Privacy Policy

For the purposes of this Privacy Policy, the controller of personal data is MAKTOUM TECHNOLOGY SARL (hereinafter referred to as “we”, “us” or “our”). To the extent permitted by applicable law, we may process relevant personal data through our affiliated companies or third-party service providers acting on our behalf.

This Privacy Policy applies to the ASTRA connected vehicle product, in-vehicle infotainment system, vehicle connectivity functions (hereinafter referred to as the “Product”), the related mobile applications (hereinafter referred to as the “App”), and other related products or services we provide to you.

Please note that for specific products, features, or services, we may provide and apply separate supplementary privacy terms, statements, or notices. In the event of any inconsistency between these supplementary terms and this Privacy Policy, the supplementary terms shall prevail. Before using the relevant products or services, please carefully read and ensure you understand the applicable privacy terms. If the Product or the App redirects you to a separate website, online store, payment page, third-party platform, or social media page, such external services may be subject to their own terms and privacy policies, unless expressly stated otherwise.

1. What Data We Collect

In this Privacy Policy, “personal data” or “personal information” refers to information that can identify you, either alone or in combination with other information. We only collect personal data that is necessary to provide vehicle-related services, enable core system functionalities, support after-sales and connected services, and ensure the security and stable operation of the vehicle infotainment system, mobile applications, vehicle connectivity functions, commerce-related pages made available through the Product or the App, and related cloud services.

1.1 Account Registration and Identity Data

To enable account creation, user authentication, vehicle binding, and service access, we may collect the following information:

• Account Registration Information: When you register an account or bind a vehicle, we collect your mobile phone number or email address for account identification, login verification, and service management.
• Third-Party Login Information: When you choose to log in through Google or other supported third-party accounts, we may collect your third-party account identifier, email address, nickname, avatar, and other information authorized by you and necessary for account login, account association, and service access.
• Optional Profile Information: You may choose to provide additional profile details such as avatar, nickname, gender, date of birth, region, language preference, or personal signature. This information is used for account display and personalization purposes only.
• Account Binding and Security Information: Where supported by the Product or the App, we may collect and process information related to your bound email address, bound mobile phone number, Google account association, password modification, account modification, login status, and account security settings. This information is used for identity authentication, account recovery, security verification, and account management.
• Identity Verification Information: If you apply for verified user status or access regulated services, we may collect copies of identity documents for identity verification and compliance purposes. Such information will only be collected where a specific function, service, legal requirement, or verification scenario clearly requires it and you are separately informed.
• Contractual and Ownership Information: When you purchase a vehicle, apply for registration, financing, or insurance, we may collect contract documents, driver’s license information, contact address, and purchaser or company identity details to fulfill contractual and legal obligations.

1.2 Vehicle Data

1.2.1 Vehicle Identification and Static Data

Including Vehicle Identification Number (VIN) and license plate number, TBOX device number, vehicle model, vehicle color, vehicle name, binding status, binding time, vehicle sales source, and account-vehicle association information, used for vehicle binding, ownership or authorization verification, service eligibility confirmation, vehicle management, remote service access, after-sales support, and regulatory compliance.

1.2.2 Vehicle Status and Usage Data

Vehicle Operation and Status Data: Including door, window, and trunk status; interior temperature; air-conditioning status; battery level; charging status; estimated remaining range; total mileage; and energy consumption. Depending on the functions enabled in the Product or the App, such data may also include vehicle power status, lock status, power mode, vehicle speed, power output, remaining battery percentage, and other vehicle status information displayed through the vehicle infotainment system or the App. This data is used to enable remote vehicle control, vehicle status display, maintenance reminders, and service diagnostics.

Remote Control and Operation Records: When you use remote control functions through the Product or the App, such as vehicle power control, lock or unlock, air-conditioning control, find vehicle, or other supported commands, we may collect the command type, command content, execution status, operation time, associated account, VIN, TBOX device number, and related operation logs. Such records are used for command execution, safety verification, troubleshooting, security audit, after-sales support, and dispute handling.

Fault and Diagnostic Information: Including system alerts, fault codes, and maintenance records generated during use or servicing of the vehicle, used to support after-sales service, troubleshooting, and safety improvements.

1.2.3 Location and Trip Data

Vehicle and Device Location Data: Where you enable relevant functions or grant required permissions, we may process your vehicle location, mobile device location, latitude and longitude, and related location information to provide nearby service centers, charging or maintenance information, vehicle location display, find vehicle, navigation or location-based services, and other connected vehicle services.

