Privacy Policy - Yesauto

This Privacy Policy is valid from 26 NOV 2020.

The following Privacy Policy (referred to as "Privacy Policy") applies to both consumers and dealers (“you”, “your”) using the services provided and operated by FETCHAUTO LIMITED, a company registered in England and Wales under company number 12250311 with its registered office at 1 (Office 6050), Fore Street Avenue, Barbican, London EC2Y 9DT (hereinafter "Yesauto", “we”, “us”).

This Privacy Policy governs the use of Yesauto’s website (https://www.yesauto.co.uk) and mobile applications made available in the United Kingdom (hereinafter referred to as "Yesauto Service ") by you. It also describes your data protection rights, including a right to object to some of the processing which we carry out. More information about your rights, and how to exercise them, is set out in the “Your rights as data subject” section.

When you use the Yesauto Service, we collect certain personal information (meaning information that identifies you personally, such as your name, photo or contact details or information that can be linked with such information in order to identify you) from you so that you can use the service more conveniently and so that we evaluate and improve the effectiveness of our marketing measures. The protection of your personal information is important and this Privacy Policy will help you understand what personal information we collect and how we use that information. You can access this privacy policy at any time from anywhere on the website or within the app

For more information about the cookies used by us, please see Section B.

Section A

1. Contact details of the privacy officer

The contact details of the privacy officer are:

Paul O'Neill paul@yesauto.com

You can contact our privacy officer at any time if you have questions, or would like more information, about how we use your personal information.

2. The personal information we collect and why

2.1 Visiting our website

If you merely visit our website without registering or otherwise transmitting information to us, we automatically collect certain personal information from your browser, including, for example, your IP address.

Why do we collect this information? We collect this information to provide our website to you and protect our systems from cyber security risks.

How do we use this information? We use this information in accordance with our legitimate interests (to provide our commercial offerings online).

Legal Basis: Art. 6 (1)(b) GDPR (necessary for the performance of the contract under which the user account is provided)

For how long do we store this information? e store your IP address for a period of seven days before it is automatically deleted.

2.2 Downloading and using our mobile application

If you download and use our mobile application, we automatically collect certain personal information, including, for example, information about your device, location, and your interactions with the application.

Why do we collect this information? We collect this information to provide our mobile application to you and to improve the functionality of the application.

How do we use this information? We use this information in accordance with our legitimate interests (to provide our commercial offerings via our mobile application)

Legal Basis: Art. 6 (1)(b) GDPR (necessary for the performance of the contract under which the user account is provided)

2.3 Registering with us

In order to provide the Yesauto Services, we require you to register to create a personal user account (if you are a consumer) or a dealer account (if you are a dealer) (please see our General Terms and Conditions for more information about this registration requirement ). When you register to use the Yesauto Services, we collect certain personal information directly from you, including, for example, your name, email address, and other contact details. Once registered, you can provide additional information, and update existing information, at any time in your account.

Why do we collect this information? We collect this information to provide you with access to the Yesauto Services.

How do we use this information? We use this information in order to provide the requested Yesauto Services to you and to ensure that we comply with our obligations under our agreement with you (please see our General Terms and Conditions).

Legal Basis: Art. 6 (1)(b) GDPR (necessary for the performance of the contract under which the user account is provided)

2.4 Logging in via social sign-in

Rather than registering with us directly, you can register to use the Yesauto Services using your existing third-party accounts.To register, you will be redirected to the website of the third-party provider where you can use information from your account with the third-party provider to register for the Yesauto Services. When you register using a third-party account, we collect all public details from your account from the third-party provider, including, for example, your name, contact details, date of birth, user ID, age, gender, profile picture, and location).

When you register using an existing third-party account, the third-party provider may see certain details from your account with us (for example, if you are a consumer, the third-party provider may see details of any dealers and vehicles you have chosen, your login status, browser information, and your IP address. If you do not want this data to be transferred to the third-party providers, please do not register using a third-party account; instead, please register with us directly.

Currently we offer the social sign-in for the following providers:

• Google,provided by Google Ireland Limited, registration number: 368047, with registered office at Gordon House, Barrow Street, Dublin 4, Ireland and operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
• Twitter, provided to users within the EU by Twitter International Company, One Cumberland Place, Fenian Street Dublin 2, D02 AX07, Ireland operated by Twitter Inc., 1355 Market St, Suite 900, San Francisco, CA 94103, USA; and
• Facebook provided by Facebook Ireland Limited, Grand Canal Square, Dublin 2, Ireland and operated by Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA.

