Privacy Policy
CUSTOMER AND WEBSITE PRIVACY NOTICE
How we collect, use, share and protect personal information
Policy information
Details
Effective Date
10 August 2026
Last Reviewed
10 August 2026
Data Controller
H.W. Moon Limited, company number 00682402
Registered Office
Challenge Way, Martland Park, Wigan, WN5 0LD
Privacy Contact
Steven Mather | steven.mather@hwmoon.toyota.co.uk | 01942 219999
H.W. Moon Limited is the data controller for the personal information described in this policy where we decide why and how that information is used.
Company name: H.W. Moon Limited
Company number: 00682402
Registered office: Challenge Way, Martland Park, Wigan, WN5 0LD
Telephone: 01942 219999
General email: sales@hwmoon.toyota.co.uk
Data protection contact: Steven Mather, steven.mather@hwmoon.toyota.co.uk
For some services, another organisation, such as Toyota (GB) PLC, Motability Operations Limited or a finance provider, may be a separate or joint controller. Their own privacy notice will explain how they use information for their purposes.
-
People who enquire about, purchase, lease, finance, sell, part-exchange or test-drive a vehicle.
-
Customers who book servicing, repairs, MOTs, warranty work, roadside support, parts or other aftersales services.
-
Motability customers, nominated drivers, appointees and relevant representatives.
-
Visitors to our premises, website and social-media pages.
-
Recipients of our service messages, surveys, events and marketing communications.
-
Business customers, suppliers, contractors and professional contacts.
-
Identity and contact information
This may include your name, title, date of birth, postal address, email address, telephone number, signature, driving licence information and other identification information.
Vehicle and transaction information
This may include vehicle registration and identification numbers, mileage, vehicle specification, ownership and keeper information, order and invoice details, part-exchange information, service history, repair and warranty records, MOT information, accessories, quotations and correspondence.
Financial and eligibility information
This may include payment details, transaction records, affordability or eligibility information, finance application information and information required for fraud prevention, identity verification, insurance or regulated products. Finance providers and credit-reference agencies may collect or generate additional information under their own privacy notices.
Motability and accessibility information
Where necessary for a Motability enquiry or vehicle adaptation, we may handle information about eligibility, mobility requirements, vehicle adaptations or accessibility needs. Some of this may reveal health information and receive additional legal protection.
Communications and preferences
This includes enquiries, emails, telephone notes or recordings where used, live-chat messages, survey responses, complaints, marketing permissions and channel preferences.
Website, device and advertising information
This may include IP address, browser and device information, pages viewed, referring website, approximate location, cookie or advertising identifiers, form submissions and interactions with our online adverts. We only use non-essential cookies or similar technologies in accordance with the choices presented through our consent tools.
CCTV and premises information
CCTV may record images of people and vehicles visiting our premises for security, safety, crime prevention and the protection of customers, employees and property. Appropriate signs are displayed where CCTV is in operation.
-
Directly from you, including through forms, calls, emails, dealership visits, test drives, orders, bookings and customer surveys.
-
From Toyota group companies and Toyota systems when you ask Toyota to pass an enquiry to us or when we provide franchised-dealer services.
-
From Motability Operations and other scheme participants where you make a Motability enquiry or order.
-
From lenders, brokers, insurers, warranty providers, vehicle manufacturers, roadside-assistance providers and identity or fraud-prevention services.
-
From vehicle-listing websites, lead-generation services, social-media platforms and advertising partners when you submit an enquiry or lead form.
-
From public registers, vehicle and MOT records, credit-reference agencies and other lawful sources where relevant to a transaction.
-
From cookies, analytics tools, CCTV and dealership systems when you use our website or visit our premises.
-
We must have a lawful basis whenever we use personal information. The basis depends on the particular purpose and circumstances.
