Privacy Policy

Baytree Cars are committed to protecting and respecting your privacy and personal data. This Privacy Policy describes how we will use your personal information and how you can exercise your rights under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA).

This Privacy Policy aims to give you information on how Baytree Cars collects and processes your personal data through your use of this website and your interaction with us, including any data you may provide through this website, including any data you may provide through this website when you contact us, sign up to receive marketing, provide us with information in order to obtain a valuation or finance estimate or reserve a vehicle.

Our website is not intended for children and we do not knowingly collect data relating to children in any circumstances.

It is important to read this Privacy Policy together with any other privacy policy or fair processing policy which we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Privacy Policy supplements other notices and privacy policies and is not intended to override them.

Data controller and contact information

The data controller and organisation responsible for your personal data is Baytree Cars Limited (referred to as “Baytree Cars”, “we”, “us” or “our” in this Privacy Policy), a company registered in England and Wales with company number 06023704 and registered address Burnden House, 31 Chequers Lane, Derby, England, DE21 6AW.

If you have any questions, comments or requests regarding this Privacy Policy, including any requests to exercise your legal rights, please feel free to contact us at:

Compliance officer: Myles McDermott

By post: Compliance Officer, Baytree Cars, Burnden House 31 Chequers Lane Derby Derbyshire DE21 6AW

By telephone: 01332 345 987

By email:

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Our data protection registration number is Z1247544.

Third party links

Our website may include links to third-party websites, plug-ins and applications, such as those used to produce valuations of your vehicle or estimates of the finance available to you.

Clicking on those links or making use of those plug-ins and applications may allow third parties to collect or share data about you. We do not control these third-party websites, plug-ins and applications and are not responsible for their privacy policies or statements.

When you leave our website or use any third party plug-in or application, we encourage you to read the applicable privacy policy.

The personal data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

  • Identity Data includes information such as your first name, last name, title, date of birth and gender.
  • Contact Data includes information such as your billing address, delivery address, email address and telephone numbers.
  • Financial Data includes bank account and payment card details, together with information such as credit reports.
  • Transaction Data includes information such as details of payments to and from you, and details of purchases that you have made from us.
  • Technical Data includes information such as your internet protocol (IP) address, login data, browser type and version, time and zone setting and location, browser plug-in types and versions and other technology on the devices you use to access our website or interact with us.
  • Profile Data includes information such as purchases you have made, preferences you have indicated, feedback and survey responses.
  • Usage Data includes information about how you use our website, products and services.
  • Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We may also collect, use and share aggregated data such as statistical or demographic data for any purpose. This may be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate Usage Data to calculate the percentage of visitors to our website who access a specific website feature. If we combine aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data in accordance with this Privacy Policy.

We do not collect any special categories of personal data (such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, health data or genetic and biometric data). We also do not collect information about criminal convictions and offences.

How we collect your personal data

We use different methods to collect data from and about you including through:

  • Direct interactions You may give us your Identity, Contact and Financial Data by filling in forms (whether on our website or at our showroom) or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
    • apply to purchase a vehicle;
    • enquire about selling a vehicle;
    • enquire about finance options regarding a vehicle;
    • request marketing to be sent to you; or
    • give us feedback or contact us.
  • Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our Cookie Policy for further details.
  • Third parties or publicly available sources. We will receive personal data about you from various third parties and public sources as set out below:
    • Identity, Financial and Transaction Data from BMW Financial Services (GB) Limited, trading as Alphera Financial Services and Codeweavers Limited, based inside the EU in relation to quotes for finance that you may obtain and credit checks carried out against you.
    • Technical Data from analytics providers such as Google based outside the EEA.
    • Technical, Usage and Profile Data from Dragon 2000 Limited, the provider of our website, based inside the EEA.
    • Contact, Financial and Transaction Data from providers of technical, payment and delivery services such as Stripe Payments Europe Limited based inside the EEA.
    • Identity and Contact Data from publicly available sources such as Companies House, the Driver and Vehicle Licensing Agency and the Electoral Register based inside the EEA.

