PRIVACY DISCLAIMER

Why we collect and process your Data and legal basis

Your Data is used for the following purposes:

a) Facilitate the collection and correction of your Data
To the extent permitted by applicable data protection law, we use your Data, in particular that provided by you to Our Network, to update the information we have about you as the owner of one of our Vehicles or as a person interested in brands Stellantis. This purpose also includes sharing with Our Network and Vehicle Manufacturers to ensure that your Personal Data is correct and up to date. This processing is based on the legitimate interest of Stellantis Europe, Our Network and Vehicle Manufacturers in keeping the quality of Personal Data relating to owners and customers up to date.

b) Provide our Services and related support
We use your Data to offer you our Services, including booking test drives on Our Website and Application; to organize Our Events in which you participate; to respond to your requests/suggestions/reports.
This processing is based on the execution of a contractual obligation or pre-contractual measures taken at your request.

c) Sending promotional communications
We may use your Contact Data (email, telephone, SMS, postal address and/or any other available means) to send promotional communications or for market research and consumer surveys which include marketing content. These communications concern all current and future brands of Stellantis Europe (e.g. Fiat, Fiat Professional, Alfa Romeo, Lancia, Abarth, Peugeot, Citroên, DS automobiles, Opel, Jeep, Mopar, Vauxhall) as well as the brands of the group companies Stellantis, such as Stellantis Financial Services SA, Stellantis Financial Services Italia SpA, Stellantis Renting SpA, Stellantis Insurance Limited, Stellantis Life Insurance Limited, Stellantis Insurance Europe Limited and Stellantis Life Insurance Europe Limited.
In some cases, communications may include promotions of products or services of selected Partners. When we send these types of communications, we may act as Joint Controller with the Partner in question. Prior to sending any communication to you, specific agreements and information will be made with such Partners. In this regard, we specify that no communication will be sent to you without your prior consent, which you can provide via appropriate tick boxes .

d) Detect anomalies and improve our Services
We use Data provided by you, Data collected by your Browser, Device and Application, Data derived from your activities and Aggregate Information to avoid anomalies in our Services. For example, we may detect anomalies when you open a section of Our Website and Application, access a link, or when there is a bug in our system.
The processing is based on our need to guarantee the best Services and on our legitimate interest in avoiding any interruptions to the service.

e) Exclude the user from irrelevant promotional communications.
We process your Data to exclude you from promotional communications, in the event that such communications are not consistent with your profile (for example, if you reside in Italy, we will not share promotions related to France, etc.)
This processing is based on our legitimate interest in reducing or using our marketing budget effectively and on your legitimate interest in not receiving irrelevant communications.

f) Analyze user preferences and behaviors in order to personalize our Services and our communications, including Content that may be useful to the User.
We use your Data, in particular Data derived from your activities, Vehicle Data , your Location Information (if shared with us), and Data collected from your Browser, Device and Application, to improve our Services (for example, Our Website and Application, Our Events, promotional communications ) and to show you Content that may be useful to you, including on social media platforms or through Programmatic Advertising platforms, only to the extent that you have authorized us to upload it to these platforms.
The Services and/or communications and/or Content that may be useful to the User are based on your behavior, interests, needs, preferences and profile; these purposes can also be achieved on the basis of Personal Data collected through the use of Cookies or Other Tracking Technologies to analyze and predict customer preferences and provide tailor-made offers.
Content that may be useful to the User:
- are not created using Sensitive Data, such as that which may derive from information about your location;
- may also be visible on websites and mobile applications other than ours once uploaded to Programmatic Advertising platforms only to the extent that you have authorized us to upload them to such platforms.
This processing is based on your prior consent.
When we target you on social media platforms or through Programmatic Advertising platforms, we may act as Joint Controller with the relevant platform provider. Before any communication is sent to you, specific agreements and information will be made with the platform provider.
If you do not want Services or Content that may be useful to you, you can change your preferences, as explained in the "How to control your data and manage your choices" section below.

