Privacy Statement

This is the Privacy Statement of Spirit Motor Group (“SMG”). In this statement we use the terms “we,” “our” and “us” to refer to SMG.

The purpose of this Privacy Statement is to outline our position concerning the collection, use, retention, disclosure, and transfer of Personal Data which is gathered and processed by us. This Privacy Statement also sets out our information management practices.

SMG respects your right to privacy and is committed to protecting your personal data. This Privacy Statement will inform you as to how we look after your personal data and tell you about your rights and how the law protects you.

It is important that you read this Privacy Statement together with any other privacy statements or fair processing notice’s we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we use your data. This Privacy Statement supplements other notices and is not intended to override them.

1.What is Personal Data?

Personal Data is any information relating to a living individual that allows for the identification of that individual. Personal Data can include a name, address, contact details, an identification number, IP address, CCTV footage, accesses cards/co-tags, fobs, audio-visual or audio recordings of a person, details about an individual's location or any other detail(s) specific to that individual such in certain cases special category data such as (Biometric).

2.Who we are and how to contact us?

SMG is made up of different legal entities, as follows; Spirit Motor Group Ltd, Spirit Volvo, Spirit Jaguar Land Rover, Spirit Burton, and other companies within the brand, Spirit Skoda Ltd, Spirit Foster, Spirit Premium, Spirit Seat, Spirit Ford Ltd, Spirit Lillis O’Donnell’s, Spirit Mobility and Spirit Cupra. This privacy statement is issued on behalf of SMG so where we mention “SMG”, “us”, “we” or “our” in this privacy policy, we are referring to the relevant company in SMG responsible for processing your data.

We have appointed a Data Compliance Officer [“DCO”] who is responsible for overseeing questions in relation to this privacy statement. If you have any questions about this privacy statement, including any request to exercise your legal right please contact our data compliance manager using the details set out below;

Data Compliance Officer, OHM Group, Clonlara Rd, Baldonnell Business Park, Dublin, D22 or emailing us at dco@ohm.ie

3.Changes to this Privacy Statement and your duty to inform us of changes

We keep our privacy statement under regular review. It is important that the personal data that we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with is.

4.Third Party Links

This website may include links to third party websites, plugins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy statement of every website you visit.

5.Categories of personal data and how we use it.

This section of the Privacy Statement sets out the type of Personal Data collected by SMG, the purposes for which such Personal Data is collected and processed and the lawful justifications for such processing in the context of the SMG Websites.

We also collect, use, and share aggregate data such as statistical or demographic data. Aggregate data is information gathered and expressed in a summary form for purposes such as statistical or demographic analysis. Aggregate data may be derived from your personal data but is not data that directly or indirectly reveals your identity. For example, we may aggregate your usage data of our website to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregate data with your personal data so that it can directly or indirectly

identify you, we treat the combined data as personal data which will be used in accordance with this data protection statement.

It is not our intention to collect any special categories of personal data about you, this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. Nor do we collect any information about criminal convictions and offences. However, if it is necessary to collect special categories of personal information and/or criminal conviction information, we will only do so with your explicit consent or where we have another lawful basis to do so and we will explain the purpose for which the information will be used at the point when we collect it.

6.The data we collect about you.

Personal data, means any information about an individual from which that person can be identified. It does not include data where the identify has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we will group

together as follows;

• Identity data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender, social media profile;
• Contact data includes billing address, delivery address, email address, telephone number;
• Financial data includes bank account and payment card details;
• Transactional data includes details about payments to and from you and other details of products and services you have purchased from us;
• Technical data includes IP addresses, your login data, time zone and location, browser and plugin type or versions, device type, operating systems and platforms and other technology devices which you use to access our websites;
• Profile data includes purchases or orders made by you, your interest, social media preferences, feedback, and survey responses;
• Usage data includes information about how you use our website, products and services and our social media sites;
• Marketing communications data includes your preferences in receiving marketing from us and other third parties and your communication preferences.

7.How we obtain your information?

