Internet Explorer is not supported. For the best experience use another browser.

General Toyota Privacy And Data Protection Notice

Toyota respects your privacy. Whether you deal with Toyota as a customer, a consumer, a member of the general public, etc., you are entitled to the protection of your personal data. This data may relate to your name, telephone number, email address but also to other data, such as your Vehicle Identification Number (VIN), (geo-)location, etc. (“personal data”).

This General Toyota Privacy and Data Protection Notice (the “General Privacy Notice”) explains how and why we will collect your personal data, what we do with your personal data, with whom we share it, how we protect it, and the choices and actions that you can take concerning your personal data.

This General Privacy Notice applies to the processing of your personal data in the framework of various services, tools, applications, websites, portals, (online) sales promotions, marketing actions, sponsored social media platforms, research and development activities, etc. that are provided or operated by us or on our behalf.

This General Privacy Notice contains general rules and explanations. Where relevant and appropriate, this General Privacy Notice is complemented with separate specific privacy notices relating to particular services, tools, applications, websites, portals, (online) sales promotions, marketing actions, sponsored social media platforms, research and development activities, etc. provided or operated by or on behalf of Toyota. These privacy notices will be communicated to you whenever your personal data is needed in the framework of these various Toyota activities. You can also access them by following the links below directly:

This General Privacy Notice applies to all your personal data collected by (or on behalf of) the Toyota entities mentioned in section 1 below, together referred to in this General Privacy Notice as “Toyota”, “we”, “us” or “our”.

At the end of this General Privacy Notice, you will find some definitions of certain key phrases used in this General Privacy Notice (for example, personal data, processing, data controller…).

We value your personal data entrusted to us and we are committed to processing your personal data in a fair, transparent, and secure way. The key principles Toyota applies are as follows:

 

  • Lawfulness, fairness and transparency: we will only collect your personal data in a fair, lawful, and transparent manner.
  • Data minimisation: we will limit the collection of your personal data to what is directly relevant and necessary for the purposes for which they have been collected.
  • Purpose limitation: we will only collect your personal data for specified, explicit and legitimate purposes and not process your personal data further in a way incompatible with those purposes.
  • Accuracy: we will keep your personal data accurate and up to date.
  • Data security and protection: we will implement technical and organisational measures to ensure an appropriate level of data security and protection considering, among others, the nature of your personal data to be protected. Such measures provide for the prevention of any unauthorised disclosure or access, accidental or unlawful destruction or accidental loss, or alteration and any other unlawful form of processing.
  • Access and rectification: we will process your personal data in line with your legal rights.
  • Retention limitation: we will retain your personal data in a manner consistent with applicable UK data protection laws and regulations and no longer than is necessary for the purposes for which they have been collected.
  • Protection for international transfers: we will ensure that your personal data is adequately protected when transferred outside Europe.
  • Safeguards towards third parties: we will ensure that personal data access by (and transfers to) third parties are carried out in accordance with applicable UK law and with suitable contractual safeguards.
  • Lawfulness of direct marketing and cookies: when we send you promotional materials or place cookies on your device, we will ensure that we do so in accordance with applicable UK law.

The entities which are responsible for the processing of your personal data are:

 

Toyota (GB) PLC (“TGB”)
Great Burgh
Burgh Heath
Epsom
Surrey
KT18 5UX
UK

 

Toyota Motor Europe NV/SA (“TME”),
Avenue du Bourget/Bourgetlaan 60
1140 Brussels
Belgium

 

The authorised national Toyota retailers/repairers, as listed here (Opens in new window)

 

When processing your data, and depending on the purpose, described in this document, TGB may act individually or collaborate with TME and/or the retailer as joint controllers (Art. 26 GDPR).

