1 THIS NOTICE
1.1 Kia Motors (UK) Ltd. trading as Bolton Kia is committed to maintaining the accuracy, confidentially and security of your personal information. Kia Motors (UK) Ltd. trading as Bolton Kia take our data protection responsibilities seriously and this notice reflects the obligations set out in the General Data Protection Regulation (EU Regulation 2016/679) (“GDPR”) and any laws in England giving effect to its provisions.
1.2 This notice relates to personal information about you from which you can be identified. We refer to this information throughout this notice as “personal data”. Personal data does not include data where the identity has been removed (anonymous data). There are “special categories” of more sensitive personal data which require a higher level of protection. Section 2 of this notice sets out examples of your personal data that we use.
1.3 We are the controller of your personal data. This means that we are responsible for deciding how we hold and use personal data about you. As a controller we use (or ‘process’) the personal data we hold on you in accordance with this notice.
1.4 This notice describes how we collect and use your personal data. It also outlines the various categories in which your data will be processed and for what purpose. We are committed to collecting and using such data fairly and in accordance with the requirements of the GDPR.
1.5 Your personal data belongs to you and it is your choice whether you provide it to us. However, because we need certain items of your personal data in order to perform our obligations to you, please be aware that if you do not provide all of the requested detail we request from you then we may not be able to fulfil all of your requirements. It is important that the personal data we hold about you is accurate and current. Please keep us informed of any changes during your relationship with us.
1.6 Please read this notice carefully, so that you are aware of how and why we are using your data.
1.7 This notice may be amended or updated from time to time. The changes will be made on www.kia.com/uk and/or we may inform you accordingly of changes implemented.
1.8 This notice does not form part of any contract to provide services.
2 ABOUT US
2.1 Bolton Kia is a wholly owned subsidiary of Kia Motors (UK), Halfway Green, Walton Green, Walton-on-Thames, KT12 1FJ. Our Fair Processing Notice explains your privacy rights and details how we gather, use and share information about you.
2.2 Should you wish to discuss this further, after having read this document, please contact Kia UK’s Data Protection Officer by email at firstname.lastname@example.org or by post to Data Protection Officer, Kia Motors (UK) Ltd, Walton Green, Walton-on-Thames, Surrey KT12 1FJ.
3 PERSONAL INFORMATION WE COLLECT
3.2 We may obtain personal data about you including but not limited to the following
3.2.1 Personal Identification: driving license, passport copy, National Insurance Number, bank account details, utility bills, marriage certificates when required for validation purposes
3.2.2 DWP Letter of Entitlement (applicable to Motability customers only)
3.2.3 Marriage certificate (if applicable)
3.2.4 Business information (if applicable when purchasing through Bolton Kia’s Fleet Department)
3.2.5 Customer Services: voice recording and records of your contact with the Kia Customer Care Centre
3.2.6 Marketing: your marketing preferences, marketing information sent, media type, time, date
3.2.7 Opinions: your responses to our surveys regarding products and services
3.2.8 Written correspondence: your communications with us by letter, email or social media
3.2.9 Competitions and games: personal data relating to competition entries and games played on our website
3.3 In addition to above examples, personal information also includes information such as full name, home address, telephone, personal email address (or business email address should you purchase a vehicle through Bolton Kia’s Fleet Department), date of birth and any other information necessary to Bolton Kia in order to process an order, service or enquiry of a vehicle.
4 SOURCES OF PERSONAL DATA
4.1 We may obtain your personal data from various sources including the following
4.1.2 Kia UK’s authorised Dealer and Repairer Network
4.1.3 Third party organisations: for obtaining credit references, ensuring fraud preventions, joint account holders and individuals who you may be linked to financially
4.2 Where permitted or required by applicable law or regulatory requirements, we may collect information about you without your knowledge or consent.
5 LEGAL BASIS FOR PROCESSING
5.1 To process your personal data in connection with the purposes set out in section 6 of this notice, we will rely most commonly on one or more of the following legal bases:
5.1.1 The processing is necessary in connection with a contract with us;
5.1.2 The processing is required for compliance with a legal obligation;
5.1.3 We have a legitimate interest in carrying out the processing, which is not overridden by your interests, fundamental rights, or freedoms. When we rely on this legal basis our legitimate interests include the following:
(a) The efficient running of our business;
(b) Enhancement of the quality of our products;
(c) Understanding and improving the customer experience offered in Kia’s authorised dealer and repairer network;
(d) Marketing to you when you are acting on behalf of a business;
(e) Fulfilling your requests that need to be passed on to our authorised dealer and repairer network;
(f) Communicating with you with good understanding;
(g) Managing vehicle support or services;
(h) Verifying and ensuring the accuracy of your personal data;
(i) Understanding and tailoring your online experience;
(j) Meeting external and internal governance obligations;
(k) To enable the business to share information intra group;
(l) Network and information security;
(m) The protection of our business from unlawful competition;
(n) To enable disposal, reorganisation or sale of the business or the integration of an acquired business; and
(o) Protection and security of property and rights.
