PRIVACY POLICY FOR AR (Agreed Repairer)

Privacy notice

1. CONTROLLER AND DATA PROTECTION OFFICER

The Controller is Leapmotor International B.V., Taurusavenue 1, 2132LS Hoofddorp, the Netherlands. Data subjects can contact the Data Protection Officer team at the email address dpo-lpmi@leapmotor- international.com.

2. PURPOSE AND LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

The personal data you have provided, including your data and those referred to employees (“data subjects”) by whom you received an expressed authorization to act (“Data”), will be processed by Leapmotor International B.V. (“Company”) for the following purposes:

a)   organizing and providing training, performing skills assessment to provide customized  professional development, creating users to access the IT system and APP used for sales and aftersales (“Service”), as foreseen by the agreement with the Company. This processing is based on the execution of a contractual obligation or pre-contractual measures;

b)   providing after-sales service support, such as remote diagnostics and technical support function, to ensure the continuity and quality of our services. This processing is based on the execution of a contractual obligation or pre-contractual measures.

c)   ensuring the security and availability of our services to prevent potential risks and to safeguard the systems and the data we process. This processing is based on our legitimate interest in safeguarding our systems and protecting our users.

Specific information about the above data processing are indicated in Annexes 1, 2 and 3.

The Data may be processed in hardcopy, by automated or electronic means.

3. CONSEQUENCES OF FAILURE TO PROVIDE THE DATA

Submitting the Data is never mandatory. However, not providing the Data marked as mandatory will prevent the Company from providing the Service. On the other hand, not providing the optional Data will allow data subjects to access the Service anyway.

4. RECIPIENTS OF THE DATA

The Data may be processed by natural persons and/or legal entities, acting on behalf of the Company and under specific contractual obligations, based in EU Member States or in countries outside the EU. The Data may be communicated to third parties to comply with legal obligations, to execute Public Authorities orders or to exercise a Company right before judicial authorities.

5. DATA TRANSFER OUTSIDE OF THE EEA

Within its contractual relations the Company may transfer the Data in countries outside of the European Economic Area (EEA), including store them in databases managed by entities acting on behalf of the Company. Databases management and Data processing are bound to the purposes of the processing and are carried out according to applicable data protection law.

In case the Data are transferred outside of the EEA the Company will use any appropriate contractual measures to guarantee an adequate protection of the Data including – among the others – agreements based on the standard contractual clauses adopted by the EU Commission to rule the transfer of personal data outside of the EEA.

6. DATA RETENTION

The Data processed to provide the Service and the Customer Satisfaction will be kept by the Company for the period deemed strictly necessary to fulfil such purposes. Concerning the Data processed for the provision of the Service, the Company may continue to store these Data for a longer period, as may be necessary to protect Company’s interests related to potential liability related to the provision of the Service

7. DATA SUBJECTS RIGHTS

Data subjects can exercise the following rights:

1.    right to access means the right to obtain from the Company whether data subjects Data are being processed and, where applicable, have access to them;

2.    right to rectification and right to erasure means the right to obtain the rectification of inaccurate and/or incomplete Data, as well as the erasure of Data when the request is legitimate;

3.    right to restriction of processing means the right to request suspension of the processing when the request is legitimate;

4.    right to data portability means the right to obtain Data in a structured format, ordinary used and readable, as well as the right to transfer Data to other controllers;

5.    right to object means the right to object to the processing of Data when the request is legitimate, including when the Data are processed for marketing or profiling, if applicable;

6.    right to lodge a complaint with a supervisory authority in case of unlawful processing of Data.

Data subjects can exercise the abovementioned rights by writing to Privacy-rights-lpmi@leapmotor- international.com.

ANNEX I

Processing activities

Please find hereunder some specifications about the purposes of processing activities.

Purpose 2.a)

Account Login: If you possess an authorized MyPeople account, you can login and authenticate using your MyPeople account and passord. Upon successful authentication, your username, organization, organization code, country, position, employment status, email, and phone number in MyPeople will be synchronized and displayed within the app.

Purpose 2.b) Remote diagnosis: You can efficiently identify and resolve vehicle issues through fault code searches with VIN. Additionally, you can analyze real-time vehicle signal data directly from your mobile device. This feature provides you with diagnostic information, increases repair precision, and helps you manage potential vehicle concerns.

Technical Support: This features facilitates the creation of work orders for technical assistance, safety concerns, incidents, and other issues you may encounter. The data associated with a work order and the history of ticket will be maintained to ensures transparency and  traceability in the support process.