Purposes and lawful basis for processing personal data

We may collect, process and use your personal data in the course of supplying vehicles, goods and services to you and to manage our relationship with you but will only use your personal data when the law allows us to. We have set out below the purposes for which we process your personal data.

Most commonly, we will use your personal data for the following purposes:

  • Processed under the lawful basis of Contract, meaning we need to process your personal data in order to perform a contract we are about to enter into or have entered into with you.
  • Processed under the lawful basis of compliance with a Legal Obligation, meaning we need to process your personal data to comply with a legal obligation.
  • Processed under the lawful basis of Consent, meaning you have given us your express, informed consent to process your personal data in a certain way.
  • Processed under the lawful basis of Legitimate Interest, meaning we need to process your personal data for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

Note that we may process your personal data for more than one lawful ground, depending on the specific purpose for which we are using your personal data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been referred to below.

Purpose / Activity Type of data Lawful basis for processing including basis of legitimate interest
When you enquire about a vehicle (a) Identity
(b) Contact
(c) Financial
Performance of a contract with you
To register you as a new customer (a) Identity
(b) Contact
Performance of a contract with you
To process and deliver a purchase or sale that you make, including:
(a) Arranging the delivery or collection of a vehicle
(b) Managing payments, fees and charges
(c) Collecting and recover money owed to us
(d) Assisting you to arrange finance for your purchase
(e) Collecting information required to transfer the registration of a vehicle
(a) Identity
(b) Contact
(c) Financial
(d) Transaction
(e) Marketing and Communications
(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to recover debts due to us)
(c) Necessary to comply with a legal obligation
To provide you with aftersales support, including in relation to any warranty you may have purchased (a) Identity
(b) Contact
(c) Financial
(d) Transaction
(e) Marketing and Communications
(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to ensure you are happy with a vehicle that you have purchased)
To manage our relationship with you which will include:
(a) Notifying you about changes to our terms or privacy policy
(b) Asking you to leave a review, feedback or to take a survey
(a) Identity
(b) Contact
(c) Profile
(d) Marketing and Communications
(a) Performance of a contract with you
(b) Necessary to comply with a legal obligation
(c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)
To administer and protect our business and website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) (a) Identity
(b) Contact
(c) Technical
(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)
(b) Necessary to comply with a legal obligation
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you (a) Identity
(b) Contact
(c) Profile
(d) Usage
(e) Marketing and Communications
(f) Technical
Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences (a) Technical
(b) Usage
Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
To make suggestions and recommendations to you about goods or services that may be of interest to you (a) Identity
(b) Contact
(c) Technical
(d) Usage
(e) Profile
(f) Marketing and Communications
(a) Necessary for our legitimate interests (to develop our products/services and grow our business)
(b) Consent

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel a contract you have with us but we will notify you if this is the case at the time.


We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

We may use your personal data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which marketing may be relevant to you.

You may receive marketing communications from us if you have requested information from us or made a purchase from us and you have not opted out of receiving that marketing.

We will get your express opt-in consent before we share your personal data with any third part for marketing purposes.

You can ask us or any third party to stop sending you marketing messages at any time by following the opt-out links on any marketing messages or by contacting us at any time. If you opt-out of receiving these messages, this will not apply to personal data provided to us as a result of a purchase you have made, a sale to us, warranty registration, service experience or other transactions.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Who we share your personal data with

We do not share your data with any other third parties except in circumstances where:

  • if you have given your consent.
  • if it is necessary to enable the provision of third party services you have requested (for example to facilitate warranty, insurance or finance quotes or agreements).
  • if we are under a duty to comply with any legal obligation.

Third party recipients of your data

We may share your personal data with the parties set out below for the purposes set out in the table above.

  • Third parties who provide elements of our business management services for us, who process or store personal data on our behalf. The categories of these recipients are accounting, marketing, software, and website providers.
  • BMW Financial Services (GB) Limited, trading as Alphera Financial Services, who may provide finance options if you are purchasing a vehicle from us.
  • Codeweavers Limited, who provide tools on our website to assist you in choosing a vehicle to purchase and identifying the financial options available to you.

We have contracts in place with our data processors to ensure they are looking after your data to GDPR standards, which means they cannot use, share or do anything with your personal data unless we have instructed them to do so.

