ALD AUTOMOTIVE DATA PRIVACY POLICY

Data protection is a key concern for Axus Finland Oy/ALD Automotive (hereinafter “ALD”, “we” or “us”) and to ALD SA to which ALD belongs. We have been placing this matter as a priority for long and we have implemented strong principles in that respect, especially in regards to the European Regulation (EU) 2016/679 on the protection of individuals regarding the processing of personal data and on the free movement of such data has been applicable since May 25, 2018 (hereinafter "GDPR").

The GDPR raises awareness of all actors in the European Union and more, on a multitude of issues related to the management, use and retention of personal data.

This Data Privacy Policy (hereinafter “Privacy Policy”) aims to explain how we collect, store, use and disclose your personal information whenever you use our products and services, our websites or interact with ALD.

1. General principles

We understand your concerns regarding the confidentiality of your personal information. Below we describe how we acquire and use that information and outline your rights. Please read this carefully, so that the process is as fair, transparent and secure as possible.

The following principles are central to how we process your personal information:

• Transparency and fairness: When we collect and process your personal information, we inform you as to who collects and receives this data, and the reasons for this. When required by law, we always seek your prior consent (e.g., before collecting any sensitive information or sending any direct marketing material). We never use your personal information for purposes that are incompatible with the purposes outlined here.
• Legitimacy: We do not collect or process personal information without a lawful reason. We use your personal information only for appropriate business purposes (e.g., to provide services, manage relationships with customers, manage customer vehicle fleets, and perform accurate invoicing, or for marketing activities, profiling to better serve customers, to conduct satisfaction surveys or draft reports and comply with our legal obligations).
• Minimization: We only collect the personal information strictly necessary for data processing, as set out in this Privacy Policy. We collect sensitive information only where relevant. We take all reasonable measures to ensure that your personal data on record is accurate, complete and up to date.
• Privacy: We endeavor to ensure privacy when implementing personal data processing. To this end we also carry out privacy impact assessments to ensure that our safeguards are appropriate and that your information is protected.

2. About ALD

Axus Finland Oy / ALD Automotive (0643850-5)
Ohtolankatu 4, 01510 Vantaa, Finland

This Privacy Policy only relates to processing undertaken by or on behalf of ALD. Whilst our websites may contain links to other third-party websites, we do not accept any responsibility or liability for those third parties' policies in relation to any personal data or their collection or processing of any personal data.

3. Specific conditions concerning your personal data

This Privacy Policy applies to all sources of data collected and processed by ALD globally in the context of various ALD Automotive Group activities such as corporate car leasing, private car lease, sales locations, third-party sources, use of our websites or mobile applications, and all offline processing activities.

We may collect and process your personal information if you are among the following categories: drivers of leased cars, private lease customers, buyers of cars, business-to-business customers’ contact, partners, dealers, prospects, fleet managers, shareholders, managers, etc.

We process your personal data for fulfillment of the agreement with you or your company, with your consent or on the basis of a legitimate interest of ALD. Legitimate interest as a legal basis for processing of personal data applies, for example, when for the purpose of to enable the fleet management services it is necessary to communicate with the user of the car or when ALD has a legitimate interest in ensuring that the legal obligations related to the ownership of a vehicle are fulfilled. ALD may also have a legal obligation to process personal data for example to comply with the requirements of accounting and taxation laws and the Anti-Money Laundering Act.

4. How we use your personal data, and which personal data is used

ALD and each of its customers carry out, as data controllers or even joint data controllers, a few processing operations involving personal data that are necessary for the performance of the lease contracts and the proper conduct of their respective activities. In this respect, we have listed below the purposes for which we carry out processing in the context of our business relationship with our customers:

(a) When necessary for contractual purposes

(i) on a general level, to manage the commercial relationship with you and/or your company, respond to estimate requests, open customer accounts, fulfill your orders for services and for related activities, manage events, send you communications related to your contract, respond to your inquiries and requests for verifications, provide customer service, account management, support and related training of our personnel involved in such activities, and to provide other services related to your account;

(ii) for white-label partners: for fleet management services with reports and widgets, for key accounts, call center assistance and follow-up of international key account fleets;

(iii) for the purposes of international customer relationship management, to perform satisfaction and quality measurement, to consolidate quality information worldwide to create a global assessment of company quality, to provide management satisfaction surveys on products, services or contents, and to follow-up customer relation claims and after-sale service;

(iv) to provide customer satisfaction surveys to professional traders about the remarketing of leased cars service via the online platform to market used cars coming from the leasing contracts.

