1. About This Privacy Policy

This Privacy Policy applies whenever you interact with First Choice Mobility Ltd, including when you:

• visit or use our website;
• purchase goods from us online, by telephone or in one of our stores;
• request a quotation or product information;
• contact us by telephone, email, website form, post or social media;
• visit one of our retail stores;
• request a product demonstration or assessment;
• arrange a delivery, collection, service or repair;
• make a warranty or after-sales enquiry;
• apply for VAT relief on eligible products;
• subscribe to our marketing communications; or
• otherwise provide personal information to us.

We process personal information in accordance with applicable UK data protection legislation, including the
UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable,
the Privacy and Electronic Communications Regulations 2003 (PECR).

This Privacy Policy should be read alongside our Terms & Conditions, Cookie Policy and any other privacy
information or notices that we may provide to you at the time we collect your information.

2. Who We Are

For the purposes of UK data protection law, the organisation responsible for deciding how and why your personal
information is processed is:

In most circumstances, First Choice Mobility Ltd acts as the
data controller. This means that we determine the purposes and means by which your personal
information is processed.

3. Our Approach to Your Personal Information

We aim to collect and use only the personal information that we genuinely need in order to provide our products
and services, operate our business and meet our legal obligations.

When we process personal information, we aim to ensure that it is:

• used lawfully, fairly and transparently;
• collected for clear and legitimate purposes;
• adequate, relevant and limited to what is necessary;
• kept accurate and, where necessary, updated;
• retained only for as long as reasonably necessary;
• protected using appropriate technical and organisational safeguards; and
• handled in a way that respects your rights under data protection law.

4. What Personal Information Do We Collect?

The information we collect depends upon how you interact with us. We may collect, use, store and otherwise
process the following categories of personal information.

4.1 Identity and Contact Information

This may include:

• your name and title;
• billing address;
• delivery address;
• email address;
• telephone and mobile telephone numbers;
• company, organisation or care-home details where relevant; and
• details of an authorised representative, carer, family member or other contact where appropriate.

4.2 Order and Transaction Information

This may include:

• products purchased or ordered;
• order numbers and invoice details;
• order value;
• payment status;
• delivery and collection information;
• refunds, returns and cancellations;
• warranty information;
• repair and servicing history;
• communications relating to your order; and
• other information necessary to fulfil your purchase or provide after-sales support.

4.3 Payment Information

When you make a payment, certain payment information will be processed in order to complete the transaction.
Online card and other electronic payments may be processed by specialist third-party payment service providers.

We do not ordinarily receive or retain your complete payment-card details when a payment is processed through
one of our external payment providers. Instead, the payment provider processes the relevant card or account
information and provides us with information confirming the transaction, such as the payment status,
transaction reference and amount paid.

Where payments are taken by telephone or in one of our stores, payment information is handled only as necessary
to complete the transaction and in accordance with the security requirements applicable to the relevant
payment system.

4.4 Website Account Information

If you create an account on our website, we may retain information associated with that account, including:

• your name;
• email address;
• billing and delivery addresses;
• account username;
• order history;
• saved account preferences; and
• other information you choose to provide through your account.

Passwords are intended to be stored in a protected form and are not available to our staff as readable
plain-text passwords.

4.5 Enquiries and Communications

If you contact us, we may retain details of the communication and any information you provide. This can include:

• emails;
• telephone enquiries and notes relating to conversations;
• website contact-form submissions;
• letters and other correspondence;
• product enquiries;
• quotation requests;
• complaints;
• customer-service enquiries;
• warranty enquiries; and
• communications through social-media platforms.

4.6 Delivery, Installation and Collection Information

Where we arrange delivery, installation, collection, servicing or repair of a product, we may process information
such as:

• your delivery or collection address;
• contact telephone number;
• preferred or agreed delivery arrangements;
• access information that you choose to provide;
• delivery instructions;
• information needed by our staff, manufacturer or courier to complete the service safely and effectively; and
• proof of delivery or collection.

4.7 VAT Relief and Health Information

When you claim VAT relief, we may collect information including:

• your name;
• your address;
• the nature of your disability, chronic illness or qualifying condition where this is required;
• confirmation that the goods are being purchased for your personal or domestic use;
• your VAT relief eligibility declaration;
• information identifying the eligible goods or services supplied; and
• the date and other details of the declaration.

We do not ask you to provide more medical information than is reasonably necessary for the relevant VAT relief
process. Information supplied in connection with a VAT relief declaration is used for administering the
VAT-relieved transaction, maintaining the records required in connection with that transaction and responding
to any appropriate enquiry concerning the VAT treatment of the sale.

