Information about data processing

ALD Automotive AG (‘ALD’) and the customer concluded a leasing contract. Due to this contract ALD Automotive as the responsible entity is processing the customer's personal data about which the customer is hereby being informed.

Who is responsible for data processing and who can I contact? ALD Automotive AG Thurgauerstrasse 54, Postfach, 8050 Zurich www.ayvens.ch

datenschutz.ch@ayvens.com

Which sources and data are used? Over the course of the application and during the contract period, ALD will process personal data provided by the customer. Personal data from publicly accessible sources (e.g. land register, commercial register, register of associations) will also be processed where necessary. Relevant personal data is:

To whom is what data forwarded and for what purposes?

To whom? ALD S.A., France What data? Name, address, date of birth, company's legal form, contract number, leasing vehicle, contract term, shareholders, jointly liable persons Purpose? Internal administrative purposes (reporting, controlling, contract management

To whom? ALD Automotive Fuhrparkmanagement und Leasing GmbH, Österreich What data? Name, address, date of birth, company's legal form, contract number, leasing vehicle, contract term, shareholders, jointly liable persons, driver names and contact details (if known), maintenance information and intervals, licence plate number, mileage, data about loss events, vehicle location, financial reports, Information on the power of representation and on the controlling or beneficial owners Purpose? Contracting and administration, especially bookkeeping and accounting, vehicle order and delivery, damage management, know-your-customer check, credit check, general contract management

To whom? Workshops commissioned by the customer as well as motor vehicle experts and insurance companies What data? Name, business address, contract number, leasing vehicle, maintenance information and intervals, licence plate number, mileage, data about loss events, vehicle location Purpose? Service and damage processing, preparation of expert opinions within the course of contract termination

To whom? Mineral oil companies visited by the customer (if fuel card service is selected) What data? Name, business address, leasing licence plate number, contract number Purpose? Billing and administration of any services use

To whom? AXA Versicherungen AG, General-Guisan-Strasse 40, 8401 Winterthur, (as per contract, only when using the insurance service is used) What data? Name, business address, leasing vehicle, leasing licence plate number, contract number, contract term, insurance product, payment, rate Purpose? Billing and administration of the service use

To whom? Societe Generale S.A., France What data? Master company data, address data and financial reports Purpose? Creditworthiness appraisal

To whom? Quadient Germany GmbH & Co. KG What data? Master company data and address data, invoice data, contract term Purpose? Electronic invoicing

To whom? Mobility service partners (if services have been selected) What data? Name, business address, leasing vehicle, licence plate number, contract number, location of the leasing vehicle, driver's contact details Purpose? Fulfilment of mobility-service and road-assistance services

To whom? The New Motion B.V., The Netherlands What data? Name, address, e-mail address and phone number of the driver Purpose? Fulfilment of services related to charging stations for hybrid and electric vehicles

To whom? ALD S.A., France What data? Name, company, company address and e-mail address Purpose? Sending surveys to improve service quality and querying customer and driver satisfaction

To whom? Respective cooperation partners What data? Name, customer number of leased vehicle, vehicle registration number, contract number, chassis number, contract term, mileage, leasing instalment, investment amount, credit line, result of risk analysis, driver name. Purpose? Execution of customer orders; internal processing (reporting and controlling, contract processing), risk analysis and customer advice.

To whom? Suppliers What data? Name, customer number of leased vehicle, vehicle registration number, contract number, chassis number, contract term, mileage, leasing rate, result of risk analysis, driver name. Purpose? Execution of customer orders, internal processing (reporting and controlling, contract processing, risk analysis and customer advice).

What is the legal basis for data processing? Data is processed to carry out pre-contractual measures relating to customer requests, to fulfil contracts (Art 6 (1) (b) GDPR) and to meet legal obligations (Art 6 (1) (c.) GDPR), in particular those pursuant to the Finanzmarkt-Geldwäschegesetz (FM-GwG – Financial Market Money Laundering Act) and the Bundesabgabenordnung (BAO – Federal Fiscal Code).

Where necessary, data may be processed within the context of weighing up interests in favour of ALD or a third party beyond the actual fulfilment of the contract to safeguard ALD's or a third party's legitimate interests (Art 6 (1) (f) GDPR). Data will be processed to protect such legitimate interests in the following cases:

How long is data stored for?

The data is stored for as long as it is necessary to retain it in order to fulfil contractual and legal obligations. The data will only be stored following termination of the business relationship as long as such retention is required on the basis of statutory retention periods and to defend against or to enforce legal claims. If mutual claims between ALD, the customer or third parties involved cannot be excluded, the data will not be deleted before the expiry of the period specified in the statute of limitations.

Is the disclosure of customer data based on a legal or contractual obligation and what are the consequences of failure to provide it? In response to customer requests, objects (vehicles) owned by ALD may be entrusted to customers on the basis of leasing contracts. The data mentioned in this information is required for the purposes of assessing customer inquiries and establishing business relationships to the extent that it would not be possible to conclude legal transactions if it were not provided.

Are decisions made automatically? No.

Information about customer rights Where their personal data is concerned customers are entitled to information, correction, erasure, objection and the transfer of data as well as the right to restrict data processing in accordance with Art. 12 ff GDPR and §§ 8 Datenschutzgesetz (DSG – Data Protection Act).The customer is also entitled to lodge complaints with the Swiss Data Protection Authority (Datenschutz- und Öffentlichkeitsbeauftragten), Feldeggweg 1,CH - 3003 Bern.

Adaptation and updating of information for data processing ALD will adapt the information about data processing to improvements and developments in data protection and consequently update it. The most recent information relating to the processing of data is available at www.ayvens.ch.