Global Privacy Statement

Last updated 15. September 2025

Your privacy is important to us and to Société Générale Group to which Ayvens belongs. This is a matter of priority for us and we have implemented strong principles in that respect, especially in regards of the EU General Data Protection Regulation. Ayvens S.A. and its affiliated entities (hereafter “Ayvens”) value the trust of customers, suppliers and business partners and are committed to protecting their personal data. Compliant privacy and information security practices are therefore integral components of Ayvens’ services, corporate governance, risk management and overall accountability. We only process such personal data as is necessary for our business activities and the provision of the Ayvens services.

This Global Privacy Statement (the “Statement”) describes our practices in connection with the personal information (“Personal Data”) that we process about you and your business relationship with Ayvens.

Please read this Global Privacy Statement carefully so that you understand how we collect and use your Personal Data.

Download this Global Privacy Statement (PDF)

1. SCOPE OF THIS STATEMENT (1.) Website visitors/users (“Website Visitors”); (2.) Corporate Customers (“Customers”); (3.) Customers’ employees/drivers (“Drivers”); (4.) Private lease customer (including sole proprietors and partnerships) (“Private Lease Customers”); (5.) Private buyers of used vehicles (“Buyers”); (6.) Professional buyers of used vehicles (“Traders”); (7.) Suppliers of goods and services (“Suppliers”); and (8.) Any third party, other than a customer, buyer, trader or supplier, with a business relationship or strategic alliance (“Business Partners”). (or prospects in relation to the above; individually and collectively also referred to as “you”, “your” or “yours”).

We collect and use your Personal Data through our various vehicle and ﬂeet leasing, fleet management and driver mobility services and in the course of performing our business activities (“Services”).

Please also note that specific services may be subject to a separate privacy statement referenced in the respective terms.

RESPONSIBILITIES OF CUSTOMERS Insofar as Customers in their capacity as employers have access to Personal Data of their employees, i.e. Drivers, the Customer is the controller responsible for the processing and use thereof in such capacity. This Statement does not apply to the processing and use of Personal Data of Drivers by Customers.

2. WHO ARE WE? Ayvens is a brand of ALD Autoleasing D GmbH, which is the responsible controller for processing your personal data (“controller”).

ALD Autoleasing D GmbH Address: Nedderfeld 95 22529 Hamburg

The Ayvens Group is part of Ayvens S.A. Address: 1, Rue Eugène et Armand Peugeot 92500 Rueil Malmaison, France

Ayvens may also be referred to as “we”, “our” or “us”.

3. HOW DO WE COLLECT YOUR PERSONAL DATA? We and our service providers collect Personal Data in the following ways:

Through sales activities We commence the processing of Personal Data if you provide this, directly or indirectly via third parties, e.g. as part of an offline sales lead, registration, online contact form, digital application path, inquiry by e-mail, telephone, chat and/or application, survey or price competition.

Through the Services Most of the Personal Data we collect are in relation to the Services we provide or will be providing to you as (i) a Driver and our Customer, your employer, if you are using a company vehicle, or (ii) a Private Lease Customer. This starts with the registration of your Personal Data with respect to the vehicle to be leased (in some circumstances we may do some preliminary credit checks before this) and continues with the registration of the leased vehicle and when we communicate with you about our services, e.g., to arrange for periodic maintenance and repairs. We may also process your Personal Data when your vehicle inadvertently is involved in an accident, to ensure that we restore mobility and handle any damage, or where we are the recipient of trafﬁc ﬁnes in relation to your leased vehicle. We can also process personal data in order to settle the terminated lease agreement and return vehicles. Next to our core-leasing activities, we also provide a number of other related services, such as e-mobility services, fuel card services, charging services, driver license checks, car rental services inclusive AboCar, and roadside assistance. Another service we provide relates to car remarketing, sales of used Ayvens vehicles.

Online We collect Personal Data from you online, when: • You visit our websites, platforms or social media channels; • Place an order over the phone or contact customer-/driver service; • Joint marketing partners share the information with us; and • You connect your social media account to your Services account or where you share information from our websites to your social media platforms, you will share certain Personal Data from your social media account with us, for example, your name, e-mail address, photo, list of social media contacts, and any other information that may be or you make accessible to us when you connect your social media account to your Services account.

From other sources We receive your Personal Data from other sources, for example: • Drivers’ employers, if you use a company vehicle; • The relevant authority (e.g., police or justice department) where we are the recipient of trafﬁc ﬁnes or administrative charges in relation to your leased vehicle; • Public and government authorities, including public and government authorities outside your country of residence, where we are subject to sanctions and embargoes or anti-money laundering and counter terrorism regulations; • From our independent service partners who assist us in providing our leasing and other services to you, including dealerships, maintenance providers and body repair shops; • From our partnerships being for instance original equipment manufacturers or dealerships; • Publicly available databases, credit reference agencies and other sources.

We need to collect Personal Data in order to provide the requested Services to you or to handle queries, comments or complaints related to our Services. If you do not provide the Personal Data requested, we may not be able to provide the Services. If you disclose any Personal Data relating to other persons to us or to our service providers in connection with the Services, you represent that you have the authority to do so and to permit us to use the information in accordance with this Statement.

Monitoring of communications Subject to applicable laws, we will monitor and record calls, e-mail, text messages and other communications we have with you. We do this for compliance with regulatory rules, self-regulatory practices or procedures relevant to our business, to prevent or detect crime, in the interests of protecting the security of our communication systems and procedures, and for quality control and staff training purposes.

For example, where we are required by a regulator to record certain telephone lines (as relevant) we will do so. In addition, where appropriate and having regard to applicable data protection law, our monitoring will be to check for inappropriate content in communications. In very limited and specific circumstances we may conduct short term carefully controlled monitoring of your activities where this is necessary for our legitimate interests or to comply with a legal obligation. We may do this for instance where we have reason to believe that fraud or other crime is being committed, where offences are suspected and where the monitoring is proportionate to the type of the disciplinary offence, or where we suspect non-compliance with sanctions and embargoes or anti-money laundering and counter terrorism regulations to which we are subject. In particular, telephone calls may be recorded for these purposes.

4. WHY AND ON WHICH LEGAL BASIS DO WE USE PERSONAL DATA?

4.1 DATA PERTAINING TO WEBSITE VISITORS

4.1.1 WEBSITES

4.1.1.a To communicate with you

What does this purpose entail? We process your Personal Data when you contact us via one of our online contact forms, for example, when you send us questions, suggestions, compliments or complaints, or when you request a quote for our Services. This processing is done for the entering into or performance of an agreement that you have with us, and to pursue our legitimate interest to be able to respond to a request.

Which Personal Data do we process for this purpose? For this purpose, we may collect your (business) contact details (for instance your name(s), e mail address, telephone number), license plate or registration number and any other information that you provide to us in the open text ﬁelds of the contact form, where you can, for example, pose your question, describe your suggestion, make a compliment or share a complaint.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.1.1.b For surveys or other (marketing) communication

What does this purpose entail? We process your Personal Data when you complete a survey on our website or via another tool, for feedback about our websites and/or Services, with your consent or for which we have a legitimate interest to process these data (improvement of services). With your consent or where we have a legitimate interest, we may send you marketing communication, to keep you updated on events, special offers, possibilities and current and future products and services of Ayvens. When we contact you in regard of surveys or marketing communication, we will do so either by e-mail, phone, or by postal mailings (newsletters/brochures/magazines). If you would no longer like to receive surveys or marketing communication from us, please use the opt out options in the communication or contact your local Ayvens entity via their webform for individuals’ rights/data subject rights on their local website or see the general contact details below. With your consent, based on your visit to a website of Ayvens, we can show you personalized advertisements outside the Ayvens website. To understand what is relevant to you, we can use manual and automated tools to analyse your personal information.

Which Personal Data do we process for this purpose? For this purpose, we process your name, your address, your e-mail address and topics you may be interested in (as may be indicated by you on our website).

