Internal Privacy Notice

This is the Privacy Notice made on behalf of the following:

Name of Entity                                                                                                               Country                                 ICO Registration

IM Discretionary Charitable Trust                                                                                  England                                    ZA064912

International Motors Limited Retirement Benefit Scheme                                             England                                    ZA354970

Human Resources Department (in respect of all current                                                        
employees of companies within the I.M.Group and                                                       England                                    ZA064998
Prospective Employees)

The Executive Office of I.M. Group former employees                                                 England                                    ZA064998

Beijing VCA Technology Service Co Ltd                                                                      China                                         N/A

Beijing IM Trade Cons. Co. Ltd                                                                                     China                                         N/A

Beijing IM Trading Co. Ltd                                                                                            China                                         N/A

(hereinafter “The I.M. Entities”)

Introduction

1. Identity and contact details of the data controller / DPO

Kevin Cahill
Data Protection Officer
Telephone: 0121 730 8079
Email: dataprotectionofficer@imgroup.co.uk

I.M. Group Ltd
I.M. House
South Drive
Coleshill
Warwickshire
B46 1DF

2. What Information do we collect?

We collect and retain the names and contact details of our employees and other personal information about them relevant to their employment by us. This information is typically held in each employee’s personnel file which will accordingly contain information relevant to each employee’s performance in their job including such items as:

For clarity, the use of the word “employee(s)” refers to current and past employees (“The Employee Data”)

3. How will your information be used?

The I.M. Entities will only use The Employee Data for the benefit of its Employees or for some other lawful purpose. In particular, it will never sell The Employee Data to a Third Party. We will only pass The Employee Data to Third Parties (such as Royal London and BUPA) where there is a business driven need to do so and where we have an Article 28 Agreement in place with them. The I.M. Entities will from time to time pass the Employee Data amongst themselves. Beijing VCA Technology Service Co Ltd, Beijing IM Trade Cons. Co. Ltd, and Beijing IM Trading Co. Ltd may from time to time use passport details of current employees to assist in obtaining a visa for the People’s Republic of China for such employees.

4. Our legal basis for processing your data

Where we do not have your consent pursuit to Article 6 1. (a) of GDPR, we always have a legitimate interest pursuit to Article 6 1. (f). In addition, or alternatively from time to time we process Personal Data pursuit to lawful bases contained in other provisions of Article 6 such as the performance of a contractual obligation.

5. Who receives your information

See paragraph 3. above.

6. Where your information is stored and how it is kept secure

On our secure computer systems and in some cases in hard form in our offices or in our onsite storage facility. We have invested in state of the art technical and organizational security measures to safeguard The Employee Data.

7. Transfers to 3rd countries and safeguards in place

The I.M. Entities operate in the following countries

Generally, we are unlikely to transfer your Personal Data outside the EEA. We will only send your data outside of the European Economic Area (‘EEA’) to:

If we do transfer Personal Data to our agents or advisers outside of the EEA, we will make sure that it is protected in the same way as if it was being used in the EEA. We’ll use one of these safeguards:

Transfer it to a non-EEA country with privacy laws that give the same protection as the EEA.

Put in place a contract with the recipient that means they must protect it to the same standards as the EEA.

Transfer it to Organisations that are part of Privacy Shield. This is a framework that sets privacy standards for data sent between the US and EU countries. It makes sure those standards are similar to what is used within the EEA.

8. How long your information will be held

With the exception of prospective employees (whose Personal Data we will generally not retain for more than 90 days) we will generally retain the Employee Data for the natural life of the Employee to whom it relates.

In some cases, however, we will retain Employee Data after the death of the Employee, if we need it for some lawful purpose such as fulfilling our obligations pursuant to that Employee’s pension arrangements. This would include paying a pension benefit to that employee’s surviving spouse or beneficiary.

9.  Your rights as a Data Subject

a)     Your ‘data subject’ rights:

You have a number of rights in relation to your Employee Data under GDPR. In relation to certain rights, we may ask you for information to confirm your identity and, where applicable, to help us to search for your Employee Data. Except in rare cases, we will respond to you within 30 days after we have received this information or, where no such information is required, after we have received your request.

b)     Accessing your Employee Data

You have the right to ask for a copy of the information that we hold about you by emailing or writing to us at the address in paragraph 1 of this privacy notice. We may not provide you with a copy of your Personal Data if this concerns other individuals or we have another lawful reason to withhold that information.

c)     Correcting and updating your Personal Data

The accuracy of your personal data is important to us and we are working on ways to make it easier for you to review and correct the information that we hold about you.

In the meantime, if you change your name or address/email address, or you discover that any of the other information we hold is inaccurate or out of date, please let us know by contacting us via our Human Resources Department:

Email: hr@imgroup.co.uk

Telephone: +44 121 730 8047

d)     Withdrawing your consent

Where we rely on your consent as the legal basis for processing your Employee Data, as set out under in paragraph 4 above, you may withdraw your consent at any time by contacting us using the details in paragraph 1 of the privacy notice.

e)     Objecting to our use of your Employee Data and automated decisions made about you.

Where we rely on our legitimate business interests as the legal basis for processing your Employee Data for any purpose(s), as outlined under paragraph 4, you may object to us using your Employee Data for these purposes by emailing or writing to us at the address in paragraph 1 of this privacy notice. Except for the purposes for which we are sure we can continue to process your Employee Data, we will temporarily stop processing your Employee Data in line with your objection until we have investigated the matter. If we agree that your objection is justified in accordance with your rights under data protection laws, we will permanently stop using your data for those purposes. Otherwise we will provide you with our justification as to why we need to continue using your data.

f)      Erasing your Employee Data or restricting its processing

In certain circumstances, you may ask for your Employee Data to be removed from our systems by emailing or writing to us at the address in paragraph 1 of this privacy notice. Unless there is a reason that the law allows us to use your Employee Data for longer, we will make reasonable efforts to comply with your request.

You may also ask us to restrict processing your Employee Data in the following situations:

• where you believe it is unlawful for us to do so,

• you have objected to its use and our investigation is pending or you require us to keep it in connection with legal proceedings.

In these situations, we may only process your Employee Data whilst its processing is restricted if we have your consent or are legally permitted to do so, for example for storage purposes, to protect the rights of another individual or company or in connection with legal proceedings.

12. How to make a complaint to us and our supervisory authority

You have the right to complain to the Information Commissioners Office (ICO) if you are concerned about the way we have processed your Employee Data. Please visit the ICO’s website for further details.