g) Analyze and improve our Services and create new Services and features
We use your Data and Aggregated Information to measure the performance of our Services or to create new ones. This can be done, for example, through the analysis of your interactions with Our Network, Our Events, our newsletter and/or our promotional communications (if requested).
As far as possible, we use anonymized or pseudonymized Data for these purposes. Only in exceptional cases may a personal reference be possible. In these cases, the following applies: with the exception of your consent to customize our Services, measuring the effectiveness of our Services and creating new Services are based on our legitimate interest in creating and maintaining Services that are truly useful to us users.

h) Share Data with Partners for their marketing purposes
We share your Contact Data with selected Third Party Partners for their independent marketing purposes. Partners will only contact you by automated means (e.g., email, SMS, tape recorder phone calls) and will be obliged to provide their Privacy Policy.
This processing is based on your prior consent. The complete list or categories of Partners with whom we have directly shared your Data can be found at: https://privacyportal.stellantis.com .

i) Comply with legal and tax obligations
We may use your Data to comply with legal obligations and orders to which we are subject, which constitute the legal basis for the processing of your Data.
Some legislation may require us to share your Data with public authorities (for example, recall campaigns). If this sharing is not required by law in your country, we may still send your Data, as explained in more detail in the "Protection of our interests and your interests" section below.

j) Sending corporate and institutional communications
To the extent permitted by Data Protection Law, we share your Contact Data to send corporate surveys and institutional communications regarding the entire Stellantis Group. These are non-promotional communications sent by us on behalf of or in lieu of Vehicle Manufacturers, based on our legitimate interest in providing consistent information to you.

k) Protection of our interests and your interests
To the extent permitted by applicable Data protection law, we may need to use your Data to detect, prevent and respond to fraudulent and illegal behavior or activities that may compromise the security of our Services and Our Website and Application. This may occur when you use our Application in ways other than those permitted, in order to verify the so-called Indirect Collection, or in case of inappropriate behavior at Our Events. These purposes also include audits and evaluations of our business operations, security controls, financial controls, records and information management program, and otherwise relating to the administration of our general business, accounting, of registers and legal functions. These purposes are based on our legitimate interest in safeguarding our interests and protecting our customers, including you.

6. How we may disclose your Data
We may disclose your Data to the following recipients and/or categories of recipients (" Recipients "):  

- Person authorized by us to carry out any of the Data-related activities described in this document: our employees and collaborators who have assumed an obligation of confidentiality and abide by specific rules for the processing of your Data;  

- Our Data Processors : external parties to whom we delegate some processing activities. For example, security system providers, accounting and other consultants, data hosting providers, banks, insurance companies, etc. We have entered into agreements with each of our Data Controllers to ensure that your Data is processed with adequate safeguards and only according to our instructions;  

- System administrators : our employees or those of the Data Controllers to whom we have delegated the management of our IT systems and who are therefore able to access, modify, suspend or limit the processing of your Data. These subjects have been selected, adequately trained and their activities are tracked by systems that they cannot modify, as required by the provisions of our competent Supervisory Authority;  

- Our Network and the relevant Vehicle Manufacturers : Our Network in the event that you have requested a service performed by them (for example, requesting a test drive near you) or if you have requested their assistance or that provided by Vehicle Manufacturers;  

- Our selected Partners : when you have consented to the communication of your Personal Data for their marketing and/or profiling purposes and who act as independent Data Controllers.  

- Police authorities or any other authority whose provisions are binding on us : this is where we have to comply with a judicial order or the law or defend ourselves in legal proceedings.

