Privacy Notice

About this notice and who we are

This Privacy Notice explains how Mobility Connect Ltd collects, uses, shares, stores and protects personal information about customers and prospective customers. It is intended to provide the transparency required by UK data protection law and should be read alongside any specific privacy information provided at the point information is collected.

Our data protection framework includes the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and amendments made by the Data (Use and Access) Act 2025, together with other applicable legal and regulatory requirements.

For the processing described in this notice, Mobility Connect Ltd will normally act as the data controller.

We have not appointed a separate Data Protection Officer. Privacy and data protection matters are handled through the contact details above.

Who this notice applies to

This notice applies to customers and prospective customers, including people who:

• make an enquiry by telephone, website, social media, WhatsApp Business or another contact channel;
• speak with our sales or customer service teams;
• purchase a mobility product or service from us;
• ask us to introduce or assist them with an application to a finance provider;
• use our aftercare, servicing, warranty or complaint processes;
• ask us to arrange insurance where this is available;
• act as a parent, guardian, carer or authorised representative for a customer; or
• visit our website or interact with our digital advertising.

Where an adult parent or guardian purchases a product for a person under 18, we normally deal with the adult purchaser. Limited information about the child may be processed where required, for example on a VAT relief declaration.

Personal information we collect

The information we collect depends on how you interact with us. The following categories may apply:

Date of birth and identification documents

We do not routinely retain copies of passports, driving licences, bank statements or other identity documents as part of our normal sales process. A date of birth or other finance information may be requested during an enquiry or finance application where relevant, but information submitted for a finance application is ordinarily entered directly into the finance provider's system rather than retained separately in our main CRM.

Special category and vulnerability information

Vulnerability information

As a business involved in consumer credit, we may identify that a customer needs additional support. This can arise because of circumstances such as difficulty understanding finance or other information, communication difficulties, learning difficulties, health or disability, bereavement, financial difficulty or other personal circumstances.

Where it is relevant to providing appropriate support or meeting our regulatory responsibilities, we may record the nature of the vulnerability or the support needed in our CRM. Some vulnerability information may reveal information about physical or mental health and therefore be special category personal data under UK data protection law.

Where special category data is processed, we identify an Article 6 lawful basis and a separate Article 9 condition. Depending on the circumstances, this may include explicit consent, reasons of substantial public interest with an applicable condition under Schedule 1 of the Data Protection Act 2018, or the establishment, exercise or defence of legal claims. We apply additional safeguards and restrict access to authorised staff who need the information for their role.

VAT relief declarations

Where a customer claims VAT relief, we may collect information about a disability or chronic medical condition on an eligibility declaration. This information is used to administer and evidence the VAT relief claimed and is kept with the relevant tax and customer records. Because this information may be health or disability data, it is treated as special category information and receives additional protection.

Accidents, injuries and legal claims

Health or injury information is not part of our routine sales process. It may be processed where a complaint, accident or legal claim alleges that Mobility Connect or a product was responsible for injury, and the information is necessary to investigate, establish, exercise or defend legal claims.

How and why we use personal information

We only use personal information where we have a lawful basis. The main purposes and bases used by Mobility Connect are set out below. The basis that applies can vary depending on the facts of a particular case.

Finance, insurance and payments

Finance

Customers may apply for finance over the telephone, through a link sent by Mobility Connect, or directly through a finance provider. Where our staff collect information needed for an application, it is entered directly into the relevant finance provider's online application system and is not ordinarily stored separately in our main CRM.

The finance provider will generally act as a data controller in its own right and will provide its own privacy information. A lender may carry out identity, fraud, creditworthiness, affordability and eligibility checks and may obtain information from credit reference agencies or fraud-prevention organisations in accordance with its own processes.

Mobility Connect may retain the finance provider used, the amount financed, whether the application was approved or declined, and a relevant reference or agreement number as part of the customer/order record. The finance agreement itself is normally retained by the lender.

Insurance

Where a customer authorises us to do so, we may pass relevant information to Mark Bates Limited / Premier Care, or another insurance provider we work with, to arrange insurance or administer an insurance-related service. Information shared will be limited to what is reasonably required for that purpose.

Payments

Our current payment providers include Revolut Pay, PayPal Virtual Terminal and GoCardless. Full card details are processed by the relevant payment provider and are not ordinarily retained by Mobility Connect. Where a member of staff assists with setting up a GoCardless Direct Debit, bank details are entered directly into GoCardless and are not separately retained by us.

Telephone calls, messaging, photos and video

Call recording

Inbound and outbound telephone calls are recorded. Recordings may be used for quality monitoring, staff training, confirming what was discussed or agreed, complaint investigation, regulatory/compliance purposes, resolving disputes and establishing, exercising or defending legal claims.

Inbound callers are informed that calls are recorded. We also inform customers when an outbound call is being recorded. Recordings are normally retained for 90 days, but a particular recording may be retained for longer where it is relevant to an ongoing complaint, legal claim, regulatory investigation or another matter requiring preservation of the evidence.

WhatsApp Business, email and other messaging

Customers may communicate with us by email, WhatsApp Business, telephone, social media, website enquiry forms and other approved communication services. These communications may contain personal information and are handled in accordance with this notice.

Photos and videos

Customers may send photographs or videos when reporting faults, warranty matters, accidental damage, insurance claims, servicing issues or complaints. These usually show the product rather than the customer, but personal information may occasionally appear in the material. We use this material for the purpose for which it was provided unless another lawful basis applies.

