LDV Privacy Notice for our cars

Important Notice:

This Privacy Notice is a general version that applies uniformly to all our products and services. By using any of our products or services, you agree to be bound by this Privacy Notice. Please note that the products and/or services configured for different vehicle models may vary. You may review the specific products and/or services associated with the vehicle model you have purchased and apply this Privacy Notice accordingly. However, if a product or service has its own separate privacy notice, that separate privacy notice shall take precedence. For matters not covered in the separate privacy notice, this Privacy Notice shall apply.

This Privacy Notice does not apply to:

• Data processing activities carried out by third-party companies and organisations that provide services for in-vehicle connected devices;

• Specific products and/or services with separate privacy policies that are not incorporated into this Privacy Notice.

Unless otherwise specified, the terms used in this Privacy Notice shall be interpreted in accordance with the applicable data protection laws. The applicable data protection laws vary by jurisdiction, please refer to Section F for the laws that apply in different jurisdictions.

We provide modern electric cars with a smart entertainment system which can be connected to your mobile phone globally. Our brands include Maxus and LDV. The specific brands in different jurisdictions are illustrated in Section F.

In context with the provision of the smart entertainment system and the app, we process personal data.

The protection of personal data is important to us. We process personal data only in accordance with the applicable data protection requirements.

Section A provides you with information about the controller responsible for the processing of your personal data and the controller's data protection officer (DPO).

Section B details how we process of your personal data.

Section C outlines your rights regarding the processing of your personal data.

Section D explains key data protection terms according to the EU the General Data Protection Regulation (GDPR).

Section E provides the effective date of this Privacy Notice and other relevant information.

Section F contains special provisions applicable to jurisdictions outside the EU, including Australia.

TABLE OF CONTENTS

TABLE OF CONTENTS

A. Information on the Controller

I. Identity and Contact Details of the Controller

II. Contact Details of the Controller's Data Protection Officer

B. Information on the Processing of Personal Data

I. I. Use of the Driver Account on the Mobile Phone and on the Audio Visual Navigation (AVN), Including Use of Remote Control Functions of the Car via App

1. Details on personal data processed

2. Details on the processing of personal data

3. Details on the recipients of personal data and the transfer of personal data to third countries and/or international organisations

II. Use of the Navigation System on the Audio Visual and Navigation System (AVN)

1. Details on personal data processed

2. Details on the processing of personal data

3. Details on the recipients of personal data and the transfer of personal data to third countries and/or international organisations

III. Use of Voice Recognition

1. Details on personal data processed

2. Details on the processing of personal data

3. Details on the recipients of personal data and the transfer of personal data to third countries and/or international organisations

IV. Use of Personalized Settings

1. Details on personal data processed

2. Details on the processing of personal data

V. Use of Phone Connectivity

1. Details on personal data processed

2. Details on the processing of personal data

VI. Use of ADAS

1. Details on personal data processed

2. Details on the processing of personal data

VII. Use of AVM (Around View Monitor)

1. Details on personal data processed

2. Details on the processing of personal data

VIII. Use of DMS

1. Details on personal data processed

2. Details on the processing of personal data

IX. Use of E-Call

1. Details on personal data processed

2. Details on the processing of personal data

X. Use of FOTA

1. Details on personal data processed

2. Details on the processing of personal data

3. Details on the recipients of personal data and the transfer of personal data to third countries and/or international organisations

XI. Use of third-party apps on our Audio Visual and Navigation (AVN) System

1. Details on personal data processed

2. Third-party apps provider embedded in the AVN

3. Potential data transfers to third countries without an appropriate level of protection

XII. Use of OMS (Occupant Monitoring System)

1. Details on personal data processed

2. Details on the processing of personal data

XIII. Compliance with legal requirements.

1. Details on personal data which are processed

2. Details on the processing of personal data

3. Details on the recipients of personal data and the transfer of personal data to third countries and/or international organisations