We use different methods to collect data from and about you including through:

Direct interactions

You may give us your Identity and Contact Data by filling in forms or by corresponding with us by email or otherwise. This includes personal data you provide when you:

• request our services; (booking a test drive or vehicle service)
• subscribe to our service or publications;
• request marketing to be sent to you;
• provide feedback; or completing a survey with a retailer;
• apply for a job with the Business;
• entering competitions;
• attendance at brand events;
• cctv;
• manage your personal data preference

Automated technologies or interactions

As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this personal data by using cookies, server logs, and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. All cookies apart from strictly necessary cookies will require your consent.

Third parties or publicly available sources

We may receive personal data about you from various third parties such as;

• the Manufacturer of your vehicle
• advertising networks which we utilise and to which you might engage with
• interactions with Social Media sites

Vehicle tracking/telematics

• we operate vehicle telematics on our vehicles via the Spirit Mobility Service and when we may loan a vehicle to a service customer. The vehicle is tracked via GPS and driver performance maybe logged.

8.What Personal Data does SMG collect and use online?

We collect various types of Personal Data when a person uses our website or social media platforms. The following are examples of Personal Data collected by SMG:

• Our website uses cookies, web beacons, device identifiers, social plugins, tracking pixels, etc. “Cookies” are small pieces of information stored by your internet browser that collect data such as your browser type, your operating system, web pages visited, time of visits, content viewed, advertisements viewed, and other click stream data. We use cookies to help us tailor our websites to your needs, to deliver a better, more personalised service and to remember certain choices you have made so you do not have to re-enter them. Cookies also enable us to identify traffic to our website including pages visited, visitor numbers and traffic paths taken. We may record which users opened and clicked any embedded links in communications sent by SMG to measure a campaigns effectiveness. We do not deploy un-necessary cookies, such as analytics, marketing, targeting, or profiling cookies without your consent. Please see our Cookie Policy for further details.
• We may collect your personal data from Contact Forms, such as booking a test drive, or vehicle service; this enables us to deal with your request in a timely manner.
• Competitions: When a person enters a competition, we may collect and use the entrant’s name and contact details (including postal address, email address, telephone number) in connection with the competition (including mobile competitions). Where we operate competitions in conjunction with a third-party commercial partner, subject to the competition rules and notices, that partner may collect and use the data.
• Social Media Pages: Content such as messages and photographs, which are posted on social media pages on which SMG has a presence may be made publicly available and may be used in connection with the operation and promotion of our social media pages, services, and this website. Data such as the name of your internet service provider, the website you visited us from, the parts of our site that you have visited, the date and duration of your visit, and information from the device (e.g., device type, operating system, screen resolution, language, country location, and web browser type) used during your visit. We may process this usage Data to facilitate access to our website (e.g., to adjust our website to the devices that are used)
• Online Advertising: We may use advertising networks to help present advertisements or other content on our website and on other websites or social media platforms that display SMG advertisements. By using SMG online services, we may use information gathered from you, and information gathered from third parties, to provide our users with certain tailored advertising offerings through our website, social media sites and other services. SMG gathers web viewing personal data from users across its various services, with their consent and which may then be used by SMG and its service providers to deliver advertising to groups of users based on the preferences or interests inferred from the data collected and processed by SMG (or a third-party service provider’s) technology. For example, SMG will only use cookies, web beacons, social plugins, tracking pixels and similar technologies to collect information from a mobile or other device with the consent of the user.

9.The purpose and legal basis for processing your information.

We will only use your personal data where the law allows us to. Most commonly we will use data in the following situations;

a)To enter into and perform a contract with you.

We may process your information in order to enter into a contract with you or to provide you with a service which you have requested from us. For example, we need to process your personal information in order to enable you to purchase a vehicle or to provide you with a brochure or information about a product or service where you have requested it.

b)To comply with our legal obligations

We are required to process your personal information to comply with certain legal and regulatory obligations to which we are subject. For example, we are required to obtain certain business records in accordance with company and revenue law which may include your personal information.