Reviews, testimonials and marketing content

Where we wish to use an identifiable customer's photograph, video or testimonial specifically in Mobility Connect advertising or promotional material, we will obtain appropriate permission first. Where consent is the basis for the use, it may be withdrawn for future use.

Marketing and advertising

Enquiry follow-up

If you ask about a product or service, we may contact you to respond to that enquiry and follow it up. A genuine response to a requested enquiry is not the same as sending unrelated ongoing promotional marketing.

Email and SMS marketing

For prospective customers who have not bought from us, we will obtain appropriate marketing consent before sending ongoing promotional emails or text messages unless another lawful exception clearly applies.

For existing customers, we may market our own similar products and services where PECR allows us to rely on the “soft opt-in”. Where we rely on this rule, we will have collected the contact details ourselves during a sale or negotiation for a sale, will provide a clear opportunity to opt out when the details are collected, and will include an opt-out in every subsequent marketing message.

Marketing emails are currently sent using Mailchimp and text/SMS communications may be sent using Webex or an equivalent provider. You may opt out at any time using the unsubscribe/opt-out method provided or by contacting [email protected]. We may keep a minimal suppression record so that your preference continues to be respected.

Marketing telephone calls

We may make live marketing telephone calls where permitted by law. We respect requests not to receive marketing calls, maintain appropriate suppression records and apply Telephone Preference Service (TPS) requirements where applicable. We do not use automated recorded-message marketing calls.

Digital advertising and audience matching

We use digital advertising services including Meta, Google and TikTok. Where legally permitted, identifiers such as an email address or telephone number may be used with an advertising platform for customer matching, remarketing, advertising measurement or the creation of similar/lookalike audiences. We only carry out this processing where we have an appropriate lawful basis and comply with applicable direct-marketing and cookie requirements.

Cookies and online tracking

Our website uses cookies and similar technologies. These may support website functionality, remember preferences, help us understand how the website is used, measure advertising performance and deliver or measure relevant advertising.

Current technologies may include services associated with Google Analytics, Google Ads, Meta, TikTok and other analytics, advertising or website-functionality providers. Our website provides cookie controls so that visitors can manage their preferences.

Where consent is required for non-essential cookies or similar technologies, they will only be used after the relevant choice has been made. Strictly necessary technologies and any technologies that fall within a specific legal exception may be used without consent where the law permits.

Who we share information with

We only share personal information where there is a legitimate reason to do so and limit the information to what is reasonably necessary for the relevant purpose. Depending on your dealings with us, recipients may include:

We do not sell, rent or trade customer personal information to other organisations for their own marketing purposes.

Delivery information

Mobility Connect delivers products to customers throughout the UK. Our delivery staff may receive information such as the customer's name, delivery address, telephone number, product/order details and other information needed to complete the delivery and demonstration. This may be provided through our CRM and through a paper order form. Delivery information must only be used for legitimate delivery and customer-service purposes.

Automated decision-making

Mobility Connect does not currently make decisions about customers that have legal or similarly significant effects solely by automated means.

Finance providers may use automated systems when assessing applications, including for identity, fraud, creditworthiness, affordability or eligibility checks. The relevant finance provider is responsible for explaining its own processing and any rights or safeguards that apply to automated decisions in its privacy notice.

International transfers

Some of the technology, communications, marketing or other service providers we use may process personal information outside the United Kingdom. Where a restricted international transfer takes place, we use an appropriate transfer mechanism required by UK data protection law. This may include UK adequacy regulations, an applicable data-privacy framework, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another lawful safeguard or exception.

How long we keep information

We keep personal information only for as long as it is reasonably required for the purpose for which it was collected and to meet legal, regulatory, contractual and evidential requirements. Our normal retention periods are:

A record may be retained longer where this is necessary because of an ongoing warranty or service obligation, complaint, litigation or threatened litigation, insurance claim, fraud-prevention need, regulatory requirement or another legal reason. Records that are no longer required will be securely deleted or destroyed.

Security

We take reasonable and proportionate technical and organisational measures to protect personal information against accidental or unlawful loss, alteration, disclosure or access. Access to our CRM and customer records is restricted to authorised staff who need the information for their work. We also expect service providers that handle personal information on our behalf to apply appropriate security and confidentiality measures.

Paper records are securely destroyed when their applicable retention period has expired. No electronic system can be guaranteed to be completely secure, but we review our controls and working practices as our systems and services develop.

Your data protection rights

Depending on the circumstances, you may have the right to:

• be informed about how your personal information is used;
• request access to the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• request deletion of information in certain circumstances;
• request restriction of processing in certain circumstances;
• object to processing based on legitimate interests in certain circumstances;
• object to direct marketing at any time;
• request portability of certain information;
• withdraw consent where consent is the basis for processing; and
• receive applicable safeguards in relation to qualifying automated decision-making.

These rights are not absolute and some only apply in particular circumstances. To exercise a right, contact [email protected]. We may need to verify your identity before responding.

Data protection complaints

If you are unhappy with how we have handled your personal information, you can make a data protection complaint by emailing [email protected] or writing to Mobility Connect Ltd at the address shown in this notice.

We will provide a clear route for raising a data protection complaint, acknowledge the complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed as appropriate and communicate the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator. Further information is available at www.ico.org.uk.

Changes to this notice and contact details

We may update this Privacy Notice where our business practices, systems, service providers, finance or insurance arrangements, marketing activities, legal requirements or regulatory expectations change. Significant changes will be brought to customers' attention where appropriate.

This notice is scheduled for formal review no later than October 2027 and will be reviewed sooner if a material change requires it.