C. Information on the Rights of Data Subjects

I. Right of Access

II. Right to Rectification

III. Right to Erasure ("Right to Be Forgotten")

IV. Right to Restriction of Processing

V. Right to Data Portability

VI. Right to Object

1. Right to Object on Grounds Relating to the Particular Situation of the Data Subject

2. Right to Object to Direct Marketing

VII. Right to Withdraw Consent

VIII. Right to Lodge A Complaint With A Supervisory Authority

D. Information About the Technical Terms of the GDPR Used in this Privacy Notice

E. Effective date of and changes to this Privacy Notice

F. Additional Information For Other Jurisdictions

I. Australia

1. Interpretation of the technical terms of the Privacy Act and Apps used in this part

2. Identity and contact details of the App entity

3. Collection, usage and disclosure of personal information

4. Direct Marketing

5. Cross-border disclosure of personal information

6. Access, correction and complaints

7. Contacting us

II. New Zealand

1. Interpretation of the technical terms of the Privacy Act used in this part

2. Identity and address of the agency

3. Collection, usage and disclosure of personal information

4. Rights to access and correct personal information

5. Contacting us

Information on the Controller

Identity and Contact Details of the Controller

SAIC MAXUS Automotive Co., Ltd.

No.2500, Jungong Rd, Yangpu, Shanghai

dpo@maxuseu.eu

dpo@saicmotor.com

Contact Details of the Controller's Data Protection Officer

DPO for EU: dpo@maxuseu.eu

DPO for other jurisdictions: dpo@saicmotor.com

Information on the Processing of Personal Data

In this Privacy Notice, we provide you with general information on our personal data processing activities, including those related to the infotainment system, intelligent driving system, and road safety assurance. In particular, the relevant information is divided into the following subsections in Section B:

• I. Use of the Driver Account

• II. Use of the Navigation System on the Audio Visual and Navigation System (AVN)

• III. Use of Voice Recognition

• IV. Use of Personalized Settings

• V. Use of Phone Connectivity

• VI. Use of ADAS (Advanced Driver Assistance System)

• VII. Use of AVM (Around View Monitor)

• VIII. Use of DMS (Driver Monitoring System)

• IX. Use of E-Call

• X. Use of FOTA (Firmware Over-The-Air Updates)

• XI. Use of Third-Party Apps on our Audio Visual and Navigation (AVN) System

• XII. Use of OMS (Occupant Monitoring System)

• XIII. Compliance with Legal Requirements

Your rights to personal data protection can be found in Section C.

We wish to provide you the best experience when you use our cars. Therefore, we offer you an app and have equipped the cars with a well-invented system. The cars include two devices which communicate with and can be controlled by the app: the Audio Visual Navigation ("AVN") and the Telematic Box ("TBOX"). All communications between the devices and the app occur via our Telematics Service Platform ("TSP Backend"). The AVN provides you infotainment applications, such as the navigation and the message centre functions. The TBOX facilitates network access for the vehicle and uploads data to the TSP Backend.

For certain functions, the AVN communicates directly with and transfers personal data to third parties (e.g. Amazon). In providing the functions outlined in this Data Privacy Information, we process your personal data and wish to inform you of the details of the processing. However, you may choose to use our cars without enabling the online functionalities of the app that require the processing of personal data. When you use the AVN for the first time or download the app, we will ask you if you want to enable all functionalities of the app system, including those that require personal data processing. Certain AVN functionalities that involve the processing of personal data can be enabled or disabled individually, while others may be subject to system limitations.

I. Use of the Driver Account on the Mobile Phone and on the Audio Visual Navigation (AVN), Including Use of Remote Control Functions of the Car via App

In connection with our electric cars, we offer an app to view and remotely control certain functions of the car and to send information (e.g., navigation destinations or Points of Interest (POIs)) to the car. In order to use these functions, the vehicle needs to be linked to your driver account. In this context, we process personal data for the following purposes:

• Creation and provision of an driver account so that you can remotely control your vehicle and view the vehicle status

• Provision of the function to bind and unbind your vehicle to your driver account

• Provision of the function to check and control the vehicle state

• Provision of the Find My Car function

• Provision of the Charging Management function

• Provision of the message centre

• Provision of the Feedback function

• Processing your feedback

• Provision of the My Calendar function

• Provision of energy consumption function

• Provision of digital key function

• Provision of local weather information

You receive more detailed information on this below:

Details on personal data processed

Details on the processing of personal data

Details on the recipients of personal data and the transfer of personal data to third countries and/or international organisations

Use of the Navigation System on the Audio Visual and Navigation System (AVN)

Through our Audio Visual and Navigation system (AVN) you have the possibility to use a navigation system. The basic functions are available without an internet connection and without us or our service providers processing any of your personal data when you use these functions. This includes in particular, the search for a specific location or points of interests in the area, calculation of routes and the navigation function, battery range function. Certain other functions, such as considering real time traffic data for finding the best route, require an internet connection. When you use the online navigation system, we process your personal data for the following purposes:

• Provision of information on real time traffic

• Provision of online search function

If you are using our navigation system via voice recognition, please also view the chapter on voice recognition (Section B.III).

