Privacy Notice
Motability Operations Limited takes data privacy very seriously. This notice is designed to help you understand how we use your personal data.
1. About us
We are Motability Operations Limited. Our registered address is Level 6, 22 Bishopsgate, London, England EC2N 4BQ and we are authorised and regulated by the Financial Conduct Authority under reference number 735390.
Our main business is operating the Motability Scheme and the Family Fund Mobility Support Scheme (“the Schemes”) which enable eligible individuals to lease new vehicles from us (such as cars, Wheelchair Accessible Vehicles, scooters and powered wheelchairs).
2. About this privacy notice
This is our main general privacy notice that applies across our business (including our operation of the Schemes), although we may publish additional privacy statements that apply to specific services that we offer from time to time.
3. Updating this privacy notice
We may update this privacy notice from time to time. You will always be able to find the up-to-date version of this notice on our main website at motability.co.uk. This version is dated November 2025.
4. What is personal data?
Personal data is information that relates to you or allows us to identify you. This includes obvious things like your name, address and telephone number but can also include less obvious things like analysis of your use of our websites.
There are different types of personal data. The most important types for you to know about are:
- Special categories of personal data: for example, health, race, religion or biometric data
- Criminal convictions data: information about offences or alleged offences
5. Our responsibility to you
We process your personal data in our capacity as a controller. This means we are responsible for ensuring that we comply with relevant data protection laws when processing your personal data.
6. Data Protection Officer
We have appointed a Data Protection Officer to oversee our data protection compliance. If you have any questions about this privacy notice or how we handle your personal data, please email the Data Protection Officer at dataprotection@mo.co.uk(opens in a new window) or write to them at Motability Operations Limited, Level 6, 22 Bishopsgate, London EC2N 4BQ.
7. Why are we collecting personal data about you?
We only collect personal data about you in connection with operating the Schemes and running our business. We will hold information about you if:
- You enquire about a Scheme
- You enter into a Scheme hire agreement with us
- You are the disabled person who ultimately benefits from a Scheme hire agreement (even though you may not have entered into the agreement yourself)
- You are a named driver of a Scheme vehicle
- Your information is provided to us or we otherwise obtain your information in connection with the operation of the Schemes or our business. For example, you are a witness to an accident involving a Scheme vehicle
- You provide services to us (or you represent a company which provides services to us)
- You represent a regulator, certification body or government body which has dealings with us
- You attend our events, receive our updates, visit our office or use our websites
8. What personal data do we collect about you?
The types of personal data that we process about you may include:
- Individual details: name, date of birth, gender, nationality, details of your mobility allowance and your contact details, including address, telephone number (including mobile number) and email address
- Identification details: identification numbers issued by government bodies or agencies such as your national insurance number, driving licence number and identification through facial recognition and other relevant technologies
- Financial information: bank account or payment card details
- Credit, anti-fraud and sanctions data: credit history, credit score and information received from various antifraud and sanctions databases relating to you
- Criminal convictions data: information relating to your criminal convictions and offences, including driving offences
- Information on your use of a Scheme vehicle: VIN number, registration number and connected vehicle data including but not limited to mileage data, technical vehicle data, driving behaviour data, charging data and location data
- Identifiers: information which can be traced back to you, such as an IP address, a website tracking code or electronic images of you
9. Where do we collect your personal data from?
We collect your personal data directly from you. For example, when you make an application to join a Scheme, set up an on-line account with us or send an email to our customer services team.
We also collect your personal data by actively obtaining your data ourselves. For example through the use of website tracking devices, and from various third parties and publicly available sources, including:
- Your employer
- Our customers
- Our service providers
- Credit reference agencies
- Anti-fraud databases, sanctions lists, court judgements and other databases
- Government agencies and publicly accessible registers or sources of information
- Other third parties, such as witnesses to accidents involving Scheme vehicles
Which of the sources apply to you will depend on why we are collecting your personal data.