We treat health information with particular care and restrict access to personnel and service providers who
have an appropriate reason to access it.

Our legal grounds for processing personal information, including the additional requirements that apply to
health information, are explained in the
“Lawful Bases for Processing Your Information” section below.

4.8 Product Advice and Assessment Information

When you ask us to help identify a suitable mobility or independent-living product, you may voluntarily tell us
information about your needs, circumstances or intended use of the product.

Depending on the nature of your enquiry, this could include information relating to mobility, physical requirements
or other health-related matters. We will only seek information that is reasonably relevant to assisting you and
will handle health-related information as special category personal data.

Our staff provide product information and guidance based on the information made available to them. Unless
expressly stated otherwise, our advice is not medical advice and is not a substitute for advice from a doctor,
occupational therapist or other appropriately qualified healthcare professional.

4.9 Website and Technical Information

When you use our website, certain technical information may be collected automatically. Depending on your
device, browser and cookie choices, this may include:

• IP address;
• browser type and version;
• device type;
• operating system;
• pages viewed;
• dates and times of visits;
• referring website or source;
• website interaction and navigation information;
• error, security and diagnostic information; and
• cookie and similar technology identifiers where applicable.

Further information about cookies and similar technologies is provided later in this Privacy Policy and,
where applicable, in our Cookie Policy and cookie-preference controls.

4.10 Marketing and Communication Preferences

Where applicable, we may record:

• whether you have asked to receive marketing communications;
• the method by which you would like us to communicate with you;
• when and how a marketing preference was obtained;
• changes you make to your preferences;
• unsubscribe requests; and
• information necessary to ensure that we respect a request not to receive marketing.

4.11 Information About Other People

Sometimes an order or enquiry may be made by a family member, carer, representative, healthcare organisation,
local authority, care home or another person on behalf of the person who will use the product.

If you provide us with another person’s personal information, you should only do so where you have an appropriate
reason and authority to provide that information to us.

We will use that information only as reasonably necessary for the relevant order, enquiry, delivery,
assessment, service or other legitimate purpose.

4.12 Information We Do Not Need

Please do not provide us with sensitive or confidential personal information that we have not requested and
that is not necessary for us to provide the relevant product or service.

In particular, when explaining a medical condition for VAT relief or product-selection purposes, please provide
only the information reasonably necessary for that purpose.

5. How We Collect Your Personal Information

We collect personal information in several different ways depending on how you interact with us.

5.1 Information You Give Us Directly

You may provide personal information to us when you:

• place an order through our website;
• purchase goods in one of our stores;
• place an order by telephone;
• complete a website form;
• create a website account;
• request a quotation;
• request product advice or a demonstration;
• make a VAT relief declaration;
• contact us by telephone, email, post or social media;
• request a repair, service, collection or warranty assessment;
• make a complaint;
• subscribe to marketing communications; or
• otherwise communicate or transact with us.

5.2 Information Collected Automatically

When you use our website, certain technical information may be collected automatically through server logs,
cookies and similar technologies.

This may include information about your device, browser, IP address, website activity, pages viewed,
how you arrived at our website and interactions with particular website features.

The extent of this collection will depend partly on your cookie choices and the technologies in use on our website.

5.3 Information From Third Parties

We may receive personal information from third parties where this is necessary for our business activities.
Examples may include:

• payment providers confirming payment or refund information;
• couriers and delivery partners providing delivery updates;
• manufacturers or suppliers assisting with warranty, repair or product-support matters;
• finance or payment providers where you choose to use their services;
• care homes, healthcare bodies, local authorities or other organisations placing orders on behalf of an individual;
• family members, carers or representatives acting on behalf of a customer;
• fraud-prevention or security providers where applicable; and
• analytics or advertising providers where you have allowed the relevant cookies or technologies.

6. How We Use Your Personal Information

We only use personal information where we have a lawful reason to do so.
The purposes for which we may use your information include the following.

6.1 Processing and Fulfilling Orders

We use your information to:

• receive and process orders;
• confirm order details;
• take or arrange payment;
• provide order updates;
• arrange delivery or collection;
• provide invoices and receipts;
• process cancellations and refunds;
• manage returns;
• provide warranty and after-sales support; and
• deal with enquiries relating to your purchase.

6.2 Providing Product Advice and Customer Service

We may use information you provide to understand your requirements and help identify products or services
that may be appropriate for you.