You receive more detailed information on this below:

Details on personal data processed

Details on the processing of personal data

Details on the recipients of personal data and the transfer of personal data to third countries and/or international organisations

Use of Voice Recognition

Our Audio Visual and Navigation (AVN) system supports navigation through voice recognition. The voice recognition function enables you to control various features of the AVN using voice commands. Examples include setting a new destination, zooming in or out of the map, or cancelling a route. Voice recognition may also be used to control media, such as skipping songs or changing tracks in the music app. Your voice commands are converted into machine-readable commands by our voice recognition provider.

You receive more detailed information on this below:

Details on personal data processed

Details on the processing of personal data

Details on the recipients of personal data and the transfer of personal data to third countries and/or international organisations

Use of Personalized Settings

Our personalized settings allow you to customize the vehicle's functions to match your individual driving preferences. This includes settings for volume, sound effects, air conditioning temperature and airflow, as well as vehicle-related options such as Bluetooth and WLAN connectivity.

Details on personal data processed

Details on the processing of personal data

Use of Phone Connectivity

Our phone connectivity feature allows you to screen mirror your phone onto the car's display screen. This enables you to conveniently access and control navigation, videos, music, and games on your phone through the display screen. Currently, we support phone connectivity applications such as Apple CarPlay and Google Android Auto.

Details on personal data processed

Details on the processing of personal data

Use of ADAS

Our ADAS (Advanced Driving Assistance System) uses a forward-facing camera module installed on the windshield to recognize road environment information ahead and make judgments based on that information. It provides functions such as lane-keeping assist, forward collision assist, adaptive cruise control, integrated cruise control, speed limit sign display, and intelligent speed assist.

Details on personal data processed

Details on the processing of personal data

Use of AVM (Around View Monitor)

Our AVM system compiles real-time image information to create a seamless, fused view of the vehicle's surroundings, allowing the driver to observe a 360-degree panoramic perspective on the car's display screen. It helps identify blind spots and facilitates safer, more intuitive parking maneuvers.

Details on personal data processed

Details on the processing of personal data

Use of DMS

The DMS (Driver status Monitoring System) continuously monitors the driver's condition in real-time and detects whether the driver is fatigued, distracted, or engaged in behaviours such as smoking or making phone calls while driving. Once detected, the system can issue prompt messages to alert the driver about these issues, avoiding potential safety risks. DMS utilizes an infrared camera positioned inside the vehicle's A-pillar, facing the driver. Additionally, facial and fatigue-related algorithms are embedded in the entertainment system. These algorithms can detect and identify the driver's behaviour during the driving process, and synchronize the detection results with the entertainment system in a timely manner. This allows for prompt and effective alerts to be delivered to the driver through the entertainment system. DMS does not record the driver's identifiable facial information. It only uses facial features to detect different behaviours. The DMS facial and fatigue-related algorithms detect facial key points and driver behaviour. By analysing the coordinates of these key points and their changes, the system can define driver fatigue, distraction, and abnormal driving behaviour. After detection, the system implements immediate deletion of in-vehicle videos, images, and data.

Details on personal data processed

Details on the processing of personal data

Use of E-Call

The eCall system is an emergency call system installed on the vehicle and currently deployed exclusively in the EU. When the vehicle has a serious traffic accident, it automatically calls 112 for help. At the same time, it also provides the vehicle information and location information to the local rescue organization. In addition, the system can initiate a manual call button.

The eCall system is automatically triggered by the airbag signal. When the vehicle collides, the aibag in the vehicle deploys, sending a signal to the eCall system through CAN network, and which activates the emergency call function of eCall system. After eCall is triggered, the "Minimum Set of Data" (MSD) is transmitted in standard protocol format to the local Public Safety Answering Point (PSAP) through a wireless communication network. Following a successful analysis, a voice call is established between the vehicle and the PSAP to confirm with the rescue operations are needed.

