ASTRAUX IN-VEHICLE PRIVACY NOTICE

1. About This Notice

MAKTOUM TECHNOLOGY SARL (“ASTRAUX”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal data relating to users of ASTRAUX vehicles.

This In-Vehicle Privacy Notice explains how personal data may be generated, collected, used, stored and otherwise processed through:

• the ASTRAUX in-vehicle infotainment system;
• the vehicle’s built-in connectivity module, including the telematics control unit (“T-Box”);
• vehicle connectivity, diagnostic and related functions; and
• Bluetooth, media and smartphone projection functions made available through the vehicle.

This Notice describes personal data processing connected with the vehicle, the in-vehicle infotainment system and the T-Box. ASTRAUX acts as a controller where it determines the purposes and means of processing. Certain data may also be processed solely within the vehicle.

Third-party applications or services installed or enabled after delivery of the vehicle may be subject to separate privacy notices provided by the relevant third parties.

2. Who Is Responsible for Your Personal Data

The controller responsible for the personal data described in this Notice is:

Where a local distributor, authorised dealer, repair centre or third-party service provider independently determines how and why it processes personal data, that party may act as a separate data controller and will be responsible for providing its own privacy information.

3. Important Information About the Vehicle System

The current version of the ASTRAUX in-vehicle infotainment system does not require you to create or log in to an ASTRAUX user account.

The in-vehicle infotainment system does not provide user-facing built-in mobile data connectivity. Where an internet connection is required for an infotainment function, the infotainment system may connect to a mobile hotspot or another network made available by the user.

Separately, the vehicle contains a T-Box with its own connectivity capability. When connected, the T-Box may transmit vehicle identification, status, operation, location, diagnostic, alert, command and related log data to backend systems at periodic intervals or when relevant events or user requests occur. This supports connected vehicle functions, vehicle and fleet management, diagnostics, cybersecurity, maintenance and the other purposes described in this Notice. The T-Box may operate independently of the internet connection used by the infotainment system.

Certain smartphone data used for Bluetooth, media playback or smartphone projection may be processed locally within the vehicle. Unless otherwise stated, ASTRAUX does not receive data that remains solely within the vehicle and is not transmitted to ASTRAUX’s backend systems.

4. Personal Data We May Process

The data actually processed depends on the vehicle model, configuration, market, activated functions, service arrangement and manner in which the vehicle is used. Function-specific details, including current data fields, service providers and retention information, may be described in the latest online version of this Notice.

4.1 Vehicle Identification and Configuration Data

We may process:

• the Vehicle Identification Number (“VIN”);
• the T-Box identifier and other vehicle device identifiers;
• vehicle model, production information and configuration;
• hardware and software version information;
• vehicle connectivity status; and
• the country or market in which the vehicle is operated or serviced.

This data is used to identify the vehicle, confirm technical compatibility, provide connected functions, manage software and hardware configurations, support maintenance and comply with applicable legal requirements.

4.2 Vehicle Status and Operation Data

Depending on the functions available in the vehicle, we may process vehicle status and operation data, such as:

• vehicle power, ACC, online/offline and operating status;
• battery level, charging status and estimated remaining range;
• speed, mileage, driving or power mode, energy or fuel consumption;
• air-conditioning and interior temperature status;
• door, window, lock or luggage compartment status;
• warning messages, fault codes, selected CAN-derived data and system status; and
• timestamps associated with vehicle events or operations.

We process such data only to the extent required to provide the relevant vehicle or connected function, display vehicle status, support diagnostics, maintain vehicle security or provide after-sales services.

4.3 Vehicle Location, Parking and Trip Data

Where a vehicle, connected or fleet-management function requires location information, we may process:

• current, last recorded or historical vehicle location, including coordinates;
• parking location;
• trip start and end locations;
• driving route, trajectory, direction or speed associated with a location record;
• trip date, time, duration and mileage; and
• related location and trip timestamps.

Location and trip data may reveal information about the movements and activities of drivers or vehicle users. When the T-Box is connected, location data may be reported periodically at a configurable interval. Depending on the service arrangement and permissions, authorised enterprise administrators may view, query or export current and historical location information. We limit access and retain such data according to the relevant function, service relationship, safety and legal requirements.

Location data will not be used for advertising or unrelated profiling unless you are separately informed and a valid legal basis is established.

4.4 Diagnostic, Alert, Driving Analysis, Maintenance and Security Data

We may process technical information necessary to maintain the safety, security and reliability of the vehicle, including:

• fault codes, diagnostic information and selected CAN-derived data;
• component and system status;
• system errors, abnormal events and operational alerts, which may include speeding, parking, geofence or regional, driving-safety, ACC, connectivity and consumption-related events;
• connectivity and communication logs;
• software version and update records;
• repair and maintenance records; and
• records necessary to investigate technical failures, cybersecurity incidents or unauthorised access.

