Throughout our website we may link to other websites owned and operated by certain trusted third parties. These other third-party websites may also gather information about you in accordance with their own separate privacy policies. For privacy information relating to these other third-party websites, please consult their privacy policies as appropriate.
We know that there’s a lot of information here, but we want you to be fully informed about your rights, and how ARRIVAL uses your data.
It’s likely that we’ll need to update this Privacy Notice from time to time. We’ll notify you of any significant changes via email, but you’re welcome to come back and check it whenever you wish.
While you are using the ARRIVAL website, ARRIVAL is the data controller.
- Explaining the legal basis we rely on
- When do we collect your personal data?
- What sort of personal data do we collect?
- How and why do we use your personal data?
- Personalised direct marketing
- Cookies and other tracking technologies
- How we protect your personal data
- How long will we keep your personal data?
- Who do we share your personal data with?
- Where your personal data may be processed
- What are your rights over your personal data?
- How can you stop the use of your personal data for direct marketing?
- Contacting the Regulator
- If you live outside the UK
- Any questions?
Explaining the legal basis we rely on
We collect, use and are responsible for certain personal information about you. When we do so we are regulated under the General Data Protection Regulation which applies across the European Union and the United Kingdom.
The legal bases we may rely on include:
- consent: where you have given us clear consent for us to process your personal information for a specific purpose
- contract: where our use of your personal information is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
- legal obligation: where our use of your personal information is necessary for us to comply with the law (not including contractual obligations)
- public task: where our use of your personal information is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law
- legitimate interests: where our use of your personal information is necessary for our legitimate interests or the legitimate interests of a third party (unless there is a good reason to protect your personal information, which overrides our legitimate interests)
When do we collect your personal data?
- When you access our website
- When you register with us
- When you submit an application for a job role to us or through a third party
- When we perform background checks on you following to a job offer with us with third parties including former employers, credit reference agencies or other background check agencies
- When you contact us by any means
- When you engage with us on social media or post material
- When you choose to complete any surveys on our website
- When you provide information and interact with any of the ARRIVAL career pages
- When you attend our sites which usually have CCTV systems operated for the safety of our staff and premises. These systems may record your image during your visit.
We collect this personal information from you either directly, such as when you register with us, contact us directly or indirectly, such as your browsing activity while on our website (see ‘Cookies’ below).
What sort of personal data we might collect?
- Your name and contact details (this may be company or personal contact information depending on your interaction with us)
- Details of any feedback you give us by phone, email, post or via social media
- Your social media username, if you interact with us through those channels, to help us respond to your comments, questions or feedback
- CCTV footage if you attend our premises
- E-commerce payment details where purchasing items from our website
- Your address and relevant contact details to enable payment and delivery of goods and services
- In addition, if you should be undertaking the recruitment process with us, we may also collect:
- Recruitment information (including copies of right to work documentation, references, interview notes and opinions taken during and following interviews and other information included in a CV or cover letter or as part of the application process)
- Employment records (including job titles, work history, working hours, training records and professional memberships)
- Any test results of any tests, psychometric or other, included in the recruitment process
- Date of birth
- National Insurance number
- Compensation history
- Information necessary to complete pre-employment security checks
- Details of your professional qualifications and education history
- Contact details of referees
We may also collect, store and use the following "special categories" of more sensitive personal information:
- Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions
- Information about your health, including any medical condition, health and sickness records
- Biometric data
- Information about criminal convictions and offences
How and why we use your personal data?
We want to give you the best possible customer and employee experience. One way to achieve that is to get the richest picture we can of who you are by combining the data we have about you.
We then use this data to offer you products and services that are most likely to interest you as a possible customer and also for entering into a potential contractual relationship with you.
The data privacy law allows this as part of our legitimate interest in understanding our customers and providing the highest levels of service.
Of course, if you wish to change how we use your data, you’ll find details in the ‘What are my rights?’ section below.
Remember, if you choose not to share your personal data with us, or refuse certain contact permissions, we might not be able to provide some services you’ve asked for.
Here’s how we’ll use your personal data and why:
- To send you communications required by law or which are necessary to inform you about our changes to the services we provide you. For example, updates to this Privacy Notice, product recall notices, and legally required information relating to your orders. These service messages will not include any promotional content and do not require prior consent when sent by email or text message. If we do not use your personal data for these purposes, we would be unable to comply with our legal obligations.
- With your consent, we will use your personal data and preferences to keep you informed by email, web, text and telephone about relevant products and services including events, competitions and so on. This is only applicable within the UK. Of course, you are free to opt out of hearing from us by any of these channels at any time
- To build a personalized experience for you in your interactions with us both online and offline and to inform our business decisions. To do this we may combine data captured from across ARRIVAL, third parties and data from publicly-available lists as we have described in the section `What Sort of Personal Data do we collect?`. We’ll do this on the basis of our legitimate business interest.
- To respond to your queries and complaints. Handling the information you sent enables us to respond. We may also keep a record of these to inform any future communication with us and to demonstrate how we communicated with you throughout. We do this on the basis of our contractual obligations to you, our legal obligations and our legitimate interests in providing you with the best service and understanding how we can improve our service based on your experience.
