PRIVACY POLICY

1. INTRODUCTION

NTS Retail Limited and NTS Motor Fuel Ltd (collectively referred to as “NTS Group”, “we”, “our”, “us”) respect your privacy and are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains how we collect, use, disclose and protect your personal data when you use our website(s), interact with us, submit a request, query, complaint or visit our premises (including sites where CCTV is in use).

This Privacy Policy should be read in conjunction with our relevant data protection policies and guidelines.

2. DATA CONTROLLER

Personal data provided to or collected by NTS Group is controlled by NTS Retail Limited or NTS Motor Fuel Ltd, as applicable to the relevant business activity.

This policy applies across NTS Group locations and operations.

This Privacy Policy also applies to NTS Group's marketing content, including offers and advertisements for our products and services, which we or a service provider acting on our behalf may send to you on third-party websites, platforms and applications based on your site usage information, where permitted by law.

These third-party websites generally have their own Privacy Notices and Terms and Conditions. We encourage you to read them before using those websites.

3. PERSONAL DATA WE COLLECT

Personal data means any information that can be used to identify directly or indirectly a specific individual.

We may collect personal data from a variety of sources. This includes:

  • Personal data you give us directly;
  • Personal data we collect automatically; and
  • Personal data we collect from other sources.

We may collect the following categories of data:

Website data: IP address, browser type, browsing behaviour (via cookies);

Contact details: Name, email, phone number;

Transactional data: Orders, payments, service use;

Complaints data: Written complaints, recordings of calls (where applicable), case resolution information;

CCTV footage: Video recordings at our forecourt sites (petrol stations and stores) or office locations where CCTV is in operation;

Photographs: Still images captured at our forecourt sites, events or office locations;

Other: Correspondence or data collected via online forms, customer surveys or support requests.

4. HOW WE USE PERSONAL DATA

NTS Group may use or share your personal data internally and with selected third parties in the following circumstances:

Internally: Your personal data may be used by us or shared between NTS Group companies for business and operational purposes, such as:

  • Responding to your requests, queries and complaints;
  • Providing services and processing transactions;
  • Maintaining and improving our website and services;
  • Protecting site and premises security (via CCTV);
  • Marketing campaigns and newsletters, where permitted.

Third-party service providers: To make various services and materials available through our website, we may share your personal data with third-party service providers that perform functions on our behalf, such as companies that host or operate our website, process payments, analyse data, provide customer service, postal or delivery services, or administer promotions. They may access personal data necessary to perform their functions but must not use it for unauthorised purposes.

Other third parties: Where permitted by law, your personal data may be shared with retail partners, advertisers, social media networks, analytics providers and other third parties in connection with marketing, promotional activities and product or service information.

Legal disclosure: We may transfer or disclose your personal data to third parties:

  • To comply with a legal obligation;
  • Where required by applicable law;
  • At the lawful request of governmental or regulatory authorities;
  • To enforce our Terms of Use or other applicable policies;
  • To detect and protect against fraud or security vulnerabilities;
  • To respond to emergencies; or
  • To protect the rights, property, safety or security of NTS Group, our customers or the public.

5. LEGAL BASIS FOR PROCESSING

Our processing is based on one or more of the following legal grounds:

  • Consent (e.g., for certain marketing activities);
  • Contractual necessity (e.g., order fulfilment);
  • Legal obligation (e.g., financial records);
  • Legitimate interests (e.g., CCTV for security, customer support).

6. CCTV MONITORING

We operate CCTV systems at our sites where required for safety and security purposes. Signs are displayed where CCTV is in use.

We operate CCTV for the purposes of:

  • Crime prevention and security;
  • Health and safety monitoring;
  • Incident investigation and complaint resolution.

CCTV data is:

  • Clearly signposted where CCTV is in operation;
  • Accessed only by authorised personnel;
  • Retained for a period appropriate to its purpose, unless required for longer in connection with investigations or legal obligations.

7. PHOTOGRAPHS & IMAGE CAPTURE

We may take photographs or capture images (e.g., at our petrol stations or during events) for:

  • Health and safety monitoring;
  • Marketing and promotional purposes (with appropriate consent where required);
  • Investigating incidents or managing premises security.

Images of individuals will only be retained where necessary for the stated purpose, and we will obtain consent where required when using identifiable images for marketing or promotional materials.

8. CUSTOMER COMPLAINTS

When you contact us with a complaint, we collect only the data necessary to:

  • Investigate and resolve your issue;
  • Maintain service records;
  • Comply with legal or regulatory obligations.

9. SHARING PERSONAL DATA

We may share your data with:

  • Service providers and IT support partners;
  • Delivery and payment processing providers;
  • Legal or regulatory bodies, courts or enforcement agencies (if required);
  • NTS Retail Limited and NTS Motor Fuel Ltd for relevant operational purposes.

We do not sell personal data.

10. INTERNATIONAL DATA TRANSFERS

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as:

  • Transferring personal data to countries recognised under applicable UK adequacy regulations;
  • Using appropriate contractual safeguards, including Standard Contractual Clauses (SCCs), the UK Addendum or International Data Transfer Agreements (IDTAs), where applicable.

11. DATA SECURITY

We use appropriate physical, digital and organisational safeguards to secure your data, which may include:

  • Encryption, firewall protection and secure authentication;
  • Secure storage of CCTV and complaints data;
  • Appropriate payment security and cybersecurity practices;
  • System monitoring and access controls.

12. DATA BREACH NOTIFICATION

In the event of a personal data breach that poses a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office (ICO) where required, without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to affected individuals, we will also notify those individuals without undue delay, as required by law.

13. YOUR RIGHTS

Under data protection law, you have the right to:

  • Access your data;
  • Request correction or deletion;
  • Restrict or object to processing;
  • Request portability of your data;
  • Withdraw consent where applicable;
  • Lodge a complaint with the Information Commissioner's Office (ICO).

These rights are subject to applicable legal conditions and exemptions.

14. DATA SUBJECT REQUESTS

You have the right to request access to your personal data held by us. This is known as a Data Subject Access Request (DSAR).

To make a DSAR, you should:

  • Submit your request through our Contact page;
  • Include your full name, contact details and a description of the data you wish to access;
  • Provide proof of identity where reasonably required.

We will:

  • Acknowledge and review your request;
  • Respond without undue delay and normally within one calendar month (or inform you if more time is permitted and required);
  • Inform you if third-party information must be redacted;
  • Restrict access where lawful exemptions apply.

Should you have any questions regarding your personal data, please contact us through our Contact page.

15. DATA RETENTION

We retain personal data only for as long as necessary.

Retention periods for different categories of data, including website enquiries, transactions, CCTV footage, complaints and Data Subject Access Requests (DSARs), are determined in accordance with UK GDPR principles, applicable legal requirements and operational needs.

Personal data will be securely deleted or anonymised when it is no longer required, unless continued retention is necessary for lawful purposes.

16. POLICY REVIEW & UPDATES

This policy will be reviewed and updated as necessary to ensure ongoing compliance with legal, regulatory and operational changes. The latest version will always be available on our website with the date of revision clearly stated.