Details on personal data processed

Details on the processing of personal data

Use of FOTA

The FOTA (Firmware Over-The-Air) system periodically checks the software version in the vehicle, notifying users of new software updates. Upon obtaining your consent, the system downloads and installs the latest updates to improve vehicle performance and safety. You can check for available software updates on the vehicle system page within the entertainment system. It will display information about the new version, download progress, and allow you to choose a suitable time for installation. During the system update process, the vehicle will temporarily be unavailable until the installation is complete.

Details on personal data processed

Details on the processing of personal data

Details on the recipients of personal data and the transfer of personal data to third countries and/or international organisations

Use of third-party apps on our Audio Visual and Navigation (AVN) System

The Audio Visual and Navigation (AVN) system provides the possibility to use third-party apps, such as Amazon Music and the Weather app. With these apps, you can use functions offered by third-party providers process personal data to fulfil these services. The AVN system does not activate these apps by default, and users must enable them via settings. Once activated, the relevant provider may collect personal data from you. The specific data collected, its processing purposes (such as for advertising personalization or profiling), and any further details of the data processing are determined by the third-party provider. The data processing activities by third parties are the responsibility of the third parties. If you need to learn about data processing or exercise your rights, please refer to the third party's Privacy Notice or contact them directly.

If you are using our AVN via voice recognition please also view the chapter on voice recognition ( Section B.III).

You will find more detailed information below:

Details on personal data processed

Third-party apps provider embedded in the AVN

The following third-party provider apps are embedded in our AVN:

Potential data transfers to third countries without an appropriate level of protection

It is possible that when you use a third-party app, personal data may be transferred to third countries for which there is no so-called adequacy decision of the European Commission and for which no suitable guarantees are provided. In this respect, there is a risk that there is no adequate level of protection for the personal data transferred. This means that your personal data processed by the third-party provider may not be subject to a level of protection comparable to the GDPR. In particular, this means that the principles for the processing of personal data set out in Art. 5 GDPR may not be complied with. In addition, you may not have enforceable rights and effective remedies with respect to the processing of personal data. By activating the respective third-party app, you accept these possible risks on your own responsibility.

Use of OMS (Occupant Monitoring System)

Our OMS (Occupant Monitoring System), currently deployed exclusively within the EU, includes functions such as the Interior Monitoring Camera, and the Occupant Reminder System. These functions are designed to enhance passenger safety and improve user experience by utilizing various sensors and cameras.

Details on personal data processed

Details on the processing of personal data

Compliance with legal requirements.

In order to comply with legal requirements, SAIC MAXUS processes your user ID, the VIN, the condition of your vehicle and, if necessary, other personal data.

SAIC MAXUS is subject to various legal requirements that it must comply with. These can be e.g. Protection against unauthorised use, legitimate CO2 emission, general safety requirements of the Vehicles.

Details on personal data which are processed

Details on the processing of personal data

Details on the recipients of personal data and the transfer of personal data to third countries and/or international organisations

The data processing activities depend on your car model. The above data categories are not generally applied to our all car models. You may contact us for further details.

Information on the Rights of Data Subjects

As a data subject, you have the following rights with regard to the processing of your personal data:

• Right of access (Article 15 of the GDPR)

• Right to rectification (Article 16 of the GDPR)

• Right to erasure ("right to be forgotten") (Article 17 of the GDPR)

• Right to restriction of processing (Article 18 of the GDPR)

• Right to data portability (Article 20 of the GDPR)

• Right to object (Article 21 of the GDPR)

• Right to withdraw consent (Article 7 paragraph 3 of the GDPR)

• Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR)

You may contact us for the purpose of exercising your rights using the contact information in Section A.

Where applicable, you can find information on any specific modalities and mechanisms that facilitate the exercise of your rights, particularly regarding data portability and the right to object, in the information on the processing of personal data in Section B of this Privacy Notice.

Below you find more detailed information on your rights with regard to the processing of your personal data:

Right of Access

As a data subject, you have the right to obtain access and information under the conditions provided in Article 15 of the GDPR.

In particular, you have the right to obtain confirmation from us as to whether we are processing your personal data. If so, you also have the right to obtain access to the personal data and the information listed in Article 15 paragraph 1 of the GDPR. This includes information regarding the purposes of the processing, the categories of personal data that are being processed and the recipients or categories of recipients to whom the personal data have been or will be disclosed (Article 15 paragraph 1 points (a), (b) and (c) of the GDPR).

You can find the full extent of your right to access and information in Article 15 of the GDPR, which can be accessed using the following link: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679.

