1. What Personal Data do we collect?

We collect your Personal Data through various sources, including the information that You provide to us directly when contacting Us by means of your access to and registration on the Customer Portal.

Please note that we must collect certain personal data as a legal requirement, or as a result of the contractual relationship we have entered into with You. Refusal to provide such information may prevent or delay the fulfilment of those obligations. When collecting your personal data we will inform you as to whether providing that data is mandatory, as well as about the consequences of not doing so.

1.1. Personal Data that You provide to us directly

The categories of Personal Data that we will collect directly from You include:

• (a) Identification details: First name(s) and Surname(s); Tax ID number.
• (b) Contact details: Address, Town/City, Postcode, Autonomous Community, telephone number; email address and province.
• (c) Other data such as: vehicle registration number.

1.2. Personal data that you provide to us about third parties

When you provide Applus+ with personal data, such as contact information and/or a vehicle registration number or any other data relating to third parties, you will be directly responsible for informing those persons about their rights and for obtaining their explicit consent, where necessary, with regard to the processing (including any transfers) of their personal data, as deemed necessary and in accordance with the relevant local data protection legislation, as set out in this Policy.

2. How and on what basis do we process your Personal Data?

We use and process the Personal Data that we collect about You for the purposes and on the legal bases indicated below:

• (a) We will process your personal data in order to fulfil our contractual relationship with you and thereby be able to manage the Customer Portal, should you decide to register. The Customer Portal will provide you with information about your vehicle's history, we will be able to connect you with your ITV Station should you wish to book an appointment, as well as other services available on the Customer Portal.
• (b) We will also process your Personal Data in order to ensure an optimum level of compliance with the legal obligations in force to which Applus+ is subject, as well as to cooperate with regulatory authorities and law enforcement bodies where necessary, as set out in Section 4 of this Privacy Policy:
  • To disclose your personal data, as well as other supplementary information, in response to requests issued by the competent authorities and/or entities, as provided for in the applicable legislation or by law enforcement officers in the exercise of their duties.
• (c) We will process your personal data on the basis of our legitimate interests described below for the following purposes:
  • To send you Road Safety Tips, Promotions and ITV discounts and/or commercial communications about Applus+'s own products and services, the legal basis for the processing being the legitimate interest of Applus+ or the legislation applicable to the sending of commercial communications, where these means are used to send them, provided that you do not object at the time of collection of the Personal Data or in any of the specific commercial communications.
  • To deal with your suggestions, queries or complaints, given the legitimate interest that Applus+ holds in carrying out its business activity diligently and being able to respond to data subjects' requests.
  • To send surveys by email for quality control purposes, given the legitimate interest that Applus+ holds in identifying areas for improvement in the business and being able to provide a better service to data subjects.
  • As mentioned in Section 4 of this Privacy Policy, among others, for disclosures to any of our employees, agents, business partners, or other Applus+ Group companies, which process the Personal Data for the purposes described in this Privacy Policy on the basis of the legitimate interest that Applus+ holds in carrying out its business activity diligently.
  • To carry out risk assessments and prevent fraud, given the legitimate interest that Applus+ holds in carrying out its business activity diligently.
  • For any disclosure to third parties, as necessary as part of due diligence processes in the context of corporate restructuring operations to which we are a party, in line with the provisions of Section 4 (d) of this Privacy Policy, given the legitimate interest that Applus+ holds in being able to continue the business in the event of a corporate transaction.
  Where Applus+, as the case may be, processes Personal Data on the basis of its legitimate interests, it will carry out a balancing test (available on request) in order to ensure that your interests or your fundamental rights and freedoms do not override our legitimate interest.
• (d) We will process your Personal Data for the following purposes, provided that you have given your prior consent:
  • Participation in prize draws and promotions that you enter.
  • For any other purpose of which you are informed at the time you provide us with your personal data, provided that you have given us your prior consent for each particular processing operation.

If we ask for your consent to process your Personal Data, you may withdraw that consent at any time by contacting us by sending an email to: rgpd.automotive@applus.com.