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.1.2 SOCIAL MEDIA

4.1.2.a To facilitate social sharing functionality

What does this purpose entail? Our websites may contain various social media sharing functionalities, such as LinkedIn, Xing, Facebook or Kununu buttons, which, with your consent, you may use to share information provided on our websites with the social media of your choosing. Our websites may also contain links to our own social media pages, such as our LinkedIn or Facebook pages or our X feed, which you may choose to use to post feedback.

Likewise, various social media websites, such as LinkedIn, Facebook, Xing, Snapchat or Kununu may contain Ayvens advertisements containing links to our websites. These social media websites may, with your consent, share information provided by you with us when you choose to follow a link to our local website.

Please note that we are not responsible for the collection, usage and disclosure policies and practices (including the data security practices) of other organizations, such as Meta (Facebook), Apple, Google, Microsoft, RIM or any other app developer, app provider, social media platform provider, operating system provider, wireless service provider or device manufacturer, including any personal information you disclose to other organizations through or in connection with our social media functionalities and/or advertisements. Processing of personal information is subject to privacy policies and practices of these other organizations.

Which Personal Data do we process for this purpose? For this purpose, we process your name, e-mail address, IP-address, photo, list of social media contacts and any other information that may be accessible by us when using social media functionalities.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.1.3 COOKIES AND SIMILAR TECHNOLOGIES

Any processing of your Personal Data via cookies and/or similar technologies will take place in accordance with our cookie statement, available on ayvens.com or our local Ayvens website.

4.1.4 AYVENS BUSINESS PURPOSES

4.1.4.a Management reporting

What does this purpose entail? Personal Data for various Ayvens business-related purposes for which we have a legitimate interest to process these data, such as audits, developing new products, enhancing, improving or modifying our websites and Services, data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and operating and expanding our business activities. To facilitate your use of our online services or applications, we may analyse data that we collect when using our digital media and combine it with information collected via cookies based on your consent. For example, to better understand which digital channel (Google search, e-mail, social media) or device (desktop, tablet or mobile) you prefer, we can optimize or limit our communication and marketing activities by channel and by device.

Which Personal Data do we process for this purpose? For this purpose, we may process your name, your e-mail address, your IP address, gender, date of birth, place of residence, digits of your postal code and any other information mentioned in this Statement or otherwise provided to us by you, if such is required for one of the purposes mentioned in the previous paragraph.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.1.4.b Compliance with laws and legal obligations and protection of Ayvens assets and interests

What does this purpose entail? To comply with a legal obligation or where we have a legitimate interest, we process your Personal Data as appropriate or necessary: (a) under applicable law, including laws outside your country of residence and including sectorial recommendations; (b) to comply with legal process; (c) to respond to requests from public and government authorities including public and government authorities outside your country of residence; (d) to enforce our terms and conditions and other applicable policies; (e) to protect our operations; (f) to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.

Which Personal Data do we process for this purpose? For this purpose, we process your name, your contact information, your correspondence with Ayvens, your use of any of our Services and any other information mentioned in this Statement or otherwise provided to us by you, if such is required for one of the purposes mentioned in the previous paragraph.

With whom do we share your Personal Data? Only if we are required to do so by law or sectorial recommendation to which Ayvens is subject, or if we have a legitimate interest to that effect, your Personal Data will be provided to supervisory agencies, fiscal authorities and investigative agencies. See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.2 DATA PERTAINING TO CUSTOMERS

4.2.1 CUSTOMER ACCOUNT MANAGEMENT

4.2.1.a To provide, manage and administer the Customer account

What does this purpose entail? We process your Personal Data to handle day-to-day management and administration of the Customer accounts, such as maintaining contracts and keeping you informed of all important developments concerning the Services and other information which is relevant for the Customer contract and account. This processing is based on the performance of the lease agreement that we have with you or based on a legal obligation.

Which Personal Data do we process for this purpose? For this purpose, we may process business contact details and log-in details to our Customer online accounts.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.2.1.b To communicate with you

What does this purpose entail? You can contact us by various means (such as e-mail or telephone, or via our website). In this case we will use your Personal Data to answer your question/request. We can also contact you, for example, regarding day-to-day management and administration of your Customer account. This processing is based on our legitimate business interest and relates to the performance of the lease agreement that we have with you, or with your consent.

Which Personal Data do we process for this purpose? For this purpose, we may process your name, your business contact details, your correspondence with Ayvens pertaining to your question/request and all other personal information you provide to us and/or which is necessary to appropriately respond to you.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.2.1.c For surveys or other (marketing) communication

What does this purpose entail? We process your Personal Data to send you surveys, if you have consented in receiving these surveys or if we have a legitimate interest in processing your personal data in this context (improving or modifying our Services). With your consent or where we have a legitimate interest, we may send you marketing communication, for example, to keep you updated on events, current and future offers, possibilities and current and future products and services of Ayvens. We will send you such surveys in the form of either a periodic e-mail or an e-mail to request your feedback on our Services and other services performed on the vehicle. We may also send you postal mailings (newsletters/brochures/magazines). To understand what is relevant to you, we can use manual and automatic tools to analyse your personal information. If you would no longer like to receive surveys or marketing communication from us, please opt out or contact us via the local Ayvens entity website form or via the contact details set out below.

To facilitate your use of our online Services or applications, we may analyse data that we collect when using our digital media and combine it with information collected via cookies based on your consent. For example, to better understand which digital channel (Google search, e-mail, social media) or device (desktop, tablet or mobile) you prefer, we can optimize or limit our communication and marketing activities by channel and by device.

Which Personal Data do we process for this purpose? For this purpose, we may process your name and your business contact details. With whom do we share your Personal Data? If you have given your consent, we may transfer Personal Data for marketing purposes to other entities within the Société Générale group or to retailers. In connection with the organization and/or implementation of (Customer-) events and, we may also transfer personal data to external service providers whom we have involved in the organization and/or implementation of our events. See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.2.2 AYVENS PREMISES

4.2.2.a Access to and security control of Ayvens premises

What does this purpose entail? We may process your Personal Data when you visit us on our premises for the purpose of ensuring appropriate access controls and security, for which we have a legitimate interest (safety and security of our assets).

Which Personal Data do we process for this purpose? For this purpose, we may process your name, your contact information and the person you are visiting. We may also process video and/or audio information about you through video/audio recording equipment, such as for instance CCTV.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.2.3 CUSTOMER REPORTING

4.2.3.a Fleet reporting tool

What does this purpose entail? We provide a designated fleet reporting tool. Customers’ contact persons can log onto these tools to review the status of their ﬂeet, damage reporting, contract management and to use other ﬂeet reporting functionalities, such as dashboard reporting, trend analysis reporting, vehicle mileage and end of lease term. This processing is done based on our legitimate interest (to be able to service Drivers being employees of our Customers) and relates to the performance of the lease agreement that we have with our Customer.

Which Personal Data do we process for this purpose? For this purpose, we process contact details and job function (e.g., (International) Fleet Manager) of Customer’s contact person, and login details (e.g., username and password).

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.2.4 AYVENS BUSINESS PURPOSES

4.2.4.a Management reporting

What does this purpose entail? We process your Personal Data for various business purposes for which we have a legitimate interest to process these data, such as data analysis, audits, developing new products, enhancing, improving or modifying our Services, identifying usage trends, determining the effectiveness of our promotional campaigns and operating and expanding our business activities. To facilitate your use of our online services or applications, we may analyse data that we collect when using our digital media and combine it with information collected via cookies based on your consent. For example, to better understand which digital channel (Google search, e-mail, social media) or device (desktop, tablet or mobile) you prefer, we can optimize or limit our communication and marketing activities by channel and by device.

Which Personal Data do we process for this purpose? For this purpose, we may process various information that we collect in the context of providing our Services (such as your name, contact details, fleet details etc.), as needed for one of the purposes set out above.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.2.4.b Compliance with laws and legal obligations and protection of Ayvens assets and interests

What does this purpose entail? To comply with a legal obligation or where we have a legitimate interest, we process your Personal Data as appropriate or necessary: (a) under applicable law, including laws outside your country of residence and including sectorial recommendations (e.g. counterparty due diligence (CDD), money laundering, ﬁnancing of terrorism and other crimes); (b) credit checks; (c) to comply with legal process; (d) to respond to requests from public and government authorities including public and government authorities outside your country of residence; (e) to enforce our terms and conditions and other applicable policies; (f) to protect our operations; (g) to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others; and (h) to allow us to pursue available remedies or limit the damages that we may sustain.

