1. Which personal data do we collect?

We collect your personal data via different sources including the information you provide directly when you contact Us for access to and registration with the Customer Portal.

Remember that we must collect certain personal data for legal reasons or as a result of the contractual relationship we have with you. Refusal to provide this information may prevent or delay compliance with these obligations. On collecting your personal data, we will inform you of the fact that it is obligatory to provide said data and the consequences of failing to do so.

1.1. Personal data that you provide directly

The categories of personal data that we collect directly from you include:

• (a) Identifying Details: Full name, identity document number.
• (b) Contact Details: Address, Town/City, Postcode, Region, phone number, e-mail address, and province.
• (c) Other data such as: vehicle registration number.

1.2. Personal data that you provide on third parties

When you provide Applus+ with personal data, such as contact information and/or vehicle registration number or any other data relating to third parties, you will be directly responsible for informing those persons of their rights and for obtaining their explicit consent, whenever necessary, with regard to the processing (including any transfers) of their personal data, as deemed necessary and in line with local data protection law, as set out in this policy.

2. For which purposes and lawful bases do we process your personal data?

We use and process the personal data we collect on you for the purposes and lawful bases indicated below:

• (a) We will process your personal data to fulfil our contractual relationship with you and, therefore, to manage the Customer Portal if you decide to register. The Customer Portal provides information on the history of your vehicle, and we can connect you with your MOT Centre if you want to arrange a prior appointment, as well as other services available on the Customer Portal.
• (b) We will also process your personal data to guarantee an optimum level of compliance with the current legal obligations to which Applus+ is subject, and to cooperate with the regulatory authorities and the law enforcement agencies whenever necessary, as set out in section 4 of this privacy policy:
  • To communicate your personal data and any other additional information in response to the requests issued by the competent authorities and/or bodies, as set out in applicable law or by the law enforcement officials in all their official functions.
• (c) We will process your personal data on the basis of our legitimate interests described below for the following purposes:
  • To send you Road Safety Tips, Promotions and discounts on MOTs and/or sales communications on in-house products and services offered by Applus+, where the lawful basis for processing is the legitimate interest of Applus+ or the applicable law on the sending of sales communications, if these media are used to send it, provided you do not object to as such at the time the personal data is collected or in any of the specific sales communications.
  • To settle your suggestions, enquiries or complaints, considering the legitimate interest of Applus+ in terms of conducting its business activity diligently and being able to deal with the requests of data subjects.
  • To send surveys via e-mail for quality control purposes, considering the legitimate interest of Applus+ in terms of being aware of areas of improvement in the business and to be able to provide a better service to data subjects.
  • As indicated in section 4 of this privacy policy, among others, for communications with any of our employees, agents, partners or other companies of the Applus Group which process personal data for the purposes described in this privacy policy, based on the legitimate interest of Applus+ in terms of conducting its business activity diligently.
  • To perform risk assessments and prevent fraud, based on the legitimate interest of Applus+ in terms of conducting its business activity diligently.
  • For any communication with third parties, as required as part of due diligence processes within the context of the business restructuring operations of which we are part, in line with the provisions of section 4 (d) of this privacy policy, based on the legitimate interest of Applus+ in terms of conducting its business activity diligently.
  When Applus+, as appropriate, processes personal data based on its legitimate interests, it will perform a balancing test (available on request) to ensure your interests or your fundamental rights and freedoms do not take priority over our legitimate interest.
• (d) We will process your personal data for the following purposes, provided you have given your prior consent:
  • Participation in prize draws and promotions for which you are registered.
  • For any other purpose of which you are informed when you provide your personal data, provided you have given your prior consent for each specific process.

If we request your consent to process your personal data, you may withdraw this consent at any time by contact us by e-mail, including a copy of your identity document, at: rgpd.automotive@applus.com.