Where a vehicle is inspected or repaired, authorised technicians may access technical data necessary to diagnose and resolve the relevant issue. Access should be limited to the data required for the relevant maintenance or repair purpose.

4.5 Remote Control, Digital Key, Bluetooth and Connected Device Data

When remote control, digital key, Bluetooth or connected-device functions are used, the vehicle and related systems may process:

• vehicle, account, device, T-Box, Bluetooth or digital-key identifiers;
• pairing, authorisation, connection and digital-key configuration status;
• contact information, call history or call status, where you grant the relevant device permission;
• media file information and media playback data; and
• remote command type, time, requesting account, execution status and other operation records necessary to provide and secure the requested function.

Available functions may include remote lock or unlock, climate control, vehicle power functions, vehicle finding and digital-key access. Controls and safeguards vary by model and configuration and may include confirmation steps or restrictions while the vehicle is moving. Certain pairing or authorisation information may remain stored until it is removed, revoked, deleted or reset.

You can manage paired devices and available permissions through the vehicle settings and the settings of your mobile device.

4.6 Data Provided During Maintenance or Customer Support

If you contact ASTRAUX, an authorised dealer or an authorised repair centre regarding a vehicle issue, personal data may also be processed in connection with the relevant request, including:

• your name and contact details;
• vehicle identification details;
• issue descriptions;
• diagnostic and repair information; and
• communications and service records.

Where this information is collected through the App, website or another customer support channel, the privacy notice applicable to that channel will also apply.

5. How We Collect the Data

We may obtain data:

• directly from vehicle components, sensors, electronic control units and the T-Box, periodically or when an event occurs;
• from the in-vehicle infotainment system;
• from a mobile device or other device connected to the vehicle, where you activate the relevant function or grant the relevant permission;
• from authorised dealers, repair centres and technical service providers; and
• from ASTRAUX applications, enterprise platforms and other systems where necessary to provide, manage or secure connected vehicle services.

Some vehicle data may be associated only with a VIN, T-Box identifier or another technical identifier at the point of collection. However, such data may constitute personal data where it can be linked to a vehicle owner, driver, passenger or other identifiable individual.

Where personal data relating to a driver, passenger or other vehicle user are not obtained directly from that individual, the data may originate from the vehicle owner, lessee, authorised user, vehicle systems, connected devices, authorised dealers, repair centres or technical service providers. ASTRAUX will provide the information required under applicable law through this Notice or another appropriate notice, subject to any applicable exemptions.

6. Why We Process Personal Data and Our Legal Bases

6.1 Providing Vehicle and Connected Functions

Where you are a party to the relevant vehicle, warranty or connected service contract, we process personal data that are objectively necessary to perform that contract or to take steps requested by you before entering into the contract. This may include processing necessary to provide vehicle connectivity, display vehicle status, provide a function specifically requested by you, or provide maintenance, warranty and after-sales support.

Where the relevant individual is not a party to the contract, including a passenger or occasional driver, ASTRAUX will rely on another appropriate legal basis, such as legitimate interests, consent, compliance with a legal obligation or protection of vital interests, depending on the circumstances.

6.2 Vehicle Safety, Security and Diagnostics

We process relevant vehicle, diagnostic and security data to:

• detect and resolve vehicle faults;
• protect the vehicle and connected systems against unauthorised access;
• investigate cybersecurity or safety incidents;
• maintain the reliability and integrity of vehicle systems; and
• support warranty, maintenance and repair services.

The applicable legal basis depends on the specific purpose:

1. (a) where diagnostic, warranty or repair processing is objectively necessary to perform a contract with the relevant individual, the legal basis is Article 6(1)(b) GDPR;
2. (b) where processing is required by vehicle safety, product compliance, recall, cybersecurity or reporting laws, the legal basis is Article 6(1)(c) GDPR; and
3. (c) where processing is necessary to detect faults, prevent unauthorised access, maintain system integrity, investigate incidents or protect ASTRAUX’s systems and users, the legal basis is Article 6(1)(f) GDPR.

The legitimate interests pursued by ASTRAUX include maintaining the safety, security, reliability and integrity of the vehicle and its connected systems, preventing fraud and unauthorised access, investigating technical or cybersecurity incidents, and establishing, exercising or defending legal claims.

Before relying on legitimate interests, ASTRAUX assesses whether the processing is necessary and whether those interests are overridden by the interests, rights or freedoms of affected individuals.

6.3 Optional Functions Requested by the User

Where you voluntarily activate Bluetooth, contact synchronisation, smartphone projection or another optional function, relevant data may be processed to provide the function you have specifically requested.