Which Personal Data do we process for this purpose? For this purpose, we process the name, contact information, the date, place and country of birth of the ultimate beneﬁcial owner of the counterparty that Ayvens want to do business with; we may also process the name, address and the date, place and country of birth of the person(s) who represent the company towards Ayvens; your correspondence with Ayvens, your use of Services and any other information mentioned in this Statement, if such is required for one of the purposes mentioned in the previous paragraph. For counterparty due diligence (CDD) purposes we periodically also process investigation data based on sanctions, enforcement, adverse media, politically exposed persons and anti-slavery screening. For this purpose, a risk-based approach is used to ensure only necessary Personal Data is collected. Please note, multiple (trained) employees are involved to evaluate the screening results in case of a ‘hit’ (human intervention).

4.3 DATA PERTAINING TO DRIVERS (EMPLOYEES OF OUR CUSTOMERS)

4.3.1 DRIVER CONTACT

4.3.1.a To communicate with you

What does this purpose entail? You can contact us by various means (such as e-mail or telephone, or via our website). In this case we will use your Personal Data to answer your question/request. We can also contact you in relation to your vehicle or other relevant driver-related issues. In relation to you this processing is based on our legitimate interest and is part of delivering the Services to you and/or your employer (under the lease agreement that we have with your employer) or with your consent.

Which Personal Data do we process for this purpose? For this purpose, we process your name, your contact information, your correspondence with Ayvens pertaining to your question/request and all other Personal Data you provide to us and/or which is necessary to appropriately respond to you, including your license plate number. For quality and training purposes we may also record your telephone calls with customer services departments if you provide us with your consent to do so.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.3.1.b For surveys or other (marketing) communication

What does this purpose entail? We process your Personal Data when we send you periodic surveys to request your feedback on our Services and other services performed on the vehicle, provided that you have consented in receiving these surveys or we have a legitimate interest in processing your personal data in this context. With your consent or where we have a legitimate interest, we may send you marketing communication, to keep you updated on events, current and future offers, possibilities and current and future products and services of Ayvens. When we contact you in regard of surveys or marketing communication, we will do so either by e-mail or by postal mailings (newsletters/brochures/magazines). To understand what is relevant to you, we can use manual and automatic tools to analyse your personal information. If you would no longer like to receive marketing communication from us, please contact us via the contact form or via the unsubscribe link in the respective marketing communication from us.

Which Personal Data do we process for this purpose? For this purpose, we process your name, your address, your e-mail address, your license plate number and your interests (as indicated by you).

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.3.2 VEHICLE SERVICES

4.3.2.a Management of the vehicle

What does this purpose entail? We process your Personal Data in relation to administering your use of the vehicle and to handle the day-to-day management of the vehicle, for which we have a legitimate interest, and this is also related to delivering the Services to you and your employer under the lease agreement that we have with your employer.

Which Personal Data do we process for this purpose? For this purpose, we process your name, address, (company) e-mail address, scope of service, license plate number, make and model, service history and operational contact with you. In addition, you may provide certain information pertaining to vehicle management to us through the Ayvens or third party portals or apps, or when you call Ayvens.

With whom do we share your Personal Data? We share information pertaining to the management of the vehicle with our Customers (your employer) or to service providers who provide services related to your vehicle. See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.3.2.b Repair, maintenance and tires

What does this purpose entail? We process your Personal Data in relation to providing (scheduled) repair and maintenance and tire services and to analyse, predict and pro-actively steer on maintenance and repairs for your vehicle, for which we have a legitimate interest, and this is also related to delivering the Services to you and your employer under the performance of the lease agreement that we have with your employer.

Which Personal Data do we process for this purpose? For this purpose, we collect e.g. your name, address, (company) e-mail address, license plate number, make and model, service history and operational contact with you. In addition, you may provide certain information to us through the Ayvens portal (e.g., your phone number to make an appointment for maintenance of the vehicle), or when you call Ayvens.

With whom do we share your Personal Data? We share information with our Customers (your employer) and with third parties performing maintenance/repair on the vehicle or changing or replacing tires, such as dealers/garages, body repair shops or car ﬁtters. See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.3.2.c Accident management

What does this purpose entail? We process your Personal Data by processing and administering accidents that you and/or your vehicle may have been involved in, to restore mobility and handle damage. We will do so by (i) giving you an opportunity to report accidents at our customer services department or via our driver portals, (ii) providing, where applicable, roadside assistance and/or a replacement vehicle and (iii) arranging repair and other necessary follow-up. This processing is based on our legitimate interest, and this is also related to delivering the Services to you and your employer under the performance of the lease agreement that we have with your employer. We may also use this information for assessing damage repairs under our damage handling and risk retention policies, for which we have a legitimate interest to process these data.

Which Personal Data do we process for this purpose? For this purpose, we collect the following Personal Data:

Us: license plate number, make and model, service history and operational contact with you.
From you: your name, contact details, vehicle details, accident details, damage details, photos of the incident, date of birth, number of passengers in the vehicle, information of witnesses to the accident (if applicable) and any other information you choose to provide to us in the context of the accident (including any information pertaining to possible injuries).
From third parties, such as individuals involved in the accident or insurance companies: information of third parties involved in the accident/incident (such as the identity of your passengers, driver and passengers of third-party vehicles, and other third parties involved), information of other third parties (such as witnesses, investigating police ofﬁcers and others) insurance information, information about the incident and third-party claims.
From authorities (such as police): your name, address, license plate number, information regarding the accident, police reports and witness statements.

With whom do we share your Personal Data? We share this information with our Customer (your employer). We may also share certain information with e.g. dealers/garages, body repair shops, car ﬁtters, insurance companies (which may be both afﬁliated and third-party insurance companies) and professional experts employed on our behalf or on behalf of third parties (such as lawyers, medical experts, investigators, etc.) for the purpose of damage or claim resolution. See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.3.2.d Trafﬁc and parking ﬁnes management

What does this purpose entail? The following may depend on the country where Drivers may have committed trafﬁc and/or parking violations: as the registered owner of the vehicles, trafﬁc and/or parking ﬁnes incurred by Drivers of the vehicles may be addressed to Ayvens by the authority that issued a speciﬁc trafﬁc or parking ﬁne (such as police or local municipality). In addition, your employer (our customer) forwards traffic or parking fines to Ayvens if the “Management of Administrative Offenses” service has been agreed between us and your employer.

We process your Personal Data for the purpose of processing and managing the payment of the ﬁne and, if applicable, obtaining reimbursement from our Customer (your employer), for which we have a legitimate interest to process these data.

Which Personal Data do we process for this purpose? We process information that we receive from the competent authorities (such as police or local municipalities), for example: your name, address and license plate number, the, nature, place, date and time of the offense/incident committed by you and the imposed fines.

With whom do we share your Personal Data? Ayvens may need to share this information with our Customer (your employer) in certain situations, for example, when leased vehicles are used in carpools and Ayvens does not know who the actual driver of a speciﬁc vehicle is. See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.3.2.e Drivers liscense check, Driver training

What does this purpose entail? Employers who provide their employees with company vehicles are obliged to regularly check that these employees have a valid driver's license. Furthermore, as part of the legally prescribed occupational safety requirements, employers are obliged to ensure that all employees who are provided with vehicles for work purposes are familiar with the handling of company vehicles.

Ayvens provides a “drivers-check” platform and a web application for the purpose of providing services such as driver's license checks and driver training. This processing is based on our legitimate interest and is carried out in order to provide services to you and your employer in connection with the fulfillment of the leasing agreement we have concluded with your employer.

Which Personal Data do we process for this purpose? As part of the driver's license check service, Ayvens processes your contact details and driver's license data, among other things. If the video identification procedure is used as part of the driver's license check, we also process video and audio data. As part of the driver training, we process your contact details as well as the type of test you have completed and its date and time.