7. Where your Data is located

We are a global company and our services are available in many jurisdictions around the world. This means that your Data may be stored, accessed, used, processed and disclosed outside of your jurisdiction, including within the European Union, the United States of America or any other country in which our Processors and our sub-processors, or where their servers or cloud computing infrastructure may be hosted. We take steps to ensure that our recipients' processing of your Data complies with applicable data protection laws, including EU legislation to which we are subject. Where required by EU data protection law, transfers of your Data to recipients outside the EU will be subject to appropriate safeguards (such as the EU Standard Contractual Clauses for data transfers between EU countries and third countries), and/or other legal bases in accordance with EU legislation. For further information on the safeguards we have implemented to protect Data transferred to third countries outside the EU, you can write to us at: dataprotectionofficer@stellantis.com

8. How long we keep your Data

The Data processed for the purposes indicated above will be kept for the period deemed strictly necessary for the fulfillment of such purposes. However, the Data may be retained for a longer period in case of potential and/or actual complaints and consequent liabilities and/or in case of other mandatory legal retention requirements and/or retention obligations. • Customer data processed for marketing and profiling purposes will be retained by the Data Controller from the moment the customer provides consent until the moment the customer withdraws consent. Once consent has been revoked, the Data will no longer be processed for marketing and profiling purposes, although they may be retained by the Data Controller to manage potential complaints and/or legal actions. The storage of Data in case of marketing and profiling complies with local law and the decisions of the Data Protection Authority. • Customer data processed to comply with legal obligations will be retained for the period required by laws and regulations. • Customer Data for the improvement of the product and Services may be retained for the period deemed strictly necessary to fulfill these purposes and no longer than three years. Once the relevant retention period has expired, your Data will be deleted according to our retention policy. You can request further information on our criteria and our retention policy by writing to us here: dataprotectionofficer@stellantis.com

9. How to control your Data and manage your choices

At any time, you can ask to: - Access your Data (right of access) : based on your use of our Services, we will provide you with your Data, such as your name, age, IP Address, Unique Identifiers, emails and the preferences expressed, together with the Privacy Policy you received when you provided it and the source of the Data (if, for example, it was provided to us by one of our Partners); - Exercise the right to portability of your Personal Data (right to Data portability) : based on your use of our Services, we will provide you with an interoperable file containing the Data concerning you. - Correct your Data (right to rectification) : for example, you can ask us to change your email address or telephone number if they are incorrect; - Restrict the processing of your Data (right to limit processing) : for example, when you believe that the processing of your Data is unlawful or that processing based on our legitimate interest is not appropriate; - Delete your Data (right to cancellation) : for example, when you do not want to use our Services and do not want your Data to be retained; - Object to processing activities (right to object); - Revoke your consent (right to withdraw consent). You can exercise the above rights or express any concerns or complaints about our use of your Data directly at: https://privacyportal.stellantis.com . At any time, you can also: - contact our Data Protection Officer (DPO), here: dataprotectionofficer@stellantis.com - contact the Guarantor Authority, here you can find the list of all Guarantor Authorities by country: https://edpb.europa.eu/about-edpb/board/members_en.

10. How we protect your Data

We take reasonable physical, technological and organizational precautions to prevent the loss, misuse or modification of the Data under our control. For example: - We ensure that your Data is only accessed and used by, transferred or disclosed to Recipients who must have access to such Data. - We also limit the amount of Data accessed, transferred or disclosed to Recipients only to what is necessary to fulfill the specific purposes or tasks performed by the Recipient. - The computers and servers where your Data is stored are kept in a secure environment, are password controlled with limited access, and have industry standard firewalls and antivirus software installed. - Paper copies of documents containing your Data (if any) are also stored in a secure environment. - We destroy paper copies of documents containing your Data that are no longer needed. - When we destroy Data recorded and stored in the form of electronic files that are no longer needed, we ensure that a technical method (for example, a low-level format) guarantees that the records cannot be reproduced. - Laptops, USB sticks, cell phones and other wireless electronic devices used by our employees who have access to your Data are protected. We encourage employees not to store your Data on such devices unless it is reasonably necessary to carry out a specific task as set out in this Privacy Policy. - We train our employees to comply with this Privacy Policy and conduct monitoring activities to ensure continued compliance and to determine the effectiveness of our privacy management practices. - Any Data Controller we use is contractually required to maintain and protect your Data using measures substantially similar to those set out in this Privacy Policy or required by applicable data protection law. In the cases provided for by applicable law, if a breach of security occurs resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to Data transmitted, stored or otherwise processed, the you and the relevant Data Protection Authority, as required (for example, unless the Data is incomprehensible to any person or the breach is unlikely to result in a risk to your rights and freedoms and others).

