INEOS GRENADIER CYPRUS — PRIVACY NOTICE
PSP MOTORS Ltd, trading as INEOS Grenadier Cyprus (“we”, “us” or “our”), respects your privacy and is committed to protecting your personal data. This privacy notice explains how we look after your personal data when you visit this website or otherwise interact with us as an authorised INEOS Grenadier retailer in Cyprus, and tells you about your privacy rights and how the law protects you.
This privacy notice is provided in a layered format so you can click through to the specific areas set out below. Please also use the Glossary to understand the meaning of some of the terms used in this notice.
1. Important Information and Who We Are
2. Data We Collect About You
3. How Your Personal Data Is Collected
4. How We Use Your Personal Data
5. Disclosures of Your Personal Data
6. International Transfers
7. Data Security
8. Data Retention
9. Your Legal Rights
10. Glossary
1. Important Information and Who We Are
Purpose of this privacy notice
This privacy notice aims to give you information on how we collect and process your personal data through your use of this website, including any data you may provide when you sign up to our newsletter, book a test drive, request a quote, take a survey, purchase a product or service, indicate an interest in purchasing a vehicle, or take part in a competition.
This website is not intended for children and we do not knowingly collect data relating to children.
It is important that you read this privacy notice together with any other privacy or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we use your data. This notice supplements any other such notices and is not intended to override them.
Controller
Legal entity: PSP MOTOROS Ltd, a company registered in the Republic of Cyprus (Registration No. HE487771), trading as INEOS Grenadier Cyprus.
Registered address: The Mall of Cyprus, Annex 3, Verginas 5, Strovolos, Nicosia 2025
Showroom: The Mall of Cyprus, Annex 3, Verginas 5, Strovolos, Nicosia 2025
Where personal data you provide through this website is also shared with INEOS Automotive Limited (an English limited liability company, company number 11201576, of 38 Hans Crescent, Knightsbridge, London SW1X 0LZ, United Kingdom) — for example where you configure a vehicle, request a brochure, or express interest in a model — PSP MOTORS Ltd and INEOS Automotive Limited act as joint controllers, or as independent controllers for their own respective purposes, in each case as described further in Section 5 below.
Data protection contact
We have appointed a data protection contact who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this notice, including any requests to exercise your legal rights, please contact us using the details below.
Email: backoffice@ineoscy.com
You have the right to make a complaint at any time to the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, the local supervisory authority for data protection issues (1 Iasonos Street, 1082 Nicosia, Cyprus; www.dataprotection.gov.cy). We would, however, appreciate the chance to address your concerns before you approach the Commissioner, so please contact us in the first instance.
Changes to this notice
This version of the privacy notice was last updated on 1st July 20026. It is important that the personal data we hold about you is accurate and current — please keep us informed if your personal data changes during your relationship with us.
Third-party links
This website may include links to third-party websites, plug-ins and applications, including the wider INEOS Automotive digital ecosystem (e.g. the vehicle configurator and stock locator). Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. When you leave our website, we encourage you to read the privacy notice of every website you visit.
2. The Data We Collect About You
Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous or anonymised data). We may collect, use, store and transfer the following kinds of personal data about you, grouped as follows:
Identity Data — first name, last name, title, date of birth and gender.
Contact Data — address, email address and telephone numbers.
Financial Data — bank account and payment card details, where relevant to a purchase, deposit or finance application.
Transaction Data — details of payments to and from you and of vehicles, parts, accessories or services purchased from us.
Technical Data — IP address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
Profile Data — your username and password (where applicable), vehicle configurations, orders, interests, preferences, feedback and survey responses.
Usage Data — information about how you use our website, products and services.
Marketing and Communications Data — your preferences in receiving marketing from us and third parties, and your communication preferences.
Social Network Data — information you share publicly or as part of your profile on a third-party social network.
Market Research Data — responses to voluntary surveys about your automotive purchase and usage behaviour and vehicle preferences.
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law, as it does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your personal data so that it can identify you, we treat the combined data as personal data in accordance with this notice.
Special category data. We do not seek to collect any Special Categories of Personal Data about you (such as race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health data, or genetic or biometric data), nor do we collect information about criminal convictions and offences.
