How we collect data

• Website forms – enquiries and orders
• Email enquiries (and information submission)
• Telephone enquiries (and information submission)
• Postal enquiries (and information submission)
• Face to face meetings (including exchange of business cards and information submission)
• Details of quotations issued for the supply of services
• Third party referrals with consent

What data we collect

• Name
• Company
• Invoice address
• Postal address
• Email address
• Website address
• Landline telephone number
• Mobile telephone number
• Record of email or postal communications between us
• Details of quotations we issue or receive
• All necessary account transaction data for purchases, sales, credits and payments

We DO NOT collect any ‘special information’ such as sexuality, Religious or Political beliefs.

What we use data for

• Facilitating the provision of all 2cv shop services contracted for
• Facilitating the provision of any third party services contracted for via ourselves, such as passing name, address and telephone number to our suppler for the membership or dispatching orders.
• Providing renewal reminders for club members and other relevant services
• Meeting all other legal and contractual obligations
• To help us improve the service we provide to you

How we protect our data (data we hold about you, for which we are responsible)

• All our office computers require password at boot-up, and after a (modest) period of activity
• All our office computers run full anti-virus and firewall software that is kept up to date
• All personal data saved in Excel or similar will be encrypted with password protection
• Our accounts system requires a username and password before access can be gained
• Our servers are located at a major UK data centre
• Our customer related database records are password protected and run under SS
• Our customer related database records are only accessible from known IP addresses (i.e our IP addresses)

Disclosure of your personal information

We will not disclose your personal information to any third party other than for the following reasons:

• You have requested or given us permission to do so
• We are required to do so in order for a third party (Mehari Club Cassis) to provide goods or services that you are purchasing through ourselves (such as parts and memberships)
• It is necessary to do so in order to provide technical support in respect of services or goods we have supplied you with or are contracted to supply
• It is necessary to do so in order to receive technical support in respect of services we purchase (such as accounts software)
• We are required to do so by law
• In the event we transfer all of (or a defined part of) our rights and obligations under current contracts to a third party

Accessing the personal information we hold about you and deletion requests

You have the right to request access to any personal data we may hold about you in order to ascertain the accuracy of that information. You may also be able to request deletion of such data. To apply for a ‘subject access request’, an individual must:

• Make the request in writing (and signed) to:

The 2cv Shop Limited
Unit 22 Deverill Road Trading Estate,
Sutton Veny,
Warminster,
Wiltshire,
BA12 7BZ

• Supply appropriate information to help us locate the required information
• Where you ask us to disclose information we will retain the written request to do so even if you also request for data to be deleted. This is because we may need to prove that you requested the data disclosure.

You may challenge the data that we hold about you and, where appropriate, you may have the data corrected or request deletion.

We may reject subject access requests that are:

• Unreasonably repetitive
• Requires disproportionate technical effort (for example, developing a new system or fundamentally changing an existing practice that is not fundamentally flawed)
• Risks the privacy of others
• Would be extremely impractical (e.g. requests concerning information contained within backup systems, whereby deleting data may be impossible or impractical without also deleting the entire backup).

We will attempt to deliver the requested information to you within 4 weeks on receipt of the request.

We may reject a request to delete data if:

• We are required to retain data by law (such as accounting records)
• The data forms a key part of a past or current contract under which we still have a responsibility to deliver or a potential liability.

Data retention

Accounting records will be retained for a minimum period of seven years after the end of the tax year during which the final transaction for you occurs. Thereafter data may be deleted if, and only if, our accounts software facilitates deletion of old transactions without compromising the system as a whole. We will at all times retain information that we may have a legal obligation to be able to supply.

General correspondence (by email, and records of phone conversations) that are not relevant to any contract will usually be retained for five years.

General correspondence (by email, post and records of phone conversations) that are relevant to any contract will usually be retained for seven years after the end of the tax year during which the contract was terminated.