1. What is this Privacy Notice about?
The protection of your personal data is an important matter for us and we want to provide you with transparent information about how we use your personal data. The purpose of this Privacy Notice is to give you an overview about the collection and the processing of your personal data in connection with the provision of test drives, sales and after-sales products and services.
This Privacy Notice applies to personal data that we collect for the purposes described below (through this website, in-person interactions or other media).
You are not obliged to provide your personal data. However, your personal data may be necessary for the provision of certain services and functionalities and to enter into, execute and perform our contracts with you. Therefore, without your personal data, we may not be able to provide the requested service or to conduct our sales and after-sales activities.
2. Who is responsible for processing my data?
The responsible data controller for any personal data collected and processed as set out in this Notice is:
Hyundai Motor UK Limited, Birchwood Building, Springfield Drive, Leatherhead, Surrey, KT22 7LP, United Kingdom
Hyundai Motor UK Limited, trading as Genesis Motor UK Limited will be referred to as “Genesis”, “we”, “our” or “us” in this Privacy Notice.
3. How can I contact the controller and the data protection officer?
3.1. If you have any questions about or in connection with this Privacy Notice or would like to complain about how we handle your personal data or you would like to exercise any of your rights, please contact us by using the contact details provided in section 2.
3.2. Alternatively, you may also contact our data protection officer via the contact details provided in section 2.
4. What categories of personal data are processed, for what purposes and on what legal basis?
4.1. Test Drives
Whenever you book a test drive, we need to schedule, confirm and manage your test drive appointment.
Purpose of the processing:
- To process and prepare for your test drive request;
- To communicate with you regarding the scheduling and the details of the test drive;
- To check your driving licence;
- To follow up and understand your purchase intent.
Categories of data subjects:
- Prospective customers;
Scope of personal data processed:
- Contact details (salutation, title, name, email, phone, street and house number, postal code, city, country);
- Test drive model, date and time of the appointment;
- Driving licence;
- Purchase intent (model of interest, potential purchase period, etc.);
- Company name (if you are a business customer).
Legal basis for processing:
- Our legitimate interest (Article 6(1)(f), UK GDPR): to provide you with a hands-on experience of the vehicle and to support your decision-making process.
Period of processing:
- Up to 1 year from our last interaction unless you showed an interest in our products or services and agreed on being recontacted at a later time.
Recipients of your personal data:
- Genesis Motor Europe GmbH;
- Authorized agents;
- Driving licence validation providers;
- Data processors that provide us with services relating to our IT infrastructure (e.g. hosting or operation and maintenance of our IT systems and platforms).
4.2. Quotes and finance application
Purpose of the processing:
- To provide you with price quotes about our products and services;
- To appraise your car and provide you with an estimate of the trade-in value;
- To follow up and understand your purchase intent;
- To put you in touch with financial service providers;
- To keep our business records;
- To establish, protect, or exercise our rights.
Categories of data subjects:
- Prospective customers;
Scope of personal data processed:
- Contact details (salutation, title, name, email, street and house number, postal code/city, country);
- Vehicle configuration;
- Financing options;
- Purchase intent (model of interest, potential purchase period, etc.);
- Company name (if you are a business customer).
Legal basis for processing:
- Our legitimate interest (Article 6(1)(f), UK GDPR): providing price quotes enhances our communication with you about our product and services and create a clear understanding of the respective costs, contributing to a positive overall experience.
- The processing of your personal data is necessary to conclude or to perform a contract with you (Article 6(1)(b), UK GDPR).
- We have an obligation, under the applicable commercial law and tax law, to process your personal data (Art. 6 (1) lit. c), UK GDPR).
Period of processing:
- Up to 1 year from our last interaction unless you showed an interest in our products or services and agreed on being recontacted at a later time. If within this period we conclude a contract with you, we will store your data for a period of 6 years.
Recipients of your personal data:
- Genesis Motor Europe GmbH;
- Authorized agents;
- Financial service providers;
- Data processors that provide us with services relating to our IT infrastructure (e.g. hosting or operation and maintenance of our IT systems and platforms).