With whom do we share your Personal Data? Ayvens transfers personal data necessary for the provision of driver's license check and driver training to service providers involved in the provision of these services. See section 5, “WHO HAS ACCESS TO YOUR DATA?”

4.3.2.f Fuel card, EV charging and tolls

What does this purpose entail? Where applicable, our Services include a fuel management program, which allows you to, for example, pay for your fuel at gas stations using a Ayvens issued or managed payment mechanism. In case you have an electric vehicle (“EV”), you may be provided with an EV charging card for charging your vehicle at charge points. We may also arrange for the placement of an EV charge station as part of the contract. This processing is based on our legitimate interest and is also related to delivering the Service to you and your employer under the performance of the lease agreement that we have with your employer).

We may further collect certain information about you to manage toll-related activities of the ﬂeet of vehicles of your employer.

Which Personal Data do we process for this purpose? For this purpose, we collect the following information: your name, contact information, e-mail address, fuel or EV charging card number, charging station number, address, phone number, license plate number, fuel information, mileage and related costs. In case of re-imbursements, we may also need to collect bank account information. We may also collect toll-related information, such as information on location, time and costs.

With whom do we share your Personal Data? Ayvens needs to share the information with the fuel card/EV charging solution/payment company. Also our Customers (your employer) may have access to certain Personal Data made available by us on our Internet or e-Mobility portal or online reporting tool. Customers can log in and review the status of their ﬂeet (e.g., mileage), and use other ﬂeet reporting functionalities (e.g., dashboard reporting on fuel consumption and fuel price and trend analysis reporting). Via the designated fleet reporting tool Customers can also request fuel cards or EV charging cards. See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.3.2. g Payroll Reporting

What does this purpose entail? To support the customer/your employer in the taxation of vehicles, Ayvens regularly provides them with a report when using the Payroll Reporting service, which includes the monetary benefit basis for each vehicle, the distance between the home/workplace of the respective assigned company car user, the monthly driver contribution in accordance with the Car Policy, and the resulting non-cash benefit in accordance with the flat-rate taxation method. This processing is based on the fact that the company car is used for business purposes and that the driver's contribution is calculated on the basis of the company car's mileage. This processing is based on our legitimate interest and is carried out in order to provide services to you and your employer in connection with the fulfillment of the leasing agreement we have concluded with your employer.

Which Personal Data do we process for this purpose? In providing this service, Ayvens processes, among other things, your name, your contact details, and the distance between your home and your place of work.

With whom do we share your Personal Data? Ayvens transmits this data to your employer. See Section 5, “WHO HAS ACCESS TO YOUR DATA?”

4.3.3 MOBILITY SERVICES

4.3.3.a Renting

What does this purpose entail? In case we provide our rental program services to you we collect your Personal Data, so that you can, for example, reach Ayvens’ rental specialists or external car rental companies, rent a vehicle from the most appropriate rental location or have a rental vehicle delivered to you. This processing is based on our legitimate interest, and this is also related to delivering the Service to you and your employer under the performance of the lease agreement that we have with your employer or, if applicable, the agreement that you have with us.

Which Personal Data do we process for this purpose? For this purpose, we collect: your name, e-mail, mobile phone number, driver’s license details, license plate number, related costs, delivery location and rental time.

With whom do we share your Personal Data? We share your data with Ayvens’ (external) rental specialists, as well as with our Customers (your employer). See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.3.3.b Roadside assistance

What does this purpose entail? When you experience a malfunction, for example, a ﬂat tire or mechanical difﬁculties while on the road, Ayvens is able to arrange roadside assistance, for which we work closely with contracted third parties. This processing is based on our legitimate interest and is also related to delivering the Service to you and your employer under the performance of the lease agreement that we have with your employer.

Which Personal Data do we process for this purpose? For this purpose, we collect the following information: your name, e-mail address, mobile phone number, license plate number and location of where assistance was needed and provided.

With whom do we share your Personal Data? We share your information with third parties providing on the road repair services, towing services or a replacement vehicle, as well as with our Customers (your employer). See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.3.4 ONLINE PORTALS AND APPS

4.3.4.a Various portals and apps for drivers

What does this purpose entail? Depending on the country you live in, we provide online portals and apps that have a number of functionalities. For example, through our portals and apps you can ﬁnd practical information about your lease vehicle, change your name, contact details and other personal information, report damage to your vehicle, schedule appointments for repairs, maintenance or changing tires through online appointment planners, contact our customer services department and, in case you have an EV, manage charging.

We may also provide you with dashboard-type overview that can provide your insight into your use of the vehicle (such as your average fuel efﬁciency, your damages, etc.). This processing is based on our legitimate interest, and this is also related to delivering the Service to you and your employer under the performance of the lease agreement that we have with your employer) or with your consent.

Which Personal Data do we process for this purpose? We receive your name and e-mail address from your employer (our Customer) to provide you with Ayvens generated log-in data (username and temporary password) so that you can access our various online portals and apps.

With whom do we share your Personal Data? We share your information with third parties engaged by us to administer and execute the various portals and apps for drivers. See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.3.4.b Fleet Reporting Tool

What does this purpose entail? The designated fleet reporting tool entails dashboard reporting on a country and/or international level to our Customers (your employer). The fleet reporting tool allows Customers for instance to access and evaluate the mileage or the remaining lease period of (individual) vehicles. We also use the data contained in this fleet reporting tool to provide (aggregated) insights to our Customers (your employer) into key aspects of their country’s ﬂeet management (such as cost and risk issues) for the purpose of implementing a balanced ﬂeet management approach (cost, environment and safety), managing ﬂeet policy implementation, having the ability to report on global carbon emission as part of the Customer’s corporate social responsibility obligations and compliance, assessing the effectiveness of policy changes and proactively communicating relevant ﬂeet developments. This processing is based on our legitimate interest and is also related to delivering the Service to you and your employer under the performance of the lease agreement that we have with your employer).

Which Personal Data do we process for this purpose? For this purpose, we may process the following Personal Data:

From our Customer (your employer): Driver name, customer-generated Driver identification number, name and contact details of Customer’s contact person, (e-mail) address, telephone number, social insurance number to the extent that this is necessary for (tax) legal purposes and use of fuel card.
Ourselves: vehicle details (e.g., make, model, registration number, license plate number), remaining contract duration, damages sustained by a vehicle, fuel type, number and type of fuel card, fuel consumption and insurance data.
From Driver: mileage and description of damages sustained by a vehicle involved in an accident.
Data received from others (such as police, local municipalities, service garage/centre): trafﬁc and/or parking ﬁnes, mileage and information on vehicle maintenance and repairs.

With whom do we share your Personal Data? We share this information with the authorized (International) Fleet Manager on behalf of the Customer (your employer). See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.3.5 AYVENS BUSINESS PURPOSES

4.3.5.a Management reporting

Which Personal Data do we process for this purpose? For this purpose, we may process various information that we collect in the context of providing our Services (such as your name, contact details, vehicle details etc.), as needed for one of the purposes set out above.

With whom do we share your Personal Data? If parts of individual reports are relevant to your employer, we share this information with the authorized (International) Fleet Manager on behalf of the Customer (your employer). See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.3.5.b Compliance with laws and legal obligations and protection of Ayvens assets and interests

Which Personal Data do we process for this purpose? For this purpose, we process your name, your contact information, your correspondence with Ayvens, your use of Services and any other information mentioned in this Statement, if such is required for one of the purposes mentioned in the previous paragraph.

With whom do we share your Personal Data? Only if we are required to do so by law or sectorial recommendation to which Ayvens is subject, your Personal Data will be provided to supervisory agencies, ﬁscal authorities and investigative agencies. In which case we may share this information with the authorized (International) Fleet Manager on behalf of the Customer (your employer). See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.4 DATA PERTAINING TO PRIVATE LEASE CUSTOMER (INCLUDING SOLE PROPRIETORS AND PARTNERSHIPS)

4.4.1 SIGN UP

4.4.1.a To be able to accept you as a customer

What does this purpose entail? We collect Personal Data when you sign up (via our website) as a customer. This processing is required for the conclusion and performance of the lease agreement, including assessment, identifying and acceptance of you as a customer and any credit checks.

