This privacy policy (the 'conditions') was last amended in May 2016.

Transcription

1 ARVAL PRIVACY POLICY This privacy policy (the 'conditions') was last amended in May These conditions generally apply to your relationship with Arval in conjunction with your use of Arval's services and products. They also apply to your use of and access to the My Arval website and associated websites (such asarvalmobilitylink.be, arvalcarsharing.com) as well as any accompanying (mobile) applications (the 'websites'). We request that you read these conditions carefully. The use of the websites is not possible without accepting these conditions beforehand. We reserve the right to change these conditions at any time to ensure that they are in accordance with applicable laws and regulations and with internal procedures. We do so by amending the provisions of this website and the date stated at the top of this page. We make every effort to inform you of any significant changes via a pop-up window on the websites. However, it may not always be possible to keep you up to date about these changes. This is why we ask you to read these conditions regularly to ensure that you are aware of all updates and changes, in particular if you are asked again to enter any supplementary personal details. If any provision of these conditions, either in whole or in part, is rendered null and void or in breach of law, the provision in question is not applicable. If this proves to be the case, Arval will replace the provision in question with a provision of equivalent effect which is not wholly or partially null and void or in breach of law. The other provisions of the conditions remain applicable in their entirety. Information about Arval The websites are operated by Arval Belgium NV. Our contact information is as follows: Ikaroslaan 99, 1930 Zaventem, Belgium. Phone +32 (0) info@arval.be Hyperlinks third-party websites These conditions do not apply to third-party websites which may be visited or are accessible via hyperlinks on the websites. We recommend that you consult the privacy policy of the relevant website. We are not liable for the processing of any personal details transferred to third parties in this manner. Personal details and privacy General Your privacy is important to us. Arval is governed by European legislation regarding the processing of personal data. This privacy policy is part of our commitment to openness and transparency with regard to how we process personal data. What personal data does Arval process? Personal data is any piece of information that can be used to identify a natural person (whether directly or indirectly). Arval processes the personal data of natural persons if a (potential) customer relationship exists, and of natural persons who, for example, are employees of (potential) corporate clients. The following types of information are processed when accessing and using the websites and using Arval's products and services:

2 In general: - Name, address, address and telephone number(s), i.e., your contact details - Your date of birth - Your position or job title where you are employed along with the department to which you belong (if a lease car has been issued to you by your employer) - Information about your driving style and driving behaviour (fuel consumption, traffic offences, fines, damage history (time/date, place and circumstances of accident or damage)) - In general, all data required by Arval to offer you its products or services within the scope of and on the basis of the agreement concluded between Arval and you/your employer Relating to the use of Arval Mobility Link: - Registration of trips and/or travel costs with public transport or other modes of transport (e.g., bike, car pooling) - Information about your available mobility budget - Registration of car journeys with a lease car, in particular start and end times of the journey and the point of departure and destination addresses Relating to the use of Arval Active Link: - Time/date, place and circumstances of an accident - Warnings - Information about your driving style and driving behaviour (fuel consumption, road safety) - Registration of car journeys with a lease car, in particular travel time and number of kilometres travelled - Start and end times of the journey and the point of departure and destination addresses (in the Arval Active Journey module) - Statistical analysis of business trips (in the Arval Active Journey module) - Real-time GPS positioning during a business trip (in the Arval Active Routing module) Relating to the use of Arval Car Sharing: - Registration of car journeys with a lease car, in particular start and end times of the journey and the addresses where the lease car reservation is activated and terminated Arval makes every effort to ensure that your personal data is complete and correct. You can help us in this matter by contacting us if you wish to change your personal data or if you have been made aware of the fact that the personal data processed is incorrect or incomplete. Arval is not liable for any damage, costs or losses incurred as the result of incorrect or incomplete information. Arval does not collect any personal data of a special nature (e.g., information relating to political views, religious beliefs or health). If Arval does wish to do this, your consent will be requested in advance. However, if you provide us with unsolicited personal data of a special nature, you automatically provide your consent for us to use such information. Processing means any operation that Arval is able to perform in conjunction with your personal data, including but not limited to the collection, recording, organisation, storage, adaptation, alteration, retrieval, consultation, use, forwarding, dissemination or otherwise making available, alignment, linking, blocking, erasure or destruction of information. How do we collect your personal data? Arval collects personal data that you or your employer forward to us as the result of our cooperation. Information supplied to Arval by its suppliers and third parties, such as (semi-)governmental