11. What this Privacy Policy does not cover

This Privacy Policy explains and covers the processing we carry out as Data Controller within our website and our Application. This Privacy Policy does not cover processing carried out by parties other than us. In these cases, we are not responsible for any processing of your Data that is not covered by this Privacy Policy.

12. Use of Data for other purposes

If we process your Data differently or for purposes other than those set out in this document, you will receive specific notice before such processing begins.

13. Changes to the Privacy Policy

We reserve the right to adapt and/or modify this Privacy Policy at any time. We will inform you of any relevant adaptations/changes.

14. License

The icons illustrated in this Privacy Policy are "Data Protection Icons" from Maastricht University, European Center on Privacy and Cybersecurity (ECPC) CC BY 4.0.

15. Definitions

Other Tracking Technologies: pixel tags (trackers used with Cookies and embedded in the images of web pages or the Application to track certain activities, such as the display of Content that may be useful to the User or to verify whether an email has been read) or unique identifiers embedded in links to commercial communications that send us information when clicked. Application: indicates this Application, if applicable. Browser: Refers to programs used to access the Internet (e.g. Safari, Chrome, Firefox, etc.). Combination and/or Cross-referencing: this is the set of fully automated and non-automated operations that we combine with your Location Information, Data derived from your activity, Data collected from your Browser, Device and Application, Data from provided to you and those collected from our Partners' Websites and Applications, used to provide the Services, analyze and improve our Services and create new services and features, as well as to offer Content that may be useful to you. We may also combine and/or cross-reference information from different sources, such as information collected from Our Website and Application, our Partners' websites and applications, and/or Data collected from public or publicly accessible sources. Content that may be useful to you: For example, if you search for the "Fiat" model, we may display other content related to this model on our Website and Application or through Programmatic Advertising. The personalization of contents can occur through the combination and/or cross-referencing of data. Cookies: this is a small text sent to your browser from our sites or our partners or resellers. It allows the site to store information such as the fact that you visited the site, your language and other information. Cookies are used for different purposes, for example to record user preferences regarding the use of Cookies (Technical Cookies), to analyze and improve our Services and to create new Services and features or to personalize our Services, including Content that may be useful to the User. The information transmitted by Cookies is subject to Combination and/or Cross-referencing with one of the Other Tracking Technologies, where applicable. Vehicle Manufacturers: individually or collectively refers to the following entities acting as vehicle manufacturers: Stellantis Europe SpA, Corso Agnelli 200, 10135 - Turin, Italy; PSA Automobiles SA (Stellantis Auto SAS), 2-10 Boulevard de l'Europe, F-78300 Poissy, France; Opel Automobile GmbH, Bahnhofsplatz, D-65423 Rüsselsheim am Main, Germany. Vehicle Data: means all technical, diagnostic and real data that can be collected via the Vehicle Device installed on the Vehicle (for example, position, speed and distances, engine running time and shutdown time; if the battery cable is cut, battery diagnostics, movements with the key removed, suspected collision, as well as diagnostic data such as, but not limited to, oil and fuel levels, tire pressure and engine status). Personal Data: any information relating to an identified or identifiable natural person, directly or indirectly, as well as any information linked or reasonably linkable to a particular individual or household. For example, an email address (if it refers to one or more aspects of an individual), IP Addresses and Unique Identifiers are considered Personal Data. For convenience, we will collectively refer to all Personal Data as “ Data ”. Sensitive Data: means Personal Data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and the processing of genetic data, biometric data intended to uniquely identify a natural person, data relating to health or data relating to the sexual life or sexual orientation of a natural person. Device: refers to the electronic Device (e.g. iPhone) through which you visit Our Website and Application and/or the Websites and applications of our Partners. Unique Identifiers: information that can uniquely identify you across your Browser, Device and/or Application. In the Browser, the IP Address and Cookies are considered Unique Identifiers. On your Device, manufacturer-provided advertising identifiers, such as Apple's IDFA and Android's AAIG, that we use to analyze and improve our Services and to create new Services and features, including