1. INTRODUCTION
Lexus respects your privacy. Whether you deal with Lexus as a customer, a consumer, a member of the general public, etc., you are entitled to the protection of your Personal Data.
This data may relate to your name, telephone number, email address but also to other data, such as your Vehicle Identification Number (VIN), registration number, geo-location, MyT or Lexus Link account information etc. In addition, we may hold data pertaining to your vehicle during the time of your ownership. Finally, we will also hold information in relation to contacts made between you and Lexus Ireland. We may also monitor and record telephone calls made to and from us to assist in improving customer services, to evidence instructions or to prevent or resolve disputes.
In this General Lexus Privacy and Data Protection Policy (“this Policy”) we describe how we collect your Personal Data and why we collect it, what we do with your Personal Data, with whom we share it, how we protect it, and the choices you can make about your Personal Data.
This Policy applies to the processing of your Personal Data in the framework of various services, tools, applications, websites, portals, promotions, marketing actions, social media platforms, etc. that are provided or operated by us or on our behalf.
This Policy contains general rules and explanations. It is complemented with separate specific privacy notices relating to particular services. These privacy notices will be communicated to you whenever your Personal Data is needed in the framework of the activities mentioned above (for example, via websites, portals, individual communication services, newsletters, reminders, surveys, offers, events, etc.).
This Policy applies to all your Personal Data collected by (or on behalf of) Lexus Ireland, referred to in this Policy as “Lexus”, “we”, “us” and ”our”.
If you accept the provisions of this Policy , you are agreeing to us processing your Personal Data in the ways that are set out in this Policy.
At the end of this Policy, you will find some definitions of certain key concepts used in this Policy and which are capitalised (for example, Personal Data, Processing, Data Controller…).
2. WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR PERSONAL DATA?
The entity which is responsible for the processing of your Personal Data is:
Lexus Ireland, Killeen Road, Dublin, D12 AW94, Ireland
3. WHO CAN YOU CONTACT IN CASE YOU HAVE QUESTIONS OR REQUESTS? THE DATA PROTECTION CONTACT POINT
We have organised a Data Protection Coordinator who will handle your questions or requests relating to this Policy, any specific privacy notice, your Personal Data (and its Processing).
For any questions or requests or complaints concerning the application of this Policy or to exercise your rights, as described in this Policy, you may contact our Data Protection Coordinator at:
· lexuscs@lexus.ie
· Data Protection Coordinator, Customer Relations Department, Lexus Ireland, Killeen Road, Dublin, D12AW94, Ireland.
Please note that any queries in relation to Lexus Financial Service (Ireland) DAC (“TFS”) should be addressed to TFS directly at the following address:
· customercare@ie.lexus-fs.com
· Customer Care, Toyota Financial Services (Ireland) DAC, Lexus House, Killeen Road, Dublin 12, Ireland.
4. KEY PRINCIPLES
We value your Personal Data entrusted to us and we are committed to processing your Personal Data in a fair, transparent and secure way. The key principles Lexus applies are as follows:
· Lawfulness: we will only collect your Personal Data in a fair, lawful and transparent manner.
· Data minimisation: we will limit the collection of your Personal Data to what is directly relevant and necessary for the purposes for which they have been collected.
· Purpose limitation: we will only collect your Personal Data for specified, explicit and legitimate purposes and not process your Personal Data further in a way incompatible with those purposes.
· Accuracy: we will keep your Personal Data accurate and up to date.
· Data security and protection: we will implement technical and organisational measures to ensure an appropriate level of data security and protection considering, among others, the nature of your Personal Data to be protected. Such measures provide for the prevention of any unauthorised disclosure or access, accidental or unlawful destruction or accidental loss, or alteration and any other unlawful form of Processing.
· Access and rectification: we will process your Personal Data in line with your legal rights.
· Retention limitation: we will retain your Personal Data in a manner consistent with the applicable data protection laws and regulations and no longer than is necessary for the purposes for which they have been collected.
· Protection for international transfers: we will ensure that any of your Personal Data transferred outside the EEA is adequately protected.
· Safeguards towards third parties: we will ensure that Personal Data access by (and transfers to) third parties are carried out in accordance with applicable law and with suitable contractual safeguards.
· Lawfulness of direct marketing and cookies: when we send you promotional materials or place cookies on your computer, we will ensure that we do so in accordance with applicable law.
5. PROCESSING OF YOUR PERSONAL DATA: WHICH PERSONAL DATA DO WE COLLECT AND ON WHICH LEGAL GROUNDS
Whenever we require your Personal Data, we will always clearly inform you which of your Personal Data we collect. This information will be provided to you through a separate privacy notice which may, for example, be included in specific services (including communication services), electronic newsletters, reminders, surveys, offers, invitations for events, etc.