This may include discussing matters such as intended use, product dimensions, mobility requirements,
transport requirements, home access, comfort or other practical considerations relevant to the product.

6.3 VAT Relief Administration

Where you claim VAT relief on an eligible purchase, we use the information you provide to:

• assess and document the basis on which VAT relief is being claimed;
• apply the appropriate VAT treatment to eligible goods or services;
• maintain appropriate VAT and accounting records;
• respond to relevant HM Revenue & Customs enquiries; and
• demonstrate, where required, why VAT relief was applied.

We will not use information concerning your disability or medical condition for unrelated marketing purposes.

6.4 Repairs, Servicing, Warranty and Product Support

We may use your information to:

• identify products previously supplied;
• review purchase and warranty information;
• book inspections, repairs or servicing;
• arrange replacement parts;
• communicate with manufacturers or suppliers;
• arrange collection or redelivery; and
• keep appropriate service and repair records.

6.5 Managing Our Relationship With You

We may use your information to:

• respond to enquiries;
• manage complaints;
• keep contact details accurate;
• manage website accounts;
• communicate important changes to our services or policies;
• provide customer support;
• record communication preferences; and
• maintain appropriate records of our dealings with you.

6.6 Operating and Improving Our Website

Subject to your cookie choices and applicable law, we may use website and technical information to:

• operate our website;
• improve website performance and usability;
• understand how visitors use our website;
• identify technical problems;
• maintain website security;
• prevent misuse;
• analyse website traffic and performance; and
• improve our products, content and online services.

6.7 Business Administration and Legal Compliance

We may process personal information where necessary to:

• maintain accounting and tax records;
• comply with HM Revenue & Customs requirements;
• manage business records;
• protect our legal rights;
• respond to legal claims or disputes;
• prevent, detect or investigate fraud or misuse;
• maintain website, system and information security;
• comply with lawful requests from regulators, courts or public authorities; and
• meet other legal and regulatory obligations.

7. Our Lawful Bases for Processing Personal Information

UK data protection law requires us to have a lawful basis whenever we process personal information.
The lawful basis we rely upon depends on the purpose for which the information is being used.

7.1 Contract

We may process personal information where it is necessary to enter into or perform a contract with you.

This commonly applies when we:

• process your order;
• take payment;
• arrange delivery;
• provide the product or service you purchased;
• process a return or refund;
• provide contractual warranty support; or
• take steps at your request before entering into a contract, such as providing a quotation.

7.2 Legal Obligation

We may process personal information where necessary to comply with a legal obligation.

This may include:

• keeping accounting and tax records;
• keeping records relating to VAT relief;
• responding to lawful requests from HM Revenue & Customs;
• complying with consumer-protection requirements;
• responding to lawful requests from courts, regulators or public bodies; and
• maintaining records where required by law.

7.3 Legitimate Interests

We may process personal information where this is necessary for our legitimate business interests or those
of a third party, provided that those interests are not overridden by your rights and freedoms.

Our legitimate interests may include:

• providing effective customer service;
• responding to enquiries;
• maintaining appropriate customer and transaction records;
• protecting our business against fraud or misuse;
• maintaining website and information security;
• improving our products, services and website;
• managing complaints and disputes;
• recovering sums properly owed to us;
• supporting the sale, restructuring or transfer of all or part of our business where appropriate; and
• communicating with existing customers about similar products or services where permitted by law.

Where we rely on legitimate interests, we consider the nature of the processing, its necessity,
the reasonable expectations of the individual and the potential impact on privacy rights.

7.4 Consent

In some circumstances, we rely on your consent.

Examples may include:

• certain marketing communications;
• optional website cookies;
• analytics cookies where consent is required;
• advertising or marketing technologies where consent is required; and
• other activities where we specifically ask for your consent.

Where processing is based on consent, you have the right to withdraw that consent at any time.
Withdrawal of consent does not affect the lawfulness of processing that took place before consent was withdrawn.

8. Health Information and Special Category Personal Data

Information concerning a person’s health is treated as
special category personal data under UK data protection law and is subject to additional safeguards.

This is particularly relevant to our business because customers may provide information concerning a disability,
chronic illness, long-term condition or mobility requirement when:

• claiming VAT relief;
• requesting help selecting an appropriate mobility product;
• discussing product suitability;
• arranging delivery or installation;
• requesting servicing, repairs or product adaptations; or
• otherwise seeking assistance relating to mobility or independent living.

8.1 Additional Legal Condition for Health Information

In addition to having a lawful basis under UK GDPR Article 6, we must also identify an appropriate condition
under Article 9 whenever we process special category personal data.

