Processing of personal data (privacy and GDPR)

1.Privacy Policy

This privacy statement applies to the processing of personal data (hereinafter " the data ") of our customers, former customers, prospects, persons who ask us for information or contact us in connection with our vehicles, products or services or use our mobile applications.

The processing of personal data that you communicate to us through our website is the subject of a separate privacy statement, available on the website.

The Controller

Your personal data are processed by the following controller :

Electrify Europe bv Westmeerbeeksteenweg 47 A1 2221 Booischot Belgium KBO BE 0653.899.071 info@electrify.eu, GSM 0479835107 www.electrify.eu.

2.Scope and purposes

In connection with and for the execution of the services under a contract entered into by the Customer with ELECTRIFY EUROPE, the Customer transfers personal data to ELECTRIFY EUROPE and authorizes and gives express - and throughout the duration of the contract irrevocable - instructions to ELECTRIFY EUROPE to process its personal data in accordance with the provisions of this agreement.

Personal data means any information relating to an identified or identifiable natural person obtained by ELECTRIFY EUROPE. An identifiable natural person is considered a natural person who can be identified, directly or indirectly, by means of an identifier such as a name, location data, an online identifier or one or more elements characterizing the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

Categories of data we may process :

Depending on the relationship we have with you, we may process the following categories of data, supplemented to the extent possible by the date of registration or modification :

General Information :

Name, first name, gender, language, date of birth

address, landline/mobile phone, e-mail address

account number

If you are a professional : information regarding your company (name, legal form, address, landline/mobile phone, VAT number, company number, fleet information)

Etc.

Information regarding your vehicle

Data made available to us through the official TESLA software Toolbox 3

Make/model of your current vehicle, make/model you are interested in

Administrative information regarding purchases of products and/or services, including purchase, repair, maintenance, etc. ( type of product or service, price, delivery, chassis number, license plate, mileage, ...)

Information regarding the use, operation, condition and performance of your vehicle, recorded following the performance of a maintenance, diagnosis or repair.

Customer History

Accounting information

Etc.

Additional information you communicate without obligation

Pertinent information for conducting personalized marketing communications : family composition, hobbies, ...

Etc.

Information coming from third parties

We may collect data related to you or supplement your data with information we receive through third parties including the manufacturers of our brands, social media platforms or third-party companies.

Purposes of processing and legal basis

The processing is necessary for the performance of a contract to which you are a party or to take action, prior to the conclusion of a contract, at your request :

In such case, the data are processed more specifically for the purpose of :

Monitoring and analysis of Your vehicle and its electrical components.

The preparation, acceptance and follow-up of your order (including test drive), general customer management, after-sales service, warranties, collection, ... ;

Providing information about updates or changes to our products and services, such as, but not limited to, changes to our terms and conditions and policies ;

For the organization, co-organization or sponsorship of events

Maintenance, diagnosis, depannage and repairs of your vehicle;

Accounting and tax purposes (including transfer of claims to third parties);

Combating possible fraud and abuse and managing disputes and legal proceedings.

Personnel administration, Customer management and administration, Supplier management and administration;

Comply with social and tax laws and regulations;

Management of competencies and training;

Manage personal development and evaluation of employees;

Compliance with applicable data protection laws and information security requirements;

Checking solvency;

Any other category of purposes for processing personal data as agreed between the parties in the relevant agreement, Engagement Letter or any other document accompanying the agreement.

The information provided by the Customer is necessary for the completion of the order and its billing.

You have consented to the processing of your data for one or more specific purposes :

In such case, the data are processed more specifically for the purpose of:

The handling of each of your specific requests (sending newsletter, brochure, answers to your questions, follow-up of your participation in our contest, ...) ;

Use for marketing communications ;

Transmission of your data to identified commercial partners, in the context of applying for insurance, loans, leasing, etc.

Transmission of your data to co-organizers or other event sponsors

Sending promotional emails about our products and services which, in accordance with legislation, we may send based on your implied consent if you have communicated your email address to us as part of a purchase. You may oppose this use of your e-mail address at any time, free of charge (unsubscribing is easily possible via the added link at the bottom of each e-mail);

You can revoke your consent at any time (see below)

The processing is necessary for the protection of our legitimate interests (exercise of our economic activities):

In such case, the data are processed more specifically for the purpose of:

Analysis and creation of marketing profiles (incl. on-line, social media and hobbies) by us and through our chosen vendors ;

Centralizing, combining and enriching your data, using useful information from external parties where appropriate ;

Improving our products and services ;

Perform market analysis, financial management and reporting ;

To combat possible fraud and abuse and manage disputes and legal proceedings.

The processing is necessary to comply with a legal obligation to which we are subject:

In certain cases, we are required by law to process your personal data (e.g. tax, accounting obligations, carpass) and/or communicate it to the government or bodies determined by law.

ELECTRIFY EUROPE will not process the personal data for any other purpose, except for different legal obligations or different written consent of Customer. ELECTRIFY EUROPE undertakes, within the framework of Customer's contract, to process with care the personal data provided by Customer.

Any processing of personal data pursuant to the agreement between the Customer and ELECTRIFY EUROPE shall take place in accordance with all applicable data protection and processing laws, in particular in accordance with EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 94/46/EC ("GDPR") and with other laws deriving from this Regulation and/or any other Belgian or European legislation relating to the protection/processing of personal data or privacy.

For the implementation of the services, ELECTRIFY EUROPE is a processor acting on behalf of the controller, namely the Customer. As a processor, ELECTRIFY EUROPE will act solely upon instructions from the Customer. The Agreement is the Customer's complete instruction to ELECTRIFY EUROPE in connection with the processing of personal data. Any additional or alternative instructions must be agreed in writing by the parties.

ELECTRIFY EUROPE processes personal data solely for the benefit of the Customer. ELECTRIFY EUROPE has no control, possession or ownership of the personal data to be made available.

ELECTRIFY However, EUROPE is not responsible for compliance with any laws and regulations applicable to Customer or Customer's industry that are not generally applicable to ELECTRIFY EUROPE as a service provider, unless the parties expressly agree otherwise.

3.Personal data

Any processing in accordance with the agreement will be considered as an instruction to process personal data by ELECTRIFY EUROPE.

The processing of personal data concerns personal data of current and former Customers, employees, contractors, agents and other employees of the Customer, as well as third parties designated by the aforementioned persons as family members or contacts, and includes the following personal data:

a.General personal data, such as name, date of birth, photograph, address, e-mail address and telephone number(s), national registration number, data for verification of access, such as usernames and passwords, etc....

b. Specific personal data such as physical and psychological data, family composition and marital status, information about relatives, etc....

c. Financial data, such as paid mandates, payment details including account number (IBAN),

d. Career data such as degrees, technical skills and other qualifications, personal development information and evaluations, including resume and references etc....

e. Special categories of personal data, such as racial data, data on union memberships, health data, etc....

f. Criminal records, such as traffic violations, wage garnishments and other convictions

g. Any other category of personal data as agreed between the parties in the relevant agreement.

4.Transfer of personal data

ELECTRIFY EUROPE will not transfer personal information to a third party unless:

(1) the Customer instructs or consents to this;

(2) as described in the agreement

(3)if required for the processing of personal data by approved sub-processors in accordance with Article 4;

(4) If required by law.

If Customer instructs ELECTRIFY EUROPE to transfer personal data to a third party, it is and shall remain Customer's responsibility to enter into written agreements with such third party to protect such personal data and Customer shall indemnify, defend and hold harmless ELECTRIFY EUROPE from any and all losses arising out of such transfer from ELECTRIFY EUROPE to the third party , except and to the extent such losses are attributable to proven shortcomings of ELECTRIFY EUROPE.

5.Use of sub-processors

Customer acknowledges and expressly agrees that ELECTRIFY EUROPE may disclose personal information to third party sub-processors for the purpose of providing the services for which ELECTRIFY EUROPE has been engaged. Any such sub-processor to whom ELECTRIFY EUROPE transfers personal data will be permitted to obtain personal data only to provide the services entrusted to it by ELECTRIFY EUROPE and will not be permitted to use such personal data for any other purpose. ELECTRIFY EUROPE remains responsible for ensuring that such sub-processor complies with ELECTRIFY EUROPE's obligations under the contract, including this Agreement.

Recipients of your data

Your data may be communicated to the following third parties :

To our subcontractors, in connection with services they provide on our behalf (e.g., call centers, advertising agencies, IT service providers, etc.) ;

To our brands and manufacturers

To our ev. legal successors;

To our commercial partners, at your request, for the application of a financial product, guarantee, loan, lease or insurance;

To certain partners that serve as the interface for our advertisements such as Social Media, Google, and other possible channels;

When we believe, in good faith, that disclosure of your information is necessary to protect your or our rights, e.g., to investigate violations of our terms and conditions or to detect, prevent or disclose fraud or other security problems.

Transfer of your data outside the European Economic Area

Our subcontractors may transfer your data outside the European Economic Area. In such case, your data will be specifically protected, in accordance with the obligations of privacy legislation.

By signing this Agreement, Customer consents to the use of sub-processors. ELECTRIFY EUROPE will enter into written agreements with each sub-processor containing obligations no less protective than the obligations in the agreement with Customer.

6. Rights of data subjects

The Customer has the right to modify or view her personal information.

If possible, ELECTRIFY EUROPE will provide its cooperation to the Customer and assist the Customer so that the Customer can comply with its obligation to respond to requests from a data subject exercising its rights.