- To develop, test and improve the systems, services and products we provide to you. We’ll do this on the basis of our legitimate business interests.
- To comply with our contractual or legal obligations to share data with law enforcement.
- To send you survey and feedback requests to help improve our services. These messages will not include any promotional content and do not require prior consent when sent by email or text message. We have a legitimate interest to do so as this helps make our products or services more relevant to you.
- To protect our employees, premises and assets from crime, we operate CCTV systems in our sites which record images for security. We do this on the basis of our legitimate business interests.
- To protect your interests (or someone else's interests) and you are not capable of giving your consent. For example, if you became seriously unwell or had an accident in our premises, we may need to provide a hospital with medical information we are aware of.
- To make a decision about your recruitment or appointment, determining the terms on which you work for us, assessing qualifications for a particular job or task and ascertaining your fitness to carry out the role.
- To check if you are legally entitled to work in the UK.
- To comply with health and safety obligations, including where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards.
- To consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview if you should have a disability.
- To ensure meaningful equal opportunity monitoring and reporting. We may use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation solely for this purpose.
- To deal with and defend any legal disputes involving you.
Personalised direct marketing
We want to send you information about products and services that are most relevant to your interests at particular times.
We will only ask whether you would like us to send you marketing messages when you tick the relevant boxes when you fill in a form or survey indicating your interest in receiving this information.
To help us form a better, overall understanding of you as a customer, we combine the data that we collect directly from you with data that we obtain from third parties to whom you have given your consent to pass that data onto us.
How we protect your personal data
We know how much data security matters to you. With this in mind we will treat your data with the utmost care and take all appropriate steps to protect it.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know.
They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
How long will we keep your personal data?
Whenever we collect or process your personal data, we’ll only keep it for as long as is necessary for the purpose for which it was collected.
If you have unsuccessfully applied for a position with us, we will only retain your personal information for 6 months following an unsuccessful application. This will include retaining information so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way.
At the end of that retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning.
Where your personal data may be processed
Sometimes we will need to share your personal data with third parties and suppliers outside the European Economic Area (EEA). The EEA includes all EU Member countries as well as Iceland, Liechtenstein and Norway. We may transfer personal data that we collect from you to third-party data processors in countries that are outside the EEA.
If we do this, we have procedures in place to ensure your data receives the same protection as if it were being processed inside the EEA. For example, our contracts with third parties stipulate the standards they must follow at all times. If you wish for more information about these contracts, please contact our Legal Department.
Any transfer of your personal data will follow applicable laws and we will treat the information under the guiding principles of this Privacy Notice.
What are your rights over your personal data?
You have the right to request:
- Access to the personal data we hold about you, free of charge in most cases.
- The correction of your personal data when incorrect, out of date or incomplete.
- The deletion of the data we hold about you, in specific circumstances; for example, when you withdraw consent or object, and we have no legitimate overriding interest, or once the purpose for which we hold the data has come to an end.
- A computer file in a common format (CSV or similar) containing the personal data that you have previously provided to us, and the right to have your information transferred to another entity where this is technically possible.
- Restriction of the use of your personal data, in specific circumstances, generally while we are deciding on an objection you have made.
- That we stop processing your personal data, in specific circumstances; for example, when you have withdrawn consent, or object for reasons related to your individual circumstances.
- That we stop using your personal data for direct marketing (either through specific channels, or all channels).
- That we stop any consent-based processing of your personal data after you withdraw that consent.
- Object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you.
You can contact us to request to exercise these rights at any time by sending an email to [email protected]. If we choose not to action your request, we will explain the reasons for our refusal.
Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.
In cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data, such as administration of an extended warranty.
You have the right to stop the use of your personal data for direct marketing activity through all channels, or selected channels. We must always comply with your request.
To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice.
If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.
How can you stop the use of your personal data for direct marketing?
There are several ways you can stop direct marketing communications from us:
- Click the ‘unsubscribe’ link in any email communications that we send you. We will then stop any further emails.
- Write to the Legal team at ARRIVAL Ltd, Beaumont House, Avonmore Road, London W14 8TS.
- Send an email to [email protected].
Please note that you may continue to receive communications for a short period after changing your preferences while our systems are fully updated.
Contacting the Regulator
If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.
You can contact them by calling 0303 123 1113.
Or you can go online to www.ico.org.uk/concerns (opens in a new window; please note we can’t be responsible for the content of external websites).
If you are based outside the UK, you have the right to lodge your complaint with the relevant data protection regulator in your country of residence. Details can be found in the section below.
If you live outside the UK
Sometimes we will need to transfer your personal data between countries to enable us to supply the goods or services you have requested. In the ordinary course of business, we may transfer your personal data to third parties located in the UK to your country of residence. You hereby expressly consent to such overseas use, transferring and disclosure of your personal data outside of your country of residence for such purposes.
If you have any questions that haven’t been covered, please contact our Legal team who will be pleased to help you:
- Email us at [email protected]
- Or write to us at For the Attention Of the Legal Team, ARRIVAL Ltd, Beaumont House, Avonmore Road, London W14 8TS.
This Policy was last updated on 16 June 2020.