3. What rights do you have over your Personal Data?

You have certain rights in relation to your Personal Data, without prejudice to the provisions of local legislation. These rights include:

• Knowing how we are processing your Personal Data and accessing the Personal Data that Applus+ or other companies in its corporate group hold about You, as the case may be.
• Requesting the rectification of inaccurate or incomplete Personal Data.
• Requesting the erasure of your Personal Data when it is no longer necessary for the purposes for which it was collected, in accordance with applicable legislation.
• Restricting the processing of your Personal Data, in certain circumstances (in which case we will only process the Personal Data for the exercise and/or defence of the rights of Applus+, as the case may be).
• Objecting to the processing of your Personal Data, taking into account certain circumstances and on grounds relating to your particular situation (in which case we will only process the Personal Data for compelling legitimate reasons or for the exercise and/or defence of the rights of Applus+ , as the case may be). This includes your right to object, at any time, on grounds relating to your particular situation, to our processing of your Personal Data on the basis of our legitimate interests or those of a third party, in which case we will stop processing your Personal Data unless we can rely on legitimate grounds for doing so.
• Exercising your right to data portability, which will allow you to receive and reuse the Personal Data in an electronic format that can be used for your own purposes and for different services without hindrance to its use, including its transmission to a third party.
• Withdrawing, at any time, the consent you have given in relation to a particular processing operation.

We recommend that you contact us to update or correct your personal information as soon as it changes, or if the Personal Data we hold about You is inaccurate.

Applus+, as the case may be, undertakes to protect your Personal Data as set out in this Privacy Policy, and under applicable legislation. If you wish to make any enquiry or request additional information about how to exercise your rights, please do not hesitate to contact us at the following email address: rgpd.automotive@applus.com.

4. How do we share your personal data and with whom?

Applus+ will share your Personal Data with third parties in the following circumstances:

• (a) Service providers and business partners: We will allow our service providers and business partners to access your Personal Data in the context of the services they provide to us, including, among others, customer care (e.g. sending SMS messages or emails), IT services (e.g. database or software management), auditing and the provision of services related to accreditations, as well as tax, insurance or legal services.
• (b) Applus+ group entities. Applus+ may share your personal data with other companies belonging to the Applus+ Group for administrative management, reporting and internal research purposes. You can consult a list of Applus+ Group entities at: applus.com/appluscompanies.
• (c) Law enforcement bodies, judges and courts, regulatory bodies, government authorities or other competent third parties. We may share your Personal Data with these third parties where necessary to comply with a legal or regulatory obligation, or to otherwise protect our own rights as well as the rights of third parties.
• (d) Purchasers of assets and mergers. We will share your Personal Data with any third party that purchases, or to which we transfer, all or substantially all of our assets and business or with those with which we carry out a merger, consolidation, integration or similar restructuring. Should such a sale or transfer take place, we will use all reasonable efforts to ensure that the entity to which we transfer your Personal Data processes it in a manner consistent with this Privacy Policy.

5. How do we protect your Personal Data?

We implement technical and organisational measures to ensure a level of security appropriate to the risk for the Personal Data processed. Those measures are intended to guarantee the ongoing integrity and confidentiality of the Personal Data. We assess these measures periodically in order to ensure the security of the processing.

6. How long do we keep your Personal Data?

We will keep your Personal Data for as long as we maintain a relationship with You and for a period of five (5) years thereafter. We will only keep your Personal Data once that period has elapsed if we are required to do so in compliance with the law, or in the event that there are pending claims or complaints that reasonably require your Personal Data to be kept.

Where the purpose of the processing is participation in prize draws or similar promotions, the retention period will be limited to the time between your entry into the specific prize draw and/or promotion and one (1) year after it is held and concluded.

7. Contact us

Applus+ is the data controller in relation to the Personal Data that we collect and process.

If you have any questions or concerns about the processing of your Personal Data, please contact us at: rgpd.automotive@applus.com.

We are committed to working with You to reach a fair resolution of any complaint or concern relating to privacy. However, if you consider that we have been unable to help you with your complaint or concern, you have the right to lodge a complaint with the Spanish Data Protection Agency through its website www.aepd.es.

8. Changes to this Privacy Policy

You have the right to request a copy of this Privacy Policy using the contact details indicated above. This Privacy Policy is subject to change, as deemed necessary from time to time.

Should we amend this Privacy Policy, we will notify you of the changes in those cases in which the changes to the Privacy Policy have a fundamental impact on the nature of the processing, or otherwise have a substantial impact on You; we will notify you sufficiently in advance so that you have the opportunity to exercise your rights (for example, among others, to object to the processing).

Likewise, and to the extent that Applus+ relies on consent to carry out any of its processing activities, we will make sure to ask for your consent where the aforementioned changes may have a substantial impact on the processing in question, before those changes take effect.

27 MARCH 2023