Frank G.Gates Ltd - Privacy Policy

Last updated: 25.9.26​​

This policy describes how we use your personal data when you use our website, buy our goods or when we provide services to you. We have provided this policy to ensure that you understand what personal data we may collect and hold about you, what we may use it for and how we keep it safe. You have legal rights to access the personal data that we hold about you and to control how we use it which are also explained.

Who we are and how you can contact us

We are Frank G Gates Ltd, Company Number 00245843, with our registered office at: Gates Corner, Edinburgh Way, Harlow, Essex CM20 2EG

You can contact us by email, data@gates.co.uk, or by post:

Data Protection Team, Frank G Gates Ltd, Gates Corner, Edinburgh Way, Harlow, Essex CM20 2EG

Our data protection team

We have a dedicated data protection team who oversee our handling of personal data.

You can contact our data protection team in writing at Frank G.Gates Ltd, Registered Office, Gates Corner, Edinburgh Way, Harlow, Essex CM20 2EG or by email at data@gates.co.uk.

What personal data we collect 

We collect personal data in several ways:

1. Personal data you provide to us

Examples include:

  • Name, address, email address, phone number
  • Driving licence details
  • Financial and credit card information
  • Enquiry details
  • Information submitted through online forms
  • Information provided during live chat sessions

2. Personal data we receive from third parties

Examples include:

  • Contact details from Ford Motor Company or other OEMs
  • Finance application details from finance companies
  • Driving licence validation data
  • Data from Codeweavers, Stripe, Visitor Chat, FingerprintJS, Mailchimp, and other service providers

3. Personal data collected through our website

Examples include:

  • IP address, browser type, device type
  • Website usage analytics
  • Local storage records of previous vehicle searches
  • Anti‑spam device fingerprinting
  • Live chat transcripts
  • Online form submissions

4. Recording and monitoring communications

We may record telephone calls, emails, and live chat interactions for:

  • quality assurance
  • training
  • fraud prevention
  • compliance
  • service delivery


How we use your personal data

We use your personal data for the following purposes:

  • Providing information, goods, and services you request
  • Managing enquiries and customer relationships
  • Administering our business
  • Improving our website and services
  • Checking driving licence validity for test drives or courtesy vehicles
  • Processing payments
  • Assessing finance eligibility
  • Sending marketing communications (see section below)
  • Fraud prevention and security

Lawful basis for processing your personal data

We use the following lawful bases under UK GDPR:

Lawful Basis for Processing

Processing Activity

Personal Data

Lawful Basis

Notes

Handling enquiries

Contact details, enquiry info

Legitimate interests

Necessary to respond to your enquiry

Vehicle sales & servicing

Contact details, transaction info

Contract

Required to provide goods/services

Test drives

Driving licence details

Legal obligation & legitimate interests

Required to ensure eligibility and safety

Courtesy vehicles

Driving licence details

Legal obligation

Insurance and regulatory requirements

Finance applications

Identity, financial info

Contract

Required to submit finance applications

Marketing communications

Contact details

Consent or soft opt‑in (email/SMS only)

PECR‑compliant; opt‑out always available

Website analytics

IP address, device info

Consent

Non‑essential cookies require prior consent

Anti‑spam protection

Device fingerprinting

Legitimate interests

Strictly necessary for fraud prevention

Call recordings

Voice recordings

Legitimate interests

Quality, training, compliance

CCTV (if applicable)

Video footage

Legitimate interests

Security and crime prevention


​Cookies and tracking technologies​

Our website uses cookies and similar technologies. Non‑essential cookies (analytics, advertising, functionality) are only used with your consent.

Please see our Cookie Policy for full details.



When we need your consent to use your personal data

We will ask for your consent when:

  • placing non‑essential cookies
  • sending marketing communications (unless soft opt‑in applies)
  • sharing your data with third parties for marketing
  • processing special category data (if applicable)

You can withdraw consent at any time.

Personal data you are legally obliged to provide

You are not legally required to provide personal data, but if you choose not to, we may be unable to provide certain goods or services (e.g., test drives, finance applications).

Your rights 

You have the following rights under UK GDPR:

  • Right of access
  • Right to rectification
  • Right to erasure
  • Right to restrict processing
  • Right to object
  • Right to data portability
  • Right to withdraw consent
  • Right to object to automated decision‑making

To exercise your rights, contact: data@gates.co.uk

Automated decision making and profiling

We do not make automated decisions about you. However, finance companies may use automated decision‑making when assessing your creditworthiness. You have the right to request human review from the finance provider.