3 organisations, is also processed as the result of our cooperation. Furthermore, if you use the Arval Mobility Link, Arval Car Sharing or Arval Active Link services, information will be collected via the telematics system installed in your lease car and via the accompanying mobile application. Alternatively, we receive information from associated data suppliers (e.g., for routes travelled using public transport). Arval may also collect information about your computer, such as the IP address, operating system or browser type. This data is collected for site administration purposes. However, the data collected is purely of a statistical nature, i.e., user behaviour and patterns, and does not lead to the identification of individuals. Arval uses cookies and similar technology to collect this information. Please consult our cookies policy on the public section of the website arval.be for further information. How do we use your personal data? Arval collects and processes personal data for one or more of the following purposes, in part depending on the capacity in which you use the websites, the nature of the agreement concluded with Arval and the products and services provided to you by Arval: the assessment and acceptance of (potential) customers, the conclusion and execution of agreements and the facilitation of payment transactions and credit management; the identification of persons who are authorised (by our customers) to use the websites; the execution of agreements with the relevant customer as the case may be: - the processing of your data is exclusively intended for the proper execution of the agreement between you as a private person and Arval; or - the processing of your data is intended for the proper execution of the business agreement between Arval and your employer, with the aim of reporting to your employer about (the use of) (lease) cars and other means of transport deployed by the employer, the provision of information to the employer as part of the agreement and management reports; the preparation of a complete logbook used by your employer for tax purposes; for claims management, including theft; for the management of the Arval customer base; for internal and external accounting purposes; for administrative management at Arval and intra-group reporting purposes; to provide you with information (e.g., about an upcoming tyre change); for management purposes in relation to your employer (e.g., drawing up productivity indicators); to permit your employer to implement a comprehensive mobility policy that focuses on reducing costs, increasing safety, influencing the driving behaviour of employees, promoting responsible driving behaviour, monitoring compliance with the conditions under which your employer allocated the lease car (e.g., restricting the number of kilometres travelled for private journeys); to make products available and provide services as agreed in the contract or that are requested by you; to advertise the products and services of Arval and for marketing purposes in order to create and/or manage customer relationships; to personalise and safeguard websites; to record statistics about the use of websites; to perform analyses for statistical and research purposes and for product development; to provide quality monitoring, training and coaching for employees in order to improve the quality of our services; to meet statutory obligations; in general, to ensure the execution of agreements concluded with you or your employer for all legitimate interests on the part of Arval and for all purposes permitted under the applicable laws and regulations. We use your contact information to get in contact with you: when necessary, to inform you about any changes to the use of our websites, appointments for changing tyres, fines, orders for new cars, car inspection requests, claims settlements, maintenance appointments, etc.;

