01 Who we are
JCT600 LTD (referred to as “we”, “us”, or “our”) is the data controller responsible for your personal data.
We process personal data in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and the Data (Use and Access) Act 2025, together with any other applicable privacy and electronic communications legislation.
This policy applies to JCT600 LTD, JCT600 (Rawdon) Ltd, JCT600 (South Yorkshire) Ltd, JCT600 Vehicle Leasing Solution. Company No. 413250 and JCT600 (Trade Parts) Ltd 06207069
02 Your rights
Under UK data protection law, you have rights including:
- The right to access your personal data
- The right to rectification (correct inaccurate data)
- The right to erasure (“right to be forgotten”)
- The right to restrict processing
- The right to data portability
- The right to object, particularly to marketing
- The right to withdraw consent at any time
You also have the right to complain to the Information Commissioner's Office if you are unhappy with how we use your data.
03 What personal data we collect
We may collect and process the following information:
Identity & Contact Data
- Name, title
- Address
- Email address
- Telephone numbers
- Date of birth
Vehicle & Transaction Data
- Vehicle details (registration, VIN, mileage, service history)
- Purchase and finance information
- Service and warranty records
Technical & Usage Data
- IP address
- Device and browser type
- Website usage data
- Cookie and tracking data (see Cookie Policy)
This may include information such as the pages you visit, the time and duration of your visit, how you navigate our website, and the website you visited before accessing ours.
Communication Data
- Call recordings
- Emails and correspondence
- Live chat records
Call recordings
Telephone calls are recorded for the purposes of:
- monitoring and improving customer service
- colleague training
- resolving complaints and disputes
- ensuring compliance with legal and regulatory obligations
Call recordings are processed on the basis of our legitimate interests in maintaining service quality and protecting our business and customers.
Recordings are only accessed where necessary and are retained for a limited period in line with our retention policy.
Location Data
- GPS/location data (where permitted)
CCTV
- CCTV images captured on our premises for security, safety and crime prevention purposes, processed on the basis of our legitimate interests.
Business Contact Data
- Job title, company name, and business contact details
04 How we use your personal data (and lawful basis)
We only use your personal data where permitted by law:
To perform a contract
- Process vehicle purchases, servicing, and repairs
- Arrange finance agreements
- Manage warranties and aftersales services
For our legitimate interests
- We use your data where necessary for our business, including:
- Responding to enquiries and bookings
- Improving our services and customer experience
- Sending service reminders (e.g. MOT, servicing)
- Internal administration and record keeping
- Ensuring network and information security
- CCTV monitoring for safety and crime prevention
- Handling complaints and legal claims
This includes monitoring communications (such as call recordings) for training, quality and complaint resolution purposes.
You have the right to object to this processing. We ensure that our legitimate interests do not override your rights and freedoms.
Marketing (Legitimate Interests / Consent)
We may send you marketing communications:
- Where you have consented, OR
- Under the “soft opt-in” (where you have purchased or enquired about similar products/services)
This may include:
- Service and MOT reminders
- Offers and promotions
- Events and product updates
We may use your data to analyse preferences and tailor marketing (profiling). This does not involve automated decision-making that produces legal or similarly significant effects.
You can object to this at any time.
Legal obligations
- We process your data where required to comply with the law, including:
- Vehicle registration with DVLA
- Financial and tax obligations (e.g. HMRC)
- Regulatory compliance (e.g. FCA requirements)
Vital interests
- In rare cases, we may contact you regarding urgent safety issues such as vehicle recalls.
05 Sharing your data
We only share your personal data where necessary, and always in accordance with data protection law.
In limited circumstances, we may share communications (including call recordings, emails and other correspondence) with relevant third parties where necessary to investigate or resolve customer complaints, support quality assurance and training, or meet contractual or regulatory requirements. This is done on the basis of our legitimate interests in maintaining service quality, resolving issues effectively, and meeting our business and legal obligations.
We ensure that any third parties we work with respect the security of your personal data and treat it in line with the law.
Who we share your data with
Manufacturer partners
We may share your information with vehicle manufacturers and their authorised networks to:
- Register your vehicle and manage warranties
- Provide aftersales support and product updates
- Carry out customer satisfaction surveys
They may contact you directly where permitted.
Finance providers
If you request or enter into a finance agreement, we will share your personal data with selected finance providers to:
- Assess your eligibility for finance
- Put finance arrangements in place
- Manage your finance agreement
These organisations will act as independent data controllers and will provide you with their own privacy information.
