties for the purpose of preventing fraud and crime.
Please see the section headed ‘
Your Privacy Rights
’ for information on your right to object to processing of your personal data based on our legitimate interests.
Where we require your consent / explicit consent
• To process about you, where necessary, ‘special categories of personal data’ – this includes data about your:
o Race or ethnicity;
o Religion or other beliefs of a similar nature;
o Sexual life or orientation;
o Trade Union membership;
o Political opinions; and
o Genetic or biometric data about you.
• We may process personal data about your health or medical conditions, where we need to understand this to provide you with support, or to make adjustments in how we provide you with information.
• Sharing your personal data with other organisations, to make you aware of their own products and services.
Retaining your personal data
We will retain your personal data for as long as we are obliged, under relevant legislation and regulation, or where no such rules apply, for no longer than it is necessary for our lawful purposes. This will usually be no more than seven years from the point at which the obligation to retain a record containing your personal data begins. The retention period of your personal data may need to be extended where we require this to bring or defend legal claims. We may also retain data for longer periods for statistical purposes, and if so we will anonymise or pseudonymise this.
Using data processors and transferring your personal data overseas
We may use service providers, agents and subcontractors to provide services on our behalf. This may require these organisations to access and process your personal data. We have listed our third party partners and categories of suppliers we use in Appendices 1 and 2.
From time to time your personal data may be transferred to organisations that are based in countries outside the European Economic Area. In these circumstances, we will ensure they process your personal data only in accordance with the applicable data protection legislation and under strict organisational and contractual controls, specifically EU model clauses. We also use the EU Commission approved EU-US Privacy Shield framework, where appropriate, when personal data is processed on our behalf in the USA. For more information about these controls, please visit https://ico.org.uk and search for ‘International transfers’.
Your Privacy Rights
You have the right to object to how we process your personal data. You also have the right to see what personal data we hold about you. You can ask us to correct inaccuracies, delete or restrict personal data or ask for some of your personal data to be provided to someone else. These rights are explained in more detail below.
Requests to exercise your rights to your personal data can be made by:
• By post: to “Star Cars and Coaches Limited, 718 Chester Road, Birmingham B23 5TE”
• By telephone: on 0800 6226611
We do not employ a Data Protection Officer, but we are registered with the ICO to process personal data, and Martin Walker, our Operations Manager, can be contacted at the address above.
Your data protection rights are subject to certain restrictions and conditions. We will assess your request and where we decide not to act upon this, we will notify you of our reasons for this. We will not make a charge for handing your rights request, unless we consider this to be manifestly unfounded or excessive (particularly if this is repetitive).
You have the right to complain to us and to the data protection regulator, the Information Commissioner’s Office, whose address is: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113. You can find out how to report a concern on their website at: https://ico.org.uk/reportaconcern
Your rights are:
To be informed: You have the right to be provided with clear, transparent and easily understandable information about how we use your personal data and your rights. We fulfil this right by giving you this notice.
Access to your personal data: You can request access to a copy of your personal data that we process as a data controller, together with details of why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision making.
Right to withdraw consent: If you have given us your consent, you can withdraw that consent at any time. Please contact us if you want to do so. If you withdraw your consent, we may not be able to provide certain products or services to you. If this is the case, we will tell you.
Right to object: You may object to our processing of your personal data by us, where this processing is based on our legitimate interests or in the public interest. We will assess whether our interest in continuing to process your personal data overrides your rights and freedoms. If not, we will stop processing your personal data. Either way, we will inform you of the outcome.
You have the right to object to direct marketing (including marketing-related profiling) and if you do so, we must stop these types of activities. (See “Automated decision making and profiling” and “Marketing” below.)
Rectification: You can ask us to change or complete any inaccurate or incomplete personal data held about you.
Erasure: This is also known as “the right to be forgotten” and this means that you can ask us to delete your personal data where it is no longer necessary for us to use it, you have withdrawn consent (where applicable), or where we have no lawful basis for keeping it or otherwise using it. There are limited exceptions, for example where we need to use the information to bring or defend a legal claim.
Portability: You can ask us to provide you or a third party with some of the personal data that we hold about you in a structured, commonly used, electronic form, so it can be easily transferred. This is limited to personal data you have provided with your consent or in relation to the products you have with us, and which we process by automated means, such as your account transaction data.
Restriction: You can ask us to restrict the personal data we use about you where:
• it is inaccurate;
• you have asked for it to be erased;
• you have objected to our use of it; or
• where you need this for the bringing or defending of legal claims.
When you have asked us to restrict the use of your personal data we may still store your information but will not use it further without your consent, unless we need to process it:
• to bring or defend legal claims;
• to protect the rights and freedoms of other individuals; or
• for other important public interest reasons.
Automated decision making and profiling
We do not engage in automated decision making or profiling.