Sharing your personal data

We share your data with:

  • OEMs: Ford, OMODA, JAECOO, Peugeot, Leapmotor, BYD, Geely
  • Finance companies
  • Service providers (Keyloop, AWS, Visitor Chat, FingerprintJS, Stripe, Codeweavers, Mailchimp)
  • Analytics providers
  • Fraud prevention agencies
  • Legal and regulatory bodies
  • Prospective buyers or sellers of our business

We may also share your personal information with third parties on a one-off basis, for example, if:

  • we sell or buy any business or assets (including our own), in which case we will disclose your personal data to the prospective seller or buyer of such business or assets
  • we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our website terms of use, our terms and conditions or other agreements; or to protect the rights, property, or safety of our customers, ourselves or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Controller/Processor Roles:

Third Party

Role

Purpose

Location

Keyloop

Processor

CRM, Website hosting, analytics, forms

EEA

AWS

Sub‑processor

Cloud hosting

EEA/Global

Migogo

Processor

Live chat

UK

FingerprintJS

Processor

Anti‑spam

USA

Stripe

Processor

Payments

EU/USA

Codeweavers

Controller

Finance eligibility

UK

Mailchimp

Controller

Email marketing

USA

OEMs

Joint controllers

Vehicle data, customer relationship

Global

Finance companies

Controllers

Credit assessment

UK

​

How we keep your personal data safe

We use:

  • secure servers
  • encryption
  • access controls
  • staff training
  • firewalls and anti‑virus software
  • locked storage for paper records
  • strict mobile device policies

How we use your personal data for marketing

We will add your details to our marketing database if:

  • you make an enquiry about our goods or services
  • you buy our goods or services
  • you have told a third party that you would like them to pass us your contact details so that we can send you updates about our goods and services
  • you have registered an interest on our website regarding the goods or services we provide, and have indicated during the sign-up process that you are happy to receive marketing communications.
  • you create an account on our website

  • We may send you marketing communications by email, telephone, text message, and post. You can ask us to only send you marketing communications by particular methods (for example, you may be happy to receive emails from us but not telephone calls), about specific subjects (for example Service reminders) or you may ask us not to send you any marketing communications at all. We may ask you to indicate your marketing preferences when you first register an account on our website, visit one of our dealerships or telephone us. You can check and update your current marketing preferences at any time by calling or emailing us using the details set out in the Who we are and how you can contact us section above.


    We use MailChimp for email marketing and so your information is transmitted to MailChimp. Mailchimp is an online marketing platform operated by The Rocket Science Group LLC, a company headquartered in the State of Georgia in the United States. MailChimp is prohibited from selling your data and from using it for purposes other than sending email. More information can be found here. When you give us permission to store your personal information and email address and to send you marketing emails, this consent can be revoked at any time via the unsubscribe link in every mailing.

    We will only share your personal data with third parties for marketing purposes if you provide us with your consent to do so by ticking a box on a form we use to collect your personal data.

    How long we keep your personal data

    Retention Schedule:

    Data Type

    Retention Period

    Notes

    Financial records

    7 years

    Legal obligation

    Customer contact details (marketing)

    7 years from last transaction

    Soft opt‑in applies

    Enquiry contact details

    3 years

    Legitimate interests

    Customer sales files

    7 years

    Contractual necessity

    Complaints

    7 years

    Regulatory requirement

    Job applications

    6 months

    Legitimate interests

    Driving licence (courtesy vehicle)

    7 years + current year

    Insurance requirement

    Driving licence (test drive)

    3 years

    Legitimate interests

    CCTV

    30 days (typical)

    Security

    Call recordings

    12 months

    Training & compliance

    Website analytics

    26 months (GA4 default)

    Consent required

    Visitor Chat logs

    2 months to contract end + 3 months

    Processor retention

    Stripe payment logs

    31 days + 14 days archive

    Processor retention

    Codeweavers finance data

    As required for finance assessment

    Controller retention

    We may retain data longer if legal proceedings are anticipated.

    When we will send your personal data to other countries

    Some providers store data outside the UK/EEA. Where this happens, we use appropriate safeguards:

    International Transfer Mechanisms:

    Provider

    Country

    Safeguard

    Mailchimp

    USA

    UK–US Data Bridge / SCCs

    FingerprintJS

    USA

    SCCs

    Stripe

    USA/EU

    SCCs

    AWS

    Global

    SCCs / IDTA

    OEMs

    Global

    OEM contractual safeguards

    How you can make a complaint

    If you are unhappy with how we use your personal data, contact our Data Protection Team at data@gates.co.uk.

    You can also complain to the ICO: www.ico.org.uk

    How we keep this policy up to date

    We will review and update this policy from time to time. This may be to reflect a change in the goods or services we offer, a change to our internal procedures or to reflect a change in the law.

    We may update this policy from time to time. You can request a copy at any time by emailing data@gates.co.uk.