4.3. Sales consultation and visit appointments
Whether you are seeking details about our latest products, pricing information, or customization options, we offer you the opportunity to contact us using the form provided on the website. You can also send Genesis a question or an inquiry via email or our social media pages, call us or visit us in person.
Purpose of the processing:
- To schedule and provide sales consultations and visit;
- To comply with legal obligations;
- To keep our business records;
- To establish, protect, or exercise our rights.
Categories of data subjects:
- Prospective customers;
Scope of personal data processed:
- Customer account data (salutation, first and last name, postal code, city, country, e-mail address, title, mobile or landline phone number);
- Purchase intent;
- Vehicle data (model of interest, etc.);
- Service and interaction history;
- Content of the inquiry and subsequent interactions;
- Company name (if you are a business customer).
Legal basis for processing:
- Our legitimate interest (Article 6(1)(f), UK GDPR) to handle and to follow up on your request, to establish, protect, or exercise our rights;
- The processing of your personal data is necessary to conclude or to perform a contract with you (Article 6(1)(b), UK GDPR).
- We have an obligation, under the applicable commercial law and tax law, to process your personal data (Art. 6 (1) lit. c), UK GDPR).
Period of processing:
- Up to 1 year from our last interaction unless you showed an interest in our products or services and agreed on being recontacted at a later time. If within this period we conclude a contract with you, we will store the relevant sales communication for a period of 6 years.
Recipients of your personal data:
- Genesis Motor Europe GmbH;
- Authorized agents and repairers;
- Contact centers;
- Data processors that provide us with services relating to our IT infrastructure (e.g. hosting or operation and maintenance of our IT systems and platforms).
4.4. Order processing and contract management
Purpose of the processing:
- To register and manage your orders, communicate with you regarding your orders and provide confirmations and address any inquiries;
- To prepare and execute the contract with you;
- Check and verification of identity and age;
- To keep our business records;
- To establish, protect, or exercise our rights.
Categories of data subjects:
- Prospective customers;
Scope of personal data processed:
- Billing address;
- Delivery address;
- Order details;
- Where applicable, the status of your financial application and the finance options;
- The preferred signature method;
- Your signature;
- Our contract with you, the supporting documents and your personal data specified therein.
Legal basis for processing:
- The processing of your personal data is necessary to conclude or to perform a contract with you (Article 6(1)(b), UK GDPR).
- We have an obligation, under the applicable commercial law and tax law, to process your personal data (Art. 6 (1) lit. c), UK GDPR).
- Our legitimate interest (Article 6(1)(f), UK GDPR) to establish, protect, or exercise our rights.
Period of processing:
- Order data: 6 years from the end of the year in which the order was placed;
- Contract data: 6 years from the termination of our contractual relationship.
Recipients of your personal data:
- Genesis Motor Europe GmbH;
- Authorized agents and repairers;
- Electronic trust service provider;
- Data processors that provide us with services relating to our IT infrastructure (e.g. hosting or operation and maintenance of our IT systems and platforms).
4.5. Invoicing and payments
We process your personal data to facilitate and process payments and to issue invoices for the products or services you purchased from us.
Purpose of the processing:
- To issue invoices;
- To track and record payments and transactions;
- To keep our business records;
- To establish, protect, or exercise our rights;
- To detect and prevent fraud.
Categories of data subjects:
Scope of personal data processed:
- Contact data (salutation, title, name, email, phone, postal code);
- Vehicle, other products and/or service data;
- Contract data;
- Payment data;
- Where applicable, the status of your financial application and the finance options.
Legal basis for processing:
- The processing of your personal data is necessary to conclude or to perform a contract with you (Article 6(1)(b), UK GDPR).
- We have an obligation, under the applicable commercial law and tax law, to process your personal data (Art. 6 (1) lit. c), UK GDPR).
- Our legitimate interest (Article 6(1)(f), UK GDPR): to comply with the applicable laws and regulations, in order to be able to offer you effective and secure payment methods such as bank transfers, loans, or other financing models, as well as to establish, protect, or exercise our rights, to defend against a legal claim, to detect and prevent fraud.
Period of processing:
- 6 years from the end of the financial year in which the invoice was issued or the payment was made, whichever is longer.