 

With regard to the processing of your data, this means:

 

  • Your contractual partner (normally, the Retailer) is generally responsible for the proper (initial) collection of your personal data, the proper entry and maintenance in our systems, and ensuring that there is an appropriate legal basis for the processing of your data. In addition, the contractual partner will generally inform you in accordance with Articles 13 and 14 GDPR about the specific processing operations and your rights as a data subject. This is ensured in particular by this data protection information.
  • TGB and TME are responsible for storing and managing personal data in Toyota systems. This includes ensuring comprehensive state-of-the-art IT security measures and quality standards. TGB is also the primary point of contact for all your questions as a data subject regarding data protection at Toyota. However, data protection rights can be asserted both with your Retailer and with TGB and TME.
  • The parties shall immediately inform each other of any legal positions asserted by data subjects. They shall provide each other with all information necessary to respond to requests for information.

We process the personal data of the following categories of data subjects:

  • persons visiting our website(s) or tools;
  • persons who download and use the MyToyota app;
  • persons who visit or contact us for test drives, offers, etc; 
  • persons who place an order with us;
  • persons who purchase a product or service with us;
  • persons who contact us for an inquiry;
  • persons whose personal data we have obtained through third parties (such as Social Media Channels) to use for Sales and Marketing purposes;
  • persons whose personal data we have obtained through third parties (such as universities and their researchers) to use for research & development purposes.

Depending on the purpose, described in section 5 of this document, we process the following categories of data:

  • Identity data: Information that tells us who you are, for example, your name or surname and title.
  • Contact data: this includes mobile number, email address, postal address.
  • Account data: for example, preferred contact information, communication language preference, authorised retailer / dealer preference, usage related data (e.g. login statistics, error message tracking).
  • Transactional data: details about your dealings with us, such as when you bought your car and any maintenance or service work done, or a test drive that you have booked with us.
  • Contract data: for example, which contracts you entered, when and when they are expiring.
  • Unique codes or numbers used by our systems: for example, cookie IDs, that help us recognize your device or account without using your name.
  • Location data: geolocation information that can pinpoint a user's location.
  • Vehicle data: for example, VIN information, technical vehicle data such as mileage, fuel consumption, warnings and diagnostic data (e.g., system failures and warning lights)
  • Website behaviour: for example, which vehicles you have configured on an online journey, which items you have pre-selected in the basket.
  • IP Address: Internet Protocol addresses that can be used to identify the user's device.
  • Browsing history: for example, data regarding the websites visited, including search queries and pages viewed.
  • Device data: details about the user's device, including operating system and browser type.
  • Survey data: your feedback and opinions about our products or services, collected through surveys.
  • Security-related data: information about the use of our digital systems and tools is collected to help ensure their safety and security—protecting your personal data and providing you with a secure digital experience.
  • Data relating to your privacy preferences: including, date you give your consent, what you consented to, date on which you withdrew your consent, how consent was given (e.g.  from which device).
  • Enquiries / Complaints: what you tell us when you contact us with a question or a complaint.

 

Whenever we require your personal data, we will clearly inform you which of your personal data we collect. This information may also be provided to you through a separate Privacy Notice which will be included in specific services, electronic newsletters, reminders, surveys, offers, invitations for events, etc.

 

You don’t have to give us all the personal data we ask for—some details are completely up to you. However, if you choose to share more information with us, we can use it to make our services and offers more relevant and helpful for you.

 

Concerning the accuracy of your personal data:

 

It is important for us to maintain accurate and up-to-date records of your personal data. Please inform us of any changes to or errors in your personal data as soon as possible by contacting us at the Data Protection Contact Point (privacy@tgb.toyota.co.uk). We will take reasonable steps to make sure that any inaccurate or outdated personal data is deleted or adjusted accordingly.

Your personal data can be processed only if based on the following legal grounds:

  • you have given us your consent for the purposes of the processing (as described in the privacy notice related to that processing). For the avoidance of doubt, you will always have the right to withdraw your consent at any time; or
  • it is necessary for the performance of a contract to which you are a party; or
  • we pursue a legitimate interest that is not outbalanced by your rights for the purposes of the processing (as described in the privacy notice related to that processing). For the avoidance of doubt, you will always have the right to object against legitimate interest-based marketing activities;
  • we have a legal obligation to the processing; or
  • processing is necessary for the performance of a public task.

We will only process your personal data for specific, explicit and legitimate purposes.  We will not process your personal data in ways that are not compatible with these purposes.

 

We will keep your personal data in line with applicable data protection law. We will only keep your personal data for as long as necessary for the purposes for which we process your personal data or to comply with the law.

 

For information on how long certain personal data is likely to be kept before being removed from our systems and databases, please contact us at the Data Protection Contact Point (see Point 10 “Who can you contact in case you have questions or requests?”).

 

We collect and use your personal data for various purposes, including but not limited to, the following:

 

Data Management

Purpose:

To ensure consistent, accurate, and efficient handling of your customer information, as joint data controllers TME and TGB manage and process certain personal data. This includes exchanging relevant customer data and using shared IT platforms, databases, and support systems. Working with joint systems allows us to maintain uniform data quality, coordinate our services, streamline internal processes, and provide you with seamless support across all entities. If you have submitted your personal data to multiple data controllers, it may be consolidated, processed and stored.

 

This serves the following purposes:

  • To manage your personal data effectively (for example, centralising your personal data allows us to keep it more current and accurate).
  • To provide you with the best possible customer experience.
  • To support and facilitate certain activities described in this section " What do we use your personal data for and for how long do we keep it?"
  • To manage your consent(s) and objections (for example, to track whether you have agreed to receive marketing materials from us).

Lawful Basis

  • The performance of a contract.
  • Our legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes and to provide and receive updated information to/from our retailers and repairers

Categories of Data:

  • Identity data
  • Contact data
  • Account data
  • Transactional data
  • Contract data
  • Unique codes or numbers used by our systems
  • Location data
  • Vehicle data
  • Website behaviour
  • IP Address
  • Browsing history
  • Device data
  • Survey data
  • Security-related data
  • Data relating to your privacy preferences
  • Enquiries / Complaints

Retention Period:

We process your data for data management as long as any other purpose allows us to keep your data.

 

 

Creation of a Joint Customer ID

Purpose:

To identify you uniquely and effectively we share data across Toyota entities - such as Toyota Financial Services, Toyota Insurance Management, KINTO - in case you are a joint customer. To manage your personal data effectively (for example, centralising your personal data allows us to keep it accurate and up-to-date).

 

Lawful Basis:

  • The performance of a contract.
  • Our legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes and to provide and receive updated information to/from our retailers

Categories of Data:

  • Identity data
  • Contact data

Retention Period:

We share your data for the time necessary to achieve the described purpose.

 

 

Data Sharing with other Toyota Entities

Purpose:

We may share certain personal data with other Toyota group companies such as Toyota Financial Services, Toyota Insurance Management, KINTO to offer you a smoother, more personalised experience. For example, if you configure a vehicle online, Toyota Financial Services may use that data (with your specific consent to that entity) to provide tailored financing options. This helps deliver more relevant offers, consistent service, and a connected experience across all Toyota touchpoints.

Lawful Basis:

  • Your consent to share data

Categories of Data

  • Identity data
  • Contact data
  • Account data
  • Transactional data
  • Contract data
  • Unique codes or numbers used by our systems
  • Location data
  • Vehicle data
  • Website behaviour
  • IP Address
  • Browsing history
  • Device data
  • Survey data
  • Security-related data
  • Data relating to your privacy preferences
  • Enquiries / Complaints

Retention Period:

We share your data for the time necessary to achieve the described purposes.

 

 

Order Management

Purpose:

To process your order and ensure delivery and invoicing of the product or service you requested.

 

Lawful Basis:

  • The performance of a contract.
  • Our legitimate interest to address claims and exercise our rights.

Categories of Data:

  • Account data
  • Identity data
  • Transactional data
  • Contract data

Retention Period:

We store your data for up to 10 years after the termination of the contract

 

 

Website Visits

Purpose:

  1. To improve your visit on our websites or portals (performance or analytical cookies).
  2. To record your visit to and interactions with our website so that our website, marketing, and advertising are more relevant to your interests (targeting cookies).
  3. To enable the website to provide enhanced functionality and personalisation (functional cookies).
  4. To keep our websites and portals running and operating for you (strictly necessary cookies).

 

Please refer to the Cookie Policy for additional information on the specific cookies deployed and their purposes.

