1. Introduction

1.1. Application

This policy applies to buyers and potential buyers of Seminovos.

1.2. Expiration

These rules and conditions may be changed or eliminated at any time by the General Management, in which case they will be duly communicated.

2. Objective / Management Rules

The purpose of this Policy is to describe the privacy and data protection guidelines of the Ayvens Channel.

It is of total importance to follow all the steps described to avoid operational risks.

3. Ayvens and privacy

We at ALD Automotive SA Brazil, registered in the CNPJ 07.563.781/0001-71 and headquartered in Belo Horizonte MG, Rod Anel Rodoviário Celso Mello Azevedo nº15040, CEP:30.750-222, Bairro: Alto Caiçaras, care about you, and therefore we take care with your data.

This document was prepared in compliance with the General Law on Personal Data Protection (Law13.709/18). This document may be updated as a result of any regulatory update, so we recommend that you review this document periodically.

As a data controller, we are responsible for collecting and handling your personal data in a lawful manner. The purpose of this Data Privacy Policy is to inform you about what personal data we may collect about you, the reasons why we use and, in some cases, share this data, how long we keep it, what your rights are in this regard and how to exercise them.

Ayvens is a provider of mobility services including operational leasing of vehicles, fleet management and Remarketing activities. This privacy policy explains our practices regarding the personal data of our carmarket.ayvens.com ("you").

We respect your privacy and therefore process your personal data in accordance with the General Data Protection Act ("LGPD"), other applicable laws and regulations in the area of data privacy, personal data protection and this Privacy Policy.

4. General Principles

Ayvens understands your concerns regarding the confidentiality of your personal information. Below we describe how we acquire and use this information and describe your rights. Please read it carefully to make the process as fair, transparent and secure as possible.

The following principles are fundamental to how we process your personal information:

• Transparency and fairness: When we collect and process your personal information, we make available our privacy policy in accordance with local law and how your personal data is treated. Where required by law, we seek your prior consent (for example, before collecting any sensitive information or sending any direct marketing materials). We never use your personal information for purposes incompatible with the purposes described here.

• Legitimacy: Ayvens does not collect or process personal information without a legal reason. We use your personal information only for appropriate business purposes (e.g. to provide services, manage customer relationships, manage customer vehicle fleets and perform accurate billing, or for marketing activities, profiling to better serve customers, perform satisfaction surveys or prepare reports and comply with our legal obligations).
• Minimization: We collect only the personal information that is strictly necessary for the data processing as set out in this document. We take all reasonable, technical and organizational measures to ensure that your recorded personal data is accurate, complete and up to date.
• Privacy: We apply technical and organizational measures to ensure privacy when implementing personal data processing and governance. To this end, we conduct personal data flow mapping and if identified risks to civil liberties and fundamental rights, we conduct privacy impact assessments to ensure that our safeguards are appropriate.

5. About Us

Ayvens is the data controller of your personal data.

• Rod Anel Rodoviário Celso Mello Azevedo nº15040, CEP:30.750 - 222, Bairro: Alto Caiçaras

• dpobrasil@aldautomotive.com

Telephone: +55 11 3147-4710

6. How we use your personal data and what personal data is used

7.How long we keep your personal data

Personal data is kept by ALD Automotive SA  Brazil, on an active basis, for the time necessary for the execution of the purpose pursued at the time of its collection.

The retention period is therefore initially defined by ALD Automotive SA Brazil according to the operational needs necessary for the execution of each individual rental agreement and considering the recommendations of the local data protection authority.

However, certain longer retention periods may result from legislative and regulatory texts. Some laws also require that documents/information containing personal data be retained for a specific period for evidentiary purposes or in anticipation of possible litigation until the action in question is time-barred. For example, in commercial matters of accountability documents, obligations are in principle time-barred for five years if they are not subject to special prescriptions. Ayvens is therefore obliged to retain certain personal data beyond the execution of the rental contracts, even if it no longer has any use for them, in the form of so-called intermediate files.

