International Car Rental Ltd Of Denbigh House, Denbigh Road, Bletchley, Milton Keynes, MK1 1DF are committed to protecting and respecting any personal information you share with us.

​

This Privacy Policy describes how ICR collects and uses personal information. It informs you about the personal information that is collected, why it is needed, how it is used, the protections in place to keep it secure, your rights and how you can contact us.

The contents of this statement may change from time to time so please check this page periodically to ensure you are still happy to share your information with us. Where possible, we will also contact you directly to notify you of changes.

 

How we collect your personal information

We collect your personal data either directly from yourself or through a third party:

• Directly from yourself (e.g. when you speak to us on the phone, over email, when we meet with you in person or when you input details into our website); and/or

• From third parties (e.g. from the DVLA, credit reference companies or from Introducers; other Brokers who introduce their customer to ICR).

 

The information we collect

We collect information about you when you engage with us either through our call centre, our website, other digital platforms or our partners. Some of this information does not identify you personally, but provides us with information about how you use our services and engage with us (we use this information to improve our services and make them more useful to you). The information we collect includes some or all of the following:

1. 1. Your personal details (e.g. name, date of birth, contact information, employment details etc.)

2. Your vehicle and driver eligibility information (e.g. vehicle registration number, drivers licence details)

3. Your requirements (e.g. details of any additional drivers, specific vehicle requirements, such as health and disability information)

4. Your financial information (e.g. income, expenditure, previous credit history, bank/credit card details and information about your lifestyle and home ownership)

5. Digital Identifiers (e.g. identifiers assigned to your computer/device(s), including your Internet Protocol (IP) address)

6. Cookie information (see our Cookie Policy)

7. Our communications (e.g. details of the communications between; emails, letters, call recordings etc.)

 

Why we need to collect and use personal information

ICR collects and uses personal information in order to:

• establish your identity

• establish your vehicle requirements

• provide a leasing solution that matches your needs

• confirm your eligibility to legally drive a vehicle

• set-up a credit line

• arrange vehicle insurance

• facilitate other financial products, such as Inflation Protection

• arrange vehicle maintenance

• organise vehicle breakdown cover

• obtain your feedback on the services provided

• From time to time, while the vehicle is on lease to you, we may contact you (via text message, telephone, email or post) about:

• servicing

• vehicle condition

• vehicle recalls

• when a MOT is due on the vehicle.

 

How we use this information and the legal basis for processing

We will only process information that is necessary for the purpose for which it has been collected. The legal basis of processing will vary depending on the type of service you have requested and we have listed some examples of our processing activities below;

1. Administering your vehicle quotes and policies (as is necessary for performance of a contract between you and us and/or as is necessary for our legitimate interests);

2. Carrying out anti-fraud and anti-money laundering checks and verifying your identity (as is necessary for compliance with our legal obligations and/or as is necessary for our legitimate interests);

3. Assessing financial risks, including by carrying out credit reference checks and credit scoring assessments, (as is necessary for the performance of a contract between you and us and/or as is necessary for our legitimate interests);

4. Broking your finance agreement and any related services (as is necessary for the performance of a contract between you and us and/or as is necessary for our legitimate interests);

5. Using your payment details to process payments or refunds relating to a service provided by us (as is necessary for the performance of a contract between you and us and/or as is necessary for our legitimate interests);

6. Sending you information about your end of contract obligations and how to renew your vehicle hire agreement (as is necessary for compliance with our legal obligations);

7. Communicating with you about your quotes and policies including responding to your enquiries (as is necessary for the performance of a contract between you and us and/or as is necessary for our legitimate interests);

8. Administering debt recoveries, where you owe us money under a contract or otherwise (as is necessary for the performance of a contract between you and us and/or as is necessary for our legitimate interests);

9. Undertaking market research and statistical analysis, including analysing your use of our website. This allows us to develop new, or improve existing, products and services (as is necessary for our legitimate interests); and

10. Fulfilling our obligations owed to a relevant regulator or authority (as is necessary for compliance with our legal obligations and/or as is necessary for our legitimate interests).

 

Our "legitimate interests" as referred to in this document include our legitimate business purposes and commercial interests in operating our business in a customer-focused, efficient and sustainable manner, in accordance with all applicable legal and regulatory requirements.

 

Credit Reference and Affordability Checks

To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).
We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.

• Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority
  FCA Firm Reference Number: 742313

• TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority
  FCA Firm Reference Number: 737740

The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.

Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices:

• Creditsafe Privacy / Transparency Notice:
  Transparency Notice | Customers & Suppliers

• TransUnion Bureau Privacy Notice:
  https://www.transunion.co.uk/legal/privacy-centre/pc-bureau

​

Identity and contact details of the data controller

• International Car Rental Limited

• Denbigh House, Denbigh Road, Bletchley, Milton Keynes, MK1 1DF

• Email info@icrleasing.co.uk or phone 01908 467467

• Z5901186​

​

International Data Transfers

We do not transfer, store, or process personal data outside of the United Kingdom.

All personal data is handled exclusively within the UK and is not accessed by individuals, employees, or third-party providers located outside of the UK.

As such, no international data transfer safeguards are required.

exclusively within the UK and is not accessed by individuals or third parties located outside of the UK.

 

Whether provision of data is statutory/contractual & consequences

Provision of Personal Data

Is the provision of personal data statutory or contractual?

The provision of certain personal data is primarily contractual and, in some circumstances, required to meet legal and regulatory obligations.

