PRIVACY POLICY

1. INTRODUCTION

The Privacy Policy for the Geely Data Act Online Platform (the "Policy") is intended to inform the individual about the processing of their personal data (collection, use, storage, disclosure and delete), which is carried out on or through the Geely Data Act Online Platform https://data-act.geely.com (the "Platform"). 

2. CONTROLLER OF THE PERSONAL DATA

The controller of the personal data collected and processed in connection with the use of the Platform is Lotus Tech Innovation Centre GmbH (hereinafter referred to as "GEELY CARS", "we" or "us"):

Lotus Tech Innovation Centre GmbH

Magellan-Allee 4, 65479 Raunheim, Deutschland

GeelyDataAct@dataprivacyhub.com

3. USERS WHOSE PERSONAL DATA ARE PROCESSED

This Policy refers to the collection and processing of personal data of users of the Platform.

4. CATEGORIES OF PERSONAL DATA PROCESSING, PURPOSE OF PROCESSING AND LEGAL BASIS FOR PROCESSING

(1) What is personal data?

Personal data is any information relating to a specific or identifiable person. An identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or by reference to one or more factors characterising the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

(2) What personal data do we collect?

We collect and process your personal data that you actively provide to us or we automatically collected via the Platform in the following scenarios.

i. Login to the Platform

• Login Verification Information: When you log in to the platform, we collect your email address (which should be the email used to register your Geely Mobile Application account) and the email verification code to authenticate your identity and ensure account security. When you login in through our application, we collect your device type, unique identifier, version and configuration in order to perform the matching of application with our website.

ii. Submitting a Data Request

When you submit a data request through the Platform, we will collect the following information to verify your identity and fulfill your request:

• Basic Profile Information: title, last name, middle name (optional), first name, connected vehicle account (email), mobile phone number (optional), address (optional), city, and country/region.
• Proof of Vehicle Ownership or Relationship: vehicle VIN, start and end dates of vehicle ownership, and proof of ownership or lawful use (e.g., vehicle registration certificate).
• Data Request Details: type of data requested, start and end dates for data access, and recipient information.
• If you choose to receive the information yourself, you are required to provide your email address.
• If you choose to designate a third party to receive the information, you are required to provide the recipient’s email address, full name, and country/region.

iii. Information Collected Automatically

When you use the platform, we may automatically collect certain device and network information by tools like cookies in our Platform. A “cookie” is a text file that websites sends to a visitor’s computer or other Internet-connected device to uniquely identify the visitor’s browser or to store information or settings in the browser. Click here to view our complete Cookie Policy.

(3) What are the legal bases for the processing of personal data?

In accordance with the applicable provisions of the General Data Protection Regulation (GDPR) and/or the legislation governing the protection of personal data, we may only process your personal data if there are one or more legal grounds for processing. These include the following:

• Consent – if you have given consent to the processing of your personal data for one or more specific purposes;
• Contract – processing is necessary for the performance of a contract to which the user is a party or for the implementation of measures at the request of the user by concluding a contract;
• Legal obligation – processing is necessary for the fulfilment of a legal obligation relating to the controller;
• Vital interests – processing is necessary to protect the vital interests of the user to whom the personal data relates or another natural person;
• Public interest – processing is necessary for the performance of a task in the public interest or in the exercise of public authority vested in the controller;
• Legitimate interests – processing is necessary for the legitimate interests of the controller or a third party, except when such interests are overridden by the interests or fundamental rights and freedoms of the user that require the protection of personal data, in particular in the case of the user to whom the personal data relates is a child.

(4) For what purpose do we process your personal data?

We process personal data for specific, explicit and lawful purposes and we will not process them in any way that is inconsistent with those intentions.

5. HOW WILL WE DISCLOSE YOUR DATA

Access to your personal data is limited only to those parties who need to be familiar with it in order to perform their work or contractual obligations.

Depending on the intention with which GEELY CARS processes your personal data, it may be mediated for certain purposes, i.e. we may disclose your personal data to the following categories of service providers:

i. Service Providers from an authorized Geely Service Network or agents from a Geely Agent Network acting as our contracted processors or separately as independent controllers of personal data;

ii. Our contracted contractors (our contracted processors of personal data), from whom we always require to act in accordance with the applicable laws and regulations, the personal data security policy and pay great attention to the confidentiality of your personal data:

• Companies that perform other services for GEELY CARS or on behalf of GEELY CARS (for example, external IT-related service providers, accounting services, law firms, etc.)

iii. Other third parties:

• Where this constitutes a contractual obligation on our part (for example, to the vehicle manufacturer);
• When required to do so by law or legally required for a protective right of the GEELY CARS Company;
• When necessary to ensure compliance with the law, authority requirements, court provisions, legal process, obligations, in relation to reporting and informing authorities, etc.;
• To protect the rights, own or security of GEELY CARS and/or its customers.

Our business partners listed under point ii above are allowed to process your personal data within the scope of our instructions and are not allowed to use the personal data for any of their own interests.

6. TRANSFER OF DATA TO THIRD COUNTRIES

Our servers are located in Europe. GEELY CARS does not transfer or pass on the collected personal data to other countries and/or countries outside the EEA/EU, unless it is necessary for the purpose of performing certain activities (e.g. business process support) and performance of contracts with users.