After the end of this period the personal data will be: Anonymized and/or Deleted.

8. With whom does Ayvens share my personal data?

In principle, we do not share your data with third parties. However, as part of the execution of the sales contract, we may share company information and personal data with Ayvens/Group SG affiliates to streamline the KYC (Know Your Customer) process.

9. Export of personal data outside the EEA - European Economic Area

In general, all Ayvens databases are located within the European Union. However, Ayvens may transfer your personal data from Europe to countries within or outside the European Economic Area. Countries outside the EEA may not provide the same level of protection available in the EEA. If we transfer your personal data outside the EEA, we will ensure that there are adequate levels of protection in relation to the processing of your personal data. Ayvens will therefore, before transferring your personal data outside Europe, ensure that it implements a Standard Contractual Clauses (SCC). This applies to our India-based support team (SGGSC).

10. Your rights

To protect data subjects involved in the processing of personal data, the GDPR has implemented rights. The rights in question are as follows:

11. Data security and Storage

Ayvens protects your data by means of technical and organizational security measures, including:

• Up-to-date policies and work instructions and regular compliance checks.
• Segregation of duties, so that our employees only have access to your personal data if it is necessary for their role and function.
• Effective training of our employees on the rules, issues and risks involved.
• Physical security of the premises where we handle your personal data (e.g., access control and video surveillance cameras).
• Numerous IT security measures (secure servers, firewalls, encryption, among others).

Only staff and employees who have a need to know your information within our company can access it. Ayvens makes sure to implement management rights and policies within our company and we take every measure to ensure that employees, consultants and contractors keep their files confidential.

12.Cookie Policy and Websites

Ayvens may collect data through cookies to improve the user's browsing experience. Cookies are used, among other trackers, to store preferences and settings to save time, enable login, combat fraud, analyze the performance of the site and the services provided by the tenant and compile visit statistics.

If you use our mobile application, we may collect your GPS location, subject to your consent where necessary. We may also analyze how often you use the app and where you downloaded it.

For more details you can view our cookie policy by following this link: https://carmarket.ayvens.com/cookiepolicy/

13. Updates to this privacy policy

We may modify this Privacy Policy from time to time to conform to any new regulations, so please review it regularly. If we change this Privacy Policy, we will notify you by means of a notice on the home page of our website. This Notice was last amended on April 15, 2022.

14. How to exercise my rights

According to Art. 18: The data subject shall have the right to obtain from the controller, in respect of data relating to the data subject processed by it, at any time upon request.

We are committed to fulfilling these rights. You can exercise these rights with Ayvens by contacting us via the exclusive privacy channel: e-mail dpobrasil@aldautomotive.com

15. Responsabilities

The Superintendent of the Remarketing area is responsible for the writing, mastery, performance, application and updating of this procedure; his name will be communicated via e-mail to the entire company in case of change.

The Director of Operations is responsible for the domain and application of this process.

This process is applicable to all employees of the ALD Automotive Brazil SA Remarketing area.

Each employee linked to this area has to take an action to respect these rules.

16. Internal Audit

The Director of the Remarketing department is responsible for providing adequate service to the internal audit and providing the necessary information.

17. Register Control

What is a Record: Completed and validated information and documents, regardless of age, origin, or medium (paper, media, electronic, etc.), that are created, received, managed as evidence of an activity, and that must be retained for legal, Group, regulatory, contractual, or operational reasons.               

18. Attachments

N/A

19. GDPR (General Data Protection Regulation)

The General Data Protection Regulation, Law No. 13,709 of August 14, 2018 establishes guidelines for the processing of personal data.

As per Ayvens internal data protection policy POL-LGPD-001, the personal data handled in this process must be recorded in the Data Mapping, i.e., the life cycle of the personal data, its purpose and legal basis applied. It is the responsibility of the area management to keep the data mapping up to date.