Privacy Policy

The Motability Foundation is a registered charity and the ‘data controller’ of personal information that we collect from you (including through our websites) and use for the purposes described in this Policy.

The websites available at www.motabilityfoundation.org.uk and www.motabilityenterprises.co.uk (both referred as our “Site”) are operated by the Motability Foundation. Motability (operating as Motability Foundation) is a company incorporated by Royal Charter (Company Number RC000716), a registered charity in England and Wales (number 299745) and a registered charity in Scotland (number SC050642) and our registered office is at Warwick House, Roydon Road, Harlow, Essex CM19 5PX ("Motability Foundation", “we”, “us” or “our”).

For the purpose of applicable data protection laws, we are the ‘data controller’ of any personal information that we collect from you or that you provide to us. This means that we are responsible for deciding how we hold and use personal information about you.

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact our DPO using the information set out in the ‘Questions regarding this Privacy Policy’ section below.

We are required under applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, to provide you with the information contained in this Privacy Policy.

This Privacy Policy explains how and why the Motability Foundation collects and uses your personal information. It applies whether you are a Motability Scheme applicant or customer, enquiring about a charitable grant or interact with us in another way (e.g. MPs, representatives, health professionals, etc).

The policy outlines:

• Our personal data handling practices;

• Your individual rights under data protection law; and

• The legal obligations we comply with.

It should be read alongside our Terms and Conditions, which include our Site terms and Cookie Policy.

Please read this Privacy Policy carefully to understand our practices regarding your personal data and how we will treat it.

This Privacy Policy explains how we collect, use and safeguard personal information, in line with applicable data protection laws.

It is intended for:

Motability Scheme applicants and customers

If you are a Motability Scheme applicant or customer, we will receive and use certain personal information about you. Some uses go beyond what is described in this Privacy Policy and are detailed in your vehicle lease agreement or any separate documents which you may complete as a Motability Scheme customer (for example, your application for a vehicle and any application for financial help).

Importantly, the Motability Scheme is operated by Motability Operations Limited (“Motability Operations”), which has its own Privacy Notice explaining how it handles personal information relating to Motability Scheme customers. That Privacy Notice is found on Motability Operations’ website here: www.motability.co.uk/utilities/privacy-notice

Individuals enquiring about Motability Foundation Charitable Grants or the Motability Scheme

Where individuals enquire about Motability Foundation Charitable Grants or the Motability Scheme and provide us with personal information, this will be collected and used as set out in this Privacy Policy, for the purposes of responding to those enquiries.

Charitable Grant Applicants and Grantees (or where applicable, their nominees or designated contacts) will receive additional data processing notices that will set out in further detail the required information and its uses.

Individuals referred by Motability Operations concerning admission, readmission, or exclusion from the Motability Scheme should be aware that their personal data may be processed by the Motability Foundation as part of its oversight role. This may include reviewing, recording, and retaining information to support decisions.

People contacting us on behalf of applicants or Scheme customers – such as MPs, Solicitors, health professionals.

If you contact us on someone’s behalf and share personal information, it will be collected and used as set out in this Privacy Policy, for the purposes to respond appropriately.

People contacting us in respect of donations and/or legacies – this includes representatives and executors.

If you contact us in respect to a donation and/or legacy and share personal information, it will be collected and used as set out in this Privacy Policy, for the purposes to respond appropriately.

General Public interacting with Motability Foundation or about Motability Foundation via social media.

If you contact us via social media and share personal information, it will be collected and used as set out in this Privacy Policy, for the purposes to respond appropriately.

We collect your personal information through completed application forms, your use of our website (the “Site”), and any other communications you have with us.

This includes:

(i) Information provided when you fill in forms on the Site, download materials, request newsletters or other services, or contact us about the Motability Scheme;

(ii) Details you share during direct communication with us – whether initiated by you, a representative or us;

(iii) Public posts on social media platforms that refer to Motability (which will include Motability Foundation, Motability Enterprises Limited or Motability Operations);

(iv) From third parties (e.g. Motability Operations Plc, Department of Work and Pensions (DWP), credit agencies, medical professionals etc

(v) Technical data from your visits to the Site, including traffic data, location data, weblogs and other communication data, and the resources that you access; and

(vi) Use of cookies and tracking technologies; We use cookies and similar tracking technologies on our Site to improve functionality, enhance your browsing experience and collect anonymised usage data to help enhance our services.