Purpose:
Responding to enquiries, preparing quotations, arranging test drives and taking steps requested before a contract
Main lawful basis:
Contract or steps before entering a contract; legitimate interests
Purpose:
Selling, leasing, financing, purchasing or part-exchanging vehicles and providing aftersales services
Main lawful basis:
Contract; legal obligation; legitimate interests
Purpose:
Managing bookings, reminders, recalls, warranty work and important service communications
Main lawful basis:
Contract; legal obligation; legitimate interests, including safety and customer service
Purpose:
Processing payments, accounts, tax records and regulatory documentation
Main lawful basis:
Contract; legal obligation; legitimate interests
Purpose:
Finance, insurance and regulated-product introductions or applications
Main lawful basis:
Steps before a contract; contract; legal obligation; legitimate interests
Purpose:
Identity checks, fraud prevention, security, debt recovery and legal claims
Main lawful basis:
Legal obligation; legitimate interests; establishment, exercise or defence of legal claims where relevant
Purpose:
Motability enquiries, orders and adaptations
Main lawful basis:
Contract or steps before a contract; legal obligation; explicit consent or another applicable condition for health-related information
Purpose:
Customer surveys, service improvement, staff training and quality monitoring
Main lawful basis:
Legitimate interests; consent where required
Purpose:
CCTV and premises security
Main lawful basis:
Legitimate interests in safety, security and crime prevention
Purpose:
Website operation, essential cookies and information security
Main lawful basis:
Legitimate interests; contract where relevant; legal obligation
Purpose:
Analytics, advertising cookies and personalised advertising
Main lawful basis:
Consent where required by privacy and electronic-communications law
Purpose:
Email, text, telephone and other direct marketing
Main lawful basis:
Consent where required; legitimate interests and the soft opt-in where legally available
Purpose:
Postal marketing to existing or prospective customers
Main lawful basis:
Legitimate interests, subject to your right to object
Where we rely on legitimate interests, those interests may include operating and improving our dealership, providing effective customer service, maintaining accurate records, securing our systems and premises, preventing fraud, understanding demand and responsibly promoting relevant products and services. We consider necessity, reasonable expectations and the potential effect on individuals before relying on this basis.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.
We do not routinely seek sensitive personal information. However, we may need limited health or accessibility information for Motability, vehicle adaptations, vulnerable-customer support or reasonable adjustments. We only use it where an Article 9 condition applies, such as explicit consent or another condition permitted by law, and we limit access to people who need it.
We may process criminal-offence information only where necessary and legally permitted, for example in connection with fraud prevention, security incidents or legal claims, and with the safeguards required by law.
If you apply for vehicle finance or another regulated product, we may send your application information to the lender or relevant product provider. They may use credit-reference and fraud-prevention agencies and may make automated or partly automated assessments. The lender or provider is responsible for explaining its decision-making, lawful basis, credit searches, retention and your rights in its own privacy notice.
HW Moon does not make solely automated decisions that produce legal or similarly significant effects unless this is permitted by law and appropriate safeguards are in place. Where applicable, you may ask for human intervention, express your point of view and challenge a decision.
We may contact you about vehicles, servicing, events, offers and related products or services where the law allows. We respect the communication choices you make and keep a suppression record where necessary so that we do not contact you again through a channel you have rejected.
-
Email, text and similar electronic marketing will be sent with consent or where the statutory soft opt-in applies.
-
Telephone marketing will be conducted in accordance with applicable preference services and any objection you have made.
-
Postal marketing may be based on our legitimate interests, but you can object at any time.
-
Online advertising may use audiences or measurement services supplied by platforms such as Meta and Google. Where required, this activity depends on your cookie or similar-technology consent.
You can stop direct marketing at any time by using an unsubscribe link, changing the settings offered to you, calling 01942 219999 or emailing preferences@hw-moon.toyota.co.uk. Opting out of marketing will not stop necessary service, safety, contractual or regulatory messages.
-
Our website may use cookies, pixels, tags, local storage and similar technologies. Strictly necessary technologies support functions such as security, navigation and form operation. Optional technologies may provide analytics, measure advertising, remember preferences or support personalised content and adverts.
We will request consent before using non-essential technologies where required. You can accept, reject or change your choices using the website’s cookie controls. Browser settings can also restrict cookies, although doing so may affect website functionality. Our cookie information should identify the specific technologies currently in use, their providers, purposes and durations.
We share information only where necessary, legally permitted and proportionate. Recipients may include:
-
Toyota (GB) PLC, Toyota Financial Services, other Toyota group entities and relevant Toyota service providers.
-
Motability Operations Limited and organisations involved in administering the Motability Scheme.
-
Banks, lenders, brokers, insurers, warranty, roadside-assistance and regulated-product providers chosen by you or relevant to your transaction.
-
DVLA, DVSA, HM Revenue & Customs, the police, courts, regulators and other public authorities where required or permitted by law.
-
Credit-reference, identity-verification, fraud-prevention and payment-service providers.
-
Vehicle transport, repair, valeting, parts, recovery and other suppliers involved in delivering requested services.
-
Providers of dealership-management, customer-relationship, telephony, communications, document, website, hosting, analytics, advertising, survey and IT-security services.
-
Vehicle marketplaces, advertising platforms and lead providers, including where needed to respond to an enquiry or measure an advertising campaign.
-
Professional advisers, auditors, insurers, debt-recovery providers and prospective purchasers or advisers in connection with a business reorganisation or sale.
Some recipients act as processors under our instructions. Others determine their own purposes and act as separate controllers. Where required, we use written contracts and data-sharing arrangements to protect personal information.
-
Toyota (GB) PLC and other Toyota entities may use information for vehicle registration, warranty, recall and safety activity, connected or digital services, customer support, research and marketing in accordance with their own privacy notices. Toyota’s UK privacy information is available at https://www.toyota.co.uk/privacy-policy.