10. How do we use your personal data?
In this Section we set out in more detail the main purposes for which we use your personal data and the lawful bases upon which we are using your personal data.
| Purpose | Lawful basis |
|---|---|
Risk management and other legal obligations | |
We use personal data about Scheme hirers, drivers and others for risk management purposes and also to help us comply with legislation on money laundering, terrorist financing, and sanctions. In relation to hirers, this includes verifying the identity of hirers and carrying out credit checks, including periodic credit checks during the term of their Scheme hire agreement. We may also use certain information, such as credit check and fraud information, for risk assessment purposes, including risk assessments relating to Scheme insurance, Scheme hire agreements and determining whether to install telematics in a Scheme vehicle. We may also share your personal data in order to help prevent fraud and money laundering, for example by uploading your data onto relevant anti-fraud databases. In some cases, the personal data processed will include special categories of personal data and criminal convictions data. | For all information: compliance with a legal obligation or legitimate interests. As a firm regulated by the Financial Conduct Authority, we have a legitimate interest to manage risks responsibly. For example, this means using information to decide whether to enter into and manage Scheme lease agreements, help prevent and detect fraud or money laundering, check and confirm the identity of hirers and drivers, trace and recover debts, if needed. These activities help us protect both our customers and our business. For special category and criminal data: preventing or detecting unlawful acts, regulatory requirements and suspicion of terrorist financing or money laundering. |
Operating the Schemes | |
We use personal data to operate the Schemes. This includes processing applications to join a Scheme, entering into Scheme hire agreements, providing hirers with an online account and communicating with hirers and drivers (including via our website’s live chat function). It also includes providing hirers with a Scheme vehicle and related services and assistance, such as roadside assistance. We also use Scheme vehicle data, together with other personal data (which may include special categories of personal data) that we hold about hirers and drivers, to support the Schemes and the servicing, maintenance and repair of Scheme vehicles. | For all information: to take steps to enter into a contract with you/fulfil our obligations under the contract and legitimate interests. We have a legitimate interest in operating the Schemes and providing Scheme vehicles and associated services and assistance. For special category data: explicit consent |
Monitoring Scheme vehicle data and location | |
We may monitor driving behaviour using DriveSmart app and the DriveSmart fitted box Telematics, as set out in the relevant Scheme hire agreement and DriveSmart terms and conditions, which will be made available to hirers and drivers where relevant. We do not generally look to collect special categories of personal data and criminal convictions data for this purpose. | To fulfil our obligations under the contract and legitimate interests. We have a legitimate interest in ensuring Scheme vehicles are driven appropriately and in tracing and recovering Scheme vehicles, where applicable. |
Research and analysis | |
We may use third party providers to contact you on our behalf to ask you for your opinion and feedback on the operation of the Schemes. They may combine the data that you provide to them as part of the survey with data from other sources to study it and produce reports and advice that helps us to understand our customers’ point of view, so that we can improve the way we work as a business and our operation of the Schemes. We also process data relating to us/the Schemes which you have shared via a public platform (such as an X feed or public Facebook page) and information that you provide voluntarily on our social media pages. We also analyse information that we collect from our third party service providers (such as Google, Facebook, X and Instagram) to understand how you engage with our services to help us understand your preferences and improve our services. We use all of this information for customer insight, internal analysis and research purposes. | For all information: legitimate interests. We have a legitimate interest in carrying out research and analysis, including surveys, to better understand the needs of our customers and your views on the operation of the Schemes, to help us to improve our services and to develop new services. We also have a legitimate interest in understanding how you engage with us and our services. For special category data: research and analysis, or where that lawful basis does not apply explicit consent. |
Marketing | |
We may use your details to provide information to you in relation to the Schemes, including news and developments. In particular, we circulate a monthly Scheme newsletter to hirers (unless they have opted out) and to other individuals on request. We may also provide targeted Scheme related updates, news and advertising to Scheme hirers via our websites and the social media platforms they use. We may also use images and footage of individuals such as individuals who attend our events for promotional and marketing purposes, including on our websites and on social media. Please see ‘Events’ below for further information on our use of personal data in this context. | For all information: legitimate interests. We have a legitimate interest in keeping you informed about updates, news, and developments that may be relevant to you. This may include sending marketing communications or showing you Scheme-related updates and advertising on our website or social media platforms. When we do this, we follow the specific laws that apply to marketing and advertising, as well as data protection laws. You can choose to stop receiving marketing communications or targeted advertising from us at any time. Every message we send includes an easy way to opt out. Please note that social media platforms also have their own settings that let you control the advertising you see when using their services. We may also rely on our legitimate interests to use photographs and video footage from our events to promote the Scheme or create marketing materials. For all information: consent. Where we cannot rely on our legitimate interests to process your personal data for any of these purposes, we will do so only with your consent. |
Events | |
We organise several Scheme-related events in different locations throughout the year. For example, we hold events which enable visitors to explore a range of adapted cars and to speak to experts about their particular needs. | For all information: legitimate interests. We have a legitimate interest organising and running events in relation to the Schemes. For special category data: explicit consent. |
Visitors to our website | |