Recipients of your personal data:
- Genesis Motor Europe GmbH;
- Authorized agents and repairers;
- Data processors that provide us with services relating to our IT infrastructure (e.g. hosting or operation and maintenance of our IT systems and platforms).
4.6. Vehicle delivery, handover and registration
Purpose of the processing:
- Delivery and handover of the car and/or other products;
- Vehicle registration;
- To keep our business records;
- To establish, protect, or exercise our rights.
Categories of data subjects:
- Customers.
Scope of personal data processed:
- Contact data (salutation, title, name, email, phone, delivery address, postal code/city, country);
- Vehicle or product data;
Legal basis for processing:
- The processing of your personal data is necessary to conclude or to perform a contract with you (Article 6(1)(b), UK GDPR).
- We have an obligation, under the applicable commercial law and tax law, to process your personal data (Art. 6 (1) lit. c), UK GDPR).
- Our legitimate interest (Article 6(1)(f), UK GDPR) to establish, protect, or exercise our rights.
Period of processing:
- 6 years from the termination of our contractual relationship.
Recipients of your personal data:
- Genesis Motor Europe GmbH;
- Authorized agents;
- Providers of car delivery services;
- Providers of vehicle registration services;
- Data processors that provide us with services relating to our IT infrastructure (e.g. hosting or operation and maintenance of our IT systems and platforms).
4.7. Maintenance services
Purpose of the processing:
- To assure service booking;
- To pick up and drop off your vehicle;
- To identify service needs;
- To carry out car repairs and to perform quality control;
- To deliver car valeting services and courtesy car solutions;
- To provide roadside assistance;
- To keep our business records;
- To establish, protect, or exercise our rights.
Categories of data subjects:
- Customers;
- Driver of the vehicle.
Scope of personal data processed:
- Customer account data (salutation, title, name, email, phone, address, postal code, location, country, etc.);
- Vehicle data (VIN, car model, etc.);
- Service details, service and interaction history.
Legal basis for processing:
- The processing of your personal data is necessary to conclude or to perform a contract with you (Article 6(1)(b), UK GDPR).
- We have an obligation, under the applicable commercial law and tax law, to process your personal data (Art. 6 (1) lit. c), UK GDPR).
- Our legitimate interest (Article 6(1)(f), UK GDPR) to establish, protect, or exercise our rights.
Period of processing:
- 6 years from the termination of our contractual relationship.
Recipients of your personal data:
- Genesis Motor Europe GmbH;
- Authorized repairers;
- Contact Center;
- Providers of roadside assistance services;
- Data processors that provide us with services relating to our IT infrastructure (e.g. hosting or operation and maintenance of our IT systems and platforms).
4.8. Provision of other services and goods
We want to inform you about how we process your personal data in connection with the provision of various services or goods beyond those explicitly specified in this Notice or in a separate document.
Purpose of the processing:
- To provide your with our products or services;
- To enter into, execute and perform our contracts with you;
- To manage our relationship with you and to ensure you the best customer experience;
- To keep our business records;
- To establish, protect, or exercise our rights.
Categories of data subjects:
- Prospective customers;
- Customers.
Scope of personal data processed:
Personal data that we collect throughout our relationship, for example when we enter into and/or perform a contract with you. This may include in particular:
- Customer account data (salutation, title, name, email, phone, address, postal code, location, country, etc.);
- Vehicle data (VIN, car model, etc.);
- Service details, service and interaction history.
Legal basis for processing:
- The processing of your personal data is necessary to conclude or to perform a contract with you (Article 6(1)(b), UK GDPR).
- Our legitimate interest (Article 6(1)(f), UK GDPR) to provide you with a positive customer experience and to manage your relationship with us; to establish, protect, or exercise our rights.
- We have an obligation, under the applicable commercial law and tax law, to process your personal data (Art. 6 (1) lit. c), UK GDPR).
Period of processing:
- As long as necessary for the provision of the services and/or in accordance with statutory retention periods.
Recipients of your personal data:
- Genesis Motor Europe GmbH;
- Authorized repairers;
- Third-party vendors who assist us in delivering and improving our services;
- Data processors that provide us with services relating to our IT infrastructure (e.g. hosting or operation and maintenance of our IT systems and platforms).