Purpose 2.c)

Security Measures: In utilizing our services, we collect device information and log information to ensure the safety, stability, and optimal performance of the services. This data collection is essential for the prevention and management of potential risks associated with the service.

Some of information is collected using Cookies and Other Tracking Technologies that are on your Browser or Device. This helps us for instance to avoid malfunctioning during the provision of the Services and allows us to provide you with Content that may be useful to you. More information on cookies can be found in Cookie Policy ( https://dev-usercenter.leapmotor.com/cookie-policy).  

ANNEX Ⅱ

SDK list

Name Purposes Type of Personal data and privacy policy
Firebase To push relevant messages under purpose 2.b) Device information.For details, please refer to https://firebase.google.com/support/privacy

ANNEX Ⅲ

APP System Permission

Permission Description Purpose
Image, Photo, File, Video Storage Permission Upload images, videos, and files Describe the problem or provide a solution in the form of pictures, documents, videos, etc. under purpose 2.b)
Camera Take photos and upload pictures and videos Describe the problem or provide a solution in the form of pictures or videos under purpose 2.b)
Notification Push notifications To push notifications such as new work orders under purpose 2.b)


PRIVACY POLICY FOR IO (Independent Operator）


Personal Data Processing Disclaimer to Article 13 of the UE Regulation 2016/679 (“Privacy Policy”)

If you are reading this document ("Privacy Policy"), it is because you are visiting this Website (“Website”) or Application (“Application”).

This Privacy Policy was written under Article 13 of the EU Regulation 679/2016 (hereinafter "GDPR") and provides some examples of how we process your Personal Data. If you have any questions about this Privacy Policy or how we process your Personal Data, please send your request to: admin_ti@stellantis.com. The information and Data you provide or otherwise acquire will be processed following the provisions of the GDPR and the confidentiality obligations that inspire the Data Controller's business. From this Website and/or Application, connecting to other third-party Websites through special links may be possible. We encourage you to consult their respective privacy policies for these processing activities. The Data Controller is not liable for the management of Personal Data, if any, by such third-party websites.

1. Who we are

 STELLANTIS EUROPE S.p.A., headquartered at Corso Giovanni Agnelli 200, 10135 - Turin, Italy (hereinafter also "we" or "us") is the Data Controller of your Personal Data (hereinafter: “Data”).
2. What data we collect and process

We collect Data from our Website and Application. The Data collected and the related processing purposes depend on the management of the settings of the Browser and the Device being used.
The purposes for collecting your Personal Data are stated in the section "Why we collect and process your Data".

   

a) Data provided by the user

You may provide us with Personal Data when you use this Website and Application. This is the case, for example, when you register with our Website and Application and use the related Services.
If you provide us with third-party data, you will be held responsible for sharing that information. You must be legally authorized to share it (i.e., authorized by a third party to share their information, or the sharing must be necessary and justified by a legitimate reason). You must hold us harmless from any liability in the event of any claims, demands, or damages that may arise from the processing of Personal Data of third parties in breach of the applicable data protection law.

b) Judicial Data referable to you

We may receive Judicial Data from you, only in cases required by laws and/or regulations during your registration to the Website and Application.

c) Data collected by the Browser and Device

When you use our Website and Application we collect information about the Browser and Device you are using. This information includes your IP Address, date, time and requested URL, Unique Identifiers, and other information, such as the type of Browser or Device. Information on the Browser or Device may include operating system, language, network settings, telephone or Internet provider, third-party applications installed, and plug-in lists.
Some of this information is collected using Cookies and Other Tracking Technologies present in your Browser or Device. More information about Cookies can be found in our Cookie Policy.

3. Why we collect and process your Data and legal grounds

 Your Data are used for the following purposes:
 

a. Provide our Services and related support

allow you to browse the Website and Application and provide the Services you request from the Data Controller from time to time. This processing is based on the performance of a contractual obligation or pre-contractual measures taken at your request;
 

b. Statistical purposes

for statistical purposes without being able to be traced back to your identity (“Statistics”). It should be noted that such processing is not performed on Data and therefore can be freely carried out by the Data Controller. This processing is based on the legitimate interest of the Data Controller.
   

c. Fulfilling legal obligations

We may use your Data to fulfill legal obligations and orders to which we are subject, which is the legal basis for processing your Data.
Some legislation may require us to share your Data with public authorities. If this sharing is not required by the law of your country, we may still send your Data, as explained in more detail in the next purpose "Protection of our interests and your interests".
 

d. Protection of our interests and your interests

To the extent permitted by applicable Data protection law, we may need to use your Data to detect, prevent, and respond to fraudulent and illegal behavior or activities that could compromise the safety of our Services , Website and Application. This could occur when you use our Website and Application in manners other than what is permitted or if you behave inappropriately at Our Events. These purposes include audits and evaluations of our business operations, safety checks, financial checks, records, and information management program, and otherwise in connection with the administration of our general business activities, accounting, record account, and legal functions.
These purposes are based on our legitimate interest in protecting our interests and protecting our customers, including you.

