Information about Ayvens.

Axus Luxembourg SA, a public limited liability company with its registered offices located at Route d’Arlon 270, L-8010 Strassen, Luxembourg, registered with the Registry of Commerce and Companies of the Grand Duchy of Luxembourg under number B23299, acting under the tradename of Ayvens (hereinafter referred to as “Ayvens”, “we” or “us”) is a mobility solutions provider mainly active in full service leasing and fleet management services. Ayvens is a member of the Ayvens Group which is a subsidiary of the Société Générale Group.

As part of its activities and services, Ayvens processes, amongst others, personal data of its clients and of employees of its clients (drivers). With respect to such processing activities, Ayvens qualifies as “data controller” and is responsible for the protection of your personal data. In this capacity, Ayvens strives to be compliant with applicable data protection legislation, such as, as of 25 May 2018, the European General Data Protection Regulation 2016/679 (the “Regulation” or “GDPR”) and any applicable national laws implementing the EU Directive 95/46 on the processing of personal data or further completing the GDPR.

Your privacy is important to us. ​

Ayvens aspires to be a trusted partner and, for this reason, strives to respect and protect your personal data or the personal data of your employees.

This Data Privacy Policy aims to explain how we collect, store, use and disclose your personal data whenever you use our products and services, our websites or otherwise interact with us. This Data Privacy Policy also outlines your rights and explains how you can exercise these rights.

Please read this Data Privacy Policy carefully, so that our processing of your personal data is as transparent as possible.

Please also ensure that your employees are adequately being informed of the processing of their personal data by Ayvens, and that where necessary their consent with the data processing as described in this Data Privacy Policy is being obtained.

The following principles are central to how we process your personal data. ​

• •
  Transparency and fairness: When we collect and process your personal data, we inform you as to who collects and receives these data, and the reasons for this. ​

• •
  Legitimacy: Ayvens does not collect or process personal data without a legitimate basis. When required by law, we always seek your prior consent (e.g., to the extent required, before sending any direct marketing material). ​

• •
  Finality: We use your personal data only for appropriate business purposes (e.g. to provide services, to manage relationships with clients, to manage client vehicle fleets, to perform accurate invoicing, for marketing activities, to better serve clients, to conduct satisfaction surveys, to draft reports and comply with our legal obligations). We never use your personal data for purposes that are incompatible with the purposes outlined in this Data Privacy Policy or communicated to you elsewhere. ​

• •
  Minimization and proportionality: We only collect the personal data that are necessary for data processing, as set out in this Data Privacy Policy. We collect sensitive information only where relevant. We take all reasonable measures to ensure that your personal data is accurate, complete and up to date. We provide your data to service partners and providers only to the extent necessary for providing our services or to comply with legal obligations.

These principles are further detailed in several sections below.

This Policy applies to all sourcesof data collected and processed by Axus Luxembourg in the context of its various business activities such as corporate vehicle leasing, private car lease, fleet management, mobility solutions (bike lease, etc.), vehicles sales, use of our websites, etc.

We may collect and process your personal data if you are among the following categories:

• •
  Clients (corporate or private);

• •
  Client’s employees or other persons authorized by the clients to benefit from a contract between the client and Axus Luxembourg (i.e. the vehicle drivers);

• •
  Contact persons of clients;

• •
  Fleet managers;

• •
  Prospects;

• •
  Purchasers of second-hand vehicles;

• •
  Guarantors;

• •
  Website visitors/users;

• •
  Company administrators;

• •
  Shareholders;

• •
  Etc.

Ayvens may collect your personal data in a variety of ways:

• •
  We collect your personal data from you directly when we interact with you (e.g. when you contact Ayvens, Ayvens may keep a record of that correspondence), when you fill out an online form (request form, order form, accident statement form, etc.), when you create an account on one of our sites, etc. ​

• •
  We may ask you to complete surveys used for research or improvement purposes, although you do not have to respond to them. ​

• •
  We may record details of your visits to our websites including, but not limited to, traffic data, location data, weblogs and other communication data and the resources that you access. ​

• •
  We may also collect information about your computer or device, such as the IP address, operating system or browser type. This information is collected for the proper administration and functioning of our websites. Cookies are used to collect this information. ​

• •
  We may also receive personal data from your employer with whom Ayvens has concluded an agreement (contact information, vehicle category, etc.). ​

• •
  We may receive personal data about you indirectly** from our suppliers**, delivering services in the performance of any contract (e.g. fuel cards provider, etc.). ​

• •
  We may receive your personal data** from authorities** (e.g. fines).

