1.Introduction

1.1.Application

This policy applies to buyers and potential buyers of Seminovos.

1.2.Expiration

These rules and conditions may be changed or eliminated at any time by the General Management, in which case they will be duly communicated.

2.Objective / Management Rules

The purpose of this Policy is to describe the privacy and data protection guidelines of the ALD Carmarket Channel.

It is of total importance to follow all the steps described to avoid operational risks.

We at ALD AUTOMOTIVE SA, registered in the CNPJ 07.563.781/0001-71 and headquartered in Belo Horizonte MG, Rod Anel Rodoviário Celso Mello Azevedo nº15040, CEP:30.750-222, Bairro: Alto Caiçaras, care about you, and therefore we take care with your data.

This document was prepared in compliance with the General Law on Personal Data Protection (Law13.709/18). This document may be updated as a result of any regulatory update, so we recommend that you review this document periodically.

As a data controller, we are responsible for collecting and handling your personal data in a lawful manner. The purpose of this Data Privacy Policy is to inform you about what personal data we may collect about you, the reasons why we use and, in some cases, share this data, how long we keep it, what your rights are in this regard and how to exercise them.

ALD Automotive is a provider of mobility services including operational leasing of vehicles, fleet management and Remarketing activities. This privacy policy explains our practices regarding the personal data of our aldcarmarket.com users ("you").

We respect your privacy and therefore process your personal data in accordance with the General Data Protection Act ("LGPD"), other applicable laws and regulations in the area of data privacy, personal data protection and this Privacy Policy.

4.General Principles

ALD Automotive understands your concerns regarding the confidentiality of your personal information. Below we describe how we acquire and use this information and describe your rights. Please read it carefully to make the process as fair, transparent and secure as possible.

The following principles are fundamental to how we process your personal information:

Transparency and fairness: When we collect and process your personal information, we make available our privacy policy in accordance with local law and how your personal data is treated. Where required by law, we seek your prior consent (for example, before collecting any sensitive information or sending any direct marketing materials). We never use your personal information for purposes incompatible with the purposes described here.

Legitimacy: ALD Automotive does not collect or process personal information without a legal reason. We use your personal information only for appropriate business purposes (e.g. to provide services, manage customer relationships, manage customer vehicle fleets and perform accurate billing, or for marketing activities, profiling to better serve customers, perform satisfaction surveys or prepare reports and comply with our legal obligations).
Minimization: We collect only the personal information that is strictly necessary for the data processing as set out in this document. We take all reasonable, technical and organizational measures to ensure that your recorded personal data is accurate, complete and up to date.
Privacy: We apply technical and organizational measures to ensure privacy when implementing personal data processing and governance. To this end, we conduct personal data flow mapping and if identified risks to civil liberties and fundamental rights, we conduct privacy impact assessments to ensure that our safeguards are appropriate.

5.About Us

ALD Automotive is the data controller of your personal data.

Rod Anel Rodoviário Celso Mello Azevedo nº15040, CEP:30.750 - 222, Bairro: Alto Caiçaras
dpobrasil@aldautomotive.com

Telephone: +55 11 3147-4710

6.How we use your personal data and what personal data is used


PROCESS	Legal Basis (Art 7º)	DATA OWNER	COLLECTED DATA
Evaluation and identification of the customer for the conclusion of a sales contract	Contract Execution	Legal Representatives	ID document of the legal representative; Articles of Incorporation
Management of dealers and contractual relationship car dealers (B2B)	Contract Execution	Legal Representatives	Surname; First Name; position; e-mail address; telephone e cellphone number
	Contract Execution	Legal Representatives	ID card company representative and/or ID company representative; Power of attorney with signature; Proof of Chamber of Commerce; Proof of tax identification; Bank account details
Contractual relationship retail management (B2C and small B2B)	Contract Execution	Individual	Individuals: Identity card and proof of address, driver's license and social security/tax identification number; e-mail address; telephone and cell phone number
	Contract Execution	Legal representatives of small businesses	Companies: Social Contract
Anti-Money Laundering and Combating the Financing of Terrorism	Compliance with legal or regulatory obligation	Legal representatives; Company members; UBO; Individual customers	Surname; First name of legal representatives; ID document; Articles of Incorporation
			• Full name (first and last names);
			• Genre;
			• Job Title;
			• Date of birth;
			• Complete residential address;
			Screening Results
PROCESS	Legal Basis (Art 7º)	DATA OWNER	COLLECTED DATA
Marketing or promotional activities; Sending newsletters.	Consent	Customer	Surname; First Name; position; e-mail address; telephone e cellphone number
	Consent	Merchants
Survey	Legitimate Interest	Merchants	Surname; First Name; e-mail address
Pick-up Services	Contract Execution	Drivers	Driver's name; address and zip code of driver's pickup address; phone number of driver; email address of driver
Delivery of the driver's vehicle	Contract Execution	Merchants	Driver's name; Driver's phone number; Driver's e-mail address
Sales via auction platform to merchants (i.e., legal entities or corporations)	Consent	Individual acting on behalf of its business; (pseudo-) UBO(s) ; Directors and, if applicable, Counterparty Representatives	Full name (first and last names); Gender; Private residential address; Date of birth; ID number; Screening results / For directors and counterpart representatives : Full name (first and last names); Gender; Job title ; Date of birth; Full residential address
Price Configuration	Legitimate Interest	pessoa de contato em uma garagem	Surname; First Name; position; professional e-mail address; professional telephone e cellphone number
Vehicle refurbishment	Contract Execution	Drivers	Deletion of personal data contained in the car.
Retail (B2C and small B2B)	Contract Execution	individuals, small businesses	Individuals : ID card and proof of address, driver's license and tax identification number/tax identification number Companies : Kbis extract

7.How long we keep your personal data

Personal data is kept by ALD Automotive Brazil, on an active basis, for the time necessary for the execution of the purpose pursued at the time of its collection.