Personal data is required to:

·         enter into and perform contracts with customers, suppliers, or business partners.

·         process orders, manage accounts, and deliver goods and services.

·         verify identity and prevent fraud; and

·         comply with applicable legal, regulatory, accounting, and tax obligations.

What are the consequences of not providing personal data?

If you choose not to provide the personal data, we request:

·         we may be unable to enter into a contract with you.

·         we may be unable to fulfil orders, supply goods, or provide services.

·         we may be unable to conduct necessary verification, compliance, or fraud prevention checks; and

·         as a result, our services may be delayed, restricted, or declined.

Where personal data is requested for optional purposes, such as marketing communications, providing this data is not mandatory, and you may withdraw your consent at any time without affecting your ability to receive goods or services from us.

​

Automated Decisions and Profiling

We will never make automated decisions when processing your data nor will we use profiling techniques.

 

Protecting your information

ICR takes the protection of personal data very seriously. There are systems in place to guard against unauthorised access, improper use, destruction or accidental loss of personal data. We take appropriate technical and organisational measures to prevent unauthorised or unlawful processing of personal data. In addition, we have rules and procedures in place to ensure that any personal information which we hold on computer systems cannot be accessed by persons who do not have the permissions to do so.

Any authorised third-party service providers with whom your data is shared are requested to sign a formal Data Processing Agreement which ensures that your personal data is treated with the same rigour as directly applied by ICR, and in accordance with current Data Protection Act and General Data Protection Regulation laws.

 

Sharing your information

We do not sell your information to third parties, but we do work closely with third party suppliers who fulfil business activities for us. In these situations we will only share the information that is necessary for the third party to perform the processing activity it was provided for, such as;

• third party service providers who support the operation of our business, such as IT and marketing suppliers, financial service providers, delivery companies, dealer groups and debt collection agencies (as is necessary for the performance of a contract between you and us and/or as is necessary for our legitimate interests);

• third party insurance providers (as is necessary for the performance of a contract between you and us and/or as is necessary for our legitimate interests).

• fraud prevention agencies and associations, (as is necessary for compliance with our legal obligations and/or as is necessary for our legitimate interests);

• regulators and law enforcement agencies, including the police, the Financial Conduct Authority or any other relevant authority who may have jurisdiction (as is necessary for compliance with our legal obligations).

 

Some of these third parties may also be considered a Data Controller in respect of holding your personal data. Although we are selective with regards who we work with, we strongly recommend you check the privacy statements of the parties, referenced in this Policy, to ensure you are comfortable with the treatment of your information.

In order to fulfil its service obligations, ICR may share your personal data with:

• our employees

• the DVLA

• our funders - In order for you to obtain finance we will need to share your personal data with funders to allow them to check your eligibility for finance. They will submit your data to credit reference agencies to verify your identity and perform a credit check.

• Supplying Dealers (all makes)

• Delivery Companies

• Daily Rental Companies

• our service provision agents, including Fevore Group Ltd and its subsidiary companies

• breakdown repair companies, including the AA and the RAC

• the Police and other authorities, where we are under a legal obligation to do so, for example where we are required to share information under statute, to prevent fraud and other criminal offences or because of a Court Order

• Credit and Fraud agencies

• Manufacturers

• Logistics Agents

• Parking Enforcement Companies

If required, at any stage of the contract our customer defaults on payment, we may share your information with our nominated debt recovery agency.

Your personal information may be stored in the following systems in order to fulfil our service obligations to you.

• Jaama Ltd

• Superoffice

• Hexol

• Epyx (1Link)

• Calas

• Xero Accounting

• Creditsafe

• Can Track

We may install trackers on our vehicles to help in the recovery of the vehicle should it be stolen. These trackers are activated daily to ensure they are functioning. This means the location of the vehicle may be recorded at that point in time.

 

How long do we keep your information for?

We will not hold your personal information for any longer than is necessary. If you are a customer or otherwise have a relationship with us we will hold personal information about you for a longer period than if we have obtained your details in connection with a prospective relationship. In any event, the retention period will be the statutory retention period unless there is a further legal or regulatory requirement to do so.

We hold your data with a view to providing current and future leasing services to you. In the event that the relationship ceases we confirm that we will delete personal data in accordance with our internal data retention policies and our legal obligations.

 

How can you manage the information we hold about you?

Under the data protection act you have certain rights in relation to the data we hold about you. Under GDPR these rights are extended and listed below;

• to obtain access to, and copies of, the personal information that we hold about you;

• to require that we cease processing your personal information if the processing is causing you damage or distress;

• to require us not to send you marketing communications.

• to require us to erase your personal information;

• to require us to restrict our data processing activities of your data where you have recorded an objection.

• to receive from us the personal information we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal information to another data controller; and

• to require us to correct the personal information we hold about you if it is incorrect.

 

Please note that these rights may be limited by data protection legislation and we may be entitled to refuse requests where exceptions apply.

To make a Subject Access Request email enquiries@icrleasing.co.uk and, after verifying your identity and understanding the scope of the SAR, we will provide you with the requested personal data within one month.

If you have a complaint regarding any aspect of how we handle your personal information, please write to us at the above address. If you are still not satisfied with the outcome of your complaint, you may write to the Information Commissioner's Office at the following address:

Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

 

You can also contact the Information Commissioner's Office using their online form: https://ico.org.uk/global/contact-us/email/

Last Updated: August 2026