3. What rights do you have on your personal data?

You have certain rights in relation to your personal data, regardless of the provisions of local law. These rights include:

• Knowing how we are processing your personal data and accessing the personal data that Applus+ or other companies in its business group have on you, as appropriate.
• Requesting the rectification of inaccurate or incomplete personal data.
• Requesting the erasure of your personal data when it is no longer necessary for the purposes for which it was collected, in line with applicable law.
• Restrict the processing of your personal data, under certain circumstances (in which case, we will only process the personal data to exercise and/or defend the rights of Applus+, wherever applicable).
• Object to the processing of your personal data, under certain circumstances and for reasons related to your specific situation (in which case, we will only process the personal data for imperative legitimate reasons or to exercise and/or defend the rights of Applus+, wherever applicable); This includes your right to object, at any time and for reasons related to your specific situation, to us processing your personal data based on our legitimate interests or those of a third party, in which case we will stop processing your personal data unless we have legitimate reasons to do so.
• Exercise your right to the portability of your data, which will enable you to receive and reuse the personal data in usable electronic format for your own purposes and for different services without any impediment in its use, including its transfer to third parties.
• Withdraw, at any time, the consent you have given in relation to a certain process.

We recommend you contact us to update or correct your personal information whenever it changes or if the personal data we have on you is inaccurate.

As appropriate, Applus+ undertakes to protect your personal data as set out in this privacy policy and according to applicable law. Should you wish to make an enquiry or require additional information on how to exercise your rights, please do not hesitate to contact us at the following e-mail address: rgpd.automotive@applus.com.

4. How do we share your personal data and with whom?

Applus+ will share your personal data with third parties under the following circumstances:

• (a) Service providers and partners: We will allow our service providers and partners to access your personal data within the context of the services they provide, including customer care (e.g. sending of text messages or e-mails), IT (e.g. database or software management), auditing and provision of services related to accreditations, as well as tax, insurance or legal services.
• (b) Companies of the Applus+ group. Applus+ may share your personal data with other companies belonging to the Applus+ Group for purposes of administrative, reporting and internal investigation management. You can consult a list of Applus+ Group companies at: applus.com/appluscompanies.
• (c) Law enforcement agencies, courts and tribunals, regulatory bodies, government authorities or other competent third parties. We may share your personal data with these third parties whenever necessary to comply with a legal or regulatory obligation or to protect our own rights and those of third parties in any other manner.
• (d) Takeovers and mergers. We will share your personal data with any third party who purchases, or to which we transfer, all or almost all of our assets and businesses or with which we are involved in a merger, consolidation, integration or similar restructuring. In the event of said sale or transfer, we will make all reasonable efforts to ensure the company to which we transfer your personal data processes it in line with this privacy policy.

5. How do we protect your personal data?

We implement technical and organisational measures to guarantee an adequate security level for the risk to the personal data processed. These measures aim to guarantee the permanent integrity and confidentiality of the personal data. We frequently assess these measures to guarantee processing security.

6. For how long do we keep your personal data?

We will keep your personal data for as long as we have a relationship with you and for a term of five (5) years after such. We will only keep your personal data once said term has elapsed if we are bound to do so by law or where there are claims or complaints pending that reasonably require the storage of your personal data.

Where the purpose of processing involves participation in prize draws or similar promotions, the storage period will be restricted to the time from your registration in the prize draw and/or specific promotion to one (1) year after it has been held and has ended.

7. Contact us

Applus+ is the controller in relation to the personal data we collect and process.

Should you have any questions or queries regarding the processing of your personal data, please contact us at: rgpd.automotive@applus.com.

We are committed to working with you on a fair solution to any complaint or query regarding privacy. However, if you believe we have been unable to help you with your complaint or query, you are entitled to file a complaint with the Spanish Data Protection Agency via its website www.aepd.es.

8. Changes to this privacy policy

You are entitled to request a copy of this privacy policy using the contact details indicated above. This privacy policy is subject to changes, as deemed necessary from time to time.

Should we amend this privacy policy, we will notify you of the changes where they have a fundamental impact on the nature of processing, or in any other manner have a substantial impact on you. We will notify you sufficiently in advance for you to be able to exercise your rights (e.g. object to processing).

Furthermore, insofar as the lawful basis of Applus+ involves the consent to carry out any of its processing activities, we will make sure we request your consent whenever the aforementioned changes may have a substantial impact on the processing activity in question before the changes are implemented.

27 March 2023