We use analytics tools to understand your preferences and to make your experience on our websites smoother and more relevant. Some areas of our websites ask you to provide personal information. For example, when you complete a form or make an enquiry. We’ll only use the information you give us for the specific purpose you provided it. Our websites also use a small number of non-intrusive cookies to help them run efficiently and to tell us how people use them. This helps us improve our websites over time. In particular, we use Google Analytics, which places small text files (known as “cookies”) on your device to collect information about how you use our websites. Google also processes this information in line with its own privacy policies and may store it on servers in the United States. You can control or delete cookies through your browser settings, or by using browser add-ons. To find out more about how we use cookies, please read our separate cookies notice. We do not generally collect any special category data (such as information about your health or beliefs) or criminal convictions data through our websites. | Legitimate interests: we have a legitimate interest in providing to you the facilities on our websites that you have requested and in understanding how our websites are used and the relative popularity of the content on our websites. We also have a legitimate interest in improving the browsing experience of visitors to our websites. Consent: where we cannot rely on our legitimate interests to process your personal data for any of these purposes, we will do so only with your consent. |
Visitors to our offices | |
We have security measures in place at our offices to help keep everyone safe. These include building access controls and, in some areas, CCTV monitoring. CCTV images are stored securely and are only accessed when necessary. For example, to investigate an incident. Recordings are automatically deleted after a short period unless they need to be kept for an investigation (such as a theft). When you visit our offices, you’ll be asked to sign in at reception. We keep visitor records securely for a short period and only access them when needed, such as to look into an incident. We do not usually collect special category data (such as health information) or criminal convictions data for this purpose. | For all information: legitimate interests. We have a legitimate interest in making sure our offices, and the people that visit and work at them, are safe and secure. For special category and criminal data: preventing or detecting unlawful acts. |
Service providers | |
We collect information about you in connection with your provision of services to us or your position as a representative of a provider of services to us. We do not generally look to collect special categories of personal data and criminal convictions data for this purpose. | Legitimate interests: we have a legitimate interest in contacting and dealing with individuals involved in providing services to us. |
11. Failure to provide your personal data to us
Where we need to collect your personal data by law or in order to provide you with our services or perform a contract we have with you and you decide not to provide that information when requested, we may not be able to provide our services or perform the contract we have or are trying to enter into with you. In other circumstances where you choose not to provide us with your personal data when we request it, your decision not to provide us with your personal data may affect our ability to provide you with our services.
12. Consent
We do not generally process your personal data based on your consent/explicit consent (as we can usually rely on another lawful basis). Where we do process your personal data based on your consent/explicit consent, you have the right to withdraw your consent at any time. To withdraw your consent please contact the Data Protection Officer using the details set out in Section 6.
If you want to opt out of receiving Scheme news and updates you can do so by following the opt out links on any communications we send to you. Alternatively, please contact the Data Protection Officer, using the details set out in Section 6, to opt out.
Please note that you cannot opt out of receiving service-related communications from us. For example, communications we send to hirers about their Scheme vehicle. However, you can still choose how you prefer us to provide you with service-related communications.
13. Who do we share your personal data with?
We do not sell your information nor make it generally available to others. But we may share your information with the following third parties:
- Third parties we use to help us operate the Schemes effectively. For example, we share personal data with our Scheme vehicle manufacturers and dealers, our Scheme insurers (currently Direct Line), our Scheme roadside assistance providers (currently RAC) and with energy suppliers where we arrange the installation of a charging point for a Scheme electric vehicle at a hirer’s home
- Research agencies
- Service providers we use to help us run our business efficiently, particularly in relation to our IT systems. Some of these services (such as email hosting and data backups) involve the service provider holding and using personal data
- Trusted third parties, such as specialist consultants, for the purposes of developing and improving our services and innovation
- Governmental departments or bodies, such as the Department for Work and Pensions, Veterans UK, Social Security Scotland and the Driver Vehicle Licensing Agency
- Relevant third parties as part of our efforts to prevent fraud, which includes third parties that have access to relevant anti-fraud databases onto which we may upload your personal data
- The Motability Foundation, which has appointed us to operate the Motability Scheme. The Motability Foundation also has its own privacy notice setting out how it processes your personal data and which can be found at
motabilityfoundation.org.uk(opens in a new window) - Family Fund Trust, which has appointed us to operate the Family Fund Mobility Support Scheme. Family Fund Trust also has its own privacy notice setting out how it processes your personal data and which can be found at motability.co.uk
- Legal and other professional advisers
- Any law enforcement agency, court, regulator, government authority or third party where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party
- In the event of termination of our appointment to operate the Motability Scheme, we will share your personal data with the Motability Foundation and the new operator of the Scheme in connection with the continued operation of the Scheme
- In the event of termination of our appointment to operate the Family Fund Mobility Support Scheme, we will share your personal data with Family Fund Trust and the new operator of the Scheme in connection with the continued operation of the Scheme
14. Organisations engaged to provide services on our behalf
Certain third parties we use to help us operate the Schemes, such as our Scheme vehicle manufacturers and dealers and our Scheme insurers, will be responsible to you, in their capacity as controllers, for how they use your personal data that we share with them. These third parties have their own privacy notices informing you how they will use your personal data. More information about how our Scheme insurers use your personal data can be found in the Scheme insurance cover booklet.