We collect the following types of personal data:

• •
  Identification and contact information, such as your name, last name, address, telephone/mobile number or email address;

• •
  Professional information, such as your job title, department or professional contact details;

• •
  Financial or credit information, such as your Credit Acceptance Date or contract information, your bank account, your loans, etc.;

• •
  Personal characteristics, such as your gender, date of birth, nationality, language(s), family status, etc.;

• •
  Your voice, when you call Ayvens Client services, during which your call may be recorded;

• •
  Driver data, such as the number/copy of the driver's license, or the employee code driver;

• •
  Vehicle operations and usage data, such as information about the vehicle (e.g. the vehicle registration plate, the last maintenance check of the vehicle, etc.) and its usage (e.g. the fuel consumption);

• •

  Driver behavior data, such as the taxes related to the use of the vehicle (parking tickets,...), the claims

  history.

We sometimes also collect sensitive data. For this data, we refer to section 12.

In order to provide you with a better experience, when you visit our websites, we collect certain information by automated means, using technologies such as cookies, pixel tags, browser analysis tools, server logs and web beacons (e.g. Google Analytics).

If you use our web sites, we may collect information about the browser you are using, and your browsing behavior.

Ayvens processes your personal data for the following purposes, as may be applicable, and any other purposes that may be compatible therewith:

• •
  To perform client screening, credit checks and "Know Your Client"-procedures: processing and performing client ratings prior to entering into a contract or prior to the sale of a second-hand vehicle. ​

• •
  To comply with legal obligations and to protect the interests and assets of Ayvens: we will use personal data to answer to legitimate queries from the supervisory authorities and from tax authorities, to detect and prevent money laundering, to conduct counterparty due diligence, etc.

• •
  To create and administer the client accounts. ​

• •
  To communicate with you: you can contact us by various means (via our website, via telephone, via email, ...) in order to ask questions, request information, give your comments, etc. We will use your personal data to communicate with you or to answer your questions. ​

• •

  To provide you with vehicle and mobility services included in the contract:

• •

  Ordering of the vehicle,

• •

  Delivery of the vehicle,

• •

  Repair, maintenance and tires,

• •

  Insurance of the vehicle,

• •

  Accident management and repair,

• •

  Fuel cards management,

• •

  Roadside assistance,

• •

  Replacement car,

• •

  Management of the vehicle return (collection of the vehicle, ...).

• •
  To provide managers with fleet management tools. ​

• •
  For the use of web portals. ​

• •
  To perform fleet reporting to clients related to the vehicles usage (fuel consumptions, claims anddamages history,…). ​

• •
  For invoicing and accounting (invoicing, payments collection, etc.). ​

• •
  To manage disputes (collection of unpaid amounts, lawyer files, ...) ​

• •
  To manage traffic and parking fines, taxes and administrative sanctions, as well as all offences related to the use of the vehicle. ​

• •
  To report to clients on satisfaction** surveys results**. ​

• •
  For management reporting, such as audits, internal control, data analysis. ​

• •
  To maintain business records for legal, administrative and audit purposes. We also use information to meet legal, insurance and processing requirements. ​

• •
  For access and security-management of the Ayvens premises and assets. ​

• •
  For vehicle sale. ​

• •
  For marketing purposes: we may use your information to contact you about new offers or services and special offers we think you will find valuable, or to send you marketing communications or newsletters; we may analyze your client profile and preferences, and perform multichannel marketing campaigns via automated tools, contact you via SMS, email, or send you brochures. ​

• •
  For client/driver satisfaction surveys based on targeted marketing tools and analysis, we may send you qualitative surveys for our products and services. ​

• •
  We may also invite you to participate in marketing events, games, or quizzes, through our websites. ​

• •
  For Websites, Cookies & Newsletters: we may collect information through cookies to provide us with an enhanced experience and improve your browsing experience notably to store your preferences and parameters to save you time (such as languages preferences), enable log in, fight against fraud, and analyze the performance of our website and services.