Right to Rectification

As a data subject, you have the right to rectification under the conditions provided in Article 16 of the GDPR.

In particular, that you have the right to receive from us without undue delay the rectification of inaccuracies in your personal data and completion of incomplete personal data.

You can find the full extent of your right to rectification in Article 16 of the GDPR, which can be accessed using the following link: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679.

Right to Erasure ("Right to Be Forgotten")

As a data subject, you have the right to erasure ("right to be forgotten") under the conditions provided in Article 17 of the GDPR.

In particular, you have the right to request the erasure of your personal data, and we are obliged to erase it without undue delay if one of the conditions listed in Article 17 paragraph 1 of the GDPR applies. This can be the case, for example, if personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed (Article 17 paragraph 1 point (a) of the GDPR).

If we have made the personal data public and are obliged to erase it, we are also obliged, taking account of available technology and the cost of implementation, to take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of those personal data (Article 17 paragraph 2 of the GDPR).

The right to erasure ("right to be forgotten") does not apply if the processing is necessary for one of the reasons listed in Article 17 paragraph 3 of the GDPR. This can be the case, for example, if the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims (Article 17 paragraph 3 points (b) and (e) of the GDPR).

You can find the full extent of your right to erasure ("right to be forgotten") in Article 17 of the GDPR, which can be accessed using the following link: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679.

Right to Restriction of Processing

As a data subject, you have the right to restriction of processing under the conditions provided in Article 18 of the GDPR.

This means that you have the right to obtain from us the restriction of processing if one of the conditions provided in Article 18 paragraph 1 of the GDPR applies. This can be the case, for example, if you contest the accuracy of the personal data. In such a case, the restriction of processing lasts for a period that enables us to verify the accuracy of the personal data (Article 18 paragraph 1 point (a) of the GDPR).

Restriction means that stored personal data are marked with the goal of restricting their future processing (Article 4 paragraph 3 of the GDPR).

You can find the full extent of your right to restriction of processing in Article 18 of the GDPR, which can be accessed using the following link: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679.

Right to Data Portability

As a data subject, you have the right to data portability under the conditions provided in Article 20 of the GDPR.

This right allows you to receive your personal data with which you have provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance, provided that the processing is based on consent or contract and is carried out by automated means (Article 20 paragraph 1 of the GDPR).

You can find information as to whether an instance of processing is based on consent pursuant to Article 6 paragraph 1 point (a) or Article 9 paragraph 2 point (a) of the GDPR or on a contract pursuant to Article 6 paragraph 1 point (b) of the GDPR in the information regarding the legal basis of processing in Section B of this Privacy Notice.

In exercising your right to data portability, you also generally have the right to have your personal data transmitted directly from us to another controller if technically feasible (Article 20 paragraph 2 of the GDPR).

The full extent of your right to data portability is available in Article 20 of the GDPR, which can be accessed using the following link: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679.

Right to Object

As a data subject, you have the right to object under the conditions provided in Article 21 of the GDPR.

We will inform you of your right to object in our first communication with you.

More details are provided below:

Right to Object on Grounds Relating to the Particular Situation of the Data Subject

As a data subject, you have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on Article 6 paragraph 1 point (e) or (f), including profiling based on those provisions.

You can find information as to whether an instance of processing is based on Article 6 paragraph 1 point (e) or (f) of the GDPR in the information regarding the legal basis of processing in Section B of this Privacy Notice.

In the event of an objection relating to your particular situation, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

The full extent of your right to objection is available in Article 21 of the GDPR, which can be accessed using the following link: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679.

Right to Object to Direct Marketing

Where your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.

You can find information as to whether and to what extent personal data are processed for direct marketing purposes in the information regarding the legal basis of processing in Section B of this Privacy Notice.

If you object to processing for direct marketing purposes, we no longer process your personal data for these purposes.

The full extent of your right to objection is available in Article 21 of the GDPR, which can be accessed using the following link: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679.

Right to Withdraw Consent

If processing is based on consent, as a data subject, you have the right withdraw consent at any time under Article 7 paragraph 3 of the GDPR, to withdraw your consent at any time. Withdrawal does not affect the legality of prior processing. We inform you of this before you grant your consent.

You can find information as to whether an instance of processing is based on Article 6 paragraph 1 point (a) or Article 9 paragraph 2 point (a) of the GDPR in the information regarding the legal basis of processing in Section B of this Privacy Notice.