Which Personal Data do we process for this purpose? We process personal data from prospects, customers, guarantors, authorized representatives, legal representatives, beneficial owners, and third-party beneficiaries that is provided to us in the context of preliminary inquiries regarding the conclusion of a contract or in the context of the conclusion of a contract. For this purpose, we collect your name, gender, title, address, contact details (including your e-mail address and telephone number), driver’s license details, delivery address or pick-up location, transaction data (such as order, amount(s) to be paid, date of payment), if applicable, your tax identification number, financial information, payment and bank account details, and the authorization you have given Ayvens, identity verification data. We also process Information about the retailer or brokers acting as an intermediary/agent. Furthermore, we process personal data that we receive in the course of identity verification using appropriate identification procedures and identification providers. For this purpose, we may process your identification card and biometric data for online identification and verification purposes. The entire identification process is recorded visually and acoustically, and screenshots of the identified person and the corresponding identification documents are also taken. If the conclusion of a contract requires a credit check, we process credit data from prospects, customers, and guarantors that has been provided to us by banks and credit agencies, such as SCHUFA Holding AG for private customers and Creditreform for commercial customers.

With whom do we share your Personal Data? We transfer your personal data to individual external service providers, e.g., in the areas of marketing and sales, identity verification, information technology, and the enforcement of claims. Dealers and brokers process personal data in the context of preliminary inquiries and have access to personal data during the initiation of the contract. In addition, with the appropriate consent, we transfer personal data to the responsible dealer and broker to enable them to submit offers for the extension or replacement of existing contracts. In addition, personal data required for the execution of the contract is transferred to cooperation partners, in particular in the banking and insurance sectors. Information on data processing by cooperation partners is contained in the relevant contract documents of the partner.See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.4.1.b Portals and apps

What does this purpose entail? Depending on the local Ayvens unit with which you have signed a contract, we offer you online portals or apps. Via these portals or apps, you can ﬁnd practical information on your lease vehicle, your contact information and other personal information, report changes thereto, report damage to your vehicle, record appointments for repairs, maintenance or tire change, contact our customer service, consult and pay ﬁnes. This processing is required for the performance of the lease agreement or done with your consent.

Which Personal Data do we process for this purpose? For this purpose, we collect your name and e-mail address to send you a temporary password, which you will need to use the platform and apps.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.4.2 CONTACT

4.4.2.a To communicate with you

What does this purpose entail? You can contact us by various means (such as via e-mail, telephone, our website). In this case we use your Personal Data to answer your question/request. We can also contact you in relation to the private lease contract. This processing is required for the performance of the lease agreement or with your consent.

Which Personal Data do we process for this purpose? For this purpose, we may process your name, your contact information, your correspondence with Ayvens pertaining to your question/request and all other Personal Data you provide to us and/or which is necessary to appropriately respond to you, (incl. the license plate number), the agreed term of the private lease contract and your ﬁnancial obligations to us.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.4.2.b For surveys or other (marketing) communication

What does this purpose entail? We process your Personal Data when we send you periodic surveys to request your feedback on our Services and other services performed on the vehicle, provided that you have consented in receiving these surveys or we have a legitimate interest in processing your personal data in this context. With your consent or where we have a legitimate interest we may send you marketing communication, to keep you updated on events, current and future offers, possibilities and current and future products and services of Ayvens. When we contact you in regard of surveys or marketing communication, we will do so either by e-mail or by postal mailings (newsletters/brochures/magazines). To understand what is relevant to you, we can use manual and automatic tools to analyse your Personal Data. If you would no longer like to receive surveys or marketing communication from us, please use the opt out options in the communication, contact the local Ayvens entity via its webform for individual rights or use the contact details below.

Which Personal Data do we process for this purpose? For this purpose, we process your name, your address, your e-mail address, the license plate number and topics you may be interested in (as may be indicated by you on our website).

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.4.3 VEHICLE SERVICES

4.4.3.a Management of the vehicle

What does this purpose entail? We process your information in relation to administering your use of the vehicle and to handle the day-to-day management of the vehicle. This processing is required for performance of the lease agreement.

Which Personal Data do we process for this purpose? For this purpose, we process your name, address, (company) e-mail address, lease category, license plate number, make and model, service history and operational contact with you. In addition, you may provide certain information pertaining to vehicle management to us through the Ayvens portal, or when you call Ayvens or any partners.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.4.3.b Repair, maintenance and tires

What does this purpose entail? We process your Personal Data in relation to providing (scheduled) repair and maintenance services and tires services for your vehicle and to analyse, predict and pro-actively steer on maintenance and repairs. For this processing we have a legitimate business interest and is required for performance of the lease agreement.

Which Personal Data do we process for this purpose? For this purpose, we process your name, address, (company) e-mail address, license plate number, vehicle identification number, make and model, service history and operational contact with you. In addition, you may provide certain information to us through the Ayvens portal (e.g., your phone number to make an appointment for maintenance of the vehicle), or when you call Ayvens.

With whom do we share your Personal Data? We share information with third parties performing maintenance/repair on the vehicle or changing or replacing tires, such as dealers/garages, body repair shops or car ﬁtters. See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.4.3.c Accident management

What does this purpose entail? Where applicable, we process your Personal Data by documenting and administering accidents that you and/or your vehicle may have been involved in, to restore mobility and handle damage. We will do so by (i) giving you an opportunity to report accidents as they happen at our customer services department, (ii) providing, where applicable, roadside assistance and/or a replacement vehicle and (iii) arranging repair and other necessary follow-up. This processing is required for the performance of the lease agreement. We may also use this Information for assessing damage repairs under our damage handling and risk retention policies, for which we have a legitimate interest to process these data.

Which Personal Data do we process for this purpose? For this purpose, we process the following Personal Data:

Us: license plate number, make and model, service history and operational contact with you.
From you: your name, contact details, vehicle details, accident details, damage details, photos of the incident, date of birth, number of passengers in the vehicle, information of witnesses to the accident (if applicable) and any other information you choose to provide to us in the context of the accident (including any information pertaining to possible injuries).
From third parties, such as individuals involved in the accident or insurance companies: information of third parties involved in the accident/incident (such as the identity of your passengers, driver and passengers of third-party vehicles, and other third parties involved), information of other third parties (such as witnesses, investigating police ofﬁcers and others) insurance information, information about the incident and third-party claims.
From authorities (such as police): your name, address, license plate number, information regarding the accident, police reports and witness statements.

With whom do we share your Personal Data? We may share certain information with dealers/garages, body repair shops, car ﬁtters, insurance companies (which may be both afﬁliated and third-party insurance companies) and professional experts employed on our behalf or on behalf of third parties (such as lawyers, medical experts, investigators, etc.) for the purpose of damage or claim resolution. See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.4.3.d Fuel card, EV charging card

What does this purpose entail? Where applicable, our Services include a fuel management program, which allows you to, for example, pay for your fuel at gas stations using an Ayvens issued or managed payment mechanism. In case you have an EV, you may be provided with an EV charging card for charging your vehicle at charge points. We may also arrange for the placement of an EV charge station as part of the contract. This processing is required for the performance of the agreement.

Which Personal Data do we process for this purpose? For this purpose, we process the following information: your name, e-mail address, fuel or EV charging card number, charging station number, address, phone number, license plate number, fuel information, mileage and related costs. In case of re-imbursements, we may also need to collect bank account information.

With whom do we share your Personal Data? Ayvens needs to share the information with the fuel card/EV-charging solution/payment company. See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.4.3.e Trafﬁc and parking ﬁnes management

What does this purpose entail? The following may depend on the country where you may have committed trafﬁc and/or parking violations: as the registered owner of the vehicles, trafﬁc and/or parking ﬁnes incurred by drivers of the vehicles may be addressed to Ayvens by the authority that issued a speciﬁc trafﬁc or parking ﬁne (such as police or local municipality). We process your Personal Data for the purpose of processing and managing the payment of the ﬁne. This processing is required for the performance of the lease agreement.