7. Deletion and return of personal data - retention periods

Upon termination of the contract, ELECTRIFY EUROPE will, without having to notify the Customer in advance, delete or anonymize all personal data on its systems (subject to any backup archives) after the expiration of all relevant laws and regulatory requirements on data retention. If ELECTRIFY EUROPE is required to retain data used to verify proper data processing in accordance with the contract or data that must comply with relevant data retention laws and regulatory requirements, ELECTRIFY EUROPE is authorized to retain such data in accordance with the respective retention periods after the termination or expiration of the contract, and ELECTRIFY EUROPE will maintain such data in a secure manner upon expiration of the data retention requirements.

8. Technical and organizational measures

Taking into account the state of the art, the implementation costs and the nature, scope, context and purpose of the processing of personal data as well as the risks to the rights and freedoms of natural persons associated with the processing, which differ in their likelihood and severity, ELECTRIFY EUROPE takes appropriate technical and organizational measures to secure and keep secure the personal data processed for the benefit of the Customer.

Retention of your data

If you are one of our prospects, we will retain your information for 24 months from the date of your last interaction or, failing that, from the registration of your information in our database.

If you are a customer with us, we will retain your information for 10 years from your last visit or interaction.

If you are subscribed to our newsletter, your subscription information will be kept as long as you do not unsubscribe.

Archiving for compliance with legal obligations and evidentiary purposes :

For other purposes, personal data may need to be kept longer, for example to comply with our legal obligations and (e.g. accounting and tax obligations) or to provide certain data as legal evidence in disputes.

These archived records have limited access.

Security of your data

We take necessary and appropriate technical and organizational security measures to optimally protect your personal data from manipulation, loss, destruction, alteration and access by unauthorized persons.

During the term of the agreement with the Customer, ELECTRIFY EUROPE will provide the Customer with an up-to-date description of the implemented technical and organizational protection measures within a reasonable period of time upon the Customer's request.

9. Duty to report data breaches

ELECTRIFY EUROPE will inform the Customer as soon as possible about breaches of its security that must be reported to the Belgian Data Protection Authority and/or the data subject(s).

At the Customer's request, ELECTRIFY EUROPE will, in the event of a breach, provide the Customer with at least the following information:

(1) The nature of the breach and of the personal data affected;

(2) The likely consequences of the breach;

(3) the measures taken or to be taken in that regard. If it is not possible for ELECTRIFY EUROPE to provide this information directly, it will do so in stages.

ELECTRIFY EUROPE will provide all necessary cooperation in providing additional information to the supervisor(s) and/or data subject(s) as necessary.

ELECTRIFY EUROPE maintains a record of the facts and consequences of security breaches.

10 Responsibilities of the Customer

The Customer is responsible for the legality of the processing of personal data within the framework of the agreement with ELECTRIFY EUROPE.

The Customer represents and warrants that, when providing personal data to ELECTRIFY EUROPE for processing:

- the relevant data subjects have been adequately informed of their rights and obligations, and in particular of the possibility that ELECTRIFY EUROPE will process personal data for the benefit of the Customer and in accordance with the Customer's instructions;

- it has complied with applicable data protection and processing laws in collecting and providing such personal data;

- it will take all reasonable steps to keep the personal data up to date to ensure that the data is not incomplete or inaccurate with respect to the purposes for which it was collected.

Duty to inform

ELECTRIFY EUROPE will make available to the Customer at the Customer's request any information necessary to demonstrate the Customer's compliance with its obligations under data protection and processing legislation.

Duty of confidentiality

All data and information mutually received by the parties from each other will be kept confidential during the term of the agreement and will not be disclosed to third parties or used for any other purpose than agreed upon between the parties.

The obligation described in the preceding paragraph does not apply to confidential information that:

- was already publicly available at the time of disclosure by the disclosing party or has subsequently become publicly available without the recipient's action;

- was already in the lawful possession of the recipient at the time of disclosure as can be adequately demonstrated by the recipient; or

- after disclosure is received by the recipient on a non-confidential basis from third parties.

ELECTRIFY EUROPE represents and warrants that personnel acting under its authority and authorized to process Personal Data are committed to ensuring the security and confidentiality of Personal Data in accordance with the terms of the agreement with the Customer. To this end, ELECTRIFY EUROPE will inform the personnel acting under its authority and having access to the personal data of the applicable requirements and ensure their compliance with such requirements through contractual or legal obligations of confidentiality.

If ELECTRIFY EUROPE is required to provide information pursuant to a legal obligation, ELECTRIFY EUROPE will verify the basis of the request and the identity of the requester. ELECTRIFY EUROPE will inform the Customer, prior to providing this information, unless prohibited by legal provisions.