Why do we collect this information? We collect this information to provide you with access to the Yesauto Services.

How do we use this information? We use this information in order to provide the requested Yesauto Services to you.

Legal Basis: Art. 6 (1)(a) GDPR (consent)

2.5 Saving and linking articles and other content

If you registered to create a personal account, our website allows you to save and like articles and other content. This facilitates finding articles and other content again at a later point. If you save or like articles or other con-tent, we will store information on the articles or content you liked in addition to the information we collect when you register for a personal account.

Why do we collect this information? We collect this information to enable you to save and like articles and other content

How do we use this information? We use this information to ensure that articles and content you saved or liked remains easily available to you.

Legal basis: Art. 6 (1)(b) GDPR (necessary for the performance of the contract for the function that enables you to save or like articles and other content)

2.6 Contacting us and leaving feedback

You can contact us via the website or using the contact details displayed in our mobile application. When you contact us, we collect certain personal information directly from you, including, for example, your name, email address, and other contact details.

Why do we collect this information? We collect this information to respond to your enquiries and improve the Yesauto Services.

How do we use this information? We use this information in order to provide assistance or feedback to you.

If you do not provide the personal information necessary, or withdraw your consent for the processing of your personal information, where this information is necessary for us to provide the Yesauto Services to you, we will not be able to provide these services to you.

Legal Basis: Art. 6 (1)(a) GDPR (consent)

2.7 Requesting financing

Our website provides a car financing comparison functionality, provided by our partner iVendi Limited ("iVen-di"). If you use this functionality, we will record the details about your financing request such as the loan amount, the repayment term and details relating to the car for which you are requesting financing. We will share this information and your IP address with iVendi, the provider of the car financing comparison service. If you are interested in the loan options you see on our website, you can apply for financing using the broker services provided by our partner Zuto Limited (Zuto). If you would like to apply for a loan using Zuto's services, we will redirect you to Zuto’s website and provide them with information about the loan you have requested.

Why do we collect this information? We collect this information to allow iVendi to display loan options for you on our website and facilitate communication between you (as the consumer) and the Zuto, so you can access the car financing services.

How do we use this information? We use this information to allow iVendi to produce loan options relevant to your vehicle of interest. If you want to apply for a loan, we will forward the information to Zuto, who provides the car financing comparison service, so that you can communicate with them regarding your car financing needs.

Legal Basis: Art. 6 (1)(b) GDPR (necessary for the performance of the contract for the function that enables you to contact the car financing provider).

2.8 Contacting dealers

To contact the dealer you may use a separate contact area on our website, which allows you to exchange electron-ic messages with the dealers or chat with them. When you contact dealers via this contact area, you may choose to exchange your name and contact information (such as e-mail addresses and telephone number). As this ex-change of information happens on our website, we will also collect this information, as well as you name, con-tact information and the messages you exchange with the dealers. However, you should note that any personal data which you provide to a dealer will be subject to that dealer’s privacy policy and we accept no responsibility for how that dealer manages your personal data.

If you are a consumer, you can contact the dealers listed on our website. If you are contacting a dealer for the first time, we will verify the information (e.g. we may check if the telephone number is complete and if you have provided a valid email address). If the information you provide is clearly not plausible or incorrect, we will either delete it immediately or attempt to correct it (e.g. by looking up a missing part of your address in a reference database of UK addresses). We will also screen your contact details against our existing customer database to ensure we do not have duplicates in the database. For duplication detection and/or address completion, we currently use the services of a company named Lolagrove.  If you have any concerns about the accuracy of an address, or if you wish to exercise your other data protection rights, please refer to section 7 below (Your rights as data subject).

Some dealers also use our service to provide you with a telephone number that you can call, connecting you to the dealer. If you call a dealer using the numbers listed on our site, we will record the call contents, the time and duration of the call, and the number you are calling from.

Why do we collect this information? We collect this information to facilitate direct communication between you (as the consumer) and the dealers listed on our website.

How do we use this information? We use this information to forward it to the dealers so they can directly respond to your enquiries.

Legal Basis: Art. 6(1)(b) GDPR (necessary for the performance of the contract for the function that enables you to contact the dealers) and Art 6(1)(f) (our legitimate interest).

2.9 Information about New Deals

We will e-mail you information on new deals, which dealers make available on our website, if you sign up and consent to receive such e-mails.

When you register to receive information about new deals, we save your name and your contact information as well as the search criteria or requirements for the deals you want to be informed about.