We also collect personal data via our network of Authorised Lexus Dealers and Repairers. As members of the Society of the Irish Motor Industry (SIMI), our network use SIMI approved data protection policies and collect personal data in accordance with SIMI’s data protection guidance.
We may also collect your personal data where you apply for a job with Lexus Ireland, either directly from you or via a recruitment agency that you have dealt with.
Please note that a separate Privacy Policy also applies to Lexus Financial Services (Ireland) DAC.
Please note that in accordance with applicable data protection law, your Personal Data can be processed if:
· you have given us your consent for the purposes of the Processing (as described in the privacy notice related to that particular Processing). For the avoidance of doubt, you will always have the right to withdraw your consent at any time; or
· it is necessary for the performance of a contract to which you are a party; or
· with such Processing, we pursue a legitimate interest that is not outbalanced by your privacy rights. Such legitimate interest will be duly communicated to you in the privacy notice related to that particular Processing.
· it is required by law.
The legal basis on which we process your data will be one of the bases set out above, depending on the type of personal data is being processed and the purpose for the processing.
6. FOR WHICH PURPOSES WE PROCESS YOUR PERSONAL DATA
We will only process your Personal Data for specified, explicit and legitimate purposes and we will not process your Personal Data further in a way that is incompatible with those purposes.
We also collect personal data via our network of Authorised Lexus Dealers and Repairers. As members of the Society of the Irish Motor Industry (SIMI), our network use SIMI approved data protection policies and collect personal data in accordance with SIMI’s data protection guidance.
Such purposes include:
· the execution of an order you have placed;
· passing on your sales, trade-in or repair enquiry to a Member of our Authorised Lexus Dealer and/or Authorised Repairer network, which you have indicated as a preferred Authorised Lexus Dealer or Authorised Repairer or which are located near you (based on your postcode/address), so that such Authorised Dealer and/or Authorised Repairer can respond to your sales or repair enquiry;
· passing your financing application on to your preferred Authorised Lexus Dealer and Lexus Financial Services Ireland, to review and consider your financing application, or to verify and administer your finance agreement with Lexus Financial Services);
· the improvement of your visit on one of our websites or portals;
· the improvement of our products and services more generally,
· the offering of services or applications;
· marketing communications and actions, etc.
Lexus Europe are obliged under EU law to report emissions and fuel consumption levels for vehicles registered since January 2021. This data and the Vehicle Identification Number will be collected by our Dealer network and transferred to Lexus Europe unless you have informed the Dealer that you wish to opt out of this data sharing.
The purpose of each Processing of your Personal Data will be clearly defined in this document or the specific privacy notice relating to that particular Processing. This privacy notice will be accessible, for example, on a website or portal, on an application, in an electronic newsletter, etc.).
Your personal data is kept in central systems operated by us or by other Lexus entities. If you have provided your personal data to several Lexus entities, it will be combined, processed and shared with relevant Lexus group recipients (incl. those listed in the section "Section 12. Disclosure of Personal Data" below) via the above-mentioned systems. In doing so, Lexus aims to maintain a single customer record for the Lexus group of companies which will:
· manage your personal data in an effective way (for example, by centralising your personal data we can more easily keep it up-to-date and accurate and organise its sharing (if required/requested);
· provide you with the best possible customer experience;
· support and facilitate your/our rights and obligations described in this policy; and
· To manage your consent(s) with us and our approved network (for example, to keep track of whether you agree with us sending you marketing materials).
7. KEEPING YOUR PERSONAL DATA ACCURATE AND UP-TO-DATE
It is important for us to maintain accurate and up-to-date records of your Personal Data. Please inform us of any changes to or errors in your Personal Data as soon as possible by contacting us at the Data Protection Contact Point (see section 3 “Who can you contact in case you have questions or requests?”). We will take all reasonable steps to make sure that any inaccurate or outdated Personal Data is deleted or adjusted accordingly.
8. ACCESS TO YOUR PERSONAL DATA
You have the right to access your Personal Data which we are processing free of charge and, if your Personal Data is inaccurate or incomplete, to request the rectification or erasure of your Personal Data. If you require further information in relation to your privacy rights or would like to exercise any of these rights, please contact us at the Data Protection Contact Point (see section 3 “Who can you contact in case you have questions or requests?”).
We will endeavour to respond to your request within a month. If we are unable to deal with your request within a month we may extend this period by a further two months and we will explain why.
9. HOW LONG DO WE KEEP YOUR PERSONAL DATA
We will only keep your Personal Data for as long as necessary for the purposes for which we process your Personal Data or to comply with the law. The length of the retention period(s) varies depending on the type of personal data being processed and is also determined by the nature of your relationship with Lexus Ireland or our approved network, the length of lapsed time since your last interaction with us, the time needed by you and us to follow up on your request, the end of any contractual relationship and the existence of any actual or potential litigation or dispute.