4. How we use your Data (processing method)

 The Data collected for the above purposes are processed both manually and in an automated manner, i.e., through programs or algorithms that analyze Data inferred from user activity and Data collected from the Browser and Device.

5. How we can disclose your Data

 We may disclose your Data to the following recipients and/or categories of recipients ("Recipients"):
   
  • Persons authorized by us to carry out any of the Data-related activities described in this document: our employees and contractors who have assumed a duty of confidentiality and abide by specific rules for handling your Data;
  • Our Data Processors: these are the external parties to whom we entrust some processing activity. For example, security system providers, accounting and other consultants, data hosting providers, etc. We have entered into agreements with each of our Data Processors to ensure that your Data are processed with appropriate safeguards and only following our instructions;
  • System Administrators: these are our employees or our Data Processors whom we have delegated to manage our computer systems and who can access, modify, suspend, and limit the processing of your data. These people have been selected, and properly trained, and their activities are tracked by systems that they cannot change, as required by the regulations of our competent Control Authority;
  • Police authority or any other authority whose provisions are binding on us: this is the case when we have to comply with a judicial order or the law or defend ourselves in legal proceedings.

6. Where are your Data

 We are a global company and our services are available in various jurisdictions around the world. This means that your Data may be stored, accessed, used, processed, and disclosed outside your jurisdiction, including within the European Union, the United States of America, or any other country where the service providers, Data Processors and their sub-processors, or where their servers or cloud computing infrastructure may be located. We strive to ensure that our Recipients' processing of your Data complies with applicable data protection laws, including EU legislation to which we are subject. Where required by EU data protection law, transfers of your Data to recipients outside the EU will be subject to appropriate safeguards (such as EU standard contractual clauses for data transfers between EU countries and third countries), and/or other legal grounds following EU law. For more information about the safeguards, we implement to protect Data transferred to third countries outside the EU, you may write to us at: admin_ti@stellantis.com

7. For how long do we retain your Data

 Data processed for the purposes of providing the Services (see sect. 3.a) and Protecting our interests and your interests (see sect. 3.d) will be retained for as long as is strictly necessary to achieve those same purposes. However, your Data may be retained for a longer period in case of potential and/or actual claims and consequent liabilities and/or in case of other requirements and/or in case of other mandatory legal retention requirements and/or retention obligations.
   

Data processed to fulfill a legal obligation (see sect. 3.c) will be retained as long as required by the specific obligation or rule of law or applicable regulation.

More information regarding the data retention period and the criteria used to determine this period can be requested by writing to the Data Processor at admin_ti@stellantis.com.

8. How to control your Data and manage your choices

 At any time, you can ask for:
   
  • Access to your Data (right of access): based on your use of our Services, we will provide you with your Data; 
  • Exercise your right to portability of your Personal Data (right to Data portability): based on your use of our Services, we will provide you with an interoperable file containing Data about you;
  • Correct your Data (right to rectification): for example, you can ask us to change your e-mail address or phone number if they are incorrect;
  • Limit the processing of your Data (right to restrict processing): for example, when you believe that the processing of your Data is unlawful or that processing based on our legitimate interest is not appropriate;
  • Delete your Data (right to erasure): for example, when you do not want to use our Services and do not want your Data stored;
  • Objections to processing activities (right to object);
  • Withdraw your consent (right to withdraw consent).

You may exercise the above rights or express any concerns or complaints about our use of your Data directly at: admin_ti@stellantis.com.
 

At any time, you can also:
 
 

9. How we protect your Data

 We take reasonable physical, technological, and organizational precautions to prevent the loss, misuse, or modification of the Data under our control. For example:
   
  • We ensure that your Data is only accessed and used by, transferred to, or disclosed to Recipients who need to have access to that Data.
  • We also limit the amount of Data accessed, transferred, or disclosed to Recipients to only what is necessary to fulfill the specific purposes or tasks performed by the Recipient.
  • The computers and servers where your Data is stored are kept in a secure environment, are password-controlled with limited access, and have industry-standard firewalls and anti-virus software installed.
  • Hard copies of documents containing your Data (if any) are also kept in a secure environment.
  • We destroy hard copies of documents containing your Data that are no longer needed.
  • When we destroy Data recorded and archived in the form of electronic files that are no longer needed, we ensure that a technical method (e.g., a low-level format) ensures that the records cannot be reproduced.
  • The laptops, USB flash drives, cell phones, and other wireless electronic devices used by our employees who have access to your Data are protected. We encourage employees not to store your Data on such devices unless reasonably necessary to perform a specific task as outlined in this Privacy Policy.
  • We train our employees in compliance with this Privacy Policy and conduct monitoring activities to ensure continued compliance and to determine the effectiveness of our privacy management practices.
  • Our Data Processors are contractually bound to retain and protect your Data using measures substantially similar to those outlined in this Privacy Policy or required by applicable data protection law.