Please note: You can browse most of the Site without providing personal data.

Some non-essential cookies may be used without your consent under low-risk provisions of Data (Use and Access) Act 2025. You can manage, adapt or disable your cookies through browser settings. Cookies are small files stored on your computer or device that help the site operate effectively and tailor content to your preferences. Please note that doing so may affect how the Site functions.

For full details about the cookies we use and why, please see our Cookie Policy.

We collect different types of personal information depending on your relationship with us.

1. Motability Scheme applicants and customers

2. Charitable grant applicants and beneficiaries

* EDI data is processed for statistical analysis, reporting and to inform our EDI strategy. Data is pseudonymised (all individual identifiers are removed) at the point of data collection, aggregated (grouped to avoid identification of individuals) and stored separately. Access to EDI data is strictly limited to authorised staff involved in EDI monitoring and compliance. Sharing EDI data is voluntary and is not visible to decision makers of specific grant applications.

We are committed to promoting equity, diversity and inclusion (EDI) across all our activities. To help us achieve this, we collect and process EDI data from applicants, beneficiaries, staff, and other stakeholders. This enables us to monitor representation, ensure fair treatment, and improve our services for all.

3. Individuals contacting us on behalf of others

4. People contacting us in respect of donations and / or legacies

5. General public interacting via social media

6. Website visitors

We may send you Lifestyle magazine, details of affinity products, and other updates - based on your contact preferences.

If you have provided your consent for this during the application process or otherwise, we may contact you by:

• Post;

• Phone;

• Email;

• Text messages; or

• Other methods.

These communications may include information about extra products and services from trusted partners, like financial services, insurance, or travel (known as ‘affinity products’).

We will only send emails or texts or call you for marketing if you’ve specifically consented to this. We may also use your personal data to:

• Build a contact list;

• Choose what information we think will interest you; and

• Organise how and when we send messages.

This kind of processing is based on our legitimate interest to let you know about things that may benefit you. We aim to do this responsibly and fairly.

You can opt out of these communications at any time if you would prefer not to receive such direct marketing from Motability Foundation using the unsubscribe button on the communications.

The Motability Foundation may monitor and record telephone calls for legal, training and quality purposes. This helps us address issues raised by Scheme customers and maintain high standards.

Types of calls recorded:

• Incoming calls – calls we receive (including any calls re-directed from Motability Operations); and

• Outgoing calls – calls we make to applicants, customers, representatives, complainants or others.

Why we record calls:

The Motability Foundation records these calls for the following purposes:

• to establish the existence of facts relevant to its activities; for example, to keep a record of information given via telephone by or to Motability Scheme customers or applicants;

• to ascertain compliance with regulatory or self-regulatory practices or procedures relevant to the Motability Foundation; for example, to ensure that the Motability Foundation is complying with applicable data protection laws and its own policies and procedures;

• to support staff training and maintain high standards;

• to ensure complaints are managed effectively; and

• to prevent or detect fraud or other serious issues.

The Motability Foundation determines the nature and extent of its call recording appropriate for the above purposes, taking into account:

• the importance which it attaches to the sensitive and responsive handling of all calls with Motability Scheme customers including those customers who may have a cognitive impairment, and the need for rigorous quality control and staff training to achieve this;

• the importance which it attaches to identifying, remedying and addressing the root cause of those calls which are not regarded as a good experience by Motability Scheme customers or applicants, recognising that such calls are likely to be isolated occurrences;

• the results of its data protection impact assessment in relation to call recording; and

• the advice of its Data Protection Officer.

The Motability Foundation may (from time to time) record telephone calls for other purposes, provided that the individuals involved in such telephone calls consent to the telephone call(s) being recorded for the stated purpose.

Consent and notification

The Motability Foundation will use all reasonable efforts to ensure that callers are informed that telephone calls, both incoming and outgoing, may be recorded.