In the event of a transfer of personal data, GEELY CARS shall ensure one of the following appropriate safeguards:

• the European Commission has adopted a decision on the adequacy of the level of data protection for a third country, its territory or sector,
• approved binding corporate rules;
• standard contractual clauses adopted or approved by the European Commission;
• an approved code of conduct and an obligation to respect the rights of individuals to whom personal data relates.

If a transfer to third countries takes place, users will be informed in a timely manner about such transfer (who the recipient is and where) and about what personal data is transferred and for what purpose.

7. RETENTION PERIOD

We will keep your personal data in accordance with the applicable legislation governing the protection of personal data. We will only keep them for as long as it is necessary for the purpose for which we process them or as long as it is in accordance with the law. When the processing of your personal data is no longer necessary or you have deleted your account, we will effectively and permanently delete or anonymize your personal data, so that it will no longer be possible to link it to the user. Personal data that we process on the basis of your explicit consent is kept until your withdrawal. Personal data that we process on the basis of a contractual relationship with you are stored for the duration of the contractual relationship and for another 5 years after the termination of the contractual relationship (which is the general limitation period).

8. YOUR RIGHTS

If you have given your consent to the processing of your personal data, you can withdraw your consent by a written statement, i.e. by sending us a message to the e-mail address GeelyDataAct@dataprivacyhub.com or directly in writing as a record to the headquarters addressed above, or in any other way. The withdrawal of consent to the processing of personal data may result in a way that after the withdrawal of consent to the processing of personal data, GEELY CARS may no longer be able to offer you some or more of its services, which cannot be offered without consent and consequently, your personal data.

Your fundamental rights include:

1. Right to access your personal data (Article 15 of the GDPR): you have the right to request confirmation from us as to whether we are processing your personal data and, if we are processing it, you may request from us access to the personal data and access information, which includes, among other things, the purpose of the processing, the types of relevant personal data, the users or categories of users to whom we are or will disclose your personal data. Notwithstanding the above, this is not your absolute right and the interests of other users may limit your right to access the data. You have the right to obtain a copy of the personal data that is the subject of the processing. For any further copies you require, we may charge you a reasonable fee for the administrative costs incurred;
2. Right to rectification of your personal data: if you find any error in your personal data or if it seems incomplete or incorrect to you, you have the right to ask us to correct the inaccurate personal data. Depending on the purpose of the processing, you have the right to have incomplete personal data completed, including the submission of a supplementary statement;
3. Right to delete your personal data: if you no longer want us to keep your personal data, i.e. there is no longer a purpose for which we collected them or the deadline for storing such personal data has expired, you have the right to request us to delete your personal data under certain conditions, and the Controller is obliged to delete personal data without undue delay in deletion.
4. Right to restriction of processing of your personal data: under certain conditions, you have the right to request that we restrict the processing of your personal data. In this case, the relevant personal data will be marked and the controller may process them exclusively for the defined purposes.
5. Right to portability of personal data: under certain conditions, you have the right to receive the personal data you have provided to us, in a structured, generally usable and machine-readable form, and you have the right to transfer this data to another controller without our interference.
6. Right to object: under certain conditions, you have the right, on the basis of reasons related to your particular situation or when your data is processed for direct marketing purposes, to object to the processing of personal data at any time. In this case, the controller is obliged to stop processing your personal data.

In accordance with the legislation governing the protection of personal data, you have the right to lodge a complaint with the competent data protection authority if you believe that the processing of your personal data does not comply with the GDPR or other applicable legislation.

For exercising your rights arising from GDPR, you can alternatively contact our Data Protection Officer from the given channels below:

Dr. Karsten Kinast, LL.M, KINAST Rechtsanwaltsgesellschaft GmbH, Hohenzollernring 54, 50672 Cologne, Germany

E-Mail: dpo-ltic@kinast.eu

9. PROTECTION OF YOUR PERSONAL DATA

GEELY CARS uses technical and organizational security measures to protect your personal data from unlawful or unauthorized access or use, also from unintentional loss or loss of its integrity. All measures are designed with respect to your own IT infrastructure, possible impact on your privacy and costs, and are in line with current industry standards and practices. Contracted processors will only process your data if they comply with these technical and organizational security measures.

10. VALIDITY AND CHANGES TO THE POLICY FOR THE PROTECTION AND PROCESSING OF PERSONAL DATA

This Policy applies to all users who use the Platform and provide personal data to the controller for management and further processing.

The Policy requires the controller, processors, and users to follow rules when transferring, managing, and handling personal data, and to respect the user's rights as well as the responsibilities of the controller and processors. This Policy is an integral part of any processing of personal data, in accordance with predefined purposes, bases of processing, consent of the user and types of personal data that are subject to further processing.

The User is informed about this Policy in advance, as it is available on the Platform and in all forms and processes where the User may provide personal data for processing. In the event of legal changes, the introduction of new technologies or the offer of additional services, there may also be a need to amend and amend/update the Policy in question, therefore GEELY CARS reserves the right to amend/supplement the Policy at any time. Any amendments to this Policy will be published on the Platform or you will be notified of the change in another appropriate manner.

The Policy is effective from September 12^th, 2025.