(v) to perform financial reporting (Sales, Procurement, Finance & Risk, Pricing, Insurance), including invoicing consolidation and profitability targets, operational performance of the group, procurement and litigation.

(vi) to provide drivers with car monitoring applications (e.g., ALD Driver's Log Service) or provide managers with fleet management tools;

(vii) to report to clients on customer satisfaction survey results.

(b) With your informed knowledge and consent

(i) Marketing purposes: we may use your information to contact you, subject to your consent when applicable, about new offers or services and special offers we think you will find valuable, or to send you marketing communications or newsletters; we may analyze your client profile and preferences, and perform multichannel marketing campaigns via automated tools, contact you via SMS, email, or send you brochures;

(ii) Customer satisfaction: based on targeted marketing tools and analysis, we may send you qualitative surveys for our products and services;

(iii) We may also invite you to participate in marketing events, games, or quizzes, through our mobile applications and/or websites.

(iv) Websites, Cookies and other Tracking Tools & Newsletters: when you visit our website or use our mobile applications, we may collect information through cookies or other tracking tools by automated means to provide you with an enhanced experience and improve your browsing experience notably to store your preferences and parameters to save you time, (such as languages preferences), enable log in, fight against fraud, and analyze the performance of our website and services. We use technologies such as cookies, pixel tags, browser analysis tools, server logs and web beacons. If you use our web sites, we may collect information about the browser you are using, and your browsing behavior. If you use our mobile application, we might also look at how often you use the app and where you downloaded it.

This information helps us enhance our web sites and apps and better understand the products and services you would prefer.

We also use cookies for web analytics to measure the web sites activity and determine the areas of the web sites which are the most visited.

While we may install functional cookies to facilitate your visit to our web sites or apps, you can express your preferences regarding cookies used for behavioral targeting advertising through the privacy settings options of your browser, which should include features to prevent information from being stored on the terminal or the processing of information already stored on such terminal, unless you turn on the feature to allow such storage or processing.

(v) Profiling: to improve our understanding of your interests and concerns: we may use your personal information to improve our website and services, to customize your experience with us and to tailor our marketing activities to fit your needs and interests. We believe that it is also in our interest to better serve you and respond to your needs.

(vi) to perform customer screening, credit check and "Know Your Client" processing; to perform customer rating

(vii) we use your personal information to maintain business records for legal, administrative and audit purposes. We also use information to meet legal, insurance and processing requirements.

We collect the following types of personal information:

•    Identification and Contact information, such as your name, last name, address, telephone/mobile number or email address;
•    Professional information, such as your job title, professional address, telephone/mobile number or email address;
•    Financial/Credit information, such as your Credit Acceptance Date or contract information, tax benefit value;
•    Private details: such as your gender, date of birth, personal identity number, nationality, language(s), or personal preferences (habits, favorite car, etc.);
•    Driver data, such as the number/copy of the driver's license;
•    GPS location data, if you use our mobile app or ALD Driver’s Log Service. We ask for your consent if required.

We may also collect information about you indirectly from our business partners or social media platforms.

We collect your personal information either directly from you (e.g., if you create an account on one of our sites or make a purchase or apply for or enter into an agreement with ALD), or passively (e.g., when using tracking tools like browser cookies), or from third parties (e.g., through social media platforms).

Vehicle operations

When you or your company uses car leasing services with us, we may collect information about the vehicle (such as the vehicle registration plate, VIN (Vehicle Identification Number) or the vehicle last revision) and the driver's behavior (such as the average speed, mileage), to provide the car leasing services in accordance with the contract and invoice you or your company.

5. How long do we keep your personal information

Personal data is kept by ALD , in an active base, for the time necessary to achieve the objective pursued at the time of their collection.

The retention period is therefore initially set by ALD according to the operational needs necessary for the execution of each individual lease contract and taking into consideration any recommendations of the local data protection authority.

However, certain longer retention periods may result from legislative and regulatory texts. Some laws also require that documents/information containing personal data are to be retained for a specific period of time for evidentiary purposes or in anticipation of possible litigation until the action in question is time-barred. ALD is therefore obliged to keep certain personal data beyond the execution of the lease contracts, even though it no longer has any use for them, in the form of so-called intermediate archives.

At the end of these periods, the personal data is:

• purged; or
• anonymized.

