Mercury Vehicle Solutions Ltd, trading as Car Leasing Online, is the data controller for personal information collected through this website and our services.
Registered office: Unit D1 Stanlaw Abbey Business Centre, Dover Drive, Ellesmere Port, Cheshire, CH65 9BF. Phone: 0151 356 5629 Email: [email protected] ICO Registration: Z1926581
We are committed to protecting and respecting any personal information you share with us, and to processing it in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
This statement explains what information we collect, how it is used, how we share it, how long we keep it, and your rights in relation to it.
We review this policy regularly. We will notify you of material changes directly where we can; please also check this page from time to time for updates.
The Information We Collect
We collect information about you when you engage with us through our call centre, our website, other digital platforms, or our partners. Some of this information does not identify you personally but provides us with information about how you use our services. The information we collect includes some or all of the following:
- Your personal details including name, date of birth, address, employment and contact details
- Your banking and financial information where you provide it (including income, expenditure, and previous credit history)
- Information about your lifestyle and home ownership
- Identifiers assigned to your computer or other devices, including your Internet Protocol (IP) address
- Cookie information (see our Cookie section below)
- Details of communications between us (for example emails or call recordings)
- Marketing preferences and consent records
- Any other information you may choose to provide to us
Special category data (UK GDPR Article 9)
We do not routinely collect special category data such as health, racial or ethnic origin, religious beliefs, or biometric data. Where this is necessary (for example a customer disclosing a disability so we can adjust our service), we will only process it with your explicit consent or another lawful condition under Article 9.
How we use this information and the legal basis for processing
We will only process information that is necessary for the purpose for which it has been collected. The lawful basis depends on the activity:
- Administering your vehicle quotes and policies — necessary for the performance of a contract between you and us, and/or our legitimate interests
- Carrying out anti-fraud and anti-money laundering checks and verifying your identity — compliance with legal obligations, and/or legitimate interests
- Assessing financial risks, including credit reference checks and credit scoring assessments — necessary for the performance of a contract, and/or legitimate interests
- Broking your finance agreement and any related services — necessary for the performance of a contract, and/or legitimate interests
- Using your payment details to process payments or refunds — necessary for the performance of a contract
- Sending you information about your end of contract obligations and how to renew your vehicle hire agreement — compliance with legal obligations
- Communicating with you about your quotes and agreements, including responding to your enquiries — performance of a contract, and/or legitimate interests
- Administering debt recovery where amounts are owed to us — performance of a contract, and/or legitimate interests
- Market research and statistical analysis, including analysing your use of our website — legitimate interests
- Sending marketing communications about our products and services — your consent (which you can withdraw at any time)
- Fulfilling our obligations owed to a regulator or authority including the FCA and HMRC — compliance with legal obligations
Our "legitimate interests" include operating our business in a customer-focused, efficient, and sustainable manner, in line with all applicable legal and regulatory requirements (including Consumer Duty).
Automated Decisions and Profiling
We do not make automated decisions about you that produce a legal effect or similarly significant effect. Credit decisions made by funders we introduce you to may involve automated processing — those decisions are made by the funder, and your rights in relation to them are explained by the funder.
How do we share this information?
We do not sell your information to third parties. We work with carefully chosen third-party suppliers who fulfil business activities for us. Where we share information, we share only what is necessary for the specific purpose:
- Finance providers and funders to whom we introduce you, for assessing and arranging finance — performance of a contract
- Credit reference agencies for credit-check and identity-verification purposes — performance of a contract and legitimate interests
- Dealer groups, supplying dealers, and delivery companies to arrange supply of your vehicle — performance of a contract
- Insurance and ancillary product providers where you choose to take a related product
- Third-party IT, marketing, and customer service providers who support the operation of our business
- Fraud prevention agencies and associations — compliance with legal obligations and legitimate interests
- Regulators and law enforcement, including the FCA, HMRC, and police — compliance with legal obligations
- Debt collection agencies where amounts are owed to us
Some of these third parties may also be a data controller in their own right in respect of your data. Where they are, we will provide their privacy information when we share data with them.
How long do we keep your information?
We will not hold your personal information for any longer than necessary. Typical retention periods we apply (subject to specific legal or regulatory requirements that may extend these):
- Active customer records, including quotes and agreements: for the duration of the agreement plus 6 years from end of agreement (to meet FCA and HMRC requirements)
- Failed or declined applications: typically 12 months
- Marketing consent records: until consent is withdrawn or 24 months of inactivity, whichever is earlier
- Call recordings: typically 6 months to 12 months
- Website analytics and cookie data: as set out in our Cookie Notice
- Complaint records: 6 years from final response
After these periods, your data is securely deleted or anonymised.
Cookies and online tracking
Our website uses cookies and similar technologies to provide essential functionality and to help us understand how visitors use our site. When you arrive on our site you will see a cookie banner explaining the categories of cookies we use:
- Strictly necessary cookies — required for the site to function (e.g. remembering your form progress on the application page). These do not require your consent.
- Analytics cookies — to understand how visitors use our site and to improve it. We only use these if you consent.
- Marketing cookies — to deliver more relevant advertising. We only use these if you consent.
You can change your cookie preferences at any time by clicking "Cookie settings" in the footer of any page.
Your rights under UK GDPR
You have the following rights in relation to the data we hold about you:
- To be informed — what we collect and why (this Privacy Policy)
- Of access — to obtain copies of the personal information we hold about you
- **To rect