We are also required under European Union Law to share information regarding the
fuel consumption of your vehicle for the purpose of monitoring CO2 emissions.

c)For our legitimate business interests

We may use your personal information for the purposes of carrying out activities that are in our legitimate interests (or those of a third party). Where we process your information for our legitimate interests, we ensure that there is a fair balance between our legitimate interest and your fundamental rights and freedoms.

If you are a customer of Spirit Motor Group, we may use your information to send you communications on products and service that may interest you and that you would reasonably expect to receive, you can at any stage easily opt out of these communications by contacting us on dco@ohm.ie

For further information on the various scenarios of how we use data under Legitimate Interest please see the below table.

d)With your consent

We will request your consent for the use of all cookies on our websites outside of strictly necessary. You can withdraw this consent at any time by clicking “cookie settings” at the bottom of our webpage, see our cookie policy for further information Site Pages | Spirit Motor Group

Generally, we do not rely on consent as a legal basis for processing of personal data although we will request consent before sending you third party direct marketing communications, passing on your personal information to a third party for marketing purposes or before sending digital marketing to you if you are not an existing customer. You can revoke your consent at any time by contacting dco@ohm.ie or by using the un-subscribe option in the marketing communication.

e)To protect your vital interests

We will in certain circumstances use your personal information to protect your vital interests, for example we may contact you in the event of a recall or safety issue with your vehicle.

We have set out below, in table format a description of all the ways we plan to use your personal

data, and which legal basis we rely on to do so. We have also identified our legitimate interest where appropriate.

Note that we may process your personal data on lawful ground depending on specific purpose

for which we are using your data:

10. Who do we share information with?

Third Party Service Providers: SMG discloses Personal Data to third parties in certain instances. For example, SMG uses third party service providers for the processing of Personal Data for a number of purposes, including, security service providers, consultant advisors, I.T service providers, printers, debt collection agencies, valuers, marketing companies who carry out marketing campaigns, market research or customer satisfaction surveys on our behalf and providers of security and administrative services. We share your information with organisations who provide services in order for you to avail of roadside assistance. These service providers are subject to a contractual obligation to only process Personal Data obtained from SMG for purposes for which it was obtained and in accordance with SMG instructions.

SMG will not provide your Personal Data to third parties who may contact you for direct marketing or promotional purposes unless you have consented to SMG disclosing your Personal Data to such third parties for that purpose.

In certain circumstances SMG will disclose personal data to other external third parties such as its professional advisors as necessary in the context of the performance of their services. Such recipients may include external legal advisors, auditors, actuaries, pension and tax advisors, pension administrators and other professional advisors.

Disclosure of such data will take place for a variety of reasons including in order to ensure that SMG meets its tax and other statutory obligations.

SMG may also disclose personal data to its insurance providers in connection, with legal claims and

prospective legal claims or proceedings.

OHM Group and other OHM Group entities: We are part of the OHM Group, and we may pass your information on to OHM Group entities, for the purpose of administrative efficiencies, for fulfillment of a contract and for storing your data in central IT Systems. https://www.ohm.ie/brands/ We may also convert your information, such as information you provide during a customer satisfaction survey, into statistical or aggregate data in such a way as to ensure that you are not identified and are indefinable from it. We may pass this information on to OHM Group and other OHM Group entities, for analytical and statistical purposes.

Website Partner: We partner with GForces who support this website www.spiritmotorgrop.ieand the collection of visitor’s data and customer preferences. Please note GForces will retain the I.P address of visitors to our website as a Controller of the data for the purposes of security measures. For further information on GForces please see their website https://www.gforces.co.uk/privacy-policy/

The Chat service on our website is provided by Gubagoo, the data that is collected on this service is processed

for the purpose of supporting customer requests via live chat.

Insurance Companies, Motor Accessors: We may pass your information to insurance companies and/or any motor assessor appointed by you or an insurance company, where any portion of the cost of the repairs or work being carried out by us on your vehicle is being covered under an insurance policy.

We may disclose personal data to our insurance providers in connection, with legal claims and prospective legal claims or proceedings. We may also pass on your personal details onto insurance companies for the purpose of providing unaccompanied test drives and courtesy cars/loan cars and rental cars.

