Privacy Notice

Welcome to Zenith’s Privacy Notice

This privacy notice will inform you as to how we look after your personal data when you visit our websites and driver portals or contact us directly, and tells you about your privacy rights and how the law protects you.

Click on the links to the left to view the applicable section of this notice. Please also use the glossary to understand the meaning of some of the terms we have used.

Important information and who we are

Purpose of this privacy notice

This privacy notice provides information on how Zenith collects and processes your personal data via your use of our websites and portals, including any data you may provide when you register or login to a driver portal, sign up to a newsletter or take part in a prize draw or survey, order a new vehicle, or access and request certain services from us.

It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them.

Controller

Zenith is made up of different legal entities, details of which can be found here. This privacy notice is issued on behalf of the whole Zenith Group so when we mention “Zenith”, “we”, “us” or “our” in this privacy notice, we are referring to the relevant company in the Zenith Group responsible for processing your data.

We will let you know which entity will be the controller for your data when you visit the applicable driver portal.

Zenith Vehicle Contracts Limited is the controller for www.zenith.co.uk

Zenith Vehicle Contracts Limited or Leasedrive Limited will be the controller of the driver portals depending on your employer’s scheme. Further information can be found on the applicable portal.

If you are visiting the ZenAuto website then that privacy notice will apply which can be found here.

We have appointed a data protection officer (DPO) who is responsible for overseeing this privacy notice and answering any questions you may have. If you would like to discuss any aspect of this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details set out below.

Contact details

Our full details are: Zenith Vehicle Contracts Limited and Leasedrive Limited
DPO: Andrew Morton
Email: [email protected]
Post: Number One, Great Exhibition Way, Kirkstall Forge, Leeds, LS5 3BF
Telephone: 0344 417 6015

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance and we’d be happy to help.

Changes to the privacy notice and your duty to inform us of changes

This version 7.0 was last updated on 25th November 2024 and historic versions can be obtained by contacting us via the methods set out above.

Third-party links

This website and our driver portals may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed for example anonymous data.

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• “Identity Data” includes your first name, maiden name, last name, username or similar identifier such as an employee number, marital status, title, date of birth and gender – and, as applicable, such Identity Data in relation to additional named drivers. We may also receive or ask you to provide your National Insurance number and driving licence number, or dash-cam footage and vehicle location if we provide related services to you.
• “Contact Data” includes your home address, email address and telephone numbers. We may also ask for details about your employer such as which office you work at or which division, and the office address. We may also need this information in relation to additional named drivers as applicable.
• “Financial Data” includes your bank account and payment card details if we are providing certain services to you.
• “Transaction Data” includes details about payments to and from you and other details of products and services you have ordered from us or that you are receiving.
• “Technical Data” includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
• “Profile Data” includes your username and password, quotes or orders made by you, your interests, preferences, feedback and survey responses.
• “Usage Data” includes information about how you use our website, products and services.
• “Marketing and Communications Data” includes your preferences in receiving marketing from us and whether you have ‘unsubscribed’ to marketing.

We also collect, use and share “Aggregated Data” such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data so that we can see how users are accessing our portals and to ensure the user journey works the way it is intended to. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

Special Categories of Personal Data require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

Depending on the type of services to be provided to you, we may collect a limited amount of health information should you be involved in a vehicle incident. We call this the ‘first notification of loss’ and is where (if you are receiving these kind of services) our representatives will record information from you about the incident. If you wish to make a personal injury claim we can, always at your request, refer your details to our preferred specialist law firms, who will then contact you directly and handle the claim on your behalf. We will ensure that any information obtained is limited to what is necessary in order to, for example, administer an insurance or injury claim.

We may also collect driving related convictions and offences when we receive your driving licence information and administer fines and traffic offences on behalf of you and your employer.

You may also tell us about certain health information and we will use that information to ensure that we are treating you fairly and adapting our approach. For example, if you have particular vulnerabilities we will use that knowledge so that we can support you to the best of our ability and act fairly and responsibly. We will seek your consent prior to logging any such information. We will remove this data once it is no longer necessary, for example once your vulnerability ends.

We do not collect any other Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health other than referenced above and genetic and biometric data). Nor do we collect any information about non-driving related criminal convictions and offences.

If you fail to provide personal data

Where we need to collect personal data and you fail to provide that data when requested, we may not be able to provide a quote for your vehicle, deliver it or provide other services to you that you have requested. In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

How is your personal data collected?

We use different methods to collect data from and about you including through:

Direct interactions. You may for example give us your Identity, Contact and Profile Data by filling in forms on our sites or by corresponding with us by post, phone, email, live chat or otherwise. This includes personal data you provide when you:

• apply for or request our products and services;
• register on our investors hub;
• create an account on our website or visit it from your employer’s intranet;
• subscribe to our service or publications;
• enter a competition, promotion or survey; or
• give us some feedback.