If you fail to provide personal data
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to sell or service a vehicle). In that case we may have to cancel a product or service you have with us, and we will notify you if this is the case at the time.
3. How Your Personal Data Is Collected
We use different methods to collect data from and about you, including through:
Direct interactions
You may give us your Identity, Contact, Social Network and Financial Data by filling in forms or corresponding with us by post, telephone, email, social media, in our showroom, or otherwise. This includes personal data you provide when you:
book a test drive or configure a vehicle;
apply for or purchase our products or services, including via finance;
create an account on this website or the wider INEOS Automotive platform;
subscribe to our newsletter or publications;
request marketing to be sent to you;
enter a competition, promotion or survey;
comment on our social media pages;
provide information in connection with our careers pages; and/or
give us feedback or otherwise contact us.
Automated technologies or interactions
As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions and patterns, using cookies, server logs and similar technologies. Please see our cookie policy for further details, including how to manage your cookie preferences.
Third parties or publicly available sources
We may receive personal data about you from:
INEOS Automotive Limited and other INEOS Group companies, where you have interacted with the wider INEOS Grenadier website, configurator or stock locator;
analytics providers such as Google, based inside or outside the EU/EEA;
providers of technical, payment and delivery services, based inside or outside the EU/EEA;
data brokers or aggregators, based inside or outside the EU/EEA;
publicly available sources such as the Cyprus Department of Registrar of Companies and Official Receiver; and
third-party social network sites or applications.
4. How We Use Your Personal Data
We will only use your personal data when the law allows us to. Under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Cyprus Law on the Protection of Natural Persons with regard to the Processing of Personal Data (Law 125(I)/2018), the most common legal bases we rely on are:
where we need to perform a contract we are about to enter into or have entered into with you (for example, a vehicle sale, deposit or service booking);
where it is necessary for our legitimate interests (or those of a third party, including INEOS Automotive Limited) and your interests and fundamental rights do not override those interests;
where we need to comply with a legal or regulatory obligation; and
where you have given consent, for example to receive direct marketing by email or SMS.
Where we rely on consent, you have the right to withdraw it at any time by contacting us at backoffice@ineoscy.com.
We set out a full description of the ways we use your personal data, and the legal bases relied on, in our processing table available on request from [insert contact/link]. Please contact us if you need details of the specific legal basis we rely on for a particular purpose, where more than one basis applies.
Promotional offers from us
We may use your Identity, Contact, Technical, Usage, Social Network and Profile Data to form a view of what we think you may want or need, and to decide which products, services and offers may be relevant to you (“marketing”). You will receive marketing from us if you have requested information, purchased goods or services, or entered a competition or promotion, and have not opted out.
Opting out
You can ask us to stop sending marketing messages at any time by following the opt-out links on any marketing message, or by contacting us at [insert dpo@ contact]. Opting out does not apply to personal data provided as a result of a purchase, warranty registration, service experience or other transaction.
Cookies
You can set your browser to refuse cookies, or to alert you when cookies are set. If you disable cookies, some parts of this website may not function properly. See our cookie policy for details.
Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another, compatible reason. If we need to use your data for an unrelated purpose, we will notify you of the new purpose and the legal basis that allows us to do so.
5. Disclosures of Your Personal Data
We may share your personal data with:
INEOS Automotive Limited and INEOS Group companies (as joint controllers or processors), which may include INEOS Group companies whose products may be of interest to you, based in the UK and/or the EU.
External third parties acting as processors, including IT and website hosting providers, payment processors, delivery and logistics providers, finance and insurance partners, marketing and analytics providers, and professional advisers (lawyers, bankers, auditors, insurers).
The Cyprus Tax Department and other regulators or authorities, acting as processors or joint controllers, where reporting of processing activities is required.
Other authorised INEOS Grenadier dealers and service centres in Cyprus and elsewhere, in connection with the products and services set out in Section 4.
Any other third party to whom you have given your consent, or to whom we may transfer or sell parts of our business or assets. If a change happens to our business, the new owners may use your personal data in the same way as set out in this notice.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes, and only permit them to process it for specified purposes and in accordance with our instructions.