We are required to disclose personal data for the registration of your vehicle

Vehicle Registration: When you purchase a new motor vehicle or a used vehicle not previously registered in the State from us, we will use your personal information to register the motor vehicle with the Revenue Commissioners to pay any VRT and VAT on the vehicle or, where applicable to apply for a VRT, VAT and/or motor tax exemption on your behalf, as required by law. Where you purchase a used previously registered vehicle, we will use your personal information to transfer the ownership of the vehicle to you as required by law.

Manufacturer of Your Vehicle & Their Distributor: We may pass your personal information on to the

manufacturer of the vehicle and/or their appointed distributor in Ireland for the purposes of warranty, recall and service issues and customer satisfaction surveys. If you consent, we will also pass your information to the manufacturer and/or the distributor of the vehicle or their appointed distributor in Ireland for marketing activities. You can withdraw this consent at any time from the manufacturer. The manufacturer may contact you separately regarding their use of your information.

Fuel Consumption Data: We are obliged under European union law to collect certain data from your
vehicle regarding CO2 emissions. We will collect this data and the VIN of your vehicle and transfer it to the
manufacture of your vehicle unless you tell us not to. The Manufacturer is obliged under EU law to report
this data to the European Commission for the purpose of monitoring CO2 emissions from vehicles. We will
delete this data once it is transferred to the Manufacturer.

Finance companies, leasing companies, brokers, and other third-party providers: Where you have asked for a quote or to arrange any third-party products such as finance, leasing, or any other third-party service, we may pass your personal information to that third party in order to obtain a quotation on your behalf.

If you are applying for Finance though our online financial application facility via our 3rd Party Provider Codeweavers your consent maybe required to fulfil your request.You can find further information on the 3^rd parties we share data with by following this link www.spiritmotorgroup.ie/data-partners/

Potential Sale or Merger: If we sell any part of our business and/or integrate it with another organisation, your details may be disclosed to our advisers and to prospective purchasers or joint venture partners and their advisers. If this occurs, the new owners of the business will only be permitted to use your information in the same or similar way as set out in this data protection statement.

Garda Síochána, Government or Quasi-Government Bodies, Courts and Tribunals: We may share your personal information with these organisations and bodies, where required to do so by law.

11. Storage Periods

The period for which we will keep your personal information will depend on the service you have requested from us. The retention period may be longer than the period for which we are providing services to you where, for example, we have a legitimate interest in retaining such information that is not outweighed by your fundamental rights and freedoms, or where we have statutory or regulatory obligations to retain personal information for a longer period, or where we may need to retain the information in the event of a legal claim.

We endeavor to ensure that Personal Data is retained for an appropriate period and no longer than necessary. Retention of data is detailed in our Data Retention Policy.

12. Transfers Outside the European Economic Area

Where the laws of such countries do not afford an equivalent level of protection of personal information as the laws of Ireland, we will take specific steps in accordance with data protection law to protect your personal information.

We will use one of these safeguards:

• Transfer to a non-EEA country with privacy laws that give the same protection as the EEA.
• Put in place a contract (in a form that is approved by the European Commission) with the recipient of the personal information that means they must protect it to the same standards as the EEA.
• Transfers to organisations that are part of an EU Framework that sets privacy standards for data sent between countries. These frameworks make sure those standards are similar to what is used within the EEA.

13. Marketing Communications

If you are not a customer of SMG and you provide consent for marketing communications SMG may use your name, address, email address, postal address and/or telephone number for marketing communications. SMG will not contact users by email, phone, or SMS for direct marketing purposes unless the users have consented to be contacted for such purposes as required by data protection laws. Where you are a customer of SMG, a legitimate interest assessment will be conducted to ensure there is an appropriate balance between our interests and your rights and freedoms , the right to object will be presented in all marketing communications.

Customers can opt-out of receiving direct marketing communications from SMG by following the unsubscribe link in the relevant marketing message.