Which Personal Data do we process for this purpose? We process information that we receive from the competent authorities (such as police or local municipalities): your name, address and license plate number, the nature, place, date and time of the offense/incident committed by you and the imposed ﬁnes.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.4.4 MOBILITY SERVICES

4.4.4a Roadside assistance

What does this purpose entail? When you experience a malfunction, for example, a ﬂat tire or mechanical difﬁculties while on the road, depending on the contract we have with you, Ayvens is able to arrange roadside assistance, for which we work closely with contracted third parties. This processing is required for the performance of the lease agreement.

Which Personal Data do we process for this purpose? For this purpose, we process the following information: your name, e-mail, mobile phone number, license plate number and location of where assistance was needed and provided.

With whom do we share your Personal Data? We share your information with third parties providing on the road repair services, towing services or a replacement vehicle. See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.4.5 AYVENS BUSINESS PURPOSES

4.4.5.a Management reporting

What does this purpose entail? We process Personal Data for various Ayvens business-related purposes for which we have a legitimate interest to process these data, such as data analysis, audits, developing new products, enhancing, improving or modifying our websites and Services, identifying usage trends, determining the effectiveness of our promotional campaigns and operating and expanding our business activities. To facilitate your use of our online services or applications, we may analyse data that we collect when using our digital media and combine it with information collected via cookies based on your consent. For example, to better understand which digital channel (Google search, e-mail, social media) or device (desktop, tablet or mobile) you prefer, we can optimize or limit our communication and marketing activities by channel and by device.

Which Personal Data do we process for this purpose? For this purpose, we may process your name, your e-mail address, your IP address, gender, date of birth, place of residence, digits of your zip code and any other information mentioned in this Statement or otherwise provided to us by you, if such is required for one of the purposes mentioned in the previous paragraph.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.4.5.b Compliance with laws and legal obligations and protection of Ayvens assets and interests

What does this purpose entail? To comply with a legal obligation or where we have a legitimate interest, we process your Personal Data as appropriate or necessary: (a) under applicable law, including laws outside your country of residence and including sectorial recommendations (e.g., counterparty due diligence (CDD), money laundering, ﬁnancing of terrorism and other crimes); (b) part of a credit check process; (c) to comply with legal process; (d) to respond to requests from public and government authorities including public and government authorities outside your country of residence; (e) to enforce our terms and conditions and other applicable policies; (f) to protect our operations; (g) to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others; and (h) to allow us to pursue available remedies or limit the damages that we may sustain.

Which Personal Data do we process for this purpose? For this purpose, we process your name, contact information, the date, place and country of birth, in case of a company of the ultimate beneﬁcial owner of the company; we may also process the name, address and the date, place and country of birth of the person(s) who represent the company towards Ayvens; your correspondence with Ayvens, your use of Services and any other information mentioned in this Statement, if such is required for one of the purposes mentioned in the previous paragraph. For counterparty due diligence (CDD) purposes we periodically also process investigation data based on sanctions, enforcement, adverse media, politically exposed persons and anti-slavery screening. For this purpose, a risk-based approach is used to ensure only necessary Personal Data is collected. Please note, multiple (trained) employees are involved to evaluate the screening results in case of a ‘hit’ (human intervention).

4.5 DATA PERTAINING TO PRIVATE BUYERS OF USED VEHICLES

4.5.1 PURCHASE

4.5.1.a Purchase of a Ayvens used vehicle

What does this purpose entail? We process your Personal Data in relation to your (potential) purchase of a Ayvens used vehicle, if applicable, the trade in of your vehicle and other related Services. This includes the execution of the purchase agreement, the delivery of Services and the settlement of the payment transaction. This processing is required for the conclusion and performance of the agreement, including assessment, acceptance of you as a customer and preliminary credit checks. Which Personal Data do we process for this purpose? For this purpose, we process your name, gender, title, (business) contact details (including your e-mail address, telephone number, name of your company), information related to your trade in vehicle and details needed to complete the transaction, including bank account information. With whom do we share your Personal Data? We may share this information with trade in parties or ﬁnancial services partners. See also section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.5.2 BUYER CONTACT

4.5.2.a To communicate with you

What does this purpose entail? We process your Personal Data when you contact us via one of our online contact forms (or provide information in one of our used vehicle centres), for example, when you send us questions, suggestions, compliments or complaints, or when you request a quote for our Services. We can contact you relating to a (potential) purchase of a vehicle. This processing is required for the performance of the agreement that you have with us or with your consent.

Which Personal Data do we process for this purpose? For this purpose, we process your name, gender, title, (business) contact details (including your e-mail address, telephone number, name of your company) and any other information that you provide to us in the open ﬁeld entry of the contact form, where you can, for example, pose your question, describe your suggestion, make a compliment or share a complaint.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.5.2.b For surveys or other (marketing) communication

What does this purpose entail? We process your personal information when we send you a survey to request your feedback on our Services, provided that you have consented in receiving this survey or we have a a legitimate interest to process these data in this context. With your consent or where we have a legitimate interest, we may send you marketing communication, to keep you updated on events, current and future offers, possibilities and current and future products and services of Ayvens. When we contact you in regard of surveys or marketing communication, we will do so either by e-mail or by postal newsletters/brochures/magazines (postal mailings). To understand what is relevant to you, we can use manual and automatic tools to analyse your Personal Data. If you would no longer like to receive surveys or marketing communication from us, please use the opt out options in the communication, contact the local Ayvens entity via its webform for individual rights or use the contact details below.

Which Personal Data do we process for this purpose? For this purpose, we process your name, your address, your e-mail address, and your interests (as indicated by you).

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.5.3 AYVENS BUSINESS PURPOSES

4.5.3.a Management reporting

Which Personal Data do we process for this purpose? For this purpose, we may process your name, your e-mail address, your IP address, gender, date of birth, place of residence, digits of your zip code and any other information mentioned in this Statement or otherwise provided to us by you, if such is required for one of the purposes mentioned in the previous paragraph.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.5.3.b Compliance with laws and legal obligations and protection of Ayvens assets and interests

What does this purpose entail? To comply with a legal obligation or where we have a legitimate interest, we process your Personal Data as appropriate or necessary: (a) under applicable law, including laws outside your country of residence and including sectorial recommendations (e.g., counterparty due diligence (CDD), money laundering, ﬁnancing of terrorism and other crimes); (b) to comply with legal process; (c) to respond to requests from public and government authorities including public and government authorities outside your country of residence; (d) to enforce our terms and conditions and other applicable policies; (e) to protect our operations; (f) to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.

4.6 DATA PERTAINING TO PROFESSIONAL BUYERS OF USED VEHICLES (TRADERS)

4.6.1 REGISTRATION AND PURCHASE

4.6.1.a Registration as a professional trader

What does this purpose entail? To be able to purchase Ayvens Used vehicle on an auction or purchase a vehicle via our car remarketing website(s), traders need to be registered with Ayvens as a professional trader. This processing is based on our legitimate interest (and also relates to the providing of Services under the performance of an agreement, including assessment, acceptance or credit checks) or based on a legal obligation.

Which Personal Data do we process for this purpose? For this purpose, we process your name, contact details (including your e-mail address, telephone number), your identification card and information related to your company including Chamber of Commerce document and VAT certiﬁcate.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.6.1.b Purchase of Ayvens used vehicles

What does this purpose entail? We process your Personal Data in relation to your (potential) purchase of an Ayvens used vehicle and/or other related Services via an auction or via our car remarketing website(s), this includes the execution of the purchase agreement, the delivery and the settlement of the payment transaction. This processing relates to the providing of Services under the conclusion and performance of the purchase agreement and is also based on our legitimate interest.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.6.2 TRADER CONTACT

4.6.2.a To communicate with you

What does this purpose entail? We process your Personal Data when you contact us via one of our online contact forms (or provide information in one of our used vehicle centres), for example, when you send us questions, suggestions, compliments or complaints, or when you request a quote for our Services. We can contact you relating to a (potential) purchase of a vehicle. This processing is based on our legitimate interest (and also relates to the providing of Services under the performance of the agreement that we have with the Trader) or with your consent.