Right to Lodge A Complaint With A Supervisory Authority

As a data subject, you have the right to lodge a complaint with a supervisory authority under the conditions provided in Article 77 of the GDPR.

Information About the Technical Terms of the GDPR Used in this Privacy Notice

The terms used in this Privacy Notice are defined as per the GDPR.

The full scope of the definitions of the GDPR can be found in Article 4 of the GDPR, which can be downloaded from the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679.

You will find more detailed information on the most important technical terms of the GDPR used in this Privacy Notice below:

"Personal data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

"Data Subject" means the respective identified or identifiable natural person, to which the personal Data refers to;

"Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

"Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

"Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

"Processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

"Recipient" means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

"Third party" means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;

"International organisation" means an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;

"Third country" means a country which is not a member state of the European Union ("EU") or the European Economic Area ("EEA");

"Special categories of personal data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

Effective date of and changes to this Privacy Notice

The effective date of this Privacy Notice is 【2025-09-05】.

It may be necessary to modify this Privacy Notice due to technical developments and/or amendment of statutory or official requirements.

Additional Information For Other Jurisdictions

Australia

We provide Smart Connected Vehicles and Connected Services in Australia under the brand LDV. In context with the provision of our products and services, we are bound by the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles set out in Schedule 1 of the Privacy Act ("APPs"). The Protection of personal information is important to us, and the following parts provide information on our personal information handling practices.

Interpretation of the technical terms of the Privacy Act and Apps used in this part

"personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable: (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not.

"sensitive information" means: (a) information or an opinion about an individual's: (i) racial or ethnic origin; or (ii) political opinions; or (iii) membership of a political association; or (iv) religious beliefs or affiliations; or (v) philosophical beliefs; or (vi) membership of a professional or trade association; or (vii) membership of a trade union; or (viii) sexual orientation or practices; or (ix) criminal record; that is also personal information; or (b) health information about an individual; or (c) genetic information about an individual that is not otherwise health information; or (d) biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or (e) biometric templates.

"APP entity" means an agency or organisation.

"organisation" means: (a) an individual; or (b) a body corporate; or (c) a partnership; or (d) any other unincorporated association; or (e) a trust; that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality of a State or Territory.

Identity and contact details of the App entity

Under the Privacy Act and the Apps, we constitute an App entity. The identity and contact details are as follows:

SAIC MAXUS Automotive Co., Ltd.

No.2500, Jungong Rd, Yangpu, Shanghai

privacy@saicmotor.com

Collection, usage and disclosure of personal information

We collects, uses and discloses information about your use of Connected Services (including in some cases personal information) for the purposes specified in the Privacy Notice above.

We only use your personal information collected in connection with your use of Connected Services for the purpose of providing the Connected Services to you or as otherwise permitted, required or authorised by law (including by the Privacy Act). If you want to use Connected Services, but do not provide us with your personal information, we may not be able to provide you with all Connected Services or may only be able to provide those Connected Services to you with limited functionality.

We may collect your sensitive personal information (including in some cases biometric templates) that is reasonably necessary for our provision of services and with your consent (unless we are required or authorised by or under an Australian law or a court/tribunal order).

If you provide us with personal information about another person (such as a joint vehicle owner or authorised driver or contact person), you need to tell the other person about this notice so they are aware that you have provided their information to us and that they can read this notice to understand how their information will be handled. You must obtain all necessary consents from the other person before supplying their personal information to us (including a parent or legal guardian's permission for minors).

Direct Marketing

We may use the contact information we collect from you for direct marketing purposes, to provide you with promotional information about our products and services. The marketing communications may be carried out by a number of methods, such as email, telephone, SMS, etc. If you do not wish to receive any marketing communication, you can request us using the contact details in paragraph 2 "Identity and contact details of the App entity". We will stop using or disclosing your personal information for the purpose of direct marketing.

Cross-border disclosure of personal information

We work with related entities and service providers that located overseas. You agree that in our daily operation, we may disclose your personal information to overseas recipients located in China and France.

Unless an exception in the Apps applies, we would take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the Apps (other than Australian Privacy Principle 1) in relation to the information.

Access, correction and complaints

Right to access: You have the right to request the access to your personal information held by us. We may charge you with a reasonable fee for the access.

Right to correction: You have the right to correct your personal information held by us. We take reasonable steps to ensure the information we held is accurate, up-to-date, complete, relevant and not misleading. We will not charge you for the correction.