Lawful Basis:

1., 2., 3.: Your consent for opt-in-based cookies.

4. Legitimate interest

 

Categories of Data:

  • Unique codes or numbers used by our systems
  • Identity data
  • Contact data
  • Location data
  • IP address
  • Browsing history
  • Device data

Retention Period:

See our Cookie Policy for details on the retention periods for all the different kind of cookies.

 

 

Communication

Purpose:

To conduct marketing activities:

  • Reminders: We use your personal data to send important service and maintenance alerts—like annual Ministry of Transport (MOT) tests, or to remind you that a commercial product or service associated with your vehicle, such as a warranty, is due to expire, to help keep your vehicle safe and reliable.
  • Offers: You may receive personalised mobility and vehicle-related offers on behalf of Toyota and the Toyota Group companies (i.e. companies that belong to Toyota Motor Europe, Toyota Financial Services, KINTO, Toyota Insurance) tailored to you and your vehicle. These product and service promotions can relate to new and used vehicles, servicing, parts and accessories, finance and insurance, connected services and other mobility-related services. on behalf of Toyota Group companies (i.e. companies that belong to Toyota Motor Europe, Toyota Financial Services, KINTO, Toyota Insurance) tailored to you and your vehicle. These product and service promotions can relate to new and used vehicles, servicing, parts and accessories, finance and insurance, connected services and other mobility-related services.
  • Events: We’ll keep you informed about relevant events, such as model launches or birthday-related invitations, always meaningful, never spam.
  • Marketing Surveys: We may contact you to ask for voluntary feedback through surveys to better understand your experience and improve our products and services.

Lawful Basis:

  • Our legitimate interest
  • Your consent

Purpose:

Contract-related reminders: To keep you informed by sending you important reminders about your existing contract with us. For example, we aim to notify you about:

  • the status of the delivery of your new car
  • a maintenance reminder included in your contract
  • a payment due
  • a contract coming to an end

 

Lawful Basis:

  • The performance of a contract.

 

Categories of Data:

  • Identity data
  • Contact data
  • Account data
  • Transactional data
  • Contract data
  • Unique codes or numbers used by our systems
  • Location data
  • Vehicle data

Retention Period:

  • We keep your data as long as you agree to be subject to marketing activities.
  • If you have a contract with us and you have not withdrawn your consent, we keep your data until 10 years after the contract is terminated.

 

 

(Enhanced) Customer Profile

Purpose:

To conduct basic profiling activities: We evaluate and analyse certain elements of the information we collect about you to build a basic customer profile that informs our sales activities. This allows us to tailor our communications—such as reminders, offers, events, and surveys—to be more relevant to you. While we may group you into broader customer segments, we do not create a comprehensive customer profile using detailed personal information.

 

Lawful Basis:

Our legitimate interest

Purpose:

To conduct advanced profiling activities which make use of sophisticated techniques for deep analysis of your customer profile, e.g. cross-device identification and/or AI. These activities involve evaluating the information you provide, along with data collected through your interactions with Toyota (e.g. dealership visits, use of our websites, the MyToyota or LexusLink+ app, Connected Services), and data received from other Toyota entities or trusted third parties.

 

The applied techniques allow us to develop a more comprehensive understanding of your preferences and behaviours across channels and devices. For example, we may use predictive analytics to anticipate your future needs—such as when you might be interested in a new vehicle or service—based on your past interactions with us. This enables us to deliver highly personalised and timely communications, offers, and experiences that are tailored to your individual interests, enhancing your overall customer journey with Toyota.

Lawful Basis:

Our Legitimate Interests
Categories of Data:
  • Identity data
  • Contact data
  • Account data
  • Transactional data
  • Unique codes or numbers used by our systems
  • Location data
  • IP Address
  • Browsing history
  • Website behaviour
  • Device data
  • Vehicle data

Retetion Period:

  • We keep your data as long as you agree to be subject to profiling.
  • If you have a contract with us and you have not withdrawn your consent, we keep your data until 10 years after the contract is terminated.