Where consent is required by applicable data protection or electronic communications law, ASTRAUX will request consent through a clear and separate interface before the relevant processing begins.

A device or operating-system permission enables technical access to a function or data category. Granting such a permission does not, by itself, constitute consent under data protection law unless the relevant interface clearly requests consent and satisfies the applicable legal requirements.

You may withdraw consent or revoke a device permission at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Revoking a permission may prevent the relevant optional function from operating.

6.4 Compliance With Legal Obligations

We may process or disclose data where necessary to comply with:

• vehicle safety and product compliance requirements;
• mandatory recall, repair or reporting obligations;
• lawful requests from courts, regulators or public authorities;
• cybersecurity and incident reporting requirements; or
• other applicable legal obligations.

6.5 Emergencies and Protection of Individuals

In an emergency, accident or serious safety incident, we may process personal data where necessary to protect the vital interests of a driver, passenger or another natural person.

Where processing is necessary to prevent or investigate serious damage to the vehicle or other property, ASTRAUX will rely on another applicable legal basis, such as its legitimate interests, performance of a contract or compliance with a legal obligation.

6.6 Whether You Are Required to Provide Personal Data

Certain vehicle identification, status, diagnostic, security and connectivity data are generated automatically and may be necessary to provide core connected functions, maintain vehicle safety, comply with legal obligations or provide warranty and maintenance services. If these data cannot be processed, the relevant function or service may be unavailable or may not operate correctly.

Data used solely for optional functions, such as contact synchronisation, are not required for the basic operation of the vehicle. You may choose not to activate the relevant function or permission without affecting the vehicle’s essential driving functions.

7. Data That Remains Within the Vehicle

Certain data may be stored or processed solely within the vehicle, including Bluetooth pairing records, media information, contact information authorised by the user and temporary smartphone projection data.

Where such data remains exclusively within the vehicle and is not accessible to ASTRAUX, ASTRAUX does not collect the content of that data through its backend systems.

The vehicle owner and users are responsible for managing locally stored information. Before selling, transferring, returning, renting out or otherwise handing the vehicle to another person, you should:

• remove paired mobile devices;
• delete locally stored contacts, call records and media information;
• sign out of or remove any third-party applications;
• revoke any vehicle access permissions; and
• perform a factory reset where available and appropriate.

8. How We Share Personal Data

We do not sell personal data.

We may share personal data only where necessary with the following categories of recipients:

8.1 ASTRAUX Affiliates

Relevant ASTRAUX group companies may process data for technical operation, information security, system maintenance, customer support and compliance purposes.

8.2 Cloud and Technical Service Providers

We may engage service providers to provide cloud hosting, data storage, mapping or location functions, connectivity, system monitoring, diagnostics, cybersecurity, messaging and other technical services. The current providers and relevant processing locations may change and are described, where required, in the latest online privacy information.

Service providers acting on our behalf are required to process personal data only in accordance with our documented instructions and to implement appropriate security measures.

8.3 Authorised Dealers and Repair Centres

Vehicle identification, diagnostic, fault and maintenance information may be provided to an authorised dealer or repair centre where necessary to inspect, maintain or repair the vehicle or to provide warranty and after-sales services.

8.4 Third Parties Requested or Authorised by You

Where you request that vehicle data be made available to a third party, or where an enterprise customer provides a fleet-management service to authorised administrators, relevant data may be made available in accordance with applicable instructions, roles and permissions, subject to identity verification, vehicle security, applicable law and technical feasibility.

8.5 Public Authorities

We may disclose personal data to a court, regulator, law enforcement body or other public authority where required or permitted by law.

8.6 Business Transfers

If ASTRAUX or the relevant vehicle business is reorganised, sold or transferred, personal data may be disclosed to relevant advisers and transaction parties, subject to appropriate confidentiality and data protection safeguards.

9. Third-Party Applications and Services

The vehicle may allow third-party applications or software to be installed or accessed after delivery.

Unless ASTRAUX is expressly identified as the provider of the relevant application or service, the third-party provider is responsible for its own collection and use of personal data.

Before using a third-party application or service, you should review the applicable terms and privacy notice. ASTRAUX does not control the independent data processing activities of third-party providers.

The installation of a third-party application by a dealer does not, by itself, mean that ASTRAUX controls the third party’s subsequent data processing.

10. International Data Transfers and Data Storage Locations

Vehicle connectivity data may be stored or accessed in the European Economic Area and in other jurisdictions where ASTRAUX, its affiliates, enterprise customers or service providers operate. Current material storage locations and transfer arrangements are described in the latest online privacy information.

Where personal data is transferred outside the European Economic Area, we will use an appropriate transfer mechanism required by applicable law. Depending on the recipient and destination, this may include:

• an adequacy decision adopted by the European Commission;
• the European Commission’s Standard Contractual Clauses;
• supplementary technical and organisational measures; or
• another lawful transfer mechanism.