4.9. Newsletter and personalized advertising
Newsletter
We offer you the possibility to subscribe to a newsletter if you wish to receive advertising about our vehicles as well as invitations and information about product launches, satisfaction surveys and information about our existing or new services, also based on your geographic area.
Purpose of processing:
- To communicate with you through newsletters.
Categories of data subjects:
- Prospective customers;
- Customers.
Scope of personal data processed:
- Salutation, title, first name, surname, e-mail address, postcode/city, country.
Legal basis for processing:
- Your consent (Article 6(1)(a), UK GDPR).
Period of processing:
- Until you unsubscribe.
Recipients of your personal data:
- Genesis Motor Europe GmbH;
- Authorized agents and repairers;
- Data processors for support of the operations related to customer relationship management, in particular supporting our email marketing platform and contact centers;
- Data processors that provide us with services relating to our IT infrastructure (e.g. hosting or operation and maintenance of our IT systems and platforms).
Personalised advertising and market research
We offer you the opportunity to receive personalized advertising about our products and events, including surveys, and to be invited to take part in our market research.
Purpose of processing:
- To send you marketing communications, surveys and invitation to events and market research.
Categories of data subjects:
- Prospective customers;
- Customers.
Scope of personal data processed:
- Customer account data (salutation, title, first name, last name, e-mail address, postal code/city, country, telephone number, current car model, model of interest, etc.);
- Service and interaction history;
- Vehicle data.
Legal basis for processing:
- Your consent (Article 6(1)(a), UK GDPR).
- If you are our customer or showed a genuine interest in purchasing our products and/or services, we will process your data based on our legitimate interest (Article 6(1)(f), UK GDPR). We want to make sure you receive all the communication about our services and products similar to those purchased by you or in which you showed a genuine interest in. You will also receive invitations to take part in surveys, events and market research because we are interested in understanding your satisfaction and expectations. You can object to such use of your personal data at any time and without any costs.
Period of processing:
- In case you give us your consent, until you withdraw it;
- In case we process your data based on our legitimate interest, we will process your data either for a period of one year after the termination of the contract or for a period of one year from your last display of interest in our products or services, unless you object to such use of your personal data.
Recipients of your personal data:
- Genesis Motor Europe GmbH;
- Authorized agents and repairers;
- Data processors for support of the operations related to customer relationship management, in particular supporting our email marketing platform, contact centers and market research agencies;
- Data processors that provide us with services relating to our IT infrastructure (e.g. hosting or operation and maintenance of our IT systems and platforms).
Whenever you actively subscribe to our marketing communication, we use the so-called double opt-in procedure to confirm your email address. In this process, a confirmation request is sent to the e-mail address you entered with your subscription to confirm your consent. In connection with the double opt-in procedure, we store and document the IP address, date and time of submission of your newsletter subscription via web form as well as the IP address, date and time of your confirmation of the double opt-in email.
You can withdraw your consent at any time free of charge with effect for the future via the "Unsubscribe" link contained in every newsletter/personalized advertisement e-mail or via the following e-mail address: privacy@uk.genesis.com.
As soon as you unsubscribe from the newsletter/personalized advertisement, your personal data provided for the newsletter/personalized advertisement will be deleted, except for your email address that will be stored in a blacklist to document that you do not wish to receive our marketing communication or unless other statutory retention periods apply.
4.10. Customer service
We use your personal data for contact within the framework of contract processing (for example, vehicle ordering, service/repair order, etc.), or for processing our services (for example, complaints to customer service, replacement vehicle order, making appointments for pick-up, etc.). We will also contact you when your vehicle is affected by what is called a technical service bulletin or a recall.
If you have any questions or complaint, we offer you the opportunity to contact us using the form provided on the website. You can also send Genesis a question or an inquiry via email or our social media pages, call us or visit us in person.
Purpose of processing:
- To receive and handle your inquiries and complaints;
- To communicate with you as part of our contractual obligations;
- To comply with legal obligations;
- To establish, protect, or exercise our rights.
Categories of data subjects:
- Customers.
