Privacy Policy

The British Vehicle Rental and Leasing Association (“BVRLA”, “we”, “us” or “our”) is committed to protecting your privacy and handling your personal information fairly, lawfully and transparently.

This Privacy Policy explains how we collect, use, share and protect personal information, how long we keep it, and the rights you have in relation to your personal information.

It applies when you use our website, become or act on behalf of a BVRLA member, contact us, attend our events or training, use our services, or otherwise interact with us.

1. Who we are

The British Vehicle Rental and Leasing Association is the trade association for the vehicle rental, leasing and fleet sectors.

For the purposes of applicable data protection law, BVRLA is the controller of the personal information described in this Privacy Policy unless we tell you otherwise.

If you have any questions about this Privacy Policy or how we use your personal information, please contact us using the details in the Contact us section below.

2. The information we collect

The personal information we collect will depend on your relationship and interactions with us. It may include:

your name, title and contact details, including your email address, telephone number and postal address;
your job title, employer, organisation and other professional information;
BVRLA membership and account information;
information you provide when registering for or using our website and online services;
information relating to events, conferences, webinars, training courses and other BVRLA activities you attend or register for;
enquiries, correspondence, feedback and complaints;
information contained in documents, enquiries or other materials processed through AI-enabled systems, together with any associated prompts and outputs, where such information constitutes personal information;
marketing and communications preferences;
payment and transaction information where relevant;
telephone call recordings where calls are recorded;
technical information about your use of our website, such as your IP address, browser, device information and information collected through cookies and similar technologies; and
any other information you choose to provide to us.

In limited circumstances, information provided to us may include special category personal information, such as information concerning health, ethnicity or religious beliefs, or information relating to criminal allegations, convictions or offences. We will only process such information where we have an appropriate lawful basis and, where required, an additional condition under applicable data protection law.

3. How we collect your information

We may collect personal information:

directly from you, for example when you contact us, create an account, register for an event or training course, complete a form or use one of our services;
from your employer or another organisation with which you are associated;
from BVRLA member organisations;
from event, training or service partners;
from publicly available sources;
through our website and online services, including through cookies and similar technologies; and
from third parties where it is lawful for them to provide information to us.

Where we obtain personal information from another source, we will provide appropriate privacy information where required by law.

4. How and why we use your information

We only use personal information where we have a lawful basis for doing so.

Depending on the circumstances, we may use your information to:

Provide membership and other services

We use information to administer BVRLA membership, manage member relationships, provide access to member services and resources, operate our website and respond to enquiries.

Our lawful basis will generally be that the processing is necessary to perform a contract or take steps connected with a contract, or that it is necessary for our legitimate interests in operating BVRLA and providing services to our members and stakeholders.

Manage events and training

We use information to process bookings and registrations and to administer events, conferences, webinars, meetings and training.

Depending on the circumstances, we rely on contractual necessity and/or our legitimate interests in providing and administering these services.

Communicate with you

We use contact information to respond to enquiries, provide service and membership communications and keep you informed about relevant BVRLA activities.

We rely on contractual necessity, legal obligations and/or our legitimate interests, depending on the nature of the communication.

Marketing

We may use your information to provide information about BVRLA news, services, events, training and other activities that we believe may be relevant to you.

The lawful basis we rely upon will depend on the nature of the communication, your relationship with us and the applicable electronic marketing rules. We may rely on legitimate interests when communicating with business contacts where it is appropriate to do so. Where consent is required by law, we will obtain your consent before sending the relevant marketing communication.

You can unsubscribe from marketing communications at any time using the unsubscribe mechanism in the relevant communication or by contacting us.

Handle enquiries and complaints

We process information to respond to enquiries, investigate complaints, resolve disputes and administer any complaint or conciliation services we provide.

Depending on the circumstances, we may rely on our legitimate interests, contractual necessity, a legal obligation or another applicable lawful basis.

Improve and protect our services

We may use information about how our website and services are used to improve their functionality, understand user needs, maintain security, prevent misuse and protect our systems and users.

We generally rely on our legitimate interests in operating, securing and improving our services.