You may contact us for further information about the safeguards applicable to an international transfer.

11. How Long We Retain Personal Data

We retain personal data only for as long as reasonably necessary for the relevant purpose. The period varies by data and service and is determined by factors including the duration of the vehicle or connected-service relationship, the need to provide current or historical functions, user or enterprise settings and deletion actions, vehicle safety, technical support, warranty requirements, security, dispute resolution and applicable legal obligations.

In general, temporary session data are kept only for the session; local pairing or device information remains until removed or reset; and backend vehicle, location, command, diagnostic, alert and security records are retained for the period needed to provide the relevant function or service and to meet safety, security, warranty, legal or claims-related needs. More specific current periods or deletion controls, where applicable, are set out in the latest online privacy information:

• temporary smartphone projection data is cleared when the relevant connection is terminated;
• Bluetooth pairing and locally stored device information remains in the vehicle until it is deleted by a user or removed through a system reset;
• vehicle status, operation and remote-command records may be retained while needed for connected, fleet, diagnostic, security or after-sales functions, and may be kept longer where linked to a fault, warranty matter, safety investigation or legal claim;
• location, parking, trip and trajectory records may be retained to provide current or historical location and trip functions, subject to applicable settings, deletion options, service arrangements and legal requirements;
• (e) diagnostic, fault, alert, CAN-derived and security records may be retained for operational, safety, maintenance, cybersecurity and evidence purposes, including until a related matter and any applicable legal-hold period have ended;
• (f) maintenance and warranty records are retained for the duration of the applicable warranty or service relationship and thereafter for the applicable statutory limitation period or another period required by vehicle safety or product compliance law; and
• (g) other records required for legal compliance or the establishment, exercise or defence of legal claims are retained for the applicable mandatory retention or limitation period.

At the end of the applicable retention period, personal data will be deleted, anonymised or otherwise handled in accordance with applicable law and ASTRAUX’s retention procedures.

12. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful access, use, disclosure, alteration, loss or destruction.

Depending on the nature and sensitivity of the data, these measures may include access controls, authentication, encryption, network security, security monitoring, logging, vulnerability management and restrictions on access by service personnel.

No system can be guaranteed to be completely secure. You should protect mobile devices connected to the vehicle, use appropriate device security settings and promptly remove devices or access permissions that are no longer required.

13. Your Rights

Subject to the conditions and exceptions set out in applicable data protection law, you have the right to:

• request access to personal data relating to you;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on our legitimate interests;
• receive certain personal data in a structured, commonly used and machine-readable format, and request transmission to another controller where applicable;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a competent data protection supervisory authority.

You may exercise these rights by contacting us at privacy@astraux.com.

We may need to verify your identity, your relationship with the relevant vehicle and your authority to make the request. Certain requests may be limited where necessary to protect vehicle security, the rights of another driver or user, confidential information, legal obligations or the rights and freedoms of other individuals.

14. Multiple Drivers and Passengers

Vehicle Data may relate not only to the registered owner, but also to other drivers, passengers and persons who connect a mobile device to the vehicle.

The vehicle owner, lessee, enterprise customer or primary user should make this Notice reasonably available to drivers, passengers and other persons who regularly use the vehicle. The latest version is available through ASTRAUX’s website.

Where a request concerns data relating to more than one individual, ASTRAUX may limit, separate or redact the disclosed data where necessary to protect the rights and freedoms of other drivers, passengers or users.

The responsibility of the vehicle owner or primary user to inform other users does not limit ASTRAUX’s own obligations to provide privacy information where required by applicable law.

15. Sale, Transfer or Return of the Vehicle

Before selling, transferring, returning or permanently handing the vehicle to another person, you should remove personal devices, delete locally stored data and reset the infotainment system where appropriate.

After a vehicle transfer, ASTRAUX may require reasonable evidence of ownership or authorised use before changing access to connected vehicle functions or responding to a request relating to vehicle data.

16. Updates to This Notice

Please consult the latest version and, where available, archived versions at our official legal portal (https://astraux.com/pages/astraux-in-vehicle-privacy-notice). The latest online version provides the most current function-specific information and will state its effective date.

Where a change materially affects the processing of personal data, ASTRAUX will provide appropriate notice through one or more available channels, which may include the ASTRAUX website, the ASTRAUX mobile application, an in-vehicle notice where technically available, or communications provided through authorised dealers or repair centres.

Where a new processing activity requires consent, the processing will not begin until valid consent has been obtained.

17. Contact Us

For questions about this Notice, the processing of vehicle-related personal data or the exercise of your data protection rights, please contact: