Privacy Notice

ShareGuard Privacy Notice

1. About this Privacy Notice

This Privacy Notice explains how ShareGuard collects, uses, stores and shares personal information when you:

• Visit the ShareGuard website;
• Contact us or request a demonstration;
• Apply for access to ShareGuard;
• Use ShareGuard on behalf of a broker, lender or other organisation;
• Appear within dealer-intelligence information;
• Communicate with our support or commercial teams; or
• Have your information processed through the ShareGuard Aftersales CRM by one of our customers.

It also explains your data-protection rights and how you can contact us.

2. Who we are

ShareGuard is a dealer-intelligence and Aftersales CRM platform designed for organisations operating within the UK motor-finance industry.

ShareGuard is a trading name and product of:

Legal company name: Apexsync Limited
Trading name: ShareGuard
Company number: 17513909
Registered office: M60 Office Park, Oak Court, Apexsync Ltd, Wynne Avenue, Manchester, United Kingdom, M27 8FF
Email: sales@shareguard.uk

In this Privacy Notice, “ShareGuard”, “Apexsync”, “we”, “us” and “our” refer to Apexsync Limited.

Apexsync Limited is the data controller for personal information where it determines why and how that information is used.

When ShareGuard processes Aftersales CRM information solely on behalf of a broker, lender or other customer, Apexsync Limited will normally act as that organisation’s data processor.

3. When we act as a data controller

We act as a data controller when we determine why and how personal information is used. This includes information relating to:

• Website visitors;
• People requesting a demonstration;
• Organisations and individuals applying for access;
• Directors, employees and authorised users of our customers;
• Prospective customers and business contacts;
• Platform account administration;
• Security and audit activity;
• Billing and contractual administration;
• Customer-support enquiries;
• Marketing preferences;
• Suppliers and professional advisers; and
• Publicly available information about company directors, officers and persons with significant control.

When acting as controller, Apexsync Limited is responsible for ensuring that this processing is lawful, fair and transparent.

4. When we act as a data processor

A broker, lender or other customer may use the ShareGuard Aftersales CRM to record information about its customers, complaints, cases, vehicles, dealers, communications, documents and outcomes.

For this information:

• The broker, lender or other customer will normally be the data controller;
• Apexsync Limited will normally act as its data processor;
• The customer determines why information is processed;
• The customer decides what information is entered;
• The customer determines the appropriate retention period; and
• We process the information in accordance with the customer’s documented instructions and the applicable Data Processing Agreement.

If you are a consumer whose information has been entered into the ShareGuard Aftersales CRM, you should normally contact the broker, lender or organisation dealing with your case first.

We will assist that organisation with valid data-protection requests in accordance with our contractual and legal responsibilities.

We will not use identifiable Aftersales CRM customer information for ShareGuard’s own unrelated marketing purposes.

5. Information we collect

The information we collect depends on your relationship with ShareGuard and how you interact with us.

5.1 Website and enquiry information

When you visit our website or contact us, we may collect:

• Your name;
• Job title;
• Employer or organisation;
• Business email address;
• Business telephone number;
• The content of your enquiry;
• Demonstration or access requirements;
• Communication preferences;
• IP address;
• Browser and device information;
• Website activity;
• Security and diagnostic information; and
• Cookie choices.

5.2 Access-application information

When an organisation applies for access to ShareGuard, we may collect:

• Registered legal name;
• Trading name;
• Companies House number;
• FCA firm reference number;
• FCA regulatory relationship;
• Registered office;
• Main trading address;
• Company website;
• Business email domain;
• Business telephone number;
• Year the business began trading;
• Applicant’s name;
• Applicant’s position and authority;
• Work email address;
• Direct telephone number;
• Expected number of users;
• Expected monthly dealer searches;
• Number of dealers used or monitored;
• Intended use of ShareGuard;
• Current due-diligence processes and tools;
• Required integrations;
• Desired start date;
• Application declarations; and
• Marketing preferences.

We may verify information provided in an application against relevant public, regulatory and commercial sources.

Submitting an application does not guarantee that access will be approved.

5.3 Platform account information

When an authorised user is given access to ShareGuard, we may collect:

• Name;
• Employer or organisation;
• Department and job title;
• Business contact details;
• Assigned role and permissions;
• Account identifier;
• Authentication information;
• Multifactor-authentication status;
• Login dates and times;
• IP addresses;
• Active-session information;
• Searches and reviews performed;
• Decisions and notes recorded;
• Reports viewed or downloaded;
• Changes made within the platform;
• Support requests;
• Training and onboarding information; and
• Audit, security and investigation records.

Passwords are not stored in readable form.