Why do we collect this information? We collect this information to be able to communicate with you about the dealers’ offers and promotions and to send you information when new deals are published that match your search criteria.

How do we use this information? We will use this information to contact you by email. We may also use information we collect about you when you browse the Yesauto website to display relevant advertisements to you online.

Legal Basis: Article 6(1)(a) GDPR (consent).

2.10 Promotional activities such as contests and reward programmes

We may occasionally organise contests, reward programmes or other promotional activities. To do so, we will need to use and (if necessary) collect information such as your name, e-mail address, physical mailing address, social media account information, date of birth, and details you provide as part of identity and/or address verifi-cation processes. Some promotional activities will require additional information collection in order to perform the activity. For example, if you leave feedback or reviews or upload photos or videos in order to claim a reward, we collect your submission. If you watch a video, we will record the fact that you watch the video (or a part of it). If you buy something via Yesauto, or follow an affiliate link, we record the fact that this took place, the time and date, or other relevant information (if any).

You are responsible for respecting the rights of any other individuals or organisations featuring in any materials you submit.

Why do we collect this information? Administering a promotional activity will typically involve registering your participation in that activity, checking you meet basic eligibility criteria (such as age limits, or that you are a local resident), monitoring for fraud, abuse or other non-compliance with the rules of the promotional activity, and then processing information necessary to perform the activity (for example, assessing the reviews you leave in order to claim a reward, or details of promotional materials you view). Feedback/review submissions will generally enhance and enrich products and services, or could be used as part of future marketing campaigns. In some cases, rewards will be conditional on doing several things in succession (e.g. leaving a certain number of reviews), in which case we keep a record of these actions and/or an equivalent metric (e.g. a points tally), Sub-sequently providing you with a physical reward might require us (for example) to send you something by mail.

Occasionally, promotional activities might reward sign-ups to promotional e-mails or similar marketing (in which case, see ‘Information about New Deals’ above).

How do we use this information? If we need to check your eligibility for an activity, we can do so by com-paring the information we hold or collrct against the eligibility rules for the activity. If we monitor for fraud or non-compliance with the activity’s rules, we will look for indicators of abuse such as IP addresses that do not match the user’s self-declared place of residence, or for multiple sign-ups from a given location, device or e-mail address. Tools such as ReCAPTCHA (discussed below) can also help with this. Sending you rewards will usually involve use of your electronic or physical mailing addresses. If you provide feedback, including positive testimonials, we can use these for internal development, or on our sites or apps, or in future promotional materi-als or similar.

Legal Basis: Unless otherwise stated, the legal basis will be Art. 6(1)(b) GDPR (necessary for the performance of the contract terms relevant to the promotional activity, which could be activity-specific terms and/or our gen-eral terms and conditions) and Art 6(1)(f) (our legitimate interest). If, as part of a promotional activity, you consent to unsolicited marketing by e-mail or similar, the legal basis for that will be as described above, under ‘Information about New Deals’.

Withdrawing consent

Wherever we rely on your consent, you will always be able to withdraw that consent. If you withdraw your con-sent to receiving information about new deals by e-mail, we will add your e-mail address to a list to ensure we do not send you further e-mails about new deals. However, your withdrawal of consent will not affect the pro-cessing of your personal data prior to the day you withdrew your consent.

3. Automated decision making

We do not carry out any automated decision making.

4. Disclosure of personal information

In addition to the specific instances mentioned above, we may share your personal information with third parties in the following circumstances:

• if necessary, where it is necessary to investigate any unlawful or abusive use of the Yesauto Services or for law enforcement purposes, personal information will be disclosed to law enforcement authorities and, where appropriate, to injured third parties. However, this only happens if there are concrete indications of unlawful or abusive conduct. A transfer can also take place if this serves the enforcement of terms of use or other agreements. We are also required by law to provide information to certain public bodies upon request. These are law enforcement authorities, authorities that prosecute administrative offences subject to fines and the tax authorities;
• where we rely on contractors and third-party service providers to either provide services that you or our other customers have requested, including:
  • as part of the Yesauto Services, we use Google Maps (provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). To use the functions of Google Maps, your IP address is transferred to Google. However, to give you the opportunity to decide for yourself about the processing of your data, we have implemented a “two-click-solution” meaning that you must consent to the transfer of your IP address to Google. Once you have provided your consent, Google receives a notification that you have accessed the corresponding subpage of our website, together with your IP address. This occurs regardless of whether you have a Google user account. However, if you are logged in to your Google account, the information will be directly associated with your Google account. If you do not want your profile to be associated with Google, you must log out before activating the Google Maps button on our site. Google stores your data as user profiles and uses them for advertising, market research and/or the design of its website to meet your needs. Further information on the purpose and scope of data collection and processing by Google, as well as setting options, can be found in the provider's privacy policy;
  • as part of the Yesauto Services, we use social plugins from Facebook (provided by Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA), Twitter (provided by Twitter Inc., 1355 Market St, Suite 900, San Francisco, CA 94103, USA), Pinterest (provided by Pinterest Inc., 651 Brannan Street, San Francisco, CA 94107, USA), Instagram (provided by Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA) and Whatsapp (provided by WhatsApp Inc., 1601 Willow Road, Menlo Park, California 94025, USA). Through this integration, you can share your experience of the Yesauto Services with third parties. By default, we embed disabled buttons that do not connect to the servers of any of the social and professional networking sites named above. Only when you activate them and agree to communicate with these networking sites, the buttons will become active and connect to the services. The purpose, scope of data collection and further processing and use of the data by the networks as well as your rights in this regard and setting options for the protection of personal data can be found in the data protection information of the respective providers; and
  • as part of the Yesauto Services, we integrate videos with YouTube (provided by Tube LLC, headquartered in 901 Cherry Avenue, San Bruno, CA 94066, USA). We have integrated YouTube videos with a "two-click solution" meaning that data is not transmitted to YouTube until a video has started to play. If you simply use the Yesauto Services with an embedded YouTube video, no data will be disclosed to YouTube. However, if you hover your mouse over the embedded video, you will first see a message advising you that, when you click on the link, certain personal information (including your IP address) will be transmitted to YouTube. You may then decide whether you want to click on the video or not. If you are logged into YouTube, YouTube may assign this information to your personal account. You can prevent this association by logging out of your YouTube user account and other YouTube LLC and Google Inc. user accounts and deleting company cookies before using our site. Further information on data processing and data protection by YouTube (Google) can be found in the provider's privacy policy;
• where we rely on contractors and third-party service providers to either provide services or perform functions on our behalf and provide services to us; and
• where we need to share your information with our other group companies for internal reasons, primarily for business and operational purposes. As we continue to develop our business, the structure of our company may change by changing its legal form or by establishing, acquiring or selling subsidiaries, companies or parts of companies. In such transactions, customer information is shared as part of the business intended to be transferred. In addition, if any bankruptcy or reorganisation proceedings are brought by or against us, all personal information will be considered an asset of ours and as such it is possible it will be sold or transferred to third parties.

Whenever personal information is passed on to third parties to the extent described above, we ensure that this is done in accordance with data protection laws and that such third parties comply with similar and equally stringent undertakings of privacy and confidentiality.

5. Transfer of personal information

We may transfer your personal information outside of the UK and EEA (including to the third parties detailed above). Where we transfer your data outside of the UK and EEA, we will to the extent required by law ensure that a suitable safeguard is in place in order to protect your data. This typically means we will ensure that recipi-ents of the data are bound by additional contract terms based on approved Standard Contractual Clauses.

Please contact us if you would like a copy of the safeguards which are in place for transfers of your personal information outside of the UK and EEA.

6. Retention of personal information

Your personal information will generally be retained until it is no longer required by us in order to provide the Yesauto Services to you (for example, if you have cancelled your Yesauto account).

However, beyond this time, we may retain your personal information if this is required by law.

We will delete your personal information when all storage periods have expired.

7. Your rights as data subject

If your personal information is being processed, you are classified as a data subject and have the rights listed below.

To assert any of your rights, simply contact support.uk@yesauto.com. We will usually process and satisfy your requests, free of charge, within 30 days after we receive your email. However, in certain circumstances, we may:

• charge a reasonable fee to cover our administrative costs of providing the information for baseless or excessive/repeated requests, or further copies of the same information;
• be entitled to refuse to act on the request; or
• take longer to deal with a request and, where this is the case, we will let you know.

7.1 Right to withdraw consent

If you have given your consent to anything we do with your personal information, you have the right to withdraw your consent at any time - without giving reasons. Your withdrawal does not affect the legality of the processing carried out based on your consent until the withdrawal.

7.2 Right of access

You have the right to obtain access to your personal information.

7.3 Right to rectification

You have a right of rectification (i.e. to correct and/or complete your personal information) if the personal information held by us concerning you is inaccurate or incomplete.

