Privacy Notice
Marston Holdings Limited respects your privacy rights and is committed to protecting your personal data.
This Privacy Notice sets out the basis on which we
process your personal data in accordance with our legal obligations and your
privacy rights. It also sets out how to contact us if you have a privacy
question and, if you are unhappy with our response, how to raise a complaint or
obtain advice from the Information Commissioners Office.
Marston Holdings Limited is made up of different
legal entities, collectively herein referred to as the 'Group'. Each entity has
its own Privacy Notice, and this Privacy Notice supplements other notices and
privacy policies and is not intended to override them.
We do not process personal data for marketing
purposes unless explicitly stated.. Our
services, and this website, are not designed for, or intentionally targeted at,
children 13 years of age or younger. We do not intentionally collect or
maintain data about anyone under the age of 13.
Data
Protection Officer
We have
appointed a data protection officer (DPO) who is responsible for this Privacy
Notice. If you have any questions about this Privacy Notice, please contact the
DPO in one the following ways:
Email
address: dpo@marstonholdings.co.uk
Postal
address: DPO, Marston Holdings Limited, Rutland House 8th Floor, 148 Edmund
Street, Birmingham, B3 2JR.
Our ICO
registration number is ZA054553.
If you
would like to understand or exercise your privacy rights, please see section 7
of this Privacy Notice.
Details
of our internal complaints policy are set out in section 8.3.
1.
What
this Privacy Notice covers
This Privacy Notice
aims to give you information on the personal data we collect and process in
relation to:
•
This website (https://www.marstonholdings.co.uk/)
•
Any communications you have with us.
•
The services we provide to our clients.
As an
outsourced provider of transportation and enforcement services, normally our clients
are Data Controller as they determine the purpose of processing your personal
data.
Marston
Holdings Limited will normally be a Data Processor acting under a written
contract with our client, Data Controller. There are occasions where we are
joint or sole Data Controller.
We always
establish a lawful basis for processing where we are a Data Controller. This is
set out in more detail in section 2.
This Privacy
Notice does not extend to the use of personal data by any other third-party
websites that are linked to or from our website, whether we provide those links
or whether they are shared by other users. We have no control over how your
data is collected, stored or used by third parties and we advise you to
check the privacy policies of any such websites before providing any data to
them.
2.
Data
we may collect about you and how we use it.
We may collect
your personal data through various means, including via our website, email or other electronic correspondence, by telephone, by
direct contact, or if you voluntarily submit it, and where we are otherwise required
by law to collect personal data.
As a provider
of outsourced transportation and enforcement services we refer to members of
the public that we interact with in order to provide
those services to our clients, as 'customers'.
For example,
where we enforce a court order on behalf of a client, the customer is the named
defendant on the court order, or where we provide outsourced parking permit
services for a local authority, the customer is the resident making an
application for a parking permit.
The way in
which we will process your personal data will depend on how we interact with
you, for example, whether you are our client or a customer, and the nature of
the services we are providing.
The table
below explains how we process personal data for the outsourced services we
deliver to clients as well as any other activities that involve processing
personal data.
3 Special
category Personal Data
UK Data
Protection legislation defines certain personal data as special
category data such as data regarding your ethnic origin, physical health and
mental health.
When we enforce a court order on behalf of
our client we have a legal obligation to understand
whether customers are vulnerable so that we can apply the appropriate
enforcement strategy and achieve the best outcome for the customer and our
client.
If we identify
potential or actual customer vulnerability, we may ask for details, however, we
will never compel a customer to provide special category data and we will
always ask for consent to record your personal data on our case management
system.
Sometimes we
receive special category data to support a customer appeal or complaint. For
example, a customer may appeal against a Penalty Charge Notice on the basis
that they have a serious medical condition and provide medical evidence. Where
special category data is volunteered for this specific purpose, we deem that
consent has been received for that specific purpose only.
We may share special
category personal data with our client, as the (joint) data controller, or
other members of the Marston group but only to ensure the enforcement is
managed appropriately and in line with our legal obligations.
4. How and where information is stored and how long
do we hold it for?
The data that we collect from you may be transferred to, and stored at, a
destination outside the UK/European Economic Area ("the EEA") at third party
suppliers (the EEA consists of all EU member states, plus Norway, Iceland and Liechtenstein).