Your Employer. Your employer may give us certain Identity Data about you so that we can pre-register you on our sites and ensure that you have access to the correct products and services. We call this an ‘Eligibility File’ and is limited to such Identity Data that we need to ensure that you have access to the right products and services when you access the portal.

Automated technologies or interactions. As you interact with our website, we may automatically collect Technical Data about your computer equipment, browsing actions and patterns. We collect this personal data by using cookies, and other similar technologies. Please see our cookie policy for further details.

Third parties or publicly available sources. We may receive personal data about you from various third parties as set out below:

• Technical Data from analytics providers.
• Identity, Contact, Financial and Transaction Data from providers of technical, payment and ‘in-life’ services such as:
  • our vehicle dealerships and agents when they deliver your new vehicle or collect your old one;
  • verification of your driving licence from the DVLA and our processing agents;
  • our approved network of repairers and garages;
  • confirmation of vehicle insurance from an insurance broker or provider.

How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.

Click here to find out more about the types of lawful basis that we will rely on to process your personal data.

Generally, we do not rely on consent as a legal basis for processing your personal data.

We have set out below a description of the main ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. We’re unable to name all of the partners here, due to commercial confidentiality and the large number that we work with. Instead, we’ve provided the categories of partner that we use, and the services that they will provide as applicable. To support our services, we also use a variety of approved third party tools and services.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you would like to discuss this further.

In addition to the below we may transfer information about your arrangements with us to our third party funders and financiers (Funders), including in connection with transferring our interest, financial or otherwise, in our arrangements to those Funders. We will not transfer personal data to the Funders unless it is absolutely necessary for us to do so however if you are a Director of our corporate customer then we may send your Identity and Contact Data to Funders so that they may complete a credit and fraud check as applicable. In the event of our insolvency, then we may transfer your personal data to those Funders so that they may collect any remaining payments from you and to continue to manage any existing arrangements. Those Funders will provide you with their relevant Privacy Notice at that time and following receipt of your data from us.

Marketing

We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We have established the following personal data control mechanisms.

Invitation to participate in your employer’s chosen scheme or access to services

You will receive communications from us and in certain cases your employer to advise you that the vehicle scheme and benefit service portal is open. These communications will be sent to you if you are eligible for the vehicle benefit or certain services as determined by your employer from time-to-time and with their collaboration. For example, if you are a company car driver then we’ll email you to let you know how you can order a new vehicle.

We won’t spam you with emails and if you aren’t interested in the scheme you can stop receiving such emails by clicking the unsubscribe link any time.

If you don’t receive a vehicle from us, your employer may still determine that it is necessary for you to receive certain services – for example logging your business mileage or personal vehicle details on our CAMS site. We’ll still email you about how you can register and access these services.

Promotional offers from us

You will receive marketing communications from us and via your employer (if applicable) if you have requested information from us, have obtained a vehicle or services from us or if you provided us with your details when you entered a competition or registered for a promotion and, in each case, you have not unsubscribed to receiving that type of marketing.

If you currently have a vehicle from us then we will advise you when it’s getting close to the end of its term and let you know about special offers on replacement vehicles and services.

Opt-In Marketing

With your consent, given at the time you supply your personal data, we may pass that data to a Zenith Group company for their direct marketing purposes. You can stop these communications at any time by following the instructions below.

Third-Party marketing

We will get your express opt-in consent before we share your personal data with any company outside the Zenith group of companies for marketing purposes.

Unsubscribing

You can ask us or third parties to stop sending you marketing messages at any time by following the unsubscribe links on any marketing message sent to you or by contacting us.

Where you unsubscribe to receiving these marketing messages, this will not apply to personal data provided to us as a result of a product or service experience or other transactions and services required to be fulfilled such as delivering your vehicle or arranging ‘in-life’ services for that vehicle.

Cookies

You can configure your cookie preferences through our cookie management tool. Through this tool, you can click on the different category headings to find out more and change your default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. For more information about the cookies we use, please click here.

Automated Decisions 

We may sometimes use systems to make automated decisions based on personal data we have about you. This helps us to make sure are decisions are quick, fair, efficient and correct based on what we know. These automated decisions can affect the products and services we may offer you or the price that we charge. We may for example place you in groups with similar individuals to learn about our customer’s needs and to make decisions on what we learn.

You have rights over automated decisions. You can ask us at any time not to make our decision based on an automation, and you can object to an automated decision and ask that a person reviews it.

If you want to know more about these rights please contact us.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required and permitted by law.