Other third parties we use to help us operate the Schemes, such as our Scheme roadside assistance providers, act as our processors when processing your personal data in relation to the Schemes. This means that we are responsible to you for how they process your personal data and they only process your personal data in line with our instructions.
All our third-party providers are required to take appropriate security measures to protect your personal data and the personal data we share with them is limited to the information they require to provide their services to us.
15. Transferring information outside the United Kingdom
As part of operating the Schemes and running our business, we may transfer your personal data to countries outside of the UK. Where we transfer your personal data outside of the UK, we will protect your personal data by ensuring that the transfer is made in compliance with all applicable data protection laws.
In most cases, this means we will only transfer your personal data to third parties located in:
- Countries that have been deemed to provide an adequate level of protection for personal data by the UK Government
- Other countries only when we have put specific contracts in place with those third parties approved by the Information Commissioner’s Office (“ICO”), the UK supervisory authority for data protection issues, which obtain contractual assurances from the third party that your personal data will be protected by standards which are equivalent to those that protect your personal data when it is in the UK
16. How we protect your personal data
We are committed to keeping your personal data safe and we implement appropriate steps to help maintain the security of our information systems and processes and prevent the accidental destruction, loss or unauthorised disclosure of the personal data we process secure. Our security measures include:
- Security controls which protect our infrastructure from external attack and unauthorised access
- Regular cyber security assessment and business continuity exercises to ensure we are ready to respond to cyber security attacks and data security incidents
- Internal policies and procedures relevant to data and data security
17. Profiling and automated decision making
We do not use profiling (where an electronic system uses personal data to try and predict something about you) or automated decision making (where an electronic system uses personal data to make a decision about you without human intervention).
18. Data retention
We keep your personal data in accordance with our data retention policy which categorises all of the information held by us and specifies the appropriate retention period for each category of information. Those periods are based on the requirements of relevant data protection laws and the purpose for which the information is collected and used, taking into account legal and regulatory requirements to retain the information for a minimum period, limitation periods for taking legal action, good practice and our business purposes.
Further information in relation to our data retention processes may be obtained by contacting the Data Protection Officer using the details set out in Section 6.
19. Your rights relating to your personal data
Under certain conditions, you may have the right to require us to:
- Provide you with further details on how we use your personal data
- Provide you with a copy of the personal data we hold about you
- Update any inaccuracies in the personal data we hold about you
- Delete any of your personal data that we no longer have a lawful ground to use
- Restrict how we use your personal data, for example, whilst a complaint is being investigated
- Where processing is based on consent, stop that particular processing by withdrawing your consent
- Object to any processing based on our legitimate interests unless our reasons for undertaking that processing outweigh any prejudice to your data protection rights
- Transfer your personal data to a third party in a standardised machine-readable format
In certain circumstances, we may need to restrict your rights in order to safeguard the public interest (for example, the prevention or detection of crime) and our interests (for example, the maintenance of legal privilege).
You can exercise any of these rights at any time by contacting the Data Protection Officer using the details set out in Section 6.
We are obliged to keep your personal data accurate and up to date. Please help us to do this by advising us of any changes to your personal data.
20. Your right to complain
If you are not satisfied with our use of your personal data or our response to any request by you to exercise your rights, or if you think that we have breached any applicable data protection laws, you have the right to make a complaint at any time to the ICO. The ICO can be contacted on 0303 123 1113 or via the website at ico.org.uk(opens in a new window).
Last updated November 2025