Where required by applicable law, in the event of a security breach resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Data transmitted, stored or otherwise processed, notice will be given to you and the appropriate Data protection authority as required (e.g., unless the Data is unintelligible to any person or the breach is unlikely to result in a risk to the rights and freedoms of you and others).
 

10. What this Privacy Policy does not cover

This Privacy Policy explains and covers the processing we perform as the Data Controller on our Website and Application.
This Privacy Policy does not cover processing by parties other than us.
In these cases, we are not responsible for any processing of your Data that is not covered by this Privacy Policy.

 

11. Use of Data for other purposes

 Should we process your Data in a different way or for purposes other than those stated herein, you will receive specific notice before such processing begins.
 

12. Changes to this Privacy Policy

 We reserve the right to adapt and/or modify this Privacy Policy at any time. We will inform you of any relevant adaptations/changes.
 

13. License

 The icons shown in this Privacy Policy are "Data Protection Icons" by Maastricht University, European Centre on Privacy and Cybersecurity (ECPC) CC BY 4.0.
 

14. Definitions

Application: means our mobile application.
   

Browser: refers to the programs used to access the Internet (e.g., Safari, Chrome, Firefox, etc.)

Cookie: this is a small text sent to your browser by our sites or our partners or resellers. It allows the site to store information, such as the fact that you visited the site, your language, and other information. Cookies are used for a variety of purposes, such as to record your preferences regarding the use of cookies (technical cookies), to analyze and improve our services, and to create new services and features or to personalize our services.

Data Controller: this means the legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and the means for processing your Personal Data.

Data Processor: refers to an entity engaged by us to process your Personal Data exclusively on behalf of the Data Controller and following its written instructions.

Device: refers to the electronic device (e.g., iPhone) through which you visit our Website and Application and/or our Partners' websites and applications.  

IP Address: is a unique number used by the browser or device to connect to the Internet. The Internet service provider provides this number to identify the provider and/or the approximate area where the user is located. Without this Data, you cannot connect to the Internet and use our Services.

Judicial Data: this means Personal Data related to criminal convictions and crimes and security measures.

Other Tracking Technologies: pixel tags (trackers used with Cookies and embedded in web page images to track certain activities) or Unique Identifiers embedded in links to commercial communications that send us information when clicked.

Our Events: these are events/showrooms organized by us or in collaboration with other brands with whom we have signed partnership agreements.

Partners: this means third-party entities that may only disclose your Personal Data to us after contractually assuring us that they have obtained your consent or have another legal basis that legitimizes their disclosure/sharing of such Data with us. This definition also includes selected partners with whom we may share your Data. Partners can belong to the following product sectors: manufacturing, wholesale and retail trade, financial services, banking, transportation and warehousing, information and communication services, professional, scientific and technical activities, travel agencies, business support services, arts, sports, entertainment and amusement activities, activities of membership organizations, physical wellness center services, electricity and gas suppliers, rental companies, electric mobility and insurance companies.

Personal Data: any information relating to an identified or identifiable natural person, directly or indirectly, as well as any information related or reasonably linkable to a particular individual or household. For example, an e-mail address (if it relates to one or more aspects of an individual), IP addresses, and Unique Identifiers are considered Personal Data. For convenience, we will collectively denote all Personal Data also referred to as "Data".

Services: collectively, this means all the Services available on our Website and Application.

Unique Identifiers: information that can uniquely identify the user through the Browser, Device. In the browser, IP addresses and cookies are considered Unique Identifiers. On the Device, vendor-provided advertising identifiers, such as Apple's IDFA and Android's AAIG, that we use to analyze and improve our Services and to create new Services and features are considered Unique Identifiers. Please note that for these purposes and in line with the opinions of European supervisory authorities, we do not use other Unique Identifiers, such as MAC addresses and IMEIs as they are not user-resettable.

Website: this includes this Website and the pages of our social networks where this Privacy Policy is present.