We will only transfer your data to a recipient outside the UK/EEA where
we are permitted to by law. For example:
•
Where the transfer is based on standard data protection clauses adopted
or approved by the European Commission;
• Where the transfer is to a territory that is deemed adequate by the
European Commission; or
•
Where the recipient is subject to an approved certification mechanism and
the personal data is subject to appropriate safeguards, or if an exemption
applies.
We always establish a lawful basis for processing where we are the data controller,
and we will only keep personal data for the minimum
period necessary to perform the lawful basis for processing.
For example,
our retention period for BWV footage is 45 days from the date of recording. We
will only keep BWV footage beyond 45 days where we have established a lawful
basis for doing so. For example, if one of our Enforcement Agents had been
assaulted and Police have requested footage under Schedule 2 Part 1 of the Data
Protection Act 2018.
We have a system of retention periods
which are regularly reviewed by the Data Protection Officer. Where your
information is no longer required, we will ensure it is disposed of or deleted
in a secure manner.
5. Disclosure of your information
We may share
your data with other companies in our Group for the purposes described in this
Privacy Notice. This includes our holding company and its subsidiaries.
We will only
share personal data with third parties or within the Group for the specific
purposes set out below and where we have confidentiality clauses and confidentiality agreements (including data
protection obligations) in place:
• We may share your data with our client where they have instructed
transportation and enforcement activity. We will only do this where our client
is data controller for the specific case.
• We may sometimes contract with third parties to supply services to you
on our behalf. These may include payment processing, correspondence management and mailing. In some cases, the third parties may
require access to some or all of your data. Where any
of your data is required for such a purpose, we will take all reasonable steps
to ensure that your data will be handled safely, securely, and in accordance
with your rights, our obligations, and the obligations of the third party under
the law.
• We may also disclose your personal information to third parties in the event that we expand or reduce all or part of our
business or assets, in which case we may disclose your personal data to the
prospective seller or buyer of such business or assets. If our business or substantially
all of its assets are acquired by a third party,
personal data held by us about our customers, clients and website users will be
one of the transferred assets and the new owner or newly controlling party
will, use the data for the purposes for which it was originally collected by
us.
• We may compile statistics about the use of our website including data on
traffic, usage patterns, user numbers, sales and other
information. All such data will be anonymised and will not include any
personally identifying information. We may, from time to time, share such data
with third parties such as prospective investors, affiliates, partners and advertisers. Data will only be shared and used
within the bounds of the law.
• In certain circumstances we may be legally required to share certain
data held by us, which may include your personal information, for example, for
compliance or regulatory purposes, where we are involved in legal proceedings, or
where we are complying with the requirements of legislation, a court order, or
a governmental, investigative or taxation authority. We do not require any
consent from you in order to share your data in such
circumstances and will comply, as required, with any legally binding request
that is made of us. In these circumstances we may be prevented by the police,
courts, or a similar authority from pre-notification or being as transparent as
with other data processing activities.
• We may share your data in pursuing a third party's legitimate interest.
This may include situations where we are required to go beyond our specific
legal obligations set in laws and regulations to assist law enforcement or
private stakeholders in their efforts to combat illegal activities, such as
money laundering, fraud detection or prevention or misuse of services. However,
the use of personal data in such circumstances will be restricted to data which
is relevant to our services and necessary to identify you.
•
We use tracing
agencies to ensure enforcement customers receive a statutory notice of
enforcement in the post at least 7 days before any enforcement agent visit.
This involves disclosing the name and address on the court order to the tracing
agency to either confirm residency or provide an up-to-date postal address. The
tracing agencies that we use are Equifax Limited, Experian Limited, TransUnion
Limited, GB Group Limited, LexisNexis and Creditsafe
Limited.
•
We may use a
credit reference agency to help identify enforcement customers that may require
additional support or forbearance in order to tailor
our enforcement action appropriately. We firstly send a statutory notice of
enforcement to the customer's address. If either full payment is not made or a
payment plan is not agreed, then after 7 days we may send a request to a credit
reference agency for a single index score to identify any financial strain. If
potential financial strain is identified, we will consider alternative
strategies that can produce a better outcome for the customer. For example,
where we hold contact data, we will look to increase our proactive attempts to
make contact to support the customer paying at the compliance stage of the
enforcement process therefore avoiding additional statutory fees that would be
incurred if an enforcement agent were required to visit.If we are not contacted or unable to make contact with a customer during the compliance stage,
then at some point an enforcement agent visit may be necessary to properly understand
the customer's individual circumstances. The personal data that we share with
the credit reference agency is customer name, address, and date of birth only.