 

 

 

Customer Satisfaction

Purpose:

To collect your opinion and satisfaction as a customer / prospect with regards to Toyota products and services you have purchased or inquired on (customer satisfaction surveys).

Lawful Basis:

  • Consent
  • Legitimate interest

Categories of Data:

  • Identity data
  • Contact data
  • Transactional data
  • Survey data

Retention Period:

A period of up to 3 years after the completion of the survey.

 

 

Enquires & Complaints

Purpose:

To answer to your enquiries or complaints.

Lawful Basis:

  • The performance of a contract.
  • Our legitimate interest to handle enquiries and complaints and to address claims and exercise our rights

Categories of Data:

  • Identity data
  • Contact data
  • Contract data
  • Vehicle data
  • Enquiries / Complaints

Retention Period:

If you are a customer: A period of up to 10 years starting as of when we have received the enquiries or complaints.

If you are a prospect: A period of 5 years starting as of when we have received the enquiries or complaints.

 

 

IT Security

Purpose:

To ensure the confidentiality, integrity and availability of our systems and services.

Lawful Basis:

  • When necessary for us to comply with a legal obligation
  • Our legitimate interest to protect the confidentiality, integrity and availability of our systems and services

Categories of Data:

  • Security-related data

Retention Period:

A period up to 24 months, that may vary by country. We may keep the data longer if:

  • Necessary as part of an ongoing investigation into a cyber security incident;
  • Necessary for us to conduct audits of the security of our systems, applications or networks.

 

 

Proudct Improvement

Purpose:

To monitor, analyse, innovate, and improve the quality and performance of our products and services, as well as the products and services of our Partners.

Lawful Basis:

  • Your consent*
  • Our legitimate interest*

* To achieve the purpose of product improvement, Toyota relies on different legal bases depending on the context in which your personal data is collected:

  • Legitimate interest: when data is collected at the dealership and is not collected from a connected vehicle.
  • Consent: when data is collected from a connected vehicle. Consent is provided, and can be withdrawn, in the app.

Specific documentation is provided at the moment of data collection. The distinction in legal basis is due to the specific and more stringent legal requirements that apply to connected vehicle data.

Categories of Data:

  • Location data
  • Vehicle data
  • Transactional data

Retention Period:

  • We keep the data for a period of up to 10 years from the date we collected the data.
  • If the data is kept longer, then you will be informed of these retention periods via specific privacy notices.

 

 

Privacy Preferences

Purpose:

Keeping record of your privacy preferences.

Lawful Basis:

  • Where necessary to comply with our legal obligations under applicable data protection laws.
  • Our legitimate interest and the legitimate interest of the Toyota entity of your country of reference / your retailer to adequately manage your privacy preferences.

Categories of Data:

  • Data relating to your privacy preferences

Retention Period:

  • We store your data until your record is in our systems.

 

 

Dispute or Investigation

Purpose:

If reasonably necessary in connection with a dispute or an investigation in which we are or may become involved either directly with you or with a third party.

Lawful Basis:

  • Legitimate interest.
  • When necessary for us to comply with a legal obligation.

 

Categories of Data:

  • Identity data
  • Contact data
  • Location data
  • Account data
  • Vehicle data
  • Security-related data
  • Contract data
  • Enquiries / Complaints

Retention Period:

We will only retain data for this purpose on a case-by-case basis when the need arises and keep it for the time necessary to address the dispute.

 

Authority Request

Purpose:

When requested by law enforcement authorities, regulators, or courts, we may be compelled to share your personal data with them.

Lawful Basis:

  • When necessary for us to comply with a legal obligation.
  • The legitimate interest for us and society in general to honour data disclosure requests from law enforcement authorities, regulators, or courts

Categories of Data:

  • Identity data
  • Contact data
  • Location data
  • Account data
  • Vehicle data
  • Security-related data

Retention Period:

  • By default, we will not retain data for this purpose, and we will only pass it on as and when requested to by law enforcement authorities, regulators or courts, keeping it for the time necessary to address the Authority request.

 

 

Legal Obligation

Purpose:

To meet legal obligations. This includes retaining billing information for tax and accounting purposes, conducting vehicle safety assessments, and complying with EU regulations such as the On-Board Fuel and Energy Consumption Monitoring (OBFCM) Regulation.