5.1.4 The processing is necessary for the performance of a task carried out in the public interest.
5.2 In rare circumstances we may rely on the following legal bases:
5.2.1 The processing is necessary to protect your vital interests or the interests of someone else; or
5.2.2 The processing is required for compliance with a legal obligation;
5.3 We do not need your consent if we process your data under one or more of the other legal bases set out above. We will ask your consent for the following:
5.3.1 To contact you by telephone, SMS, post and/or email about our offers, products, promotions, developments or services which we think may be of interest to you;
5.3.2 To pass your name and contact details to our online review partner who will contact you to request your independent feedback and to process results.
5.4 You have the right to withdraw this consent at any time. You can do this using the unsubscribe links presented in emails, in the profile area of the MyKia Online Portal or by contacting Kia Motors UK Customer Service.
6 PURPOSES OF PROCESSING
6.1 We need your personal data primarily to allow us to perform a contract with you [“PC”], to enable us to comply with legal obligations [“LO”], to perform a task carried out in the public interest [“PI”], to pursue legitimate interests of our own or those of third parties [“LI”], provided your interests and fundamental rights do not override those interests. We will use your personal data for a variety of different purposes including those listed below. We have indicated by [using the definitions PC, LO and LI] the relevant legal basis on which we are processing or will process your personal data, as well as indicating which categories of data are involved. Some of the legal bases for processing will overlap and there may be several which justify our use of your personal data.
6.2 We will use your personal data for a variety of different purposes including the following:
6.2.1 Sending you customer surveys asking your opinions on Kia products and services provided by our authorised dealer and repairer network [LI];
6.2.2 Contacting you by telephone, email or post about offers, products, promotions, developments or services which we think may be of interest to you when you are acting on behalf of a business [LI];
6.2.3 Processing requests for brochures, test drives, service bookings, click and collect accessories, used car, finance and rental enquiries and passing on to our authorised dealer and repairer network [LI];
6.2.4 Responding to your ‘Contact Us’ queries [LI];
6.2.5 Recording your Kia history to process customer service interactions [LI];
6.2.6 Processing warranty information relating to your vehicle [LI];
6.2.7 Validating customer offers and eligibility for Kia partner programmes [LI];
6.2.8 Providing vehicle support and services [LI];
6.2.9 Website user processing research or analysis including to collect statistics, traffic patterns and related site information [LI];
6.2.10 Verifying and ensuring the accuracy of your personal data [LI];
6.2.11 Sending you important notices such as communications about changes to terms and conditions and policies [LI];
6.2.12 Keeping basic information on you to identify you when you have exercised your privacy rights including an objection to direct marketing or removal of consent [LI];
6.2.13 Managing your vehicle service plans [PC];
6.2.14 Contacting you by post when we need to recall your vehicle for safety reasons [PI];
6.2.15 Making a decision about your recruitment or appointment [PC];
6.2.16 Assessing applications for a particular job or task [PC];
6.2.17 Administrating by sharing customer data within our group [LI].
7 Notification and consent
7.1 To the extent that your consent is required, we will require you to confirm this either in writing or verbally to Kia Motors (UK) Ltd. trading as Bolton Kia for the purposes stated in section (2).
7.2 Where your consent is required for our collection, use or disclosure of your personal information, you may, at any time, subject to legal or contractual restrictions and reasonable notice, withdraw your consent.
7.3 All communications with respect to such withdrawal or variation of consent should be made in writing and addressed to Bolton Kia.
7.4 We would not usually rely on your consent to process your personal data as in most cases you would have entered into a contract with ourselves and this would be our legal basis to processes your personal data.
7.5 We will only ever process your personal data for the purpose of direct marketing where we have your consent to do so.
8 RECIPIENTS OF PERSONAL DATA
8.1 We may disclose the personal data you provide to us to our group companies and affiliates or third party data processers who may process data on our behalf to enable us to carry out our usual business practices. Any such disclosure will only be so that we can process your personal data for the purposes set out in this notice.
8.1.1 Group Companies
(a) Kia Motors Europe GmbH
(b) Hyundai AutoEver Europe GmbH
(c) Mobis Parts Europe NV
(d) Hyundai Capital UK Limited https://www.kiafinance.co.uk
(e) Kia Motors Slovakia sro
(f) Kia Motors Corporation
(g) Innocean Worldwide UK Limited
8.1.2 Third Party Data Processors
(a) Marketing and Research Services
(b) IT and Software Platform Services
(c) Vehicle and Parts Logistics Services
(d) Training and Consultancy Services
(e) Recruitment Services
8.2 The full network of Kia Authorised Dealers and Repairers can be found at
8.3 We choose our service providers carefully and require them to take appropriate security measures to protect your personal data.