Which Personal Data do we process for this purpose? For this purpose, we may process your name, your business contact details, your correspondence with Ayvens pertaining to your question/request and all other Personal Data you provide to us and/or which is necessary to appropriately respond to you.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.6.2.b For surveys or other (marketing) communication

What does this purpose entail? We process your Personal Data when we send you a survey to request your feedback on our Services, provided that you have consented in receiving this survey or we have a legitimate interest to process these data. With your consent or where we have a legitimate interest, we may send you marketing communication, to keep you updated on events, current and future offers, possibilities and current and future products and services of Ayvens. When we contact you in regard of surveys or marketing communication, we will do so either by e-mail or by postal newsletters/ brochures/magazines (postal mailings). If you would no longer like to receive surveys or marketing communication from us, please use the opt out options in the communication, contact the local Ayvens entity via its webform for individual rights or use the contact details below.

Which Personal Data do we process for this purpose? For this purpose, we process your name, your address, your e-mail address, and your interests (as indicated by you).

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.6.3 AYVENS BUSINESS PURPOSES

4.6.3.a Management reporting

Which Personal Data do we process for this purpose? For this purpose, we may process your name, your e-mail address, your IP address, gender, date of birth, place of residence, digits of your zip code and any other information mentioned in this Statement or otherwise provided to us by you, if such is required for one of the purposes mentioned in the previous paragraph.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.6.3.b Compliance with laws and legal obligations and protection of Ayvens assets and interests.

What does this purpose entail? To comply with a legal obligation or where we have a legitimate interest, we process your Personal Data as appropriate or necessary (a) under applicable law, including laws outside your country of residence and including sectorial recommendations (e.g., counterparty due diligence (CDD), money laundering, ﬁnancing of terrorism and other crimes); (b) to comply with legal process; (c) to respond to requests from public and government authorities including public and government authorities outside your country of residence; (d) to enforce our terms and conditions and other applicable policies; (e) to protect our operations; (f) to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.

4.7 DATA PERTAINING TO SUPPLIERS

4.7.1 SUPPLIER ACCOUNT MANAGEMENT

4.7.1.a To provide, manage and administer the Supplier account

What does this purpose entail? We process your Personal Data to handle day-to-day management and administration of the Supplier accounts, such as maintaining contracts, and keep you informed of all important developments concerning the services you render and other information which is relevant for the Supplier contract and account. This processing is based on the agreement that we have with you or based on a legal obligation.

Which Personal Data do we process for this purpose? For this purpose, we may process business contact details and log-in details to our Supplier online accounts.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.7.1.b To communicate with you

What does this purpose entail? You can contact us by various means (such as e-mail or telephone, or via our website). In this case we use your Personal Data to answer your question/request. We can also contact you, for example, regarding day-to-day management and administration of your Supplier account. This processing is based on the agreement that we have concluded with you, our legitimate interest in clarifying your request or is based on your consent.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.7.1.c For surveys or other (marketing) communication

What does this purpose entail? We process your Personal Data to send you surveys, provided that you have agreed to receive this survey or we have a legitimate interest to process these data. With your consent or where we have a legitimate interest, we may send you marketing communication, for example, to keep you updated on events, current and future offers, possibilities and current and future products and services of Ayvens. We send you such surveys in the form of either a periodic e-mail or an e-mail to request your feedback on our communication and relationship. We may also send you postal mailings (newsletters/brochures/magazines). If you would no longer like to receive surveys or marketing communication from us, please use the opt out options in the respective communication, contact the local Ayvens entity via its webform for individual rights or use the contact details below.

Which Personal Data do we process for this purpose? For this purpose, we may process your name and your business contact details.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.7.2 AYVENS PREMISES

4.7.2.a Access to and security control of Ayvens premises

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.7.3 AYVENS BUSINESS PURPOSES

4.7.3.a Management reporting

To facilitate your use of our online services or applications, we may analyse data that we collect when using our digital media and combine it with information collected via cookies based on your consent. For example, to better understand which digital channel (Google search, e-mail, social media) or device (desktop, tablet or mobile) you prefer, we can optimize or limit our communication and marketing activities by channel and by device.

Which Personal Data do we process for this purpose? For this purpose, we may process your name, your e-mail address, your IP address, gender, date of birth, place of residence, digits of your zip code and any other information mentioned in this Statement or otherwise provided to us by you, if such is required for one of the purposes mentioned in the previous paragraph.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.7.3.b Compliance with laws and legal obligations and protection of Ayvens assets and interests.

What does this purpose entail? To comply with a legal obligation or where we have a legitimate interest, we process your Personal Data as appropriate or necessary: (a) Under applicable law, including laws outside your country of residence and including sectorial recommendations (e.g., counterparty due diligence (CDD), money laundering, ﬁnancing of terrorism and other crimes); (b) to comply with legal process; (c) to respond to requests from public and government authorities including public and government authorities outside your country of residence; (d) to enforce our terms and conditions and other applicable policies; (e) to protect our operations; (f) to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.

Which Personal Data do we process for this purpose? For this purpose, we process the name, contact information, the date, place and country of birth of the ultimate beneﬁcial owner of the counterparty that Ayvens wants to do business with; we also process the name, address, job title, signature and the date, place and country of birth of the person(s) who represent the counterparty towards Ayvens; your correspondence with Ayvens, the services you render and any other information mentioned in this Statement, if such is required for one of the purposes mentioned in the previous paragraph. For counterparty due diligence (CDD) purposes we periodically also process investigation data based on sanctions, enforcement, adverse media, politically exposed persons and anti-slavery screening. For this purpose, a risk-based approach is used to ensure only necessary Personal Data is collected. Please note, multiple (trained) employees are involved to evaluate the screening results in case of a ‘hit’ (human intervention).

4.8 DATA PERTAINING TO BUSINESS PARTNERS

4.8.1 BUSINESS PARTNER ACCOUNT MANAGEMENT

4.8.1.a To provide, manage and administer the Business Partner account

What does this purpose entail? We process your Personal Data to handle day-to-day management and administration of the Business Partner accounts, such as maintaining contracts, and keep you informed of all important developments concerning the arrangements between us, other information which is relevant for the Business Partner contract and account. This processing is based on the agreement that we have with you or based on a legal obligation.

Which Personal Data do we process for this purpose? For this purpose, we may process your business contact details.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.8.1.b To communicate with you

What does this purpose entail? You can contact us by various means (such as e-mail or telephone). In this case we use your Personal Data to answer your question/request. We can also contact you, for example, regarding day-to-day management and administration of your Business Partner account. This processing is based on the agreement that we have concluded with you, our legitimate interest in clarifying your request or is based on your consent.

Which Personal Data do we process for this purpose? For this purpose, we may process your business contact details, your correspondence with Ayvens pertaining to your question/request and all other data you provide to us and/or which is necessary to appropriately respond to you.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.8.1.c For surveys or other (marketing) communication

What does this purpose entail? We process your Personal Data to send you surveys, provided that you have agreed to receive these surveys or we have a a legitimate interest to process these data. With your consent or there is a legitimate interest in processing your data we may send you marketing communication, for example, to keep you updated on events, current and future offers, possibilities and current and future products and services of Ayvens. We send you such surveys in the form of either a periodic e-mail or an e-mail to request your feedback on our communication and relationship. We may also send you postal mailings (newsletters/brochures/magazines). If you would no longer like to receive surveys or marketing communication from us, please use the opt out options in the communication, contact the local Ayvens entity via its webform for individual rights or use the contact details below.

Which Personal Data do we process for this purpose? For this purpose, we may process your name and your business contact details.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.8.2 AYVENS PREMISES

4.8.2.a Access to and security control of Ayvens premises

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.8.3 AYVENS BUSINESS PURPOSES

4.8.3.a Management reporting

Which Personal Data do we process for this purpose? For this purpose, we may process your business contact details and any other information mentioned in this Statement or otherwise provided to us by you, if such is required for one of the purposes mentioned in the previous paragraph.

With whom do we share your Personal Data? See section 5 ‘WHO HAS ACCESS TO YOUR DATA?’.