Content that may be useful to you , are considered Unique Identifiers. Please note that for these purposes and in line with the advice of European supervisory authorities, we do not use other unique identifiers such as MAC addresses and IMEIs as they are not resettable by the user. For the Application, however, the Unique Identifiers are considered the code that identifies the installed Application. IP Address: is a unique number used by the Browser, Device and Application to connect to the Internet. Your Internet Service Provider provides this number which helps identify the provider and/or the approximate area where you are located. Without this Data, you cannot connect to the Internet and use our Services or Content that may be useful to you. Aggregate Information: refers to statistical information about the user that does not contain your Personal Data. We use this information to analyze and improve Our Services and create new Services and features and to create statistical reports for our Partners and Our Network. For example, we may collect information about your location or content that may be useful to you and that you have displayed. We would like to point out that we do not share your Data in these reports. Our Events: are events/showrooms organized by Stellantis or in collaboration with other brands with which Stellantis Europe has signed partnership agreements. Our Website: includes this Website and the pages of our social networks where this Privacy Policy is present. Our Network: these are resellers and/or dealers and/or workshops with which Stellantis Europe and the Vehicle Manufacturers have signed commercial agreements for the sale of Vehicles and/or for the provision of assistance services/products. Partner: indicates third-party entities that can communicate your Personal Data to us only after having contractually assured us that they have obtained your consent or have another legal basis that legitimizes their communication/sharing of such Data with us (for example, if you ask one of our Partners to book a test drive, when you purchase and when you request to receive commercial communications). This definition also includes selected Partners with whom we may share your Data. Partners may belong to the following product sectors: manufacturing activities, wholesale and retail trade, financial, banking, transport and warehousing services, information and communication services , professional, scientific and technical activities, travel agencies, business support services, artistic, sporting, entertainment and entertainment activities, activities of associative organisations, physical well-being center services, electricity and gas suppliers, rental companies , electric mobility and insurance. Programmatic Advertising: these are platforms that share information collected about the user, such as the IP Address and Data collected by Cookies and other Tracking Technologies, with entities that have an interest in showing Content that may be useful to the User. In our case, if you display the "Jeep" model on our Website and Application, we will ask Programmatic Advertising participants to grant us advertising space on one of the Websites you visit in order to display Content that may be useful to you . In this regard, we would like to reiterate that the communication of your Data to participants in Programmatic Advertising is based on your prior and specific consent provided on the banner at the time of your first visit to Our Website and Application. Indirect Collection: is one of the Services we provide on our Partners' websites and applications. In these cases, it is the Partner who assures us that it has received your consent or has another legal basis that legitimizes the communication/sharing of your Personal Data. In this regard, we specify that, before being used, we verify the ways in which the Partners collect and transfer the Data to us in order to respect your preferences. Processor: refers to an entity appointed by us to process your Personal Data exclusively on behalf of Stellantis Europe SpA and according to your written instructions. Device Sensors: depending on the Device, these are sensors such as accelerometers, gyroscopes, Bluetooth, Wi-fi and GPS which, in one way or another, share the information collected through the Device and therefore the Application. If enabled by your Device settings, they allow us to obtain information about your location. Services: Collectively, we mean all Services available on Our Website and Application, such as "set up and order", "find Dealers", "buy or rent", test drive reservations, institutional newsletter, customer service and Our Events. Data Controller: refers to the legal person, public authority, service or other entity that, individually or jointly, determines the purposes and means for the processing of your Personal Data. This definition typically refers to Stellantis Europe SpA In other cases, it is preceded by the word "Independent" (for example, "Independent Data Controller") to indicate that your Personal Data is processed by a party other than Stellantis Europe SpA Vehicle: refers to a Vehicle of one of the brands of the Stellantis group.