We use pre-recorded messages or verbal notices to inform that a call may be recorded. By continuing with the call, Motability Foundation take that as confirmation of that person’s consent to the recording. If we record calls for other specific reasons, we will request additional consent, such as for case studies.

Share recordings

The Motability Foundation will make call recordings available to Motability Operations only where it is necessary for Motability Operations to hear the call first hand:

• to establish facts and understand the customer’s circumstances to address the issue being raised;

• to enable a customer complaint to be addressed appropriately; and

• to understand the context in which information is being provided.

The Motability Foundation does not make call recordings available to any other third parties, unless it is legally obliged to do so.

The Motability Foundation will not retain telephone recordings for any longer than necessary for the purposes for which they are collected, or as required by applicable legal or regulatory requirements, whichever is longer.

When recording incoming and outgoing telephone calls, the Motability Foundation will comply with applicable data protection laws and our internal Information and Communication Technology (ICT) and Data Protection Policies and Procedures.

The Motability Foundation has determined that it has a legitimate interest in recording incoming and outgoing telephone calls in accordance with this Privacy Policy and that the importance of such call recording practices as described in this Privacy Policy are not overridden by the privacy rights of the relevant data subjects.

Auto Quality Assurance

We use automated tools to support the quality monitoring of telephone calls. These tools help us review a greater volume of interactions and provide insights that support the development of our team and improve customer experience.

These assessments do not result in automated decisions about individuals interacting with us.

If you are in receipt of a grant from Motability Foundation, we may use your personal data to conduct evaluation or innovation research.

This helps us:

• to understand the impact of our programmes on beneficiaries;

• improve and develop our programmes and services; and

• better understand the mobility and transportation needs of disabled people.

In cases where personal data is used for research or statistical purposes:

• We may seek consent for broadly defined areas of research in accordance with the Data (Use and Access) Act 2025;

• Robust safeguards are in place to minimise risks to individuals; and

• Findings will never identify individuals unless explicit consent has been provided.

The Motability Foundation will endeavour to protect individual’s privacy rights by anonymising data wherever possible so you cannot be personally identified. Participation in research involving personal data is entirely voluntary.

If as part of our research your personal data is published externally, we will always:

• Request your consent to your personal data being used in external reporting, and

• Share the relevant content with you before it is included in any report and circulated externally.

These activities help to inform policy, improve services, and support charitable outcomes. If you prefer not to take part or not have your personal data included in any report, please contact us and we will respect your decision.

You can withdraw your consent at any time by contacting us using the details below.

If you are a Motability Scheme user or you are in receipt of a grant from Motability Foundation, we may invite you to participate as a case study to help us demonstrate the impact of our programmes and share real life experiences. Case studies may be published on our Site, in reports, press releases or on social media.

We may collect additional information from you such as photographs, quotes, or video/audio recordings, but only with your explicit consent.

You can withdraw your consent at any time by contacting us using the details under ‘Questions Regarding this Privacy Policy’ below. If you do so, we will stop using your information in future publications and, where possible, remove it from our Site and other channels. Please note that once an article is published in the public domain, we are unable to retract it.

We use social media listening and monitoring tools to understand public sentiment, identify trends, and manage our reputation. These tools help us to:

• Monitor public conversations and posts on social media platforms (such as X, Facebook, Instagram, LinkedIn, and TikTok) that mention or relate to the Motability Foundation, our programmes, or relevant topics;

• Analyse engagement, sentiment (positive, neutral, negative), and trends using keywords (e.g., “Motability”, “Motability Scheme”);

• Respond to direct messages or public posts where appropriate and manage community interactions;

• Identify and address potential reputational risks, misinformation, or emerging issues quickly; and

• Generate aggregate reports and insights to inform our communications and improve our services.

We collect publicly available information and direct messages sent to our official accounts to support our understanding and engagement with the public, manage our reputation and improve our services (our legitimate interests).

We retain your personal information for as long as is necessary to fulfil the purposes for which it is collected. Where possible, we may anonymise your data such as statistical data about website usage or browsing patterns, so that it no longer identifies you, and in that case the anonymised data may be retained for a longer period or indefinitely.