Depending on the circumstances, we may process health information where:

• you have explicitly provided information for a specific purpose and explicit consent is the appropriate
  legal condition;
• processing is necessary for the establishment, exercise or defence of legal claims;
• processing is necessary for reasons of substantial public interest where an applicable condition under
  UK law is available; or
• another lawful Article 9 condition applies to the particular circumstances.

Where health information is provided solely to enable us to determine whether a VAT-relieved supply may be made,
we process that information only to the extent necessary to administer and document the relevant transaction
and comply with associated legal, tax and record-keeping requirements.

We do not sell health information, use it for unrelated profiling or disclose it for unrelated advertising.

9. When Providing Information Is Necessary

In some circumstances, we need certain personal information in order to provide a product or service,
enter into a contract or meet a legal requirement.

For example, we may need your:

• name and address to process an order;
• delivery details to deliver goods;
• payment information to complete a transaction;
• contact details to communicate with you about an order; or
• appropriate declaration information where VAT relief is claimed.

If you do not provide information that is necessary for a particular purpose, we may be unable to complete
the relevant transaction or provide the requested service.

10. Using Information for a Different Purpose

We will generally use personal information only for the purpose for which it was collected or for another
compatible purpose.

If we need to use your personal information for an unrelated purpose, we will consider whether there is an
appropriate lawful basis and, where required, provide you with further information about that processing.

We may process personal information without your knowledge or consent where this is required or permitted by law.

11. Who We Share Your Personal Information With

We treat your personal information with care and confidentiality.
We do not sell your personal information to third parties and we do not allow unrelated organisations to use your information for their own marketing purposes.

However, in order to operate our business and provide our products and services, we may share information with carefully selected third parties where this is necessary and lawful.

11.1 Delivery & Courier Companies

Where necessary to fulfil your order we may provide relevant information to delivery companies including:

• your name;
• delivery address;
• telephone number;
• delivery instructions;
• details of the products ordered.

Only the information necessary to complete the delivery is shared.

11.2 Manufacturers & Suppliers

Some products supplied by First Choice Mobility are manufactured by third-party manufacturers.
Where necessary we may share limited information with manufacturers or suppliers for purposes such as:

• warranty claims;
• technical support;
• product recalls;
• repair authorisation;
• replacement parts;
• product safety investigations.

Manufacturers receive only information reasonably required to deal with the matter.

11.3 Payment Providers

Payments may be processed by specialist payment providers.
Depending upon the payment method selected these providers may process payment card details, bank information or other payment credentials.

First Choice Mobility does not ordinarily store your full payment card information.

Payment providers operate under their own privacy notices and security standards including PCI DSS requirements where applicable.

11.4 Finance Providers

If you choose to purchase goods using finance or a buy-now-pay-later service, your information may be shared directly with the relevant finance provider to enable them to assess your application and administer the agreement.

The finance provider will act as an independent controller of the information you provide to them.

11.5 Website, Hosting & Technology Providers

To operate our website and business systems we use trusted technology providers who may process information on our behalf.
These may include providers responsible for:

• website hosting;
• WooCommerce;
• cloud storage;
• email services;
• security monitoring;
• website backups;
• website maintenance;
• website analytics;
• spam prevention;
• technical support.

These providers are contractually required to protect your information and may only process it on our documented instructions where they are acting as our data processor.

11.6 Professional Advisers

Where appropriate we may disclose information to professional advisers including:

• accountants;
• auditors;
• legal advisers;
• insurance providers;
• IT consultants;
• data protection advisers.

Such disclosures are limited to what is reasonably necessary.

11.7 Regulators & Public Authorities

We may disclose personal information where required by law or where we reasonably believe disclosure is necessary to:

• comply with legal obligations;
• respond to HM Revenue & Customs;
• respond to a court order;
• protect legal rights;
• prevent fraud;
• protect customers;
• assist law enforcement agencies.

12. International Transfers

Some of the organisations that help us operate our business may process information outside the United Kingdom.

Where personal information is transferred internationally we take appropriate steps to ensure suitable safeguards are in place in accordance with UK data protection law.

These safeguards may include:

• UK International Data Transfer Agreements (IDTA);
• UK Addendum to Standard Contractual Clauses;
• transfers to countries recognised as providing an adequate level of protection;
• other lawful transfer mechanisms permitted under UK GDPR.

We take reasonable steps to ensure organisations processing information on our behalf provide an appropriate level of security.