Scope of personal data processed:
- Customer account data (salutation, title, first and last name, postal code, city, country, e-mail address, title, mobile or landline phone number, etc.);
- Company name (if you are a business customer);
- Service and interaction history;
- Vehicle data;
- Content of the inquiry or of the complaint and subsequent interactions.
Legal basis for processing:
- Our legitimate interest (Article 6(1)(f), UK GDPR) to handle and to follow up on your inquiry or complain; necessity for establishing, exercise or defense of legal claims.
- The processing of your personal data is necessary to conclude or to perform a contract with you (Article 6(1)(b), UK GDPR).
- We have an obligation, under the applicable commercial law and consumer law, to process your personal data (Art. 6 (1) lit. c), UK GDPR).
Period of processing:
- 6 years from the end of the year in which our last interaction occurred.
Recipients of your personal data:
- Genesis Motor Europe GmbH;
- Authorized repairers;
- Contact centers;
- Data processors that provide us with services relating to our IT infrastructure (e.g. hosting or operation and maintenance of our IT systems and platforms).
4.11. Data analysis to improve our business
In order to continuously improve our business processes and services, we analyse data of our prospective customers and customers that interact with our products and services.
Purpose of processing:
- To perform analysis and predictions in order to improve our business processes, products and services.
Categories of data subjects:
- Prospective customers;
Scope of personal data processed:
- Visitor data of Genesis studios or websites (e.g. number of visitors in the studios, unique visitor ID);
- Private contact and identification data (e.g. postcode);
- Customer database data (e.g. account number, order number, vehicle identification number);
- Interaction data (e.g. requests to call center, requests for test drive, registration for newsletter, quotations, orders or sales);
- Service history.
Legal basis for processing:
- Our legitimate interest (Article 6(1)(f), UK GDPR): to improve our business processes and operations; to improve our product or service offerings; to generate insights about user behavior and trends.
Period of processing:
- 5 years from data collection.
Recipients of your personal data:
- Genesis Motor Europe GmbH;
- Providers of data transformation services;
- Providers of data analytics services;
- Data processors that provide us with services relating to our IT infrastructure (e.g. hosting or operation and maintenance of our IT systems and platforms).
In the course of the processing, in order to comply with the principle of data minimisation, the personal data concerned is properly pseudonymized. This includes the removal of all direct personal identifiers (e.g. name, email), which are then replaced by an Account ID. Indirectly traceable identifiers are retained. After pseudonymisation, the data is analysed in Genesis' analytics systems. At no point the direct personal reference is restored.
The results of the analysis (in particular, dashboards and key figures) are always aggregated and presented as anonymous data.
5. With whom is my data shared?
Any access to your personal data is restricted to those individuals that have a need to know in order to fulfil their job responsibilities.
We may transfer your personal data for the respective purposes to the recipients and categories of recipients listed below and as stated in section 4.
- Unaffiliated private third parties – In certain cases, we may share your personal data with trusted, unaffiliated third parties who assists us in delivering our products and services to you efficiently.
These are in particular, but not limited to:- Our network of authorized agents: we may share your data with our network of agents for the purpose of customer relationship management (including administration and update of customer profile and contact history), customer satisfaction surveys, event management, marketing and market research activities.
Our agents act as joint controllers. Joint controllers are entities that, together with us, determine the purposes and means of processing your data. These joint controllers are bound by strict agreements ensuring that your data is handled with the same level of care and protection as we provide. If you have any inquiries regarding the specifics of this joint controller arrangement, please refer to the contact information provided in this Privacy Notice.
- Our networks of authorized repairers for the purpose of customer relationship management, customer satisfaction surveys, event management, marketing and market research activities.
- Affiliated private third parties – We are part of the Hyundai group. In some cases, after careful review, we may transfer your personal data to other entities in the group (e.g. our local entities in your country of residence), which process your personal data as independent data controller or as a joint controller with us (for example, for administrative support etc.).
These are in particular, but not limited to: - Hyundai Motor Company, 12 Heolleung-ro, Seocho-gu, Seoul, South Korea;
- Genesis Motor Europe GmbH, Strahlenbergerstraße 110-112, 63067 Offenbach am Main, Germany.