Meet legal and regulatory obligations

We may use and disclose information where necessary to comply with applicable laws, respond to lawful requests, establish or defend legal claims or cooperate with regulators and other competent authorities.

Where applicable, we rely on compliance with a legal obligation, recognised legitimate interests or our legitimate interests.

5. Legitimate interests

Where we rely on legitimate interests, those interests may include:

operating and administering BVRLA;
supporting and communicating with members;
providing and improving our services;
promoting appropriate BVRLA services, events and activities;
understanding how our website and services are used;
maintaining the security and integrity of our systems;
preventing fraud or misuse;
handling enquiries, complaints and disputes; and
protecting BVRLA's legal rights and those of its members and other stakeholders.

Where required, we consider whether our interests are overridden by your interests, rights or freedoms before relying on this lawful basis.

6. Special category and criminal offence information

We do not routinely seek special category personal information or criminal offence information.

However, such information may occasionally be provided to us, for example during a telephone call, enquiry or complaint.

Where we process special category information, we will identify an appropriate lawful basis and an additional condition permitted under applicable data protection law. Where we process criminal offence information, we will ensure that an appropriate lawful basis and any additional legal requirements are satisfied.

We will only use this information where it is necessary and proportionate for the relevant purpose.

7. Telephone calls

We may record telephone calls for purposes such as quality assurance, training, complaint handling, dispute resolution, security and establishing an accurate record of communications.

Where calls are recorded, we will provide appropriate notice.

Recordings will only be retained for as long as necessary for the purpose for which they were made and in accordance with our retention requirements.

8. Who we share information with

We may share personal information where necessary with:

suppliers and service providers that support our operations, website, IT systems, communications, events, training, artificial intelligence and AI-enabled technologies, and other services;
professional advisers, including legal, financial and other advisers;
event venues, organisers and partners where necessary to administer an event;
BVRLA members or other organisations where appropriate and lawful;
regulators, law enforcement bodies, courts and other competent authorities where required or permitted by law; and
other third parties where you have asked us to share information or where we otherwise have a lawful basis to do so.

Our service providers may include technology, communications, event-management and website providers, including providers such as Microsoft and other suppliers used to operate our systems and services.

Where another organisation processes personal information on our behalf, we require it to protect that information appropriately and process it in accordance with our instructions and applicable law.

We do not sell your personal information.

9. International transfers

Some of the organisations that provide services to us may process personal information outside the United Kingdom.

Where a transfer of personal information is subject to UK international transfer restrictions, we take steps to ensure that the transfer is lawful and that appropriate protection is in place.

Depending on the destination and circumstances, this may include relying on UK adequacy regulations or implementing appropriate safeguards, such as approved contractual provisions.

You can contact us if you would like further information about the safeguards applicable to transfers of your personal information.

10. How long we keep your information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, regulatory, accounting and reporting requirements and to establish, exercise or defend legal claims.

The period for which we retain information varies depending on factors including:

the nature and sensitivity of the information;
the purpose for which it is processed;
the duration of our relationship with you or your organisation;
applicable legal, regulatory or contractual requirements;
relevant limitation periods; and
whether the information is required in connection with a complaint, dispute or legal claim.

When personal information is no longer required, we will securely delete or anonymise it in accordance with our retention arrangements.

11. Website, cookies and analytics

When you use our website, we may collect technical information about your device and use of the site.

We use cookies and similar technologies for purposes such as operating the website, remembering preferences, understanding how the website is used and, where applicable, measuring the effectiveness of communications.

Where consent is legally required for a cookie or similar technology, we will ask for your consent before using it.

Further information about the cookies and similar technologies we use, including how to manage your preferences, is available in our Cookie Policy.

12. Security

We take appropriate technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to personal information is restricted to those who need it for legitimate business purposes and appropriate safeguards are applied to the systems and service providers we use.

No method of transmitting or storing information is completely risk-free. We therefore regularly review our security arrangements and take reasonable steps appropriate to the nature of the information and the risks involved.

13. Use of artificial intelligence (AI)

BVRLA may use artificial intelligence (AI) and AI-enabled technologies to support its operations, improve efficiency and enhance the services it provides to members and other stakeholders.