Kia UK Customer Services
CPM United Kingdom Limited
Kia Business Centre
Return on Investment Limited
White Clarke Automotive Solutions Limited
RAC Motoring Services https://www.rac.co.uk/kia-assist
Verex Insurance Services https://www.kiacarinsurance.co.uk
Kia Approved Extended Warranty
Car Care Plan
8.4 In addition, we may share your personal data with the following recipients:
8.4.1 Legal and regulatory authorities, on request, or for the purposes of reporting any actual or suspected breach of law or regulation;
8.4.2 External professional advisers such as accountants, auditors, lawyers and other outside professional advisers, subject to binding obligations of confidentiality;
8.4.3 Any relevant party, law enforcement agency, tribunal or court, to the extent necessary for the establishment, exercise or defence of legal rights;
8.4.4 Any relevant party for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties; and
8.4.5 Any relevant third party acquirer(s), in the event that we sell or transfer all or any portion of our business or assets (including in the event of a reorganisation, dissolution or liquidation).
9 TRANSFERS OF PERSONAL DATA OVERSEAS
9.1 We may transfer the personal data we collect about you outside of the EU to the Republic of Korea (South Korea) in order to fulfil our obligations to you.
9.2 There is not an adequacy decision by the European Commission in respect of that country. This means that the country to which we transfer your data is not deemed to provide an adequate level of protection for your personal data.
9.3 However, to ensure that your personal data does receive an adequate level of protection we have put in place Standard Data Protection Clauses in the form of template transfer clauses adopted by the Commission to ensure that your personal data is treated in a way that is consistent with and which respects the EU and UK laws on data protection.
9.4 We have third party data processors who work with companies (sub-processors) outside of the EU. We have ensured that those companies have the appropriate safeguards in place to provide an adequate level of data protection.
10 RETENTION OF PERSONAL DATA
10.1 We will hold your personal data only for so long as is necessary for us to do so. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
10.2 Where we no longer need to process your personal data for the purposes set out in this notice then we will delete your personal data from our system.
10.3 If you make contact with Kia having no prior relationship with us, we will store your data for up to 6 months if we have no permission to contact you for marketing purposes.
10.4 When you begin a customer relationship with Kia, your data will be retained for 8 years to enable us to deliver our customer services throughout the 7 year vehicle warranty period. The 8 year retention will re-start when a new vehicle is purchased. As an owner of an Approved Used Car, your personal data will be retained in line with the remaining warranty period.
10.5 You may inform us or we may find out that the customer relationship has ended. If we have no permission to use your data to contact you for marketing purposes, we will hold your data for 6 months following the notification.
10.6 Your consent to contact you for marketing purposes and to be included in online reviews is valid for 3 years from when the consent is given. The consent may be refreshed by you during this time leading to the re-start of the 3 year period.
10.7 If you raise a query to the customer contact centre, we will retain your data for a longer period than stated to allow us to respond to you and to manage legal claims, complaints or concerns.
10.8 If you have applied for a job with Kia, your details will be retained for 6 months if you are unsuccessful in gaining a contract with us
11 AUTOMATED DECISION MAKING
11.1 Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. We are allowed to use automated decision-making in the following circumstances:
11.1.1 Where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights
11.1.2 In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights; or
11.1.3 Where authorised by law and subject to certain conditions
11.2 If we make an automated decision on the basis of any particularly sensitive personal data, we must have either your explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard your rights.
11.3 You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.
11.4 We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.
12 YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA
12.1 You have a number of rights in connection with the processing of your personal data, subject to certain conditions set out in the GDPR and in UK law, including the right to:
12.1.1 Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
12.1.2 Request the correction of the personal data that we hold about you. This enables you to have incomplete or inaccurate data we hold about you corrected.
12.1.3 Request the erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it.
12.1.4 Ask us to stop processing personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground.
12.1.5 Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
12.1.6 Request the transfer of your personal data to another party.
12.1.7 Lodge a complaint regarding the processing of your data with the Information Commissioner’s Office.
12.2 In the circumstances where you have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please follow the guidance in section 5.3 or contact our Data Protection Officer email@example.com in writing in accordance with section Error! Reference source not found.. After we have received notification that you have withdrawn your consent in relation to a particular purpose we will no longer process your information for that purpose, unless we have another legitimate basis for doing so in law.
12.3 If you want to review, verify, correct or request erasure of your personal data, object to the processing of your personal data, or request that we transfer a copy of your personal data to another party, please contact our Data Protection Officer firstname.lastname@example.org in writing in accordance with section 2.2.
13 IF YOU HAVE ANY FURTHER QUESTIONS
Also Kia Motors (UK) Customer Services are available at 0333 202 2990 Monday- Friday 8.30am-9pm, Saturday 9am-1pm.
 The EC has so far recognised; Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and the USA (limited to the Privacy Shield Framework) as providing adequate protection. Adequacy talks are ongoing with Japan and South Korea.