LeaseKind launch waitlist — privacy notice

Version · 8 October 2026 · LK-PRIVACY-1.1

Who looks after your information

LeaseKind is a trading name of McNally Change and Transformation Consultants Ltd, registered in Scotland, company number SC619958. Our registered office is 2 Tupper Court, Hamilton, South Lanarkshire, Scotland, ML3 7ZU. This company is the controller of your personal information.

For privacy questions or requests, contact enquiries@mcnallyconsultants.co.uk or write to our registered office.

Joining the launch list

We collect your email address, the time you request launch emails, the permission wording and privacy-notice version you see, and a record of your confirmation. We use these to confirm your request and send LeaseKind launch updates if you confirm. Joining is optional and does not reserve a vehicle, book a service or commit you to pay anything.

We rely on your consent for these emails. We do not use this permission for other brands’ marketing, sell the list or pass it to car providers for marketing. We do not make automated decisions about you that have legal or similarly significant effects.

You can withdraw permission at any time using the unsubscribe link in a launch email or by emailing our privacy contact. Withdrawal does not affect processing that was lawful before you withdrew.

Keeping the website and emails working

Our hosting and email providers process technical information to deliver and secure their services, including request times, browser/device information, IP information, email delivery results and bounces. We use limited security and delivery records under our legitimate interests in preventing abuse, operating the service and resolving delivery problems.

The signup service uses a coded version of your IP address to limit repeated requests. It does not save your email in the website’s application logs. IONOS says its standard web-hosting visitor logs anonymise IP information when collected and retain visitor data for eight weeks.

We do not load optional website analytics, advertising pixels or third-party signup embeds. Brevo’s email technology can record opens and clicks; our settings use anonymous statistics rather than reports linked to individual subscribers. Confirmation and unsubscribe actions still need to identify your subscription to carry out your request.

Who processes information for us

We use IONOS for website hosting and Brevo (Sendinblue SAS, France) for confirmation emails and the launch list. These providers and their authorised subprocessors process information under their service and data-processing arrangements. Information may also be disclosed where required by law.

Brevo’s arrangements include processing in the European Economic Area and access or processing in other countries, including the United States and India. Its published agreement describes contractual safeguards and other applicable transfer mechanisms. You can contact us for information about the safeguards relevant to your information. We do not promise that all processing takes place in the UK.

How long we keep it

• Launch-list contact details: until you unsubscribe, or for up to 12 months after confirmation, whichever comes first. If we finish sending launch updates earlier, we remove you from the active launch list within 30 days of the final update. An ongoing newsletter would require separate permission.
• Unconfirmed requests: you are not added to the launch list. Confirmation links expire after 30 days. Related delivery records follow the email-log period below.
• Email delivery logs: one month, followed by Brevo’s deletion processing, which may take up to 24 hours. We do not retain new email-content previews in Brevo.
• Permission and unsubscribe evidence: only the information needed to demonstrate permission or handle a complaint, for up to two years after leaving the list, unless a specific dispute or legal obligation requires longer retention.
• Suppression records: a minimal record of your opt-out for as long as we operate the launch mailing list, reviewed annually, so we do not accidentally contact you again. These records are not used to send marketing.
• Website rate-limit records: removed by a daily housekeeping process after they are 24 hours old, so deletion can take up to 48 hours. Standard IONOS visitor logs follow its eight-week period.

Deletion from active systems may be followed by expiry from protected provider backups under their backup processes. Information in retained backups must not be used for marketing.

Your rights

Depending on the circumstances, you can ask for access, correction, erasure, restriction or portability of your personal information. You can object to processing based on legitimate interests, and you can always object to direct marketing. Contact us using the details above.

You can also complain to the Information Commissioner’s Office.