This information helps us enhance our web sites and better understand the products and services you would prefer. We also use cookies for** web analytics** to measure the web sites activity and determine the areas of the web sites which are the most visited.

While we may install** functional cookies** to facilitate your visit to our web sites, you can express your preferences regarding cookies used for behavioral targeting advertising through the privacy settings options of your browser, which should include features to prevent information from being stored on the terminal or the processing of information already stored on such terminal, unless you turn on the feature to allow such storage or processing.

For more information, please consult our Cookie Policy available on our websites.

• •
  For profiling: to improve our understanding of your interests and concerns, we may use your personal data to improve our website and services, to customize your experience with us and to tailor our marketing activities to fit your needs and interests.

Ayvens processes your personal data based on the following legitimate grounds, as the case may be:

• •
  The performance or preparation of the agreement you have with Ayvens;

• •
  Your prior and informed consent, where required;

• •
  The compliance with our legal obligations, such as under the anti-money-laundering legislation, the provisions of the Law of 25 July 2015 creating the automated control and sanction system, etc.;

• •
  The legitimate interests of Ayvens or a third party, in so far as these interests override your interests and fundamental rights and freedoms, such as, as the case may be, to detect and prevent money laundering, to conduct counterparty due diligence, to provide you with useful information, etc..

To provide our services, we occasionally need to use partners or processors for the purposes described above. We limit our sharing of your personal data to the following categories of recipients:

• •
  With internal business departments such as sales, client care/quality department, marketing, IT services, support and maintenance. ​

• •
  Within the Ayvens group, with other entities. ​

• •
  With our partner, via the sales network of which you have received a leasing quote. ​

• •
  With our client (your employer, as the case may be). ​

• •
  With our service providers such as: credit insurer, vehicle insurance company, data hosting service providers, IT providers, marketing partners, call centers, third parties performing fitting, maintenance, mechanical repair, tires changes, assessment, damage repair, road assistance, etc. ​

• •
  With public authorities when required to do so by law, such as in response to a subpoena, including to law enforcement agencies and courts, requests of fiscal authorities,… ​

• •
  Where needed to effect the sale or transfer of business assets, in connection with a bankruptcy proceeding, to enforce our rights, protect our property, or protect the rights, property or safety of others, or as needed support external auditing, compliance and corporate governance functions. ​

We understand that you do not want us to provide your personal data directly to third parties for their own marketing purposes without your consent.

Please note that we may also use and disclose personal data about you that is not personally identifiable i.e. personal data in an aggregate form that no longer identifies you.

Ayvens aims to ensure that your personal data are:

• •
  Protected against accidental or intentional destruction / loss;
• •
  Properly used; and
• •
  Not accessible to unauthorized persons. ​

All information you provide to us is stored on our secure servers. Your personal data are stored either in our databases, or in the database of our service providers.

We may transfer your personal data to the service providers involved in the provision of maintenance and support services (located in countries such as India), or the provision of any other tool used for the processing of our clients or prospects personal data.

When we transfer information outside the European Economic Area, we provide adequate protection for the transfer of personal information to recipients in those countries by entering into data transfer agreements based on the European Commission standards clauses with such data recipients where required.

In general, we retain your personal data for as long as necessary for the purposes described in Section 7 of this Policy, or according to the relevant laws in force.

For example, we retain your personal data only as long as necessary having regard to your business relationship with Ayvens and, if applicable, the termination thereof, or as long as required to comply with Ayvens’s legal obligations.

In case of litigation, we may keep your personal data until the litigation is fully resolved. We will then either delete or archive it according to applicable law.

We may sometimes be required to process data relating to judicial information, such as fines, traffic offences and criminal data relating to claims (police report,…).

We processes your personal data exclusively for the following purposes:

• •
  For the claims management and related disputes: recovery of amounts in respect of claims incurred during the rental period, etc.

If necessary, this data may be transferred to the client (employer), to the insurers and brokers involved in the management of the claim, to the professional experts appointed by us or by them (lawyers, legal experts in charge of the file), to any subcontractors involved in the management of claims, as well as to the authorities and courts.