13. Marketing Communications

We occasionally send information about products, services or promotions which may be of interest to customers.

We will only do so where permitted under UK law.

Depending upon the circumstances we may rely upon:

• your consent;
• the “soft opt-in” provisions under PECR for existing customers; or
• another lawful basis where applicable.

14. Cookies & Similar Technologies

Our website uses cookies and similar technologies to improve functionality, analyse website usage and enhance your browsing experience.

Cookies are small text files stored on your device.
Some cookies are essential for the operation of the website while others are optional.

We may use:

• Essential cookies
• Performance cookies
• Analytics cookies
• Functionality cookies
• Preference cookies
• Marketing cookies (where consent has been provided)

Where consent is required we will request your permission before placing non-essential cookies on your device.

You may withdraw or amend your cookie preferences at any time using our Cookie Preference Centre.

15. Website Analytics

We may use website analytics services to better understand how visitors use our website.

Analytics information may include:

• pages visited;
• time spent on pages;
• device type;
• browser type;
• traffic source;
• general geographic region;
• website interactions.

Where legally required, analytics cookies will only operate after your consent has been obtained.

16. Information Security

Protecting personal information is extremely important to us.

We maintain appropriate technical and organisational measures designed to safeguard information against accidental loss, unauthorised access, disclosure, alteration or destruction.

Depending upon the nature of the information this may include:

• SSL encryption;
• secure website hosting;
• firewalls;
• malware protection;
• password-controlled systems;
• restricted staff access;
• encrypted backups;
• software updates;
• security monitoring;
• staff confidentiality obligations.

17. How Long We Keep Your Personal Information

We do not keep personal information for longer than is reasonably necessary for the purpose for which it was
collected, unless we are required or permitted by law to retain it for a longer period.

When deciding how long information should be retained, we consider factors including:

• the purpose for which the information was collected;
• the nature and sensitivity of the information;
• our legal, accounting and tax obligations;
• warranty and product-support requirements;
• applicable limitation periods for legal claims;
• fraud-prevention and security requirements;
• whether there is an ongoing customer relationship; and
• whether retention remains necessary and proportionate.

17.1 Order, Invoice and Accounting Records

Records relating to purchases, invoices, payments, refunds and other financial transactions will normally
be retained for at least the period required by UK tax and accounting legislation.

VAT records are generally retained for a minimum of six years, unless a different retention period applies
under law or HM Revenue & Customs requirements.

17.2 VAT Relief Declarations

Where VAT relief has been claimed, we retain the relevant eligibility declaration and associated transaction
information for as long as reasonably necessary to meet our VAT, accounting and record-keeping obligations.

This will normally mean retaining the relevant documentation with the associated VAT transaction records
for at least six years.

Because VAT relief declarations may contain information concerning a disability, chronic illness or medical
condition, we treat this information as special category personal data and apply appropriate safeguards.

17.3 Warranty, Servicing and Repair Records

We may retain purchase, warranty, servicing and repair information for the duration of the relevant warranty
and for an appropriate period afterwards where this is reasonably necessary for customer support, product
safety, dispute resolution or legal purposes.

17.4 Enquiries and Customer Service Correspondence

General enquiries and correspondence will normally be retained only for as long as necessary to deal with
the enquiry and for an appropriate period afterwards.

Information may be retained for longer where the correspondence relates to an order, warranty, complaint,
dispute, legal claim, safety issue or other matter requiring continued records.

17.5 Marketing Records

Marketing information will generally be retained while you remain subscribed or while we have another lawful
basis to communicate with you.

Where you unsubscribe, we may retain limited information on a suppression list so that we can remember and
respect your request not to receive future marketing.

17.6 Website and Security Records

Website logs, security information and technical records may be retained for a reasonable period where
necessary to protect our website, diagnose technical issues, investigate suspicious activity or maintain
appropriate security records.

17.7 Deletion and Anonymisation

When personal information is no longer required, we will take reasonable steps to securely delete it,
destroy it or anonymise it so that it can no longer be associated with an identifiable individual.

18. Your Data Protection Rights

Depending on the circumstances and subject to certain legal conditions and exemptions, UK data protection
law gives you a number of rights in relation to your personal information.

18.1 Right to Be Informed

You have the right to be given clear information about how we collect and use your personal information.
This Privacy Policy is intended to provide that information.

18.2 Right of Access

You may ask us whether we process personal information about you and request a copy of the personal information
we hold about you, together with other information about how it is being processed.

This is commonly known as a Subject Access Request.