6. Who we may share your personal data with

We understand that you do not want us to provide your personal information directly to third parties for their own marketing purposes without your consent. However, ALD occasionally needs to use partners or processors to provide you with the requested services and a better experience, for the purposes described above. We therefore limit our sharing of your personal information on a need-to-know basis as follows:

•    with internal business departments such as sales, customer care/quality department, marketing, IT services, support and maintenance. Inside the ALD Automotive Group, we may share your personal data with other ALD Automotive entities, who may only use your personal information in compliance with this Privacy Policy.

•    with our service providers, such as data hosting service providers, call centers, data administrators, located in Finland or within the European Economic Area (hereinafter “EEA”) and instructed to only use your personal information in accordance with our instructions.

•    with unaffiliated partners, but only if you have given us your consent.

•    where needed to affect the sale or transfer of business assets, in connection with a bankruptcy proceeding, to enforce our rights, protect our property, or protect the rights, property or safety of others, or as needed support external auditing, compliance and corporate governance functions.

•    when required to do so by law, such as in response to a subpoena, including to law enforcement agencies and courts in the countries where we operate.

Please note that we may also use and disclose personal information about you that is not personally identifiable i.e., personal information in an aggregate form that no longer identifies you.

7. Export of personal data outside of the EEA

In general, all of the ALD Automotive Group’s databases are located inside the European Union. However, ALD may transfer your personal data from the European Union to countries within or outside the EEA. The countries outside of the EEA may not provide the same level of protection as is available in the EEA. If we transfer your personal data outside the EEA, we will ensure that adequate levels of protection are in place in relation to the processing of your personal data. Hence, ALD will before transferring your personal data outside EEA make sure to implement Binding Corporate Rules (BCR) or to sign Standard Contractual Clauses (SCC).

However, certain countries outside the EEA have been approved by the European Commission as providing essentially equivalent protections to European Union data protection laws and therefore no additional safeguards are required to export personal data to these jurisdictions. A list of the aforementioned countries can be found online at the European Commission’s official website.

8. Your rights

In order to protect data subjects concerned by the processing of personal data, the GDPR has implemented rights. The rights in question are as follows:

Data subject Right	Description of the right	GDPR Article
Right of access	You can obtain information relating to the processing of your personal data, and a copy of such personal data. If you make such a request, we will provide you with all the information on the purposes of the processing, categories of data processed, categories of recipients, data retention term, your rights to rectify, delete or restrict the data accessed if applicable.	Article 15
Right to rectification	When you consider that your personal data is inaccurate or incomplete, you can require that such personal data is modified accordingly.	Article 16
Right to erasure (right to be forgotten)	You can require the deletion of your personal data, to the extent permitted by the law.	Article 17
Right to restriction of processing	You can request a restriction on the use of your personal information.	Article 18
Right to data portability	Where legally applicable, you have the right to have the personal data you have provided to us be returned to you in an intelligible format.	Article 20
Right to object	You can object to the processing of your personal data, on grounds relating to your particular situation. You have the right to object the processing of your personal data for direct marketing purposes, which includes profiling related to such type of marketing.	Article 21

Please note that at any time you have the right to address a complaint to the competent local supervisory authority.

9. Security and data storage

We protect your data through technical and organizational security measures (including education and training of relevant personnel) against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing.

Only those teams and employees who need to know your information within our company can access it. We make sure to implement administration rights and policies within our company, and we take all measures to ensure that employees, advisers and service providers keep your files confidential.

10. Cookie policy & websites

We may collect data via cookies to improve the user's browsing experience. Cookies are used, among other tracers, to store preferences and settings in order to save time, enable login, combat fraud, analyze the performance of the website and the services provided by us, and compile visit statistics.

For more details you can consult our Cookie policy by following this link.

11. Updates to this Privacy Policy

We may modify this Privacy Policy periodically to be compliant with any new regulations, so please review it regularly. If we change this Privacy Policy, we shall notify you by means of providing a notice on our website homepage. This Privacy Policy was last amended on 23.1.2023.

12. How to contact us

If you have any questions, complaints, or comments regarding this Data Privacy Policy or our information collection practices, please contact us by writing, or sending an email to: ALD’s Data Protection Correspondent: fi.dataprotection@aldautomotive.com.

You can also lodge a complaint with the Data Protection Ombudsman if you have any concern about the conditions of processing of your personal information by ALD.