Please note that, with respect to OBFCM-related processing, you have the right to object to the processing via the channels indicated in par. 11 below.

Lawful Basis:

  • When necessary for us to comply with a legal obligation.

 

Categories of Data:

  • Identity data
  • Contact data
  • Account data
  • Vehicle data
  • Transactional data

 

Retention Period:

For as long as we are legally obliged to keep the data.  The retention requirements vary from one country to the other, however in the UK, the general rule is that data is retained for 7 years following the end of the relevant fiscal year. For vehicle safety risk assessments linked with recall campaigns, certain data is kept for up to 40 years.

 

 

Campaign Performance

Purpose:

To evaluate the effectiveness of our marketing campaigns and improve them, thus delivering greater value and relevance to the customer.

Lawful Basis:

  • Our Legitimate Interest to improve our campaigns and business proposals

Categories of Data:

  • Identity data
  • Contact data
  • Unique codes or numbers used by our systems
  • Type/Brand of vehicle

Retention Period:

  • For the duration of the campaigns and 5 years thereafter.

 

We always strive to share a minimal amount of personal data to data recipients, only for specific, defined and legitimate purposes and wherever possible in an anonymous or aggregated way.

Depending on the purposes for which we collect your personal data, we may disclose it to the following categories of recipients, which will then process your personal data only within the framework of these purposes:

 

6.1. Within our organisations and our brand environment (non-exhaustive list):

  • Members of our authorised retailers/repairers which you have indicated as preferred authorised retailers/repairers or which are located near you (based on your postcode, address) or which you have been in contact with;
  • Toyota Financial Services;
  • Toyota Insurance Management;
  • KINTO, our mobility company;
  • Toyota Connected Europe Limited, 2nd Floor 80 Turnmill Street, London, England, EC1M 5QU, United Kingdom;
  • Toyota Manufacturing Companies.

 

6.2. Business partners which process data on our behalf (data processors):

  • Advertising, marketing and promotional agencies: These partners help us create and evaluate the effectiveness of our advertisements and promotions or to send you marketing materials.
  • Business partners: Trusted companies that use your personal data to provide services or products you requested, for example sending you a brochure.
  • Service providers of Toyota: Companies that offer services for Toyota, such as IT services, for example for marketing automation, customer care, data storage, cyber security, analytics.
  • Research & Development partners: Institutions or companies that do R&D for scientific purposes or for Toyota to improve and innovate our products and services. For example alliance manufacturing partners, suppliers, universities.

 

6.3. Other third parties:

  • when required by law or where permitted by law we may exceptionally share personal data with law enforcement authorities, regulatory authorities, courts or other authorities. For example, we may have to disclose personal data:
    • to a law enforcement authority when that law enforcement authority requests such data;
    • to a court in connection with a dispute that Toyota is involved in;
    • to the to the appropriate regulatory authorit(y)(ies) under applicable law (e.g. public authorities for recall campaign activities);
  • in connection with corporate transactions: in the context of a transfer or divestiture of all or a portion of its business, or otherwise in connection with a merger, consolidation, change in control, reorganisation or liquidation of all or part of Toyota’s business.

 

Please be aware that recipients–especially service providers who may offer products and services to you through Toyota services or applications or via their own channels– may separately collect personal data from you. In such case, these parties will provide you with separate information and are solely responsible for the protection of such personal data and your dealings with them will fall under their terms and conditions.

If you login into a Toyota tool (like a website or portal) using a social media platform (such as Facebook), Toyota will collect the personal data from that social media platform. By using your social media account to log in, you are giving permission for Toyota to access and use this information.

 

You may engage with Toyota-owned pages on social media platforms like X (formerly Twitter) and Facebook to share content that may constitute personal data (for example, comments, reviews, opinions).  Be aware that these platforms have their own rules. Posting on social media can impact your privacy and that of others. Once content is posted, it may be difficult to remove it. You are responsible for your posts, and Toyota is not liable for any issues arising from your social media activity.