Subject to the above, we will keep your Personal Data in a manner consistent with applicable data protection law for a period of for a maximum period of 7 years from the date of completion of a contract with a Lexus Authorised Dealer or Authorised Repairer or an interaction with Lexus Ireland.
If you apply for a job in Lexus Ireland, we will retain your personal data in this instance for as long as the recruitment process is underway and will delete it when this process has been completed.
Our retention policy is in line with that recommended by the Society of the Irish Motor Industry (SIMI).
10. PROTECTING YOUR PERSONAL DATA
We have a set of technical and organisational security measures in place to protect your Personal Data against unlawful or unauthorised access or use, as well as against accidental loss or damage to their integrity. They have been designed taking into account our IT infrastructure, the potential impact on your privacy and the costs involved and in accordance with current industry standards and practice.
Your Personal Data will only be processed by a third party Data Processor if that Data Processor agrees to comply with those technical and organisational data security measures.
Maintaining data security means protecting the confidentiality, integrity and availability of your Personal Data:
(a) Confidentiality: we will protect your Personal Data from unwanted disclosure to third parties.
(b) Integrity: we will protect your Personal Data from being modified by unauthorised third parties.
(c) Availability: we will ensure that authorized parties are able to access your Personal Data when needed.
11. USE OF COOKIES OR SIMILAR DEVICES
We use cookies on our websites. This helps us to provide you with a better experience when you browse our website and also allows us to make improvements to our site.
For further information about our use of cookies and on how to avoid them, please consult our cookie policy, available at https://www.Lexus.ie/#/ajax/%2Fsys%2Fe-privacy%2Fsettings
12. DISCLOSURE OF PERSONAL DATA
Depending on the purposes for which we collect your Personal Data, we may disclose it to the following categories of recipients, which will then process your Personal Data only within the framework of these purposes:
a) Within our organisations and our brand environment:
· Our authorised staff members;
· Our affiliates and subsidiary companies;
· Members of our Authorised Retailers and Authorised Repairers network which you have indicated as preferred Authorised Retailers or Authorised Repairers or which are located near you (based on your postcode, address) or which you have been in contact with;
· Lexus Financial Services Ireland (to verify and administer your finance agreement with Lexus Financial Services);
· Toyota Motor Europe (to assist in administering warranty/service product details, product quality improvements, research and development initiatives, customer relations queries and any other TME provided services)
· Toyota Motor Corporation (to assist with warranty, product quality improvements, research and development initiatives, technical or customer relations matters)
b) Third party business partners:
· Advertising, marketing and promotional agencies: to help us deliver and analyse the effectiveness of our advertising campaigns and promotions;
· Business partners: for example, trusted companies that may use your Personal Data to provide you with the services and/or the products you requested and/or that may provide you with marketing materials (provided that you have consented to receiving such marketing materials). We ask such companies to always act in compliance with applicable laws and this Policy and to pay high attention to the confidentiality of your personal information;
· Service providers of Lexus: companies that provide services for or on behalf of Lexus, for the purposes of providing such services (for example, Lexus may share your Personal Data with external providers of IT related services or fulfilment companies);
c) Other third parties:
- when required by law or as lawfully necessary to protect Lexus:
· to comply with the law, requests from authorities, court orders, legal procedures, obligations related to the reporting and filing of information with authorities, etc.;
· to verify or enforce compliance with Lexus policies and agreements; and
· to protect the rights, property or safety of Lexus and/or its customers;
- in connection with corporate transactions: in the context of a transfer or divestiture of all or a portion of its business, or otherwise in connection with a merger, consolidation, change in control, reorganisation or liquidation of all or part of Lexus business.
Please be aware that third party recipients listed under points b) and c) above –especially service providers who may offer products and services to you through Lexus services or applications or via their own channels– may separately collect Personal Data from you. In such case, these third parties are solely responsible for the control of such Personal Data and your dealings with them will fall under their terms and conditions.
13. SPECIFIC CONTACT WITH OUR AUTHORISED RETAILERS AND REPAIRERS
If you purchase a car or another product or service from one of our Authorised Retailers or Authorised Repairers or if you give them your personal information, you will have a separate relationship with this Authorised Retailer or Authorised Repairer. In this case, they become the data controller of your Personal Data, possibly together with us. For all questions or requests about the collection and use of your Personal Data by one of the Authorised Retailers or Authorised Repairers, please contact them directly.
The preferred Authorised Retailer or Authorised Repairer is (1) the Authorised Retailer or Authorised Repairer that you have selected as your preferred one via a sales or service experience survey or (2) in case you did not make such selection, we will identify an Authorised Retailer or Authorised Repairer based on the history of your contacts with our network.
14. USE OF SOCIAL MEDIA
If you use on a Lexus tool (website, portal, App) a specific login from a social media (for example, your Facebook account), Lexus will record your Personal Data available on this social media and your use of such social media means that you have explicitly allowed the communication of your Personal Data recorded by Lexus through its tool.