We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

When assessing what retention period is appropriate for your personal data, we take into consideration:

• the requirements of the Motability Foundation including applicable legal, regulatory, tax, accounting or other requirements;

• the purposes for which we originally collected the personal data;

• the lawful grounds on which we based our processing (which may include our legitimate interests, where the processing is necessary for the performance of a contract, in some cases where you have specifically consented to the processing or to comply with legal obligations);

• the nature, sensitivity, types and volumes of personal data we have collected; and

• whether the purpose of the processing could reasonably be fulfilled by other means.

We may share your personal information with third parties, including the Department for Work and Pensions (DWP), Motability Operations and service providers to the Motability Foundation, where necessary for the purposes described in this Privacy Policy.

Why might you share my personal information with third parties?

We will share your personal information with third parties when:

• required by law;

• it is necessary to administer our relationship with you; or

• supported by a legitimate interest.

Which third-party service providers process my personal information?

‘Third party service providers’ include:

• our contractors and designated agents;

• other entities within our group;

• service partners involved in the provision of Motability Scheme vehicles or driving lessons;

• third parties verifying eligibility for the Motability Scheme or in assessing applications for financial help;

• professional advisors (such as lawyers, insurers, auditors and bankers;

• regulators such as Charity Commission, Information Commissioners Office, Financial Conduct Authority;

• affinity services providers; and

• providers of IT and data storage services, professional advisory services, administration services and emailing services.

All our third-party service providers are required to take appropriate security measures to protect your personal information. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

What about other third parties?

For Motability Scheme customers, we may also share your personal information with third parties to verify your eligibility for the Scheme and for the other purposes described in our separate documents with you. Third party recipients of your personal information for these purposes include the Department for Work and Pensions (DWP), Motability Operations, credit reference agencies, vehicle convertors and adaptors and Direct Line Motability (DLM) as the Motability Scheme insurer.

We may also share the personal information of our Site visitors with our Scheme delivery partners to enable us to deal with your request(s).

We may share your personal information with other third parties, for example in the context of the possible restructuring of Motability Foundation. We may also need to share your personal information with a regulator or to otherwise comply with the law.

We will not ordinarily transfer personal information outside of the UK. However, if any third party recipients of your data are located or use processing facilities outside the UK (including the EEA) such transfers may occur.

Where this happens, we will ensure a similar degree of protection is afforded to it by ensuring that at least one of the following safeguards is implemented:

• we will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data through ‘Adequacy Regulations’ made under applicable data protection laws; and

• we may use standard contractual clauses approved by the Information Commissioner’s Office, including the UK International Data Transfer Addendum, to ensure your personal data continues to receive the same protection it has in the UK.

Our email sending service provider, Mailchimp (The Rocket Science Group LLC), is based in the USA. Our contract with Mailchimp incorporates

• the EU ‘standard contractual clauses’;

• the UK International Data Transfer Addendum which has been approved by the European Commission and the UK Secretary of State respectively; and

• the Rocket Science Group LLC t/a ‘Mailchimp’ also participates in and has certified its compliance with the EU-US Data Privacy Framework.

Please contact our Data Protection Officer (under ‘Questions Regarding this Privacy Policy’ below) if you want further information on the specific mechanism to be used by us if we are to transfer your personal data outside of the UK.

We take the security of personal information very seriously. As a data controller, we implement appropriate measures to keep personal information secure, and we take steps to ensure that our third party service providers do the same.

Our security measures include:

• Appropriate and technical organisational measures to prevent your personal information from being accidentally lost, used or accessed, altered or disclosed in an unauthorised way;

• Strict access controls to limit access to your personal information to those employees, agents, contractors and other third parties who have a need to access it for the purpose of their work; and

• Confidentiality obligations for those with access rights, they will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We also have in place procedures to respond to data security incidents. We will notify you and any applicable regulator (including the Charity Commission and/or the Information Commissioner’s Office) of a known or suspected personal data breach where we are legally required to do so.

As an individual whose personal information we are processing, you have certain legal rights as the ‘data subject’ under applicable data protection laws.

These include rights to access, rectify, erase and object to the use of your data, in certain circumstances.