Your personal data may be transferred to recipients which may be outside the UK and may be processed by us and these recipients outside the UK. In connection with any transfer of your personal data to countries outside the UK that do not generally offer the same level of data protection as in the UK, Toyota will implement appropriate specific measures to ensure an adequate level of protection of your personal data. These measures can for instance consist in agreeing with recipients on binding standard contractual clauses from the European Commission, attaching the UK Addendum, or an International Data Sharing Agreement, guaranteeing such adequate level of protection.

 

We will always clearly inform you whenever your personal data would be transferred outside the UK. This information will be provided to you through a separate privacy notice which will, for example, be included in a specific communication such as electronic newsletters, reminders, surveys, offers, invitations for events, etc.

We have a set of technical and organisational security measures in place to protect your personal data against unlawful or unauthorised access or use, as well as against accidental loss or damage to their integrity. They have been designed considering our IT infrastructure, the potential impact on your privacy and the costs involved and in accordance with current industry standards and practice.

 

Your personal data will only be processed by a third-party data processor if that data processor agrees to implement and maintain technical and organisational data security measures that are no less protective than the technical and organisational data security measures that Toyota has in place.

 

Maintaining data security means protecting the confidentiality, integrity, and availability of your personal data:

  1. Confidentiality: we will protect your personal data from unwanted disclosure to third parties.
  2. Integrity: we will protect your personal data from being modified by unauthorised third parties.
  3. Availability: we will ensure that authorised parties are able to access your personal data when needed.

 

We have implemented a wide range of security measures, including organisational measures such as governance and accountability structures, personnel measures like training and awareness programmes, technical safeguards such as encryption, access controls and system integrity checks, and physical protections for facilities and devices.

Depending on and subject to applicable laws, you have certain rights under the UK General Data Protection Regulation (“UK GDPR”) regarding the personal data we process about you. These rights include the following:

 

10.1. Right to be informed (Art. 12 – 14 UK GDPR)

You have the right to be provided with clear, transparent, and easily understandable information about how we use your personal data, and your rights related thereto. This is in part why we are providing you with the information in this General Privacy Notice.

 

10.2. Right of access by the data subject (Art. 15 UK GDPR)

You have the right to obtain access to your personal data. You may wish to access your personal data to confirm our use in accordance with applicable data protection laws. 

 

10.3. Right to rectification (Art. 16 UK GDPR)

You are entitled to have your personal data rectified if they are inaccurate or incomplete.  

 

10.4. Right to erasure (Art. 17 UK GDPR)

This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there is no compelling reason for us to keep using it. Please note that this is not an absolute right and exceptions apply.  

 

10.5. Right to restriction of processing (Art. 18 UK GDPR)

You have rights to block or prevent further use of your personal data. When processing is restricted, we can still store your personal data, but our use of your personal data will be restricted. 

 

10.6. Right to data portability (Art. 20 UK GDPR) 

You have the right to obtain and reuse your personal data for your own purposes across different services. For example, if your relationship with Toyota ends, this right enables you to move, copy or transfer your personal data easily between our IT systems and those of another service provider, without affecting its usability. Please note that this is not an absolute right and exceptions apply. Also, this right can be applied only in certain circumstances and provided it does not adversely affect others’ rights (for example, it can be applied regarding the personal data you provided to us, which we processed to fulfil our contract with you). 

 

10.7. Right to object (Art. 21 UK GDPR)

Where the processing is based on our legitimate interest, you have the right to object to such processing (unless we have a compelling and legitimate reason to continue processing your personal data). 

 

You also have the right to object at any time to the processing of your personal data for direct marketing purposes including profiling to the extent that it is related to such direct marketing purposes.

 

If our processing of your personal data is based specifically on your consent, you have the right to withdraw that consent at any time. 

 

10.8. Right not to be subject to automated decision making (Art. 22 UK GDPR)

You have the right not to be subject to a decision that is based solely on automated processing (including profiling) and that produces legal effects for you or similarly significantly affects you. Such processing is only permitted if it is necessary for entering into or performing a contract, authorised by UK law, or based on your explicit consent.