Service and product providers
Where you request additional products or services (such as warranties, insurance products, or service plans), we will share your data with relevant providers to fulfil your request.
Service providers (data processors)
We use trusted third parties to support our business operations, including:
- IT systems and software providers
- Website hosting and data storage providers
- Marketing and communications providers
- Payment processing providers
- Compliance and regulatory support services
These organisations process data on our behalf and are contractually required to:
- Only act on our instructions
- Keep your data secure
- Not use your data for their own purposes
Professional advisers
We may share your data with professional advisers such as:
- Lawyers
- Insurers
- Accountants
Where necessary for legal, insurance, or financial purposes.
Regulators and authorities
We may disclose your personal data where required by law or regulation, including to:
- HM Revenue & Customs (HMRC)
- The Driver and Vehicle Licensing Agency (DVLA)
- Financial regulators
- Law enforcement agencies
- Fraud prevention agencies
- Credit reference agencies
Business transfers
If we sell, transfer, or merge parts of our business or assets, your personal data may be shared with the new owners. They will continue to use your data in accordance with this privacy policy.
How we protect your data when sharing
Whenever we share your personal data:
- We only share what is necessary for the purpose
- We ensure appropriate contracts and safeguards are in place
- We require third parties to comply with data protection law
More information
If you would like more detail about who we share your data with, you can contact us using the details in this policy.
06 International transfers
Some of our suppliers may process data outside the UK.
Where this happens, we ensure appropriate safeguards are in place, such as:
- UK adequacy regulations, or
- Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTA)
07 How long we keep your data
We retain personal data only as long as necessary:
- Customer records: up to 10 years after last interaction (for legal claims)
- Enquiries (no sale): up to 12 months
- CCTV: typically 30–90 days unless required for investigation
- Call recordings: typically up to 6–12 months
- Recruitment data: up to 6–12 months unless retained with consent
Retention may be extended where required by law or for legal claims
08 AI and automated analysis
We may use artificial intelligence (“AI”) and automated analytical tools to support and improve our business operations, customer service, communications, and recruitment processes.
This may include analysing information from:
- customer relationship management (CRM) systems;
- call recordings;
- emails and communications;
- Microsoft Teams and other business collaboration platforms;
- customer feedback and interaction data.
These tools may be used to:
- identify trends and areas for service improvement;
- support staff training and quality assurance;
- improve customer experience and operational efficiency;
- assist with complaint resolution and customer support;
- generate insights, summaries, recommendations or suggested actions;
- support recruitment and candidate assessment processes.
AI tools are used to support human decision-making and operational processes. We do not make solely automated decisions that produce legal or similarly significant effects on individuals without meaningful human involvement.
Where required, we undertake appropriate privacy and data protection assessments in relation to the use of AI technologies and implement safeguards designed to protect personal data and individual rights.
09 Security of data
We use appropriate technical and organisational measures to protect your data, including:
- Secure systems and access controls
- Encryption where appropriate
- Colleague training and data protection procedures
10 Third-party websites
Our website may contain links to third-party sites.
We are not responsible for their privacy practices.
11 Children's data
Our services are not intended for children under 16.
We do not knowingly collect data from children.
12 Changes to this policy
We may update this policy from time to time.
The latest version will always be available on our website.
13 Contact, complaints and Subject Access Requests
We have appointed a Head of Data to oversee compliance with this privacy policy. To exercise any of your rights as a Data Subject please contact us using the details below and we will, in the exception of rare cases, respond to you within 30 days:
To submit a Subject Access Request please visit www.jct600.co.uk/sar
Post: Head of Data, JCT600 Ltd, Tordoff House, Apperley Bridge, West Yorkshire, BD10 0PQ
Should you wish to amend your data preferences and the way you receive communications from ourselves please visit www.jct600.co.uk/datapreferences
If you have a concern or complaint about how we have collected, used or handled your personal data, please contact our Head of Data using the details here - www.jct600.co.uk/datacomplaint. We have a formal process for handling data protection complaints and will acknowledge your complaint within 30 days and investigate and respond without undue delay. We aim to resolve concerns directly wherever possible.
Having contacted us if you are still unhappy, you have the right to lodge a complaint with the data protection regulator
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Phone: 0303 1231113
Email: icocasework@ico.org.uk