Job Applicants

If you apply for a job with us, we will collect and use the information you provide to us in the course of your application to assess your suitability for the position you have applied for and for other roles in future, and to monitor diversity and equal opportunities within our recruitment process.

What information does the company collect?

We collect a range of information in relation to a job application. This includes:

• your name, address, date of birth, National Insurance number, HMRC new starter checklist details, contact details, including email address, telephone number and an emergency contact;
• details of your qualifications, skills, experience, employment history and any gaps in your employment;
• information from interviews and phone-screenings you may have;
• bank account information;
• information about your current level of remuneration, including benefit entitlements;
• information about all spent and unspent convictions, cautions, reprimands, and final warnings held on central police records (apart from protected convictions and cautions) and information about your address history and electoral roll registration, County Court Judgements (CCJs), bankruptcies, voluntary arrangements, decrees and administration orders;
• information about your entitlement to work in the UK;
• equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, physical health or mental conditions, religion or belief, gender identity and nationality;
• Dietary requirements (for induction purposes only);
• Vehicle registration/s;
• Uniform requirements (for applicable Commercial employees only).

How is this data collected?

This data may be obtained from:

• Our background checking partner
• Directly from you, including:
  • your CV and job application form
  • other documents provided by you to confirm your identity and support your job application
  • information provided by you through our applicant tracking portal.
• Your previous employers
• Educational and professional organisations
• Internet searches and other publicly available information sources

We will seek information from third parties only once a job offer has been made to you.

Data will be stored in a range of different places, including on your application record, in our HR management systems and our email system.

How do we use this personal data?

We collect and process your data for a number of purposes and where we have a legal basis to do so, as follows.

We have a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to:

• manage the recruitment process,
• make a well-informed hiring decision,
• protect our business, and employees, from potential risk,
• assess the honesty, character, safety, and qualifications of our applicants,
• confirm a candidate’s suitability for employment,
• decide what form of employment to offer,
• set successful applicants up as employees in our HR systems,
• respond to and defend against legal claims,
• to ensure that individuals in privileged roles remain trusted and do not pose any risk to our business on an ongoing basis (for select employees only).

In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required to check a successful applicant’s eligibility to work in the UK before employment starts.

We may process information about whether or not applicants are disabled so we can make reasonable adjustments for candidates who have a disability. Where we process other special categories of data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is for equal opportunities monitoring purposes. Our processing of these types of data will be carried out to ensure you or us can meet our obligations or exercise our rights under law related to employment or (only where applicable) to enable us to establish, exercise or defend legal claims.

We will not use your data for any purpose other than the recruitment process of which you are a part.

Who will we share this data with?

Your information may be shared internally within our group for the purposes of the recruitment process. This includes members of the HR team, interviewers involved in the recruitment process, and managers in the business area with a vacancy. In limited circumstances, your application data may also be shared with members of the legal and compliance team and with senior managers.

We will not share your data with third parties, unless your application for employment is successful and an offer of employment is made. We will then share your data with former employers in order to obtain references. We may also share your data with our group companies, for business performance and other types of monitoring and management purposes and, if the role requires certain levels of screening we may share limited data with our screening providers. To process successful applicant’s data, we will also share data with our payroll and benefits providers.

In addition, we may need to share your personal information with relevant regulators, or otherwise to comply with the law.

How long do we keep this data?

If your application for employment is unsuccessful (including when you have speculatively applied to us in respect of a role which is not available), we will hold your data on file for 6 months. At the end of that period, your data is deleted or destroyed (unless we need to retain it for longer to exercise or defend any legal claims).

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which employee data is held will be provided to you in a separate employee privacy notice.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to us during the recruitment process. However, if you do not provide the information, we may not be able to process your application.

Disclosures of your personal data

We may have to share your personal data with the parties set out below for the purposes set out in the table in paragraph 4 above.

• Internal Third Parties as set out in the Glossary
• External Third Parties as set out in the Glossary
• Specific categories of third parties listed in the table in paragraph 4 above.
• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

International Transfers

In the majority of cases it will not be necessary for us to transfer your personal data outside the European Economic Area.

If we do need to share your personal data outside of the European Economic Area, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
• Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe.
• Where we use providers based in the US, we may transfer data to them if we have carried out appropriate transfer risk assessments to ensure data is transferred securely and put in place appropriate contractual clauses and/or wording (which may include using UK specific contractual clauses and/or wording).

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA as applicable.

Data Security and GDPR Accountability

Information security

We have put in place appropriate technological and organisational measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We operate an Information Security Management System (ISMS) which is accredited to ISO/IEC 27001:2013. We use industry-recognised tools and partnerships to secure our network, systems, and software – including web-filtering and data loss prevention tooling, co-location data centres, network intrusion monitoring and a 24/7/365 SOC / SIEM solution, database patching, penetration testing and vulnerability scanning, anti-virus and firewall software, PCI DSS compliant payment software, encryption and anonymisation tooling – where it is appropriate to do so.