- Data processors – Certain third parties, whether affiliated or unaffiliated, may receive your personal data to process such data on behalf of us under appropriate instructions as necessary for the respective processing purposes. The data processors will be subject to contractual obligations to ensure the implementation of appropriate technical and organisational security measures to safeguard the personal data, and to process the personal data only as instructed.
The current data processors are involved in particular, but not limited to in the following processes: - We are using data processors for providing us with services relating to our IT infrastructure (e.g. hosting or operation and maintenance of our IT systems and platforms).
- We are using data processors for the support of the operations related to customer relationship management.
- We transmit your personal data to certain third party service providers (contact centers, market research companies and event management companies etc.).
- Governmental authorities, courts, external advisors, and similar third parties that are public bodies as required or permitted by applicable law. Some disclosures are required by law (for example, court orders or requests from the police). In these cases, we will process your data because we are subject to a legal obligation (Art. 6 (1)(c), UK GDPR).
6. Is my data transferred abroad?
Within the scope of the activities set out above, your personal data may be transferred to other countries (including countries outside the EU or EEA) which may have different data protection standards than your country of residence. In this case we have applied appropriate safeguards with the involved third parties in place to ensure an adequate level of protection for personal data. Please note that personal data processed in a foreign country may be subject to foreign laws and accessible to foreign governments, courts, law enforcement, and regulatory agencies. However, we will endeavour to take reasonable measures to reach an adequate level of data protection also when sharing your personal data with such countries (for example, by concluding specific agreements the recipient of your data, or we will ask for your explicit consent to such transfer).
7. How long will my data be stored?
Your personal data is generally stored for as long as necessary in relation to the purposes and in order to provide you with our services. Beside we generally store your data to the extent needed to meet our legal obligations and to protect our rights: for example, we will store your data in accordance with statutory retention periods.
Insofar more specific retention periods will apply, you can refer to the information on the period of processing of your personal data as indicated in section 4 above.
8. What rights do I have and how can I exercise them?
You have certain rights in relation to your personal data that you can exercise towards us. In accordance with applicable data protection laws these rights may be restricted under certain conditions.
You can always exercise your rights at any time by contacting us via the contact information as stated in section 3.
Generally, you have the following rights:
8.1. Right of access: You have the right to obtain from us confirmation as to whether or not we process your personal data and, where that is the case, to request access to your personal data. You also have the right to obtain a copy of your personal data which we process.
8.2. Right to rectification: You have the right to the rectification of any inaccurate personal data concerning you. Depending on the purposes of the processing, you have the right to have incomplete personal data updated, including by means of providing a supplementary statement.
8.3. Right to erasure (“right to be forgotten”): Under certain circumstances, you have the right to the erasure of your personal data and we may be obliged to erase your personal data.
8.4. Right to restriction of processing: Under certain circumstances, you have the right to have a restriction placed on the processing of your personal data. This means that your data will generally not be processed by us with the exception of storage.
8.5. Right to data portability: Under certain circumstances, you have the right to receive the personal data, which you have provided to us, in a structured, commonly used and machine-readable format. You have the right, without hindrance from us, to transfer this data or have it transferred directly by us to another entity.
8.6. Right to object: You have the right to object to processing of personal data for the purposes of direct marketing and, under certain circumstances, when the processing of data for other purposes is based on legitimate interest.
8.7. Right to complain: You also have the right to make a complaint with the competent data protection supervisory authority in your country.
8.8. Right to withdraw consent: If you have given your consent to the processing of your personal data, you can withdraw your consent at any time with the effect for future processing. The withdrawal of the consent does not affect the processing that took place prior to the withdrawal of the consent.
9. Changes to the Privacy Notice
We may change and/or supplement this Privacy Notice from time to time in the future. Such changes and/or supplements may be necessary due to the implementation of new technologies or the introduction of new services. We will publish the changes on https://www.genesis.com/uk/en/privacy-policy.html and/or inform you accordingly (for example, via email or hard copy letter).
Where we provide addresses and contact information of companies and organizations in this privacy notice, please note that both may change over time. Therefore, we recommend checking the relevant information before contacting us.
Date: January 1st, 2024