4.8.3.b Compliance with laws and legal obligations and protection of Ayvens assets and interests.

Which Personal Data do we process for this purpose? For this purpose, we process the name, contact information, the date, place and country of birth of the ultimate beneﬁcial owner of the counterparty that Ayvens wants to do business with; we also process the name, address, job title, signature and the date, place and country of birth of the person(s) who represent the counterparty towards Ayvens; your correspondence with Ayvens, the services you render and any other information mentioned in this Statement, if such is required for one of the purposes mentioned in the previous paragraph. For counterparty due diligence (CDD) purposes we periodically also process investigation data based on sanctions, enforcement, adverse media, politically exposed persons and anti-slavery screening. For this purpose, a risk-based approach is used to ensure only necessary Personal Data is collected. Please note, multiple (trained) employees are involved to evaluate the screening results in case of a ‘hit’ (human intervention).

5. WHO HAS ACCESS TO YOUR DATA?

In addition to what is indicated for each purpose above regarding who has access to Personal Data under the control of Ayvens, we may also share Personal Data:

Within Ayvens Group for the purposes described in this Privacy Statement. For a list of the Ayvens affiliates and their locations that may process Personal Data, see the country signs on the top right of www.ayvens.com.
Within Société Générale Group to which Ayvens belongs, for internal administrative purposes, to fulfil a legal obligation, to improve our services, to enable us to comply more efficiently and more effectively with laws and regulations or for monitoring, control and reporting purposes. Reporting purposes relate to any regulatory and statutory reporting obligations and data requests as required by Société Générale Group’s regulators.
To our third-party service partners, service providers and unaffiliated partners, or business partners such as original equipment manufacturers (OEMs) and brokers, to facilitate services they provide to you and us. In order to provide you with our services, we work closely with service partners, service providers and unaffiliated partners. Our independent service partners assist us e.g. in providing our leasing and other services to you, and include dealerships, maintenance providers, body repair shops, and roadside assistance providers, but also rental service companies and the administrators of our driver safety programs. Dealerships or suppliers of (electric) vehicles may require contact details of a driver to activate a personal account necessary to be set up as a driver, otherwise the vehicle does not work. Service providers are companies we retain that support us in running our business, for example to help us maintain our IT network and related infrastructure and security and access controls to our premises.

We also use and disclose your Personal Data as necessary or appropriate, especially when we have a legal obligation or legitimate interest to do so:

To comply with applicable law and regulations. This can include laws outside your country of residence.
To cooperate with public and government authorities. To respond to a request or to provide information we believe is important. These can include authorities outside your country of residence.
To cooperate with law enforcement. For example, when we respond to law enforcement requests and orders or provide information, we believe is important.
For other legal reasons. To enforce our terms and conditions and to protect our rights, privacy, safety or property, and/or that of our afﬁliates, you or others.
In connection with a sale or business transaction. We have a legitimate interest in disclosing or transferring your Personal Data to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of Ayvens business, assets or stock (including in connection with any bankruptcy or similar proceedings). Such third parties may include, for example, an acquiring entity and its advisors.

We will limit access to Personal Data to personnel with a business need to know for the purposes described in this Statement.

6. WHY PERSONAL DATA MAY BE TRANSFERRED TO THIRD COUNTRIES?

Ayvens is a global service provider that has customers and locations around the globe. Your Personal Data may be stored and/or processed in a country other than the one you reside in. For a list of the Ayvens affiliates and their locations, that may process Personal Data, see the country signs on the top right of www.ayvens.com.

Some of the non-EEA countries are considered to provide for an adequate level of protection of your Personal Data, according to EU standards. For the transfer of Personal Data to other countries, Ayvens has put in place adequate measures to protect your Personal Data, such as Standard Contractual Clauses.

7. CHILDREN’S PRIVACY

Our Services are not directed at individuals under the age of 18.

8. DO WE USE YOUR DATA FOR OTHER PURPOSES?

We may also use your Personal Data for a purpose other than the initial purpose. This is subject to the condition that the secondary purpose is in line with the initial purpose. The following factors are inter alia taken into account: are the purposes clearly related; is the secondary purpose appropriate and/or expected, was the Personal Data obtained directly from you or in another way; what kind of Personal Data is concerned for the secondary purpose; what would be the implications for you; and what data protection measures are applied when using your data for the secondary purposes.

It is generally permissible to process Personal Data for the following secondary purposes: transfer of the Personal Data to an Archive, internal audits or investigations, implementation of business controls and operational efficiency, IT systems and infrastructure related Processing such as for maintenance, support, life-cycle management, and security (including resilience and incident management), statistical, historical or scientific research, dispute resolution, legal or business consulting or insurance purposes.

9. HOW LONG WILL WE KEEP YOUR DATA?

Personal data of data subjects will be kept for the period necessary to fulfil the purposes described in this Statement unless a longer retention period is required or permitted by law.

The criteria applied to determine the applicable retention periods are: • the duration of a relationship and to provide the Services to you (for example, for as long as you use or lease an Ayvens vehicle); • as required by a legal obligation to which we are subject; and • as advisable in light of our legal position, such as in regard of applicable statutes of limitations, litigation or regulatory investigations.

After the relevant retention period, Ayvens will securely delete or destroy or de-identify your Personal Data or transfer your Personal Data to an Archive, unless this is prohibited by law or an applicable records retention schedule.

10. HOW DO WE SECURE YOUR DATA?

We seek to use appropriate organizational, technical and administrative measures to protect Personal Data within our organisation, in accordance with applicable privacy and data protection laws and regulations, including requiring service providers to use appropriate measures to protect the confidentiality and security of Personal Data. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please notify us in accordance with the ‘How can you contact us?’ section below immediately.

11. CHANGES TO THIS STATEMENT

We reserve the right to amend this Statement at any time in order to, for instance, address future developments of Ayvens or changes in industry or legal trends. The ‘Last Updated’ legend at the top of this Statement indicates when this Statement was last revised.

12. HOW CAN YOU CONTACT US?

If you have questions, requests or complaints, please feel free to contact either your respective customer/driver support via the contact page of the relevant Ayvens entity, contact ALD Autoleasing D GmbH, Nedderfeld 95, 22529 Hamburg in writing or contact our Data Protection Officer via datenschutz@aldautomotive.com. Because e-mail communication is not always secure, please do not include sensitive personal information in the e-mails you send us.

13. HOW CAN I EXERCISE MY PERSONAL DATA RIGHTS?

Please contact either ALD Autoleasing D GmbH, Nedderfeld 95, 22529 Hamburg in writing, your respective customer or driver support or our local Data Protection Officer by email (datenschutz@aldautomotive.com)

Your rights

a) Access You have the right to request information at any time about whether we process your personal data and, if so, to request access to this personal data. To exercise this right, you can contact us at any time using the contact details provided above.

b) Correction, deletion, restriction of processing When we process your personal data, we endeavour to take appropriate measures to ensure that your personal data is accurate and up to date for the purposes for which it was collected. If your personal data is inaccurate or incomplete, you may request that it be corrected. You may have the right to request the deletion of your personal data or the restriction of its processing. To exercise these rights, you can contact us at any time using the contact details above.

c) Data portability You may have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, or to transmit this data to another controller. To exercise this right, you can contact us at any time using the contact details above.

d) Right to object

You have the right to object to the processing of your personal data at any time, provided that we process your personal data to pursue our legitimate interests and there are reasons arising from your particular situation.To exercise this right, you can contact us at any time using the contact details above.

e) Revocation of consent with effect for the future You can revoke your consent at any time with effect for the future. Your revocation does not affect the legality of the processing carried out to date. To exercise this right, you can contact us at any time using the contact details above or use the unsubscribe option provided e.g. in our marketing emails (unsubscribe link).

f) Right to file a complaint You also have the right to file a complaint with the supervisory authorities in your country. Please see here a link to the national data protection authorities located in the European Union and the European Economic Area.

Please note that we may not be required to comply (or fully comply) with your request. Applicable laws or regulations may impose conditions or restrict certain of such rights.

Global Privacy Statement

Contents