We may also share your personal data with third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Policy.

Vehicle documents

Any documents which arrive with a vehicle when it is taken into stock may be shown to any potential buyers and handed to any new owner to ensure the provenance of the vehicle.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they will be subject to a duty of confidentiality.

We have in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Retention periods

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting and other requirements.

Unless otherwise listed below, certain personal data relating to transactions you enter into with us, including Contact, Identity, Financial and Transaction Data, will be kept for a period of 7 years after you cease to transact with us in order to comply with HMRC requirements.

Personal data processed under consent will be kept for as long as you consent to its processing. We will seek to refresh your consent at appropriate intervals.

In some circumstances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Your rights in regard to your personal data

You have a number of rights in regard to your personal data. If you wish to make any requests in the exercise of your rights please contact us in writing using the contact details at the top of this page.

You will not usually have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us to confirm your identity and ensure your right to access your personal data or to exercise your rights in relation to it. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Right to request access to your personal data

Commonly known as a “data subject access request”, you may request a copy of the personal data which we hold about you.

Right to request correction of your personal data

You may request that any incomplete or inaccurate data we hold about you be corrected, although please note that we may need to verify the accuracy of the new data you provide to us.

Right to request the erasure of your personal data

You may ask us to delete or remove personal data where there is no good reason for us continuing to process it. You can also ask us to delete or remove personal data where you have successfully exercised your right to object to processing (see below). We may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Right to object to the processing of your personal data

Where we are relying on a legitimate interest to process your personal data, you may object to our processing if you believe it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your personal data which override your rights and freedoms.

Right to request the restriction of the processing of your personal data

You may ask us to suspend the processing of your personal data if you want to establish the data’s accuracy, where our use of the data is unlawful but you do not want us to erase it, where you need us to hold the data even if we no longer require it, such as if you need it to establish, exercise or defend a legal claim, or if you have objected to our use of your data but we need to verify whether we an overriding legitimate interest in using it.

Right to request the transfer of your personal data

You may request the transfer of your data to you or a third party. We will provide you, or the relevant third party, with your personal data in a structured, commonly used and machine-readable format. Please note that this only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Right to withdraw consent

Where we have processed your personal data on the lawful basis of consent, you have the right to withdraw this consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Right to complain

If you have any concerns about how we have handled your personal data, please contact us so we may address them.

You also have the right to lodge a complaint with the supervisory authority, the Information Commissioner's Office, about how we manage your data.

International transfers

Some of the external third parties which we use are based outside the European Economic Area (EEA) so their processing of your personal data will involve a transfer of data outside the EEA.

Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

Changes to this policy

We will regularly review this privacy notice and update it where necessary. This policy was last updated in October 2020.


From the 31st December, our showroom is exclusively online. However in the meantime we are able to provide a safe click and collect service whereby you can order over the phone or via email and come to the showroom to collect your car. All of our cars can be reserved with a holding deposit, ready to be collected at a later date at your convenience. To ensure the safety of customers and our staff, all viewings and handovers will be conducted outside to ensure all social distancing measures and Government guidance is met.


All our cars remain available to browse online, 24 hours a day, 7 days a week. Each car page has an enquiry form where you can request more information and receive a finance quotation. In addition, we are able to offer a virtual viewing of any car, via Zoom or Facetime, in advance of any potential visit.


Alternatively, if you’d rather wait and purchase a car from the comfort and safety of your own home, we are offering a contactless delivery service, whereby we will provide:


  • A free delivery service made available to suit your date and time and at your convenience.
  • All invoices including any supporting documentation will be managed by e-sign. Any additional documentation (e.g. vehicle tax confirmation) will be left in the car, or by any other arrangement.
  • Keys will be posted through the door or any other mutually agreed arrangement.


We are constantly reviewing Government guidelines during this uncertain time as the safety and health of our customers and staff is our utmost priority. Please continue to follow us on all social media platforms and our website to ensure you remain fully updated on our current service arrangements.


We remain committed in continuing to provide you with the high levels of service and customer experience that you would expect from Baytree Cars.


Stay safe and we hope to see you all again very soon.


COVID-19 Update