Trip and Driving Records: We may collect and display trip-related information such as driving date, driving time, mileage, trip duration, start point, end point, vehicle model, and related timestamps, for the purpose of providing trip records, vehicle use history, connected vehicle services, troubleshooting, and after-sales support.

1.2.4 Digital Key and Bluetooth Data

Where you use digital key or Bluetooth-related functions, we may process Bluetooth device information, discovered or connected device information, connection status, digital key configuration records, use records, authorized device information, and related operation logs. Such data is used to enable device discovery, digital key configuration, vehicle access control, security verification, troubleshooting, and account or vehicle security management.

2. How We Use Your Personal Data and Legal Basis

We process your personal data for the following purposes and based on the corresponding legal grounds:

Fulfillment of Contractual Obligations: To provide core vehicle functions, process orders for reservation vouchers, manage vehicle binding, and provide connected vehicle services you have requested.

Legitimate Interests: To improve product performance, conduct internal research, ensure network and vehicle security, and manage business operations.

Consent: Where you have provided explicit consent for specific processing activities, such as certain device permissions or promotional communications.

Legal Obligations: To comply with applicable laws, including tax, financial, and vehicle safety reporting requirements.

3. How We Share Your Personal Data

We do not sell your personal data. We may share your data with:

Affiliates: Within ASTRA and its subsidiaries for unified technical support and management.

Authorized Partners: Including dealers and service centers for sales fulfillment and maintenance.

Service Providers: Third-party processors for cloud hosting, map navigation, and payment processing.

Financial Institutions: To facilitate financing and insurance services at your request.

4. Location of Data Storage

Your data may be stored on servers located outside of your country of residence. We may transfer your personal data to third-party service providers located in different countries/regions. Regardless of where the data is transferred, we will comply with applicable legal requirements and take appropriate protective measures to ensure that your data is protected in a manner consistent with the commitments made in this policy.

5. Your Rights and Choices

You have various rights concerning your personal data held by us:

• Right of Access: You have the right to know what data we have collected about you, the purposes of processing, and who your data will be shared with.
• Right to Rectification: You have the right to request correction or modification of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: You have the right to request the deletion of your personal data under certain circumstances, such as when the data is no longer necessary or when you withdraw your consent.
• Right to Restrict Processing: In certain circumstances, you have the right to request the restriction of our processing of your personal data.
• Right to Data Portability: Where technically feasible, you have the right to receive a transferable copy of the personal data you have provided to us.
• Right to Object: In certain circumstances, you have the right to object to our processing of your personal data (e.g., for direct marketing purposes).
• Right to Withdraw Consent: If we process your personal data based on your consent, you have the right to withdraw your consent at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the regulatory authority in your jurisdiction.

Product and App Permissions: You may manage or disable certain device permissions, such as location, Bluetooth, camera/photo album, microphone, and notifications, through your device or App settings. Please note that disabling certain permissions may affect the availability or proper functioning of related features.

Account Deletion and Vehicle Unbinding: You may request to delete your account or unbind your vehicle through the Product, the App, or by contacting us.

6. Data Security

We are committed to implementing reasonable and appropriate management, technical, and organizational security measures to protect your personal data from unauthorized or unlawful access, alteration, use, disclosure, or loss. Considering that connected vehicle services may involve vehicle location, remote control, and digital key data, we will apply appropriate access control, authentication, logging, and encryption protective measures.

7. Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes for which it was collected. In general:

• Account data will be retained for as long as your account remains active.
• Vehicle binding data will be retained for as long as the vehicle remains bound to your account and for a reasonable period thereafter where necessary for service records or compliance.
• Vehicle status, location, trip, and digital key records will be retained only for the period necessary to provide Product functions and troubleshoot issues.
• Commerce-related records, including order, payment, and delivery records, may be retained for the period required for accounting, tax, and consumer protection purposes.

8. Data Transfer to Third Countries

If necessary, we may transfer your personal data across borders within ASTRA and its subsidiaries. We will implement appropriate protective measures such as standard contractual clauses or adequacy decisions.

9. Children

Our Product and related services are not designed for or directed to children. We do not knowingly collect or process personal data from individuals below the applicable Age Limit. If we inadvertently collect such data, we will take reasonable steps to delete it without undue delay.

10. Updates to this Privacy Policy

We reserve the right to modify or update this Privacy Policy. Significant changes will be notified through email, App notifications, or website announcements. By continuing to use ASTRA products and services, you will be deemed to have accepted the updated version.