If you make a request to exercise your right to rectification, we are obliged to notify all third-party recipients to whom we have disclosed your personal information of such request, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about the identity of these third-party recipients.

7.4 Right to restriction of processing

You have the right to restrict the processing of your personal information in certain circumstances. If you have restricted the processing of your personal information, we will still store your information, but will only process that information with your consent or in certain other limited circumstances.

If you make a request to exercise your right to restriction of processing, we are obliged to notify all third-party recipients to whom we have disclosed your personal information of such request, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about the identity of these third-party recipients.

7.5 Right to erasure

You have the right to obtain the erasure of your personal information ("the right to be forgotten") when one of the following reasons apply:

• the information is no longer necessary for the purpose of processing;
• you have withdrawn your consent for data processing (where consent is necessary to process the data);
• you have objected to the processing of your personal information and there are no overriding legitimate grounds for the processing, or you have objected data processing for purposes of direct marketing;
• the personal information has been processed unlawfully;
• the personal information has to be erased due to a legal obligation of Yesauto.
• Please note that this is not a general right to erasure; there are exceptions to this right when processing is necessary, such as:
• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation or performance of a task carried out in the public interest; or
• for the establishment, exercise or defence of legal claims.

If you make a request to exercise your right to erasure, we are obliged to notify all third-party recipients to whom we have disclosed your personal information of such request, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about the identity of these third-party recipients.

7.6 Right to information

You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This is why we’re providing you with the information in this Privacy Policy.

7.7 Right to data portability

You have the right to obtain and reuse your personal information for your own purposes across different services. For example, if you decide to switch to a new provider, this enables you to move, copy or transfer your information easily between our IT systems and theirs safely and securely, without affecting its usability.

Freedoms and rights of other persons must not be affected by this.

7.8 Right to object to processing

You have the right to object to certain types of processing of your personal information. If you send us an objection, we will no longer process your personal information, except for where:

• we can demonstrate compelling legitimate reasons for the processing outweighing your interests, rights and freedoms; or
• the processing serves the assertion, exercise or defence of legal claims.

In particular, if we process your personal data for direct advertising, you have the right to object at any time to the processing of your data for the purpose of such advertising. If you object to the processing of your data for direct marketing purposes, we will no longer use your personal data for this purpose.

You also have the right not to be subject to any decision based solely on automated processing, including profiling, that has any legal effect on you or similarly significantly affects you.

7.9 Right to complain to a supervisory authority

You have the right to complain to a supervisory authority if you are unhappy with the way we process your personal information. The supervisory authority responsible for us is the ICO situated at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You can contact the ICO by calling 0303 123 1113.

8. Changes to this Privacy Policy and your duty to inform us of changes

This Privacy Policy was last updated on 02 December 2020.

We recommend that you review this Privacy Policy periodically, as we will update it from time to time. Any changes to this Privacy Policy will be posted on our homepage.

It is important that the personal information we hold about you is accurate and up to date. Please let us know if your personal information changes during your use of the Yesauto Service.

Section B

1. Analysis and tracking technologies

We may monitor your behaviour in order to get to know how you use the Yesauto Services.

When using the website, we usually use cookies or pixel tags to monitor your behaviour.

Cookies are small text files that contain a characteristic string of characters (cookie ID) and that are stored on your device (e.g. smartphone or computer) via an Internet browser if you do not prevent this through technical settings. Cookies enable the visited Internet pages and servers to distinguish your individual browser from other Internet browsers. A certain Internet browser can therefore be recognised and identified via the unique cookie ID. This makes it possible to simplify the use of our website for you, for example because you only have to enter certain data once rather than every time you visit the website. If possible, we use cookies that can be deleted when you close your browser (so-called “session cookies”). However, we may also use cookies that are stored on your computer for a longer period (so-called “persistent cookies”). In addition to the option of configuring your browser so that it does not accept cookies, you can delete cookies that have already been set at any time via your Internet browser or other programmes. Please note, however, that not using cookies may mean that not all functions of our website or services are fully usable.

Pixel tags (web beacons) are small, usually invisible graphics that are integrated into websites and other services in order to carry out statistical evaluations, usually for marketing purposes.

When using the mobile application, such services may also be used but are technically based on a programming interface. You can opt-out of interest-based ads by changing the settings on your device.

Unless otherwise state below, the legal basis for all services mentioned in Section B: Art. 6 (1)(a GDPR (consent).

2. Types of Cookies