If a customer signs up to receive marketing communications from SMG Partners and provide their contact details to SMG for such purposes, we may provide your name and contact details (e.g., email or mobile number) to SMG commercial partners (such as manufacturers or distributors that are partnering with SMG) so that they can send you marketing communications. SMG will not provide such information to third parties for direct marketing purposes unless the users have consented to SMG giving their Personal Data to third parties for that purpose.

If a user opts-out from receiving communications from our partners, SMG will no longer share that user’s contact details with our partners. However, users will still need to directly opt-out from communications from the partners to whom we have already given their information.

SMG uses third party service providers to help deliver its marketing communications. Those third-party data processors are subject to contractual and legal restrictions in relation to any unauthorised use of your information.

14. How we use automated processing

We may analyse your personal information by automated means for the purposes of market research, analysing our customer database and for our marketing activities. You have a right to object to this processing at anytime by emailing dco@ohm.ie

15. Processing for Security Purposes

We operate closed circuit television cameras ("CCTV") throughout our premises covering buildings, internal spaces, car parks, roads, pathways, and grounds. Our CCTV system is implemented in a proportionate manner as necessary to protect our property against theft or pilferage and for the security of employees, customers, and visitors to SMG premises (to protect their vital interests). Whilst CCTV footage is monitored by our, senior management, security staff or contractors, access to recorded footage is strictly limited to authorised personnel. Footage is retained for 60 days, except where incidents or accidents have been identified in which case such footage is retained specifically in the context of an investigation of that issue. CCTV footage may be used in the context of disciplinary proceedings involving SMG employees and to detect, establish and/or defend legal proceedings (to protect the vital interests of our, staff and affected individuals). CCTV footage is not disclosed to third parties except where disclosure is required by law (such as for the purpose of preventing, detecting, or investigating alleged offences) and in such instance’s disclosure is based on a valid request. Signage indicating that CCTV is in use is displayed throughout our premises.

16. If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with a test drive). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

17. Information Security

In accordance with applicable laws, we aim to ensure that all Personal Data controlled by us is held securely using appropriate security measures including the following:

• Physical measures;
• IT security systems;
• Restricted access to Personal Data subject to approvals;
• Time limits on retention of personal data;
• Provision of targeted data protection training to employees, contractors and other staff who have access to and process Personal Data;
• Password restrictions on access to Personal Data; and technical measures including:
  • Encryption on all laptops/portable devices; and
  • Logging mechanisms to record certain access to Personal Data and alteration and other processing of Personal Data.
  • Encrypted e-mail services

In the event of a personal data breach, we will comply with applicable reporting and notification obligations under data protection law. SMG has in place a Breach Notification Policy.

18. Your Rights

In certain circumstances, you have the following rights under data protection law in relation to your personal data:

A right to access Personal Data held by SMG.

• Any individual has a right to make an access request, in writing, under data protection law for a copy of their Personal Data held by us. We may ask for further identification details to confirm your identity before the relevant information is provided.
• It should be noted that there may be specific exemptions relating to accessing Personal Data. If we utilise any of the exemptions, we will provide you with details and our justification for their use.

Other data protection rights

• Rectification of inaccurate personal data;
• Erasure of personal data (also known as the "right to be forgotten");
• Restriction of processing of persona data;
• Right to data portability;
• Right to object to processing of personal data.

However, under data protection law, these rights are available only in certain circumstances. If you wish to exercise any of your data protection rights, please contact dco@ohm.ie or by us using the contact details below.

We will endeavor to respond to your request within a month. If we are unable to deal with your request within a month, we may extend this period by a further period of two months, and we will explain why. Please provide as much detail as possible to enable us to respond to your request and to locate relevant personal data about you.

By Post:DCO, OHM Group, Clonlara Rd, Baldonnell Business Park, Dublin, D22 WIH9

By Email: dco@ohm.ie

By Phone: + 353 (0) 1 4034100

You also have the right to lodge a complaint to the Office of the Data Protection Commission. For further information please see www.dataprotection.ie

19. Updates

This policy [“version 5”] was updated and deemed effective on the 31st of March 2022. We will update this data protection statement from time to time. Any updates will be made available on our websites at Site Pages | Spirit Motor Group and, we would ask that you check regularly.