5.4 Dealer-intelligence information

Dealer profiles may contain business information and limited personal information about people connected to a business, including:

• Current and former directors;
• Company officers;
• Persons with significant control;
• Sole traders or partners;
• FCA-approved or regulated individuals where lawfully available;
• Appointment and resignation dates;
• Business contact details;
• Information contained in public corporate filings;
• Business ownership and control information;
• Insolvency information;
• Director-disqualification information;
• Regulatory information;
• Broker and lender review activity;
• Complaints and unwind information relating to the dealer business;
• Business outcomes;
• Risk indicators; and
• Evidence supporting a business review or decision.

ShareGuard is intended to assess dealer businesses and commercial relationships. It is not intended to provide consumer credit reports about private individuals.

5.5 Aftersales CRM information

Our customers may enter information into the ShareGuard Aftersales CRM, including:

• Customer name;
• Address and contact details;
• Date of birth where required by the customer;
• Customer or application reference;
• Vehicle information;
• Finance-agreement information;
• Dealer and lender information;
• Complaint and aftersales case details;
• Case status and ownership;
• Emails, letters, messages and call records;
• Call recordings or transcripts where lawfully collected;
• Documents, photographs and other evidence;
• Tasks and deadlines;
• Service-level and complaint dates;
• Investigation notes;
• Redress information;
• Costs and financial outcomes;
• Vulnerability or additional-support requirements;
• Allegations of fraud or misconduct; and
• Complaint and case outcomes.

Our customers are responsible for ensuring that they have a lawful basis for information they enter into the CRM.

Information concerning health, vulnerability, criminal allegations or other sensitive matters must only be entered where the customer has identified an appropriate legal condition and applied suitable safeguards.

5.6 Support and communication information

When you communicate with us, we may collect:

• The contents of emails and messages;
• Details of telephone calls;
• Support-ticket information;
• Screenshots and documents you provide;
• Technical and diagnostic information;
• Actions taken to resolve an issue; and
• Records of complaints or disputes.

5.7 Contractual and billing information

Where applicable, we may collect:

• Organisation billing details;
• Finance contact details;
• Purchase orders;
• Subscription details;
• Invoice and payment status;
• Contract and renewal records; and
• Records required for accounting and taxation.

Where payment-card processing is required, it should be handled through an authorised payment provider. ShareGuard does not intend to retain complete payment-card details within the platform.

6. Where information comes from

We may receive personal information directly from:

• You;
• Your employer;
• A broker, lender or other ShareGuard customer;
• Authorised platform administrators;
• CRM systems connected by a customer;
• Support or enquiry communications;
• Website and platform activity; and
• Devices used to access ShareGuard.

We may also obtain information from lawful third-party and public sources, including:

• Companies House;
• The Financial Conduct Authority Register;
• Licensed business-information and credit-information providers;
• Insolvency and director-disqualification records;
• Dealer websites;
• Search engines;
• Publicly accessible websites;
• Online business listings;
• Review platforms;
• Approved data and integration providers;
• Brokers and lenders providing dealer outcomes; and
• Professional advisers, fraud-prevention services or public authorities where appropriate.

The fact that information is publicly available does not remove our responsibility to process it fairly and lawfully.

7. Why we use personal information

We may use personal information to:

• Operate and secure the ShareGuard website and platform;
• Respond to enquiries;
• Arrange demonstrations;
• Review and verify access applications;
• Verify organisations and authorised representatives;
• Create and manage customer accounts;
• Provide dealer-intelligence services;
• Combine and display information from approved sources;
• Support dealer reviews and commercial decisions;
• Apply customer-configured policies;
• Provide watchlists, alerts and monitoring;
• Provide the Aftersales CRM;
• Manage complaints and customer-support requests;
• Maintain audit and decision records;
• Detect and investigate misuse, fraud or security incidents;
• Maintain service availability and performance;
• Administer contracts and subscriptions;
• Invoice customers and maintain financial records;
• Meet legal, regulatory and contractual obligations;
• Establish, exercise or defend legal claims;
• Improve our services using appropriately controlled information;
• Send requested product and service communications; and
• Send marketing communications where permitted.

8. Our lawful bases

We only process personal information where an appropriate lawful basis applies.

8.1 Contract

We may process information where necessary to enter into or perform a contract, including:

• Reviewing steps requested before entering into a contract;
• Providing customer accounts;
• Delivering subscribed services;
• Providing support;
• Managing subscriptions; and
• Administering billing.

8.2 Legitimate interests

We may process information where necessary for our legitimate interests or those of another organisation, provided those interests are not overridden by an individual’s rights.