Motability Operations and finance, insurance or warranty providers also issue their own privacy notices. You should read the relevant notice before completing an application or entering into an agreement because those organisations may process information independently from HW Moon.
Some suppliers or platforms may store or access personal information outside the United Kingdom. Where this occurs, we require an appropriate transfer mechanism and safeguards, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful mechanism. Additional technical and organisational safeguards may be used where appropriate.
You may contact us for further information about the safeguards relevant to a particular transfer.
We keep information only for as long as reasonably necessary for the purpose for which it was collected and to satisfy legal, accounting, regulatory, warranty, fraud-prevention, complaint and dispute requirements. Retention may vary according to the record and relationship.
Record type:
Unsuccessful or unprogressed enquiries
Typical approach:
Normally reviewed and deleted or anonymised when no longer needed, subject to marketing preferences and any legal reason to retain them
Record type:
Vehicle sale, purchase, finance-introduction and aftersales records
Typical approach:
Normally retained for the customer relationship and an appropriate period afterwards to meet tax, warranty, regulatory, complaint and legal-claims requirements
Record type:
Marketing permissions and suppression records
Typical approach:
Permission records retained while relied upon; suppression information may be retained for as long as necessary to respect an opt-out
Record type:
CCTV
Typical approach:
Normally retained for a short period unless required for an incident, investigation, insurance matter or legal claim
Record type:
Call recordings, where used
Typical approach:
Retained for a limited period based on training, quality, complaint, regulatory and legal needs
Record type:
Website analytics and advertising data
Typical approach:
Retained according to our configured settings and the relevant cookie or platform information
When information is no longer required, we securely delete it, anonymise it or place it beyond operational use, subject to technical backup cycles and legal restrictions.
We use proportionate technical and organisational measures designed to prevent personal information from being accidentally lost, altered, disclosed, accessed or used without authority. Measures may include access controls, staff training, secure systems, supplier due diligence, backups, monitoring, physical security and incident-management procedures.
No method of transmission or storage is completely secure. If a personal-data breach creates a risk to individuals, we will assess it and make notifications to the Information Commissioner and affected individuals where the law requires.
Depending on the circumstances and lawful basis, you may have the right to:
-
Ask for access to your personal information and receive a copy.
-
Ask us to correct inaccurate or incomplete information.
-
Ask us to erase information where there is no lawful reason to continue using it.
-
Ask us to restrict how information is used in certain circumstances.
-
Object to processing based on legitimate interests or public task.
-
Object at any time to the use of your personal information for direct marketing.
-
Receive certain information in a structured, commonly used and machine-readable format and ask us to transmit it to another organisation where the right to portability applies.
-
Withdraw consent at any time where processing is based on consent.
-
Seek safeguards in relation to certain solely automated decisions.
Your right to object to direct marketing is absolute. If you object, we will stop using your personal information for that purpose.
These rights are not unlimited and exemptions may apply. We may need to confirm your identity before acting on a request. We normally respond without charge and within the period required by law, although additional time or a reasonable fee may be permitted for particularly complex, repetitive or manifestly unfounded requests.
-
Please contact our data-protection contact:
Steven Mather
H.W. Moon Limited
Challenge Way, Martland Park
Wigan
WN5 0LD
Email: steven.mather@hwmoon.toyota.co.uk
Telephone: 01942 219999
If you make a data-protection complaint, we will acknowledge it within 30 days and take appropriate steps to investigate and respond without undue delay, in accordance with applicable law. Please explain what you believe has gone wrong and include enough information for us to identify the relevant records.
You also have the right to complain to the Information Commissioner’s Office. We would appreciate the opportunity to address your concern first, but you may contact the ICO at any time through https://ico.org.uk/make-a-complaint/ or by calling 0303 123 1113.
Our services are not directed at children. We may handle limited information about a young person where necessary and lawful, for example in relation to a nominated driver, a Motability arrangement or an enquiry made by a parent, guardian or authorised representative. We take additional care where children’s information is involved.
Our website and messages may link to websites, apps or services operated by other organisations. Their privacy practices are outside our control and you should read their privacy information before providing personal information. Interactions with our social-media pages may also be visible to and processed by the relevant platform under its own terms and privacy policy.
We may update this policy to reflect changes to our services, systems, suppliers or legal obligations. The current version will be published at https://www.hwmoon.co.uk/privacy-policy with its effective date. Material changes may also be brought to your attention through an appropriate channel.
Questions about this policy or our use of personal information can be sent to steven.mather@hwmoon.toyota.co.uk or addressed to Steven Mather, H.W. Moon Limited, Challenge Way, Martland Park, Wigan, WN5 0LD.