Right to Complain: If you believe our practices constitute a breach of the Privacy Act or the Apps, you can contact us. We will try our best to resolve the matter with you. If your concerns are not resolved to your satisfaction, you can lodge a complaint with the Office of the Australian Information Commissioner by visiting https://webform.oaic.gov.au/prod?entitytype=Complaint&layoutcode=ComplaintWF , and filling the privacy complaint form.

The request for access and correction, and the submission of complaint need to be submitted to us via the contact details provided in paragraph 7 "Contacting us". We will respond to your request within a reasonable period.

Contacting us

If you would like to make an enquiry or complaint about how we handle your personal information, or if you wish to request access or correction to your personal information, or you have questions or comments about this part, you can contact us using the information provided in Section A of this Privacy Notice.

Alternatively, you may contact our general agent in the Australian region, who will assist us in handling your request.

Company Name: SAIC MAXUS Automotive Co., Ltd.

Privacy Mailbox Address: privacy@saicmotor.com

Address: No.2500, Jungong Rd, Yangpu, Shanghai

New Zealand

We provide Smart Connected Vehicles and Connected Services in New Zealand under the brand [LDV]. In context with the provision of our products and services, we are bound by the Privacy Act 2020 ("Privacy Act"). The Protection of personal information is important to us, and the following parts provide information on our personal information handling practices.

Interpretation of the technical terms of the Privacy Act used in this part

"Personal information" (a) means information about an identifiable individual; and (b) includes information relating to a death that is maintained by the Registrar-General under the Births, Deaths, Marriages, and Relationships Registration Act 2021 or any former Act.

"agency" means (a) an individual who is ordinarily resident in New Zealand; or; (b) a public sector agency; or (c) a New Zealand private sector agency; or; (d) a court or tribunal, except in relation to its judicial functions.

"foreign person or entity" (a) an individual who is neither present in New Zealand; nor ordinarily resident in New Zealand; (b) a body, incorporated or unincorporated, that is not established under the law of New Zealand; and does not have its central control and management in New Zealand; (c) the Government of an overseas country.

Identity and address of the agency

Under the Privacy Act, the identity and address of the agencies that collect or hold the information are as follows:

Agency Name: SAIC MAXUS Automotive Co., Ltd.

Address: No.2500, Jungong Rd, Yangpu, Shanghai

DPO Mailbox Address: privacy@saicmotor.com

Collection, usage and disclosure of personal information

We collects, uses and discloses information about your use of Connected Services (including in some cases personal information) for the purposes specified in the Privacy Notice above.

We only use your personal information collected in connection with your use of Connected Services for the purpose of providing the Connected Services to you or as otherwise permitted, required or authorised by law (including by the Privacy Act). If you want to use Connected Services, but do not provide us with your personal information, we may not be able to provide you with all Connected Services or may only be able to provide those Connected Services to you with limited functionality.

We may collect your sensitive personal information (including in some cases biometric templates) that is reasonably necessary for our provision of services as illustrated in the Privacy Notice above, and we adopt stricter protection standard for the processing of sensitive information.

If you provide us with personal information about another person (such as a joint vehicle owner or authorised driver or contact person), you need to tell the other person about this notice so they are aware that you have provided their information to us and that they can read this notice to understand how their information will be handled. You must obtain all necessary consents from the other person before supplying their personal information to us (including a parent or legal guardian's permission for minors).

Rights to access and correct personal information

Right to access: You have the right to obtain confirmation from us as to whether or not we hold personal information about you, and request the access to your personal information held by us. We will respond your request in any case not later than 20 working days after the day on which the request is received.

Right to correction: You have the right to correct your personal information held by us. We take reasonable steps to ensure the information we held is accurate, up-to-date, complete, and not misleading. We will respond your request in any case not later than 20 working days after the day on which the request is received, and inform you our decision of whether to grant the request.

Contacting us

If you would like to make an enquiry or complaint about how we handle your personal information, or if you wish to request access or correction to your personal information, or you have questions or comments about this part, you can contact us using the information provided in Section A of this Privacy Notice.

Alternatively, you may contact our general agent in New Zealand, who will assist us in handling your request.

Company Name: SAIC MAXUS Automotive Co., Ltd.

Privacy Mailbox Address: privacy@saicmotor.com

Address: No.2500, Jungong Rd, Yangpu, Shanghai