6. International Transfers
As a member state of the European Union, Cyprus forms part of the European Economic Area (“EEA”), and personal data processed within Cyprus and the wider EEA is protected under the GDPR without the need for additional transfer safeguards.
However, some of your personal data will be transferred outside the EEA — most notably to INEOS Automotive Limited and its service providers in the United Kingdom, which is a “third country” for GDPR purposes following its withdrawal from the EU. Such transfers are lawful because the European Commission has adopted an adequacy decision in respect of the UK, meaning the UK is recognised as providing an equivalent level of data protection to the EEA.
Where we or our processors transfer personal data to other countries that do not benefit from an adequacy decision, we ensure an equivalent degree of protection is applied, including by using the European Commission's Standard Contractual Clauses or other safeguards recognised under the GDPR.
Please contact us at backoffice@ineoscy.com if you would like further information on the specific safeguards used when we transfer your personal data outside the EEA.
7. Data Security
We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a genuine business need to know it, and they are subject to a duty of confidentiality.
We have procedures in place to deal with any suspected personal data breach and will notify you and the Office of the Commissioner for Personal Data Protection of a breach where we are legally required to do so, in accordance with Articles 33 and 34 GDPR.
8. Data Retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, tax or reporting requirements.
Under Cyprus tax and company law, we are generally required to keep basic customer records (including Contact, Identity, Financial and Transaction Data) for six years from the end of the relevant tax year, and certain company records for longer periods as required by the Cyprus Companies Law, Cap. 113. Vehicle warranty, safety and service records may be retained for longer to meet product liability and safety obligations.
In some circumstances you can ask us to delete your data — please contact us for further information. We may also anonymise your personal data for research or statistical purposes, in which case it ceases to be personal data and we may use it indefinitely without further notice to you.
9. Your Legal Rights
Under the GDPR and Cyprus Law 125(I)/2018, you have the right to:
Request access to your personal data (a “data subject access request”), to receive a copy of the data we hold and check we are processing it lawfully.
Request correction of incomplete or inaccurate personal data we hold about you.
Request erasure of your personal data, where there is no good reason for us to continue processing it, where you have successfully objected to processing, where we have processed it unlawfully, or where erasure is required by law.
Object to processing of your personal data where we rely on legitimate interests, or where we process it for direct marketing purposes.
Request restriction of processing of your personal data in certain circumstances, for example while we verify its accuracy.
Request transfer of your personal data to you or a third party, in a structured, commonly used, machine-readable format, where the processing is based on consent or contract and carried out by automated means.
Withdraw consent at any time, where we rely on consent to process your personal data, without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, please contact us at backoffice@ineoscy.com. You will not usually have to pay a fee, unless your request is clearly unfounded, repetitive or excessive, in which case we may charge a reasonable fee or refuse to comply.
We may need to request specific information from you to confirm your identity and ensure your right to access your data (or exercise any other right) is protected. We aim to respond to all legitimate requests within one month; if a request is particularly complex, this may take longer, in which case we will notify you and keep you updated.
Right to complain. You also have the right to lodge a complaint at any time with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, or with the supervisory authority in your own EU member state of habitual residence, place of work, or place of the alleged infringement.
10. Glossary
Lawful basis
Legitimate Interest means the interest of our business in conducting and managing it to give you the best service and product experience. We balance any potential impact on you (positive and negative) and your rights before relying on this basis, and do not use it where our interests are overridden by the impact on you, unless we have your consent or are otherwise permitted by law.
Performance of Contract means processing your data where necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract.
Comply with a legal or regulatory obligation means processing your personal data where necessary for compliance with a legal or regulatory obligation to which we are subject in Cyprus, the EU, or (where applicable) the UK.
Third parties
Internal third parties — other companies in the INEOS Group and the wider E-Cars Group acting as joint controllers or processors, based in the EU and/or UK.
External third parties — service providers acting as processors (IT, hosting, payments, deliveries, marketing, analytics); professional advisers (lawyers, bankers, auditors, insurers); the Cyprus Tax Department, regulators and other authorities; authorised dealers in our network; and any other third party to whom you have given consent.