This processing does not leave a footprint on the customer credit file nor is
customer data shared with any other organisation including our client. The
credit reference agency we use is called Experian Limited and their address is
The Sir John Peace Building, Experian Way, NG2 Business Park, Nottingham NG80
1ZZ.
6. Complaints
If you have a privacy complaint, please contact the Data Privacy Team.
There is a two-stage complaint process which includes a right of appeal
to the Data Protection Officer
a)
Stage One
Please forward your complaint plus any supporting documentation by email
to datarequest@marstonholdings.co.uk
As a result of the COVID-19 pandemic a lot of our
teams are remote working therefore we prefer to receive your correspondence by
email. If you do not have email and prefer post instead if may not reach us as
quickly or not at all. Please mark all post clearly for the Data Privacy Team
and send to our registered office: Marston Holdings Limited, Rutland House, 8th Floor, 148 Edmund Street, Birmingham, B3 2JR
The Data Privacy Team take all privacy concerns
seriously and will investigate the matter thoroughly.
The Data Privacy Manager or Team Leader will respond
to your complaint in writing.
We aim to respond to complaints as soon as possible,
but at the latest within one calendar month of receipt.
b)
Stage Two
If you are unhappy with the stage one response from
the Data Privacy Team you can appeal directly to the
Data Protection Officer.
Please forward your appeal to dpo@marstonholdings.co.uk or alternatively write to the Data Protection
Officer at our registered office address.
The decision of the Data Protection Officer is our
final response and the end of the internal complaints process.
You have the right to raise a complaint at any time or obtain advice from
the Information Commissioners Office (ICO), the UK regulator for data
protection issues (www.ico.org.uk).
The ICO prefer that you exhaust our internal complaints process before
you bring the matter to their attention.
We would also appreciate the chance to properly investigate the matter
and report our findings back to you.
When we
investigate a complaint, we may need to share personal data with the
organisation you have an outstanding debt with and with other relevant bodies e.g.,
the Civil Enforcement Association or the Local Government Ombudsman to
adjudicate on disputed complaints.
All complaints
will be dealt with in strict confidence; however, we are usually required to
disclose the complainant's identity to whoever the complaint is about. This is
inevitable where, for example, the accuracy of a person's record is in dispute.
If a complainant does not want information identifying him or her to be
disclosed, we aim to respect that. However, it may not always be possible to
handle a complaint on an anonymous basis.
7. Controlling your personal information
• When you submit information via our website, you may be given options to
restrict our use of your data. In particular, we aim
to give our clients and website users strong controls on our use of their data
for direct marketing purposes (including the ability to opt-out of receiving
emails from us, which you may do by unsubscribing using the links provided in
our emails and at the point of providing your details).
• You may also wish to sign up to one or more of the preference services
operating in the UK: The Telephone Preference Service the Corporate Telephone
Preference Service and the Mailing Preference Service. These will help to
prevent you receiving unsolicited marketing by phone/mail. Please note,
however, that these services will not prevent you from receiving marketing
communications that you have consented after signing up.
8. Protecting your
information
Data security
is of great importance to us and to protect your data we have put in place
suitable physical, electronic and managerial controls
to safeguard and secure data collected through our website or otherwise.
You should
note that when using the website and our related services, your information may
travel through third party infrastructures that are not under our control. If
you follow a link to any of these websites, please note that these websites
have their own privacy policies and that we do not accept any responsibility or
liability for these policies.
We use high
level encryption software on our IT networks to prevent access to your personal
information. Unfortunately, the internet is never a completely secure
environment. Therefore, we cannot guarantee that hackers or unauthorised
personnel will not gain access to your personal information despite our best
efforts.
We have put in
place confidentiality clauses or confidentiality agreements (including data
protection obligations) with our third-party service providers and require
all third parties to respect the security of your personal data and to treat it
in accordance with the law.
Notwithstanding
the security measures that we take, it is important to remember that the
transmission of data via the internet may not be completely secure and that you
are advised to take suitable precautions when transmitting personal data to us
via the internet.
9. Your legal rights
Under certain circumstances, you have the
following rights under data protection laws in relation to your personal data. The
rights available to you depend on our reason for processing your information
and (in most cases) we have one calendar month to respond to your request:
9.1 Your right to withhold information
You may access
certain areas of our website without providing any data at all. However, to use
all features and functions available on our website you may be required to
submit or allow for the collection of certain data.