4 to offer you services that you may find useful, such as promotions, newsletters, surveys, etc., unless you have expressly indicated that you do not wish to receive services of this kind. If you wish to opt out from receiving information of this nature, please submit a written request to Arval. In what cases do we forward personal data to third parties? Arval will not, under any circumstances, sell or rent your personal data to third parties. We only forward your personal data to third parties (i) in cases specified in these conditions, (ii) in accordance with the agreement concluded with you or your employer, and (iii) in the cases specified below: to third parties that process your personal data on our behalf (e.g., hosting partners); to third parties that supply products or services to you on our behalf within the context of your use of your lease car, e.g., bodyshops, garages, tyre centres, fuel card suppliers, insurance providers, suppliers of replacement transport options; to third parties that perform credit worthiness checks or record payment behaviour on our behalf; to public authorities, courts, police authorities and judicial services that request the data from us or when we are required to do so by law; to your employer as the lessee of the vehicle that you are using with a view to the management of the employer's car fleet and lease agreements concluded with Arval, and with a view to implementing a mobility policy. For travel information that you classify as being private within Arval Mobility Link or Arval Active Link (Active Journey and Active Routing modules), only the total amount of kilometres will be disclosed to your employer. GPS positions, departure and arrival times and addresses are not disclosed to your employer if the journey was made for private purposes; to any entity belonging to the BNP Paribas Group to which Arval belongs; to any third party to which we assign our rights and obligations. If Arval engages any third parties to implement its services and for which access to your personal data is required, a written agreement shall be concluded by Arval with these third parties to the effect that they shall provide adequate protection for your personal data and shall only process this data on behalf of your employer and/or Arval for the purposes described above. Fines Management Services (FMS) Arval will forward your first name, surname, date of birth and address linked to the registration plate of the vehicle made available to you to the Federal Public Service for Mobility and Transport for use in the Central Vehicle Database. This data will only be used by authorised recipients through the Federal Public Service for Mobility and Transport's Central Vehicle Database for the purposes set out in Article 4(7) of the Royal Decree of 8 July 2013 regarding the implementation of the Law of 19 May 2010 concerning the creation of the Central Vehicle Database, in particular: enabling the detection, prosecution and sentencing of criminal acts (infractions); facilitating the fulfilment of the duties of the police regarding road transport and road traffic safety, including the safety of motor vehicles and trailers; facilitating the fulfilment of the duties of the administrative police by the relevant police services; facilitating the collection of taxes, charges or fees for vehicle parking. How do we protect your personal data and where do we store it? Arval implements a range of appropriate organisational and technical measures to safeguard your personal data against unlawful processing and/or loss. Arval employees with access to the personal data of those concerned on behalf of Arval are bound by a non-disclosure agreement. Despite the security measures taken by Arval, third parties may nevertheless seek to circumvent these measures and/or use the personal data of those concerned for malicious purposes. Arval cannot be held liable for this.

5 Arval is not liable for any damage resulting from the use of personal data by third parties to whom this data was provided on the basis of this privacy policy or with the consent of the person(s) concerned. To the extent possible under the applicable legislation, Arval is furthermore not liable for ensuring the compliance of these third parties with the applicable laws and regulations (including privacy laws). In exceptional cases, your personal data will be processed (including the storage and preservation thereof) in a country outside the European Economic Area (EEA) that does not offer the same level of protection for personal data as is provided in Belgium. By submitting your personal data to us, you agree to your data being processed in this manner. We shall take all measures that could reasonably be required to ensure that your personal data is processed in accordance with applicable legislation, with the EU model contract in relation to the processing of personal data and with this privacy policy. Your rights relating to the personal data processed by Arval You can contact Arval at any time to find out which of your personal data is processed by Arval, to amend information supplied by you to Arval or to have it deleted from our database. You can do so using the contact details stated at the top of this page or via your account manager. You can also contact Arval if you have any questions about this privacy policy or if you require more information about the manner in which Arval processes your personal data. If you have concluded a business agreement and you ask Arval to delete your personal data, we request that you first discuss this with the employer under whose responsibility we process your personal data. Arval will delete personal data in compliance with the applicable legal storage periods. How long will we store your personal data for? Arval will only store your personal data for as long as is necessary for fulfilling the purpose for which the data was collected and for meeting legal, regulatory and/or internal requirements. You are of course entitled to request that we delete your personal data from our databases. We shall proceed with the deletion of this data in accordance with the applicable laws and regulations. Declaration to the Commission for the Protection of Privacy Arval has reported the processing of personal data to the Commission for the Protection of Privacy (the "privacy commission"). This declaration is included in the public register that can be viewed on the website of the Commission for the Protection of Privacy. Applicable law and competent jurisdiction This privacy policy is exclusively governed by Belgian law. All disputes regarding the interpretation or application of this privacy policy will be reviewed solely by the competent courts in Brussels.