The retention period is therefore initially defined by ALD Automotive Brazil according to the operational needs necessary for the execution of each individual rental agreement and considering the recommendations of the local data protection authority.

However, certain longer retention periods may result from legislative and regulatory texts. Some laws also require that documents/information containing personal data be retained for a specific period for evidentiary purposes or in anticipation of possible litigation until the action in question is time-barred. For example, in commercial matters of accountability documents, obligations are in principle time-barred for five years if they are not subject to special prescriptions. ALD is therefore obliged to retain certain personal data beyond the execution of the rental contracts, even if it no longer has any use for them, in the form of so-called intermediate files.

After the end of this period the personal data will be: Anonymized and/or Deleted.

8.With whom does ALD Automotive share my personal data?

In principle, we do not share your data with third parties. However, as part of the execution of the sales contract, we may share company information and personal data with ALD/Group SG affiliates to streamline the KYC (Know Your Customer) process.

9.Export of personal data outside the EEA - European Economic Area

In general, all ALD databases are located within the European Union. However, ALD may transfer your personal data from Europe to countries within or outside the European Economic Area. Countries outside the EEA may not provide the same level of protection available in the EEA. If we transfer your personal data outside the EEA, we will ensure that there are adequate levels of protection in relation to the processing of your personal data. ALD will therefore, before transferring your personal data outside Europe, ensure that it implements a Standard Contractual Clauses (SCC). This applies to our India-based support team (SGGSC).

10.Your rights

To protect data subjects involved in the processing of personal data, the GDPR has implemented rights. The rights in question are as follows:


ARTICLES 17 to 22 - TITLE RIGHTS
Confirmation of the existence of treatment	You can confirm that your data is being processed	ART 18: I
Access	You can obtain information regarding the processing of your personal data and a copy of this personal data.	ART 18: II
Correction	When you consider that your personal data is inaccurate or incomplete, you can demand that this personal data be modified.	ART 18: III
Anonymization, Blocking, Deletion	You may demand the deletion of your personal data, to the extent permitted by law	ART 18: IV
Data portability	Where legally applicable, you have the right to have the personal data you have provided to us returned to you in an intelligible format.	ART 18: V
Deletion	You can request the deletion of personal data collected upon consent.	ART 18: VI
Sharing Information	You can request information on who your data has been shared with (Public and private entities)	ART 18: VII
Withdraw consent / Information about not consenting	Right not to provide consent and consequences of refusal	ART 18: VIII
Revocation of consent	Right to withdraw consent at any time	ART 18: IX

11.Data security and Storage

ALD Automotive protects your data by means of technical and organizational security measures, including:

Up-to-date policies and work instructions and regular compliance checks.
Segregation of duties, so that our employees only have access to your personal data if it is necessary for their role and function.
Effective training of our employees on the rules, issues and risks involved.
Physical security of the premises where we handle your personal data (e.g., access control and video surveillance cameras).
Numerous IT security measures (secure servers, firewalls, encryption, among others).

Only staff and employees who have a need to know your information within our company can access it. ALD Automotive makes sure to implement management rights and policies within our company and we take every measure to ensure that employees, consultants and contractors keep their files confidential.

12.Cookie Policy and Websites

ALD Automotive may collect data through cookies to improve the user's browsing experience. Cookies are used, among other trackers, to store preferences and settings to save time, enable login, combat fraud, analyze the performance of the site and the services provided by the tenant and compile visit statistics.

If you use our mobile application, we may collect your GPS location, subject to your consent where necessary. We may also analyze how often you use the app and where you downloaded it.

For more details you can view our cookie policy by following this link: https://www.aldcarmarket.com/cookiepolicy/

13.Updates to this privacy policy

We may modify this Privacy Policy from time to time to conform to any new regulations, so please review it regularly. If we change this Privacy Policy, we will notify you by means of a notice on the home page of our website. This Notice was last amended on April 15, 2022.

14.How to exercise my rights

According to Art. 18: The data subject shall have the right to obtain from the controller, in respect of data relating to the data subject processed by it, at any time upon request.

We are committed to fulfilling these rights. You can exercise these rights with ALD Automotive by contacting us via the exclusive privacy channel: e-mail dpobrasil@aldautomotive.com

15.Responsabilities

The Superintendent of the Remarketing area is responsible for the writing, mastery, performance, application and updating of this procedure; his name will be communicated via e-mail to the entire company in case of change.

The Director of Operations is responsible for the domain and application of this process.

This process is applicable to all employees of the ALD Automotive Brazil Remarketing area.

Each employee linked to this area has to take an action to respect these rules.

16.Internal Audit

The Director of the Remarketing department is responsible for providing adequate service to the internal audit and providing the necessary information.

17.Register Control

What is a Record: Completed and validated information and documents, regardless of age, origin, or medium (paper, media, electronic, etc.), that are created, received, managed as evidence of an activity, and that must be retained for legal, Group, regulatory, contractual, or operational reasons.

18.Attachments

N/A

19.GDPR (General Data Protection Regulation)

The General Data Protection Regulation, Law No. 13,709 of August 14, 2018 establishes guidelines for the processing of personal data.

As per ALD Automotive internal data protection policy POL-LGPD-001, the personal data handled in this process must be recorded in the Data Mapping, i.e., the life cycle of the personal data, its purpose and legal basis applied. It is the responsibility of the area management to keep the data mapping up to date.