Under certain circumstances, you have the right under applicable data protection laws to:

• request access to your personal information. This enables you to receive details of the personal information we hold about you;

• request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;

• request erasure of your personal information, also known as the ‘right to be forgotten’. This enables you to ask us to delete or remove personal information where there is no legal reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below);

• object to processing of your personal information where we are relying on a legitimate interest and there is something about your particular situation which makes the processing unfair insofar as it affects you. You also have the right to object where we are processing your personal information for direct marketing purposes;

• request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it; and

• request the transfer of your personal information to another party.

It is important that the personal information we hold about you is accurate and current.

If you fail to provide certain information when requested, we may not be able to perform a contract that we have entered into with you or complete or progress a request that you have made, or we may be prevented from complying with our legal obligations.

If you want to exercise any of the above rights, please email: DataProtectionOfficer@motabilityfoundation.org.uk or write to the Data Protection Officer at Motability Foundation, Warwick House, Roydon Road, Harlow, Essex CM19 5PX.

You will not have to pay a fee for making a legitimate request to access your personal information (or to exercise any of the other rights). However, if your request for access is clearly unfounded, repetitive or excessive then we may charge a reasonable fee or, alternatively, we may refuse to comply with the request in such circumstances.

We may request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to a person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Please note that the data subject rights listed above are not absolute and we may be entitled (or required) to refuse requests where exceptions or other grounds apply.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

In the limited circumstances where you may have provided your consent to the use of your personal information for a specific purpose (for example, in relation to the sending of electronic direct marketing which you have indicated you would like to receive from us), you have the right to withdraw your consent to the use of your information for that purpose at any time. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

You can withdraw your consent to the use of your personal information at any time by contacting our Data Protection Officer by post at: Warwick House, Roydon Road, Harlow, Essex CM19 5PX, or by email: DataProtectionOfficer@motabilityfoundation.org.uk.

Once we have received notice that you have withdrawn your consent, we will stop processing your information for the specified purpose, unless we have another lawful basis for doing so.

We do not rely on ADM that has a legal or similarly significant effect on individuals.

Where such processing does occur, we will:

• Inform affected individuals about the logic involved and potential consequences;

• Provide an opportunity to request human review (please use the contact details under ‘Questions Regarding this Privacy Policy’ below) or contest the decision; and

• Ensure that any use of ADM is fair, transparent, and subject to appropriate safeguards.

We are committed to protecting the privacy of children. While individuals under the age of 18 may be eligible to receive grants, we liaise exclusively with their parent or guardian rather than directly with the child.

Where our services may be accessed by individuals under the age of 18, we take steps to:

• Design content and communications with young people’s privacy needs in mind;

• Implement age-appropriate safeguards in line with Data (Use and Access) Act 2025.

If we discover that personal information has been collected directly from a child without the appropriate consent or involvement of a parent or guardian, we will take reasonable steps to delete that information.

Any changes we may make to our Privacy Policy in the future will be notified by publishing an updated version on this website page: www.motabilityfoundation.org.uk/privacy-policy/

This Privacy Policy was last updated on 23 February 2026.

This section explains how to raise a complaint specifically about how we handle your personal data or privacy rights under data protection law. For all other types of complaints (e.g. service, grants, or general feedback), please refer to our general complaints process.

The Data Protection Team aim to respond to all data protection and privacy related complaints promptly, clearly and respectfully.

Our process includes:

• Acknowledging your complaint within 30 calendar days;

• Investigating and responding without undue delay;

• Providing a clear summary of the outcome and any actions taken; and

• Offering an internal review if you remain dissatisfied.

For urgent matters or unresolved feedback, we encourage you to contact our Data Protection Officer using the details under ‘Questions Regarding this Privacy Policy’ below.

Under the Data (Use and Access) Act 2025, you should raise your concern with us first. If you are not satisfied after completing our internal process, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. Visit www.ico.org.uk for details.

If you have any questions regarding this Privacy Policy or how we handle your personal information, please contact:

• Data Protection Officer

• Motability Foundation, Warwick House, Roydon Road, Harlow, Essex CM19 5PX;

• DataProtectionOfficer@motabilityfoundation.org.uk; or

• 01279 635999.

Please mark all email and postal correspondence with: “FAO Data Protection Officer”.