Lexus sometimes facilitates the publication of (personal) data via social media such as Twitter, Facebook, Instagram, Google+ and YouTube. These social media have their own terms of use which you need to take into account when active on social media. We remind you that publication on social media may have certain consequences, including for your privacy or for the privacy of persons whose Personal Data you share, such as, for example, the impossibility to withdraw a publication within a short term. You are fully responsible for your publications. Lexus will not have any responsibility and liability in this regard.
15. TRANSFERS OUTSIDE THE EEA
Your Personal Data may be transferred to recipients which may be outside the EEA, and may be processed by us and these recipients outside the EEA. An example of this would be the sharing of personal data with the Toyota Motor Corporation in Japan.
In connection with any transfer of your Personal Data to countries outside the EEA that do not generally offer the same level of data protection as in the EEA, Lexus will implement appropriate specific measures to ensure an adequate level of protection of your Personal Data. These measures can for instance consist in agreeing with recipients on binding contractual clauses guaranteeing such adequate level of protection.
16. YOUR CHOICES AND YOUR RIGHTS
We want to be as transparent as possible with you, so that you can make meaningful choices about how you want us to use your Personal Data.
· How you contact us and how you will be contacted
To unsubscribe from communications please follow the unsubscribe instructions included in the communication you received or contact us at customerservice@Lexus.ie.
Please note that by default, Lexus may communicate with you electronically and you will receive our communications at the normal frequency of the publication involved.
· Your Personal Data
You may always contact the Data Protection Coordinator (see section 3 “Who can you contact in case you have questions or requests?”) to find out what Personal Data we have concerning you. Under certain conditions, you have the right to receive your Personal Data, which you have provided to us, in a commonly used, structured machine readable format and to transmit your Personal Data to any third party of your choice..
· Your corrections
If you find any mistake in your Personal Data or if you find it incomplete or incorrect, you may also require from us that we correct or complete it.
· Your restrictions
You have the right to request a restriction on the Processing of your Personal Data (for example, while the accuracy of your Personal Data is being checked).
· Your objections
You may also object to the use of your Personal Data for direct marketing purpose by unsubscribing or to the sharing of your Personal Data with third party for the same purpose.
You may withdraw your consent at any time to the continued Processing of the Personal Data that you have provided to us by contacting us the Data Protection Coordinator (see section 3 “Who can you contact in case you have questions or requests?”).
Moreover, you may require us to erase any data concerning you (except in some cases, for example, to prove a transaction or when required by law).
Please note that these rights are in some circumstances limited by data protection legislation.
Finally, please note that you have the right to file a complaint against the Data Controller with the Data Protection Commissioner.
17. LEGAL INFORMATION
The requirements of this Policy supplement, and do not replace, any other requirements existing under applicable data protection law. In case of contradiction between what is written in this Policy and requirements in applicable data protection law, applicable data protection law will have priority.
Lexus may amend this Policy at any point in time. Where this happens we may alert you of any changes and we will then ask you to re-read the most recent version of our Policy and to confirm your acceptance thereof. You can also check this Policy periodically on https://www.lexus.ie/privacy-and-data-protection-policy to inform yourself of any changes.
18. DEFINITIONS
In this Policy, the following terms have the following meanings:
· (a) Data Controller means the organisation which determines the purposes for which, and the manner in which, your Personal Data is processed. Unless we inform you otherwise, the Data Controller is Lexus Ireland, Killeen Road, Dublin, D12AW94, Ireland. Further information may be provided to you through a separate privacy notice which will, for example, be included in specific services (including communication services), electronic newsletters, reminders, surveys, offers, invitations for events, etc.
· (b) Data Processor means the person or organisation which processes your Personal Data on behalf of the Data Controller.
· (c) Data Protection Contact Point means the contact point where you can address to the your questions or requests regarding this Policy and/or (the Processing of) your Personal Data and which will handle such questions and requests. Unless we inform you otherwise, the Data Protection Contact Point can be reached as described in section 3 “Who can you contact in case you have questions or requests?”).
· (d) EEA means the European Economic Area (= member states of the European Union + Iceland, Norway, and Liechtenstein).
· (e) Personal Data is any information that may relate to your name, telephone number, email address but also to other data, such as your Vehicle Identification Number (VIN), registration number, (geo-)location, etc. In addition, we may hold data pertaining to your vehicle during the time of your ownership. We will also hold information in relation to contacts made between you and Lexus Ireland and to surveys completed by you. We may also monitor and record telephone calls made to and from us to assist in improving customer services, to evidence instructions or to prevent or resolve disputes..
· (f) Processing means the collection, accessing and all forms of use of your Personal Data.
Updated on 12 December 2022.