• •
  For the** management of traffic fines and administrative sanctions, as well as all offences related to the use of the leased vehicle**. ​

Ayvens, as well as its possible subcontractor in charge of managing fines, may be obliged to:

• •
  Process information concerning the traffic fine, the administrative sanctions and the traffic offences related to the use of the vehicle, such as the place of violation, the date and time, the offence, the amount to pay; and

• •
  Transfer personal data to the competent authorities in order to allow identification via fax or email); and, as the case may be,

• •
  Transfer data relating to the fine or the administrative sanction to the client (often the employer of the driver) in order to allow the management and invoicing of the fine or sanction.

We protect your data through technical and organizational security measures against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing.

Where we outsource any data processing, we impose contractual obligations to protect your information.

You may exercise a number of rights with regard to the processing of your personal data vis-à-vis Ayvens, in so far as you effectively have those rights under applicable data protection legislation, such as the GDPR.

To exercise the rights set out in this section at any time, please contact Ayvens’s Data Protection Correspondent (see Section 15) who will handle your request.

Object. You have the right to object at any time to the processing of your personal data based on a legitimate interest of Ayvens, for example when used for (direct) marketing purposes, for profiling to send you targeted advertising, or for sharing your data with third parties or with other entities within the Ayvens Group.

Withdrawal. In cases where you have given your previous consent for your personal data to be processed, you can withdraw that consent at any moment. This does not affect the lawfulness of processing based on consent before its withdrawal.

Access. You can request access to or a copy of your personal data we maintain about you. You may also request information on the purposes of the processing, categories of data, categories of recipients, data retention terms, etc.

Portability. You may have the right to obtain a copy of any personal data that we hold about you in our records in a compatible format to allow you to exercise your right to data portability.

Restriction. You have the right to request a restriction of the processing of your personal data in the following cases:

• •
  for a period enabling Ayvens to verify the accuracy of your personal data in the event you contest the accuracy of your personal data; ​

• •
  if the processing is unlawful and you wish to restrict the use of your personal data rather than deleting it; ​

• •
  if you wish Ayvens to keep your personal data because you need it for your defense in the context of legal claims; ​

• •
  if you have objected to the processing but Ayvens needs to check whether it has legitimate grounds for such processing which may override your own rights. ​

Rectification. You may also have the right to correct inaccurate personal data and to complete incomplete personal data.

Erasure. You may have the right to request the deletion of your personal data in the following cases:

• •
  if your personal data is no longer necessary for the purpose of the data processing; ​

• •
  if you have withdrawn your consent and there is no other legal ground for the processing; ​

• •
  if you have objected to the data processing and there is no overriding legitimate ground for Ayvens; ​

• •
  if the personal data have been unlawfully processed; ​

• •
  if the personal data must be erased to comply with a legal obligation applicable to Ayvens. ​

In case of erasure, we will take reasonable steps to inform other entities of the Ayvens group which might be involved in the data processing of such erasure.

Complaint. You also have the right to** lodge a complaint** with the competent supervisory authority if you have any concern about the conditions of processing of your personal data by Ayvens (Commission Nationale pour la Protection des Données, Avenue du Rock’n Roll 1, L-4361 Esch-sur-Alzette, Luxembourg, www.cnpd.lu).

The Group Société Générale has appointed a** Data Protection Officer** common to the SG entities in Luxembourg, amongst which Ayvens. This Data Protection Officer can be reached via

lu.dpo@axus.lu.

In addition, Ayvens has designated a Data Protection Correspondent within its organization.

The Data Protection Correspondent acts as a primary point of contact for Client’s questions concerning the protection of personal data or for the exercise of his rights.

In that regard, any questions, complaints, or comments about this Data Privacy Policy or our data processing practices should be sent via e-mail to the following e-mail address lu.privacy@axus.lu.

For the avoidance of doubt, this person does not have the capacity of a data protection officer within the meaning of the GDPR.

Ayvens’s Data Protection Officer will then act as an escalation level for any issue regarding an (alleged) non-compliance with the Regulation and/or applicable data protection laws.

Our Data Privacy Policy may change from time to time to reflect changes in the way we are processing your personal data. We encourage you to periodically visit our websites in order to have the latest information on our privacy practices. We will notify you of any material changes as required by law.

You can verify the last revision date of this Data Privacy Policy at the beginning of this document.