You may restrict your internet
browser's use of Cookies. For more information, see section 11 and our Cookie
Policy https://marstonholdings.co.uk/cookie-policy/.
9.2
Ensuring the accuracy of your information
If you believe that any data
we are holding on you is incorrect or incomplete, please contact us as soon as
possible using the contact details at the top of this Privacy Notice. We will
promptly correct or remove any information that is incorrect.
You have the right to settle or close your customer
account and request that your personal information be removed from our website
or other records.
Upon the closure of your account, we are not
obliged to retain your information and may delete any or all
of your account information without liability unless it is specifically
required for legal reasons.
If you request an
account closure, we may retain basic residual information about you in our
backup and/or archival copies of our database. This will be deleted in
accordance with our data retention policy.
9.3
Your right of access
You have the right to ask us for copies of your
personal data. This right always applies.
There are some exemptions, which means you may not
always receive any or all or the information we process. If an exemption
applies, we will always explain it to you.
For example, you may not receive full copies of
original documents because your right of access only covers personal
information. Other information may be redacted. If it is important that you
receive full copies of original documents, you may want to telephone our
customer contact centre instead.
If you would like a copy of any personal information we hold about you please direct your request to
our dedicated Data Subject Access Team otherwise it will delay how long it
takes us to receive it or we might not even receive it.
There are several ways that you can contact the Data
Subject Access Team. The quickest route is through our web-form which is
delivered instantly to the team's work queue.
Please do not include any other information such as
a complaint as the team deal exclusively with data privacy requests, otherwise
it will delay how long it takes the team to respond.
The webform will guide you through the request. When
you click submit your request will instantly be acknowledged by the Data
Subject Access Team.
https://privacyportal.onetrust.com/webform/4cc0cef7-56aa-4cff-8b93-4c7424789646/58f20d2e-85dc-4033-9ee5-639ae2f6748f
You can still submit your Data Subject Access
Request in writing if you prefer to our dedicated email address datarequest@marstonholdings.co.uk
Depending on the personal data that you request we
may need to confirm your identity before accepting your subject access request.
This is part of our security policy to ensure that we do not release personal
data to the wrong data subject.
9.4 Your right to rectification
You have the right to ask us to rectify data you
think is inaccurate. You also have the right to ask us to complete information
you think is incomplete. This right always applies.
However, please be aware that as an outsourced
provider of transportation and enforcement services much of the information we
hold about you is received from our clients. Therefore, we may not be able to
automatically amend personal data on request and we may instead need to work
with our client or re-direct your request. For example, we cannot change the
name on a court order issued to our client.
9.5
Your right to erasure
You have the right to ask us to erase your personal
data in certain circumstances.
If an exemption applies, we will always explain it
to you. For example, we would not normally erase a live court order as we have
a lawful basis for processing that does not rely on your consent.
9.6
Your right to restriction of processing
You have the right to ask
us to restrict the processing of your information in certain circumstances. If
an exemption applies, we will always explain it to you.
9.7
Your right to object to processing
You have the right to
object to processing in certain circumstances. If an exemption applies, we will
always explain it to you.
9.8 Your right to data portability
This only applies to
information you have given us. You have the right to ask that we transfer the
information you gave us to another organisation or third party or give it to
you. The right only applies if we are processing information based on your
consent or under a contract with you and the processing is automated.
If you would like to
exercise any of your rights above, our contact details can be found at the top
of this Privacy Notice.
10.
Cookies
Our website
may place and access certain first party Cookies on your computer or device.
First party Cookies are those placed directly by us and are used only by us. We
use Cookies to facilitate and improve your experience of our website and to
provide and improve our services.
By using our
website, you may also receive certain third-party Cookies on your computer or
device. Third party Cookies are those placed by websites, services, and/or
parties other than us. For more details, please refer to Our Cookie
Policy: https://marstonholdings.co.uk/section-policy/.
11.
Changes to our Privacy Notice
We may change this Privacy Notice as we may deem necessary from time to
time, or as may be required by law. Any changes will be immediately posted on
our website together with the version number and date. If the change in Privacy
Policy materially impacts our data subjects, then we will also communicate with
them directly.
We recommend that you check this page regularly to keep up to date. This
Privacy Notice was last updated in April 2022.
@
Marston Holdings Limited
Version
9.0
September
2022