This may include using AI to assist with:

drafting, reviewing and summarising documents, reports and communications;
research, analysis and the preparation of information and guidance;
administrative tasks, data organisation and business processes;
analysing feedback, enquiries and other information to help improve our services; and
supporting employees in delivering BVRLA services and activities.

Personal information and AI

Where personal information is processed using AI-enabled technologies, BVRLA will ensure that an appropriate lawful basis applies and that such processing is consistent with the purposes explained in this Privacy Policy.

We will take reasonable and proportionate steps to minimise the personal information shared with AI systems and use anonymised or pseudonymised information where appropriate.

We will apply additional safeguards when processing sensitive or confidential information, including special category personal information and criminal offence information.

AI service providers

BVRLA may use third-party providers of AI-enabled technologies. Where these providers process personal information on our behalf, we will ensure appropriate contractual, technical and organisational safeguards are in place.

Where applicable, this will include measures addressing confidentiality, security, retention, international data transfers and the use of information for training or improving AI models.

BVRLA will not permit personal information to be used to train or improve third-party AI models unless such use has been appropriately assessed, is lawful under application data protection legislation, and is subject to appropriate contractual, technical and organisational safeguards.

We will assess whether personal information may be used by an AI provider for its own purposes and ensure that any such processing is lawful and appropriately explained.

Human oversight and automated decisions

AI-generated information may assist BVRLA employees in carrying out their responsibilities. We recognise that AI-generated outputs may be inaccurate or incomplete and will apply appropriate human oversight, verification and accountability according to the nature and risks of the activity.

BVRLA does not currently use solely automated decision-making that produces legal or similarly significant effects on individuals.

If this changes, we will provide appropriate information about the processing and the rights and safeguards available under applicable data protection law.

Responsible use of AI

BVRLA is committed to using AI responsibly, transparently and in accordance with applicable data protection legislation. We will review our use of AI technologies and associated safeguards as our services and the regulatory environment develop.

14. Your rights

Depending on the circumstances and the lawful basis on which we use your information, you may have the right to:

access personal information we hold about you and receive a copy of it;
rectify inaccurate or incomplete personal information;
request erasure of your personal information in certain circumstances;
restrict processing of your personal information in certain circumstances;
data portability, allowing you to obtain certain personal information in a structured, commonly used and machine-readable format;
withdraw consent at any time where we rely on your consent, without affecting the lawfulness of processing carried out before consent was withdrawn; and
exercise applicable rights relating to automated decision-making.

Your right to object

You have the right to object at any time to our use of your personal information for direct marketing. If you object, we will stop using your information for that purpose.

You may also have the right to object where we process your personal information on the basis of legitimate interests. Whether we are required to stop processing will depend on the circumstances and applicable law.

These rights are not absolute and exemptions may apply.

To exercise a right, please contact us using the details below. We may need to ask for information to verify your identity before acting on your request.

15. Data protection complaints

If you have concerns about how BVRLA has collected or used your personal information, we encourage you to contact us so that we can investigate the matter.

You can make a data protection complaint using the contact details set out below.

We will acknowledge a data protection complaint within 30 days of receiving it. We will take appropriate steps to investigate the complaint without undue delay, keep you informed about its progress where appropriate and communicate the outcome of our investigation to you.

If you are dissatisfied with our response, you also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Information about making a complaint and the ICO's current contact details are available at www.ico.org.uk.

16. Links to other websites

Our website may contain links to websites operated by other organisations.

Those organisations are responsible for their own privacy practices. We recommend reviewing their privacy information before providing personal information to them.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our activities, services, legal obligations or data protection practices.

When we make changes, we will update the “Last updated” date at the top of this policy. Where a change is significant, we may take additional steps to bring it to your attention where appropriate.

18. Contact us

If you have questions about this Privacy Policy, wish to exercise your data protection rights or want to make a data protection complaint, please contact:

British Vehicle Rental and Leasing Association (BVRLA)
River Lodge
Badminton Court
Amersham
HP7 0DD

Telephone: 01494 545700
Website: www.bvrla.co.uk

Please mark data protection correspondence for the attention of the person responsible for data protection at BVRLA.