These interests may include:

• Operating and improving our business;
• Verifying business-access applications;
• Providing business-focused dealer intelligence;
• Protecting ShareGuard and its users;
• Preventing and investigating fraud;
• Maintaining audit and security records;
• Communicating with business contacts;
• Protecting legal rights;
• Understanding service usage; and
• Supporting consistent business decisions.

Where we rely on legitimate interests, we consider the necessity and proportionality of the processing and its potential effect on individuals.

8.3 Legal obligation

We may process information where necessary to:

• Comply with applicable law;
• Maintain required financial and business records;
• Respond to lawful regulatory or court requests;
• Meet data-protection obligations; or
• Assist law-enforcement or public authorities where legally required.

8.4 Consent

We may rely on consent for:

• Certain non-essential cookies;
• Optional electronic marketing where consent is required;
• Optional communications; and
• Other processing for which consent is specifically requested.

You can withdraw consent at any time. Withdrawal does not affect processing carried out before consent was withdrawn.

8.5 Legal claims and sensitive information

Where special-category or criminal-offence information is processed, an additional legal condition must apply.

ShareGuard or the relevant customer must identify and document the applicable condition and safeguards before undertaking that processing.

9. Dealer ratings and risk indicators

ShareGuard may analyse dealer-business information and present:

• ShareGuard Ratings;
• Confidence levels;
• Risk indicators;
• Information conflicts;
• Alerts;
• Monitoring results; and
• Suggested outcomes such as Proceed, Review or Pause.

These outputs are intended to support trained business users. They do not guarantee that a dealer is safe or unsafe, and they do not replace a broker’s or lender’s own checks, professional judgement or regulatory responsibilities.

ShareGuard does not make final lending or consumer-credit decisions.

Unless we specifically notify affected individuals otherwise, ShareGuard does not make solely automated decisions about individuals that produce legal or similarly significant effects.

If this changes, this Privacy Notice will be updated and affected individuals will be provided with the information and safeguards required by law.

10. Who we share information with

Where necessary and lawful, we may share personal information with:

• The organisation employing or authorising a platform user;
• Brokers, lenders or other customers with appropriate permission;
• Hosting and cloud-infrastructure providers;
• Data-storage and backup providers;
• Authentication and account-security providers;
• Email and communication providers;
• Customer-support providers;
• Approved data, verification and integration providers;
• Payment and billing providers;
• Analytics providers where permitted;
• Lawyers, accountants, auditors and insurers;
• Regulators, courts and public authorities;
• Law-enforcement agencies where lawfully required;
• A potential purchaser, investor or professional adviser involved in a genuine corporate transaction, subject to appropriate confidentiality obligations; and
• Other parties where you authorise us or the law permits or requires disclosure.

Our service providers must only process information for authorised purposes and must apply appropriate contractual and security safeguards.

We do not sell personal information.

Information about the key service providers and subprocessors used by ShareGuard can be requested by emailing sales@shareguard.uk.

11. Information sharing between customers

ShareGuard is designed to help authorised brokers and lenders make better-informed business decisions.

Information must not automatically become available to every ShareGuard customer merely because it has been entered into the platform.

Any sharing of dealer outcomes, complaints, warnings or evidence must be:

• Connected to a lawful and documented purpose;
• Limited to authorised organisations and users;
• Accurate, relevant and proportionate;
• Controlled through appropriate permissions;
• Recorded within the platform audit history; and
• Governed by applicable customer and data-sharing agreements.

Identifiable consumer complaint information must not be shared with unrelated organisations unless there is a documented lawful basis.

12. International transfers

Some service providers may process personal information outside the United Kingdom.

Where information is transferred internationally, we will use an appropriate transfer safeguard, which may include:

• UK adequacy regulations;
• The UK International Data Transfer Agreement;
• The UK Addendum to approved standard contractual clauses; or
• Another lawful transfer mechanism.

We will also consider whether additional contractual, organisational or technical safeguards are required.

You may contact us for further information about the safeguards applying to a relevant transfer.

13. How long information is kept

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, security, regulatory and contractual requirements.

Our standard retention periods are:

We may keep limited information for longer where necessary to:

• Establish, exercise or defend legal claims;
• Investigate fraud or security incidents;
• Comply with a legal obligation;
• Respond to a regulatory requirement; or
• Preserve a marketing opt-out.

At the end of the applicable period, information will be securely deleted, anonymised or returned to the controller where appropriate.

14. How we protect information

We use proportionate technical and organisational measures designed to protect information against:

• Unauthorised access;
• Accidental loss;
• Unlawful disclosure;
• Inappropriate alteration;
• Misuse; and
• Destruction.