18.3 Right to Rectification

You may ask us to correct personal information that you believe is inaccurate or to complete information
that you believe is incomplete.

18.4 Right to Erasure

In certain circumstances, you may ask us to delete your personal information.
This is sometimes referred to as the right to be forgotten.

The right to erasure is not absolute. For example, we may need to retain certain information where it is
required for tax, accounting, legal, fraud-prevention, warranty or dispute-resolution purposes.

18.5 Right to Restrict Processing

In certain circumstances, you may ask us to restrict how we use your personal information.
This may mean that we retain the information but temporarily limit the ways in which it is processed.

18.6 Right to Data Portability

In certain circumstances, you may have the right to receive personal information that you have provided to us
in a structured, commonly used and machine-readable format and to ask for that information to be transferred
to another organisation where technically feasible.

This right generally applies where processing is based on consent or contract and is carried out by automated means.

18.7 Right to Object

In certain circumstances, you may object to processing that is based on legitimate interests.

You also have the right to object at any time to the use of your personal information for direct marketing.
If you object to direct marketing, we will stop using your personal information for that purpose.

18.8 Right to Withdraw Consent

Where we rely upon your consent to process personal information, you may withdraw your consent at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before your consent was withdrawn.

19. How to Exercise Your Rights

If you wish to exercise any of your data protection rights, please contact us using the details in the
“How to Contact Us” section below.

You will not normally have to pay a fee to exercise your rights.
However, where permitted by law, we may charge a reasonable fee or refuse to act on a request that is
manifestly unfounded or excessive.

We may ask you to provide information necessary to confirm your identity before responding to a request.
This is an important security measure designed to ensure that personal information is not disclosed to
somebody who is not entitled to receive it.

We aim to respond to valid requests within the time limits required by data protection law.
In most circumstances this will be within one calendar month, although the period may lawfully be extended
in certain situations.

20. Automated Decision-Making and Profiling

Automated decision-making occurs where a decision is made using automated processing without meaningful human
involvement.

First Choice Mobility does not currently use customer personal information to make solely automated decisions
that produce legal effects, or similarly significant effects, about customers as part of our normal retail
activities.

Certain third-party services, such as payment, fraud-prevention or finance providers, may use automated systems
as part of their own services. Where they determine the purposes and means of that processing, their own privacy
notices will explain how such systems are used and the rights available to you.

If we introduce significant automated decision-making in the future, we will provide appropriate information
about the processing and the safeguards available under applicable data protection law.

21. Children’s Personal Information

Our website and retail services are primarily intended for adults and we do not knowingly target children
with advertising or marketing.

Some products may nevertheless be purchased for, or used by, a child. In those circumstances, personal
information may sometimes be provided by a parent, guardian, carer, healthcare professional or other
authorised representative where it is reasonably necessary to supply an appropriate product or service.

Where we process information relating to a child, we take particular care to collect only information that is
reasonably necessary for the relevant purpose.

22. Links to Other Websites

Our website may contain links to websites, services or social-media platforms operated by third parties.

Clicking on those links may allow the relevant third party to collect or process information about you.
We do not control third-party websites and are not responsible for their privacy practices.

We recommend that you review the privacy notice of any external website or service that you use.

23. Personal Data Breaches

We maintain procedures designed to identify, assess and respond appropriately to suspected personal data breaches.

Where required by applicable law, we will notify the Information Commissioner’s Office and, where the relevant
legal threshold is met, affected individuals.

24. Sale or Reorganisation of Our Business

If First Choice Mobility Ltd is sold, merged, reorganised or transfers part of its business or assets,
personal information may form part of the assets transferred to a purchaser, successor or relevant professional
adviser.

Any such disclosure or transfer will be handled in accordance with applicable data protection law and will
be limited to information reasonably necessary for the relevant transaction.

25. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

• our business activities;
• our website;
• the products and services we provide;
• technology used by our business;
• third-party service providers;
• data protection law; or
• regulatory guidance.

The most recent version will be published on this page and the
“Last updated” date at the beginning of the policy will be amended accordingly.

Where a change materially affects the way we process your personal information, we will take reasonable
steps to bring the change to your attention where appropriate.

26. How to Contact Us

If you have a question about this Privacy Policy, how we use your personal information, or wish to exercise
any of your data protection rights, please contact:

27. Complaints to the Information Commissioner’s Office

We would appreciate the opportunity to deal with any privacy concern directly and encourage you to contact
us first if you believe we have not handled your personal information appropriately.

You also have the right to complain to the
Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.