In addition, we operate internal policies and procedures which cover access controls and privileged access management, IT acceptable usage, mobile devices, data breach and cyber-attack response plans, business continuity management and physical office controls. We also operate several delegated groups who are responsible for ensuring that systems are stable, secure, available and performant (covering vulnerabilities, patches, business change, project management and development).

UK Data Protection / UK GDPR

Our privacy management framework ensures compliance with UK data protection legislation and provides evidence of our compliance with the ‘accountability’ principle. This framework is maintained by our Data Protection Officer, who is accredited to CIPP/E & CIPM (IAPP). We utilise a lifecycle model to continuously measure and improve our privacy program.

In addition to our privacy policies and procedures, our governance structures ensure the confidentiality, integrity, and availability of data. Directors are accountable for managing the data in their business areas (referred to internally as ‘Information Risk Owners’). They are supported by ‘Data Guardians’, who are operational managers responsible for delivering mandatory and risk-based activities regarding information security (e.g., access control reviews) and data protection (e.g., DPIAs). In addition, Data Guardians act as advocates for managing data responsibly and fielding queries from their operational teams. Data Guardians and Information Risk Owners are supported with subject matter expertise by our Information Security team and our DPO.

Data Retention

How long will you use my personal data for?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

We generally keep personal data about our customers and drivers for six years after they cease being customers. This is for insurance, accident management, tax purposes – or to defend ourselves against legal action. In some circumstances we may retain personal data for a shorter time-frame, and we have programmes in place to ensure this is deleted or put beyond use at the relevant time.

In some circumstances you can ask us to delete your data: see Request erasure below for further information.

In some circumstances we may anonymise or pseudonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes and we may also put your personal data beyond use. In these instances we may use or hold this information indefinitely without further notice to you.

Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data. Please click on the links below to find out more about these rights:

• Request access to your personal data
• Request correction of your personal data.
• Request erasure of your personal data.
• Object to processing of your personal data.
• Request restriction of processing your personal data.
• Request transfer of your personal data.

If you wish to exercise any of the rights set out above, please email us.

No fee required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights) but see further below.

Refusal

We may refuse to comply with your request if it is clearly unfounded, repetitive or excessive. In these circumstances we will confirm your right to complain to the Information Commissioner’s Office (ICO), and to a judicial remedy, as quickly as we can – but at the latest within one month. We may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

What we need from you

We may need to confirm your identity before we can action any request. This is a security measure to ensure that your personal data is protected from inappropriate use. You will need to provide a copy of your photo driving licence or passport, plus a copy of a utility bill or bank statement within the last 3 months.  We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Glossary

Lawful basis

Legitimate Interest means the interest of Zenith in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

Third Parties

Internal Third Parties

Other companies in the Zenith Group acting as joint controllers or processors and who are based in the United Kingdom and provide IT and system administration services and other services.

External Third Parties

• Service providers acting as processors based in the United Kingdom who provide IT and system administration services.
• Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers based in the United Kingdom who provide consultancy, banking, legal, insurance and accounting services.
• HM Revenue & Customs, DVLA, regulators and other authorities acting as processors or joint controllers based in the United Kingdom who require reporting of processing activities in certain circumstances.
• Other third parties acting as processors or joint controllers based in the United Kingdom to whom we subcontract certain services to.

Your legal rights

You have the right to:

Request access: You have the right to be aware of the personal data that we or our partners hold about you, and to verify the lawfulness of the processing. This is formally known as a “Subject Access Request”. When submitting your request, it would assist us if you could specify what information or processing activities you’d like to see.

Request correction: You have the right to have your personal data corrected if it is inaccurate or incomplete. This includes the data that we and our partners hold on you. In many instances you can simply call or email our customer teams, who can make most changes immediately, however you can also send us a formal written request.

Request erasure: In certain circumstances you are entitled to have your personal data erased (also known as “the right to be forgotten”). This includes the personal data that we hold on you and also the data which our partners process (see Third Parties above). Please note that where you are using a vehicle under our fleet management services we have a legitimate interest to continue processing your personal data and we will be unable to erase your data.

Object to processing: You have the right to object where we are processing your personal data for direct marketing purposes. We will remove you from our mailing list.

Request restriction of processing: You have the right to restrict or ‘block’ the processing of your personal data. This might be where you contest the accuracy of the personal data that we hold on you, and require us to restrict any further processing until the personal data has been verified.

Request the transfer: You have the right to receive your personal data in a format that can be easily transferred to, and used by, an alternative service provider. This is formally known as “Data Portability”. We will provide you with a CSV or Excel format file.