Depending on the service and implementation, these measures may include:

• Role-based permissions;
• Organisation-level data separation;
• Multifactor authentication for relevant accounts;
• Secure network transport;
• Controlled administrative access;
• Session controls;
• Audit logging;
• Backup and recovery procedures;
• Supplier due diligence;
• Incident-management procedures;
• Staff confidentiality requirements; and
• Data-protection training.

No online platform can guarantee complete security. Users are responsible for protecting their login information and reporting suspected unauthorised access promptly.

15. Your data-protection rights

Depending on the circumstances, you may have the right to:

• Be informed about how your personal information is used;
• Request access to personal information held about you;
• Ask for inaccurate information to be corrected;
• Ask for incomplete information to be completed;
• Request deletion in certain circumstances;
• Request restriction of processing in certain circumstances;
• Object to processing based on legitimate interests;
• Object to direct marketing at any time;
• Receive certain information in a portable format;
• Withdraw consent where processing is based on consent; and
• Request safeguards relating to qualifying automated decisions.

These rights are not absolute. Whether a right applies will depend on the circumstances, purpose and lawful basis for processing.

To exercise a right relating to information held within a customer’s Aftersales CRM, you should contact the broker, lender or organisation handling your case.

You may also contact us. Where ShareGuard acts as processor, we will refer the request to the relevant controller and assist it where appropriate.

We may need to verify your identity before responding. We will only request information reasonably necessary to complete this verification.

16. Marketing communications

We may send relevant product or service information to business contacts where permitted by law.

You can stop marketing communications at any time by:

• Selecting the unsubscribe option in an email;
• Updating your communication preferences; or
• Emailing sales@shareguard.uk.

Please use “Marketing Opt-Out” in the subject line.

Service, security, account and contractual messages are not marketing and may still be sent where necessary.

We will not use consumer information stored within the Aftersales CRM to send ShareGuard marketing.

17. Cookies

ShareGuard uses cookies and similar technologies to operate and secure its website.

Non-essential cookies, including relevant analytics or marketing technologies, will only be used in accordance with applicable requirements and the choices made through our cookie controls.

Further information is available in our Cookie Policy:

https://shareguard.uk/cookies

You can review or change your cookie preferences through the cookie settings available on the website.

18. Accuracy and challenges to dealer information

We take reasonable steps to ensure dealer-intelligence information is relevant and accurate.

If you believe information about you or your business is inaccurate, incomplete, misleading or no longer current, contact us at sales@shareguard.uk.

Please use “Dealer Information Review” in the subject line.

We may:

• Verify your identity and relationship with the business;
• Review the original source;
• Request supporting evidence;
• Correct or annotate a record;
• Restrict the disputed information while it is reviewed;
• Notify relevant recipients where required; and
• Retain a record of the challenge and outcome.

A disagreement with a business assessment does not automatically mean the underlying personal information is inaccurate. However, legitimate concerns will be reviewed fairly.

19. Children

ShareGuard is a business service and is not intended for use by children.

Platform accounts may only be created for authorised business users aged 18 or over.

Customers must not enter children’s information into the Aftersales CRM unless it is necessary, lawful and protected by appropriate safeguards.

20. Personal-data breaches

We maintain procedures for identifying, assessing and responding to personal-data breaches.

Where required, we will notify the Information Commissioner’s Office and affected individuals.

Where ShareGuard acts as processor, we will notify and assist the relevant controller in accordance with our legal and contractual obligations.

21. Complaints about personal information

If you have concerns about how we use personal information, please contact us first:

ShareGuard Data Protection
Apexsync Limited
M60 Office Park
Oak Court
Wynne Avenue
Manchester
United Kingdom
M27 8FF

Email: sales@shareguard.uk

Please include “Data Protection Request” in the subject line. Do not send unnecessary sensitive personal information by ordinary email.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://ico.org.uk
Telephone: 0303 123 1113

We would appreciate the opportunity to investigate your concern before you contact the Information Commissioner’s Office, but you are not required to contact us first.

22. Changes to this Privacy Notice

We may update this Privacy Notice when:

• Our services change;
• Our processing activities change;
• We introduce new integrations or suppliers;
• Legal requirements change; or
• We identify that additional information would improve transparency.

The current version will be published on the ShareGuard website with an updated version number and effective date.

Where a change materially affects how personal information is used, we will provide additional notice where appropriate.

Previous versions will be retained in our policy archive.

23. Contact us

Questions about this Privacy Notice or the way ShareGuard uses personal information should be directed to:

ShareGuard Data Protection
Apexsync Limited
Company number: 17513909

M60 Office Park
Oak Court
Wynne Avenue
Manchester
United Kingdom
M27 8FF

Email: sales@shareguard.uk

Please include “Data Protection Request” in the email subject line so that your enquiry can be directed appropriately.