 

In these cases, we implement suitable measures to safeguard your rights and freedoms and legitimate interests, including the right to obtain human intervention, to express your point of view, and to contest the decision.

 

10.9. Right to file a complaint with a data protection authority

You have the right to lodge a complaint about the way we handle or process your personal data with your national data protection authority.

We have organised a Data Protection Contact Point which will handle your questions or requests relating to this General Privacy Notice, any specific privacy notice, or your personal data (and its processing).

For any questions, requests or complaints concerning the application of this General Privacy Notice or to exercise your rights, as described in this General Privacy Notice, you may contact us at the Data Protection Contact Point via:

 

Email: privacy@tgb.toyota.co.uk

 

Or

Post:
Toyota (GB) PLC
For the attention of: Data Protection Officer
Great Burgh
Burgh Heath
Epsom
Surrey
KT18 5UX

 

When you contact the Data Protection Officer, we may ask you to provide certain personal data (such as your name, contact details, or customer reference number) to verify your identity and ensure that we are addressing your request appropriately and securely. If applicable it is recommended to specify the relevant 17-digit Vehicle Identification Number (VIN), to enable us to act on any collected vehicle data. This information will only be used for the purpose of handling your inquiry or request and will be processed in accordance with this General Privacy Notice.

If you purchase a car or another product or service from one of our authorised retailers/repairers or if you give them your personal data you will have a separate relationship with this authorised retailer/repairer. In this case, they become the data controller of your personal data regarding their use of your personal data, possibly together with us. For all questions or requests about the collection and use of your personal data by one of the authorised retailers/repairers, please contact them directly.



How is your preferred authorised retailer/repairer identified?

 

The preferred authorised retailer/repairer is:

  1. the authorised retailer/repairer that you have selected as your preferred one via the settings of your MyToyota account (which you can change at any time); or
  2. in case you did not make such selection, we will identify an authorised retailer/repairer based on location (the nearest to you based on your postcode, address) or based on the history of your contacts with our network.

Toyota may amend this General Privacy Notice at any point in time. Where this happens, we may alert you of any changes. You can also check this General Privacy Notice periodically on https://www.toyota.co.uk to inform yourself of any changes.

 

This General Privacy Notice dates from March 2026.

If there is any conflict or inconsistency between a provision of this General Privacy Notice and a provision of a specific Privacy Notice, the specific Privacy Notice will prevail.

 

The requirements of this General Privacy Notice supplement, and do not replace, any other requirements existing under applicable data protection law. In case of contradiction between what is written in this General Privacy Notice and requirements in  applicable data protection law, then requirements in Data Protection Laws will have priority.

In this General Privacy Notice, the following terms have the following meanings:

  1. Data controller means the organisation which determines the purposes for which, and the way, your personal data is processed.
  2. Data processor means the person or organisation which processes your personal data on behalf of the data controller.
  3. Data Protection Contact Point means the contact point (i.e., a person appointed by Toyota in the relevant jurisdiction) where you can address, to the data controller, your questions or requests regarding this Policy and/or (the Processing of) your personal data and which will handle such questions and requests. Unless we inform you otherwise, the Data Protection Contact Point can be reached as described in Point 11 “Who can you contact in case you have questions or requests?”).
  4. Data protection laws means any EU data protection and privacy law, including UK data protection law and, to the extent applicable, the data protection or privacy laws of any other country equivalent to EU privacy and data protection standards.
  5. Data subject means an identified or identifiable living individual to whom personal data relates.
  6. GDPR means Regulation 2016/679 on the Protection of natural persons with regards to the processing of personal data and on the free movement of such data, including the equivalent legislation in the United Kingdom.
  7. Personal data means any data relating to you directly or which allows your identification, such as, for example, your name, telephone number, email address, Vehicle Identification Number (VIN), (geo-)location, etc.
  8. Processing means the collection, accessing and all forms of use of your personal data.
  9. UK GDPR means the General Data Protection Regulation ((EU) 2016/679)), as adopted into UK law by the European Union (Withdrawal) Act 2018, and as amended by domestic legislation from time to time.

Unsubscribe here
Find a Dealer Explore the range