1. Introduction

ALJ Motors is committed to respecting your privacy and protecting your personal data.

• We will be transparent about the information we are collecting about you and what we will do with it.

• We will use your personal data for the purposes described below. Your personal data will not be processed in a manner inconsistent with the purpose of its collection or in cases other than those stipulated by applicable privacy laws.

• We will only process your personal data where we have a legal basis to do so. The legal basis will depend on the reason or reasons we collected and need to process your personal data.

• We have measures to protect your personal data and keep it secure.

• We will respect your data protection rights and aim to give you control over your own personal data.

You can access our full Privacy Policy below to help you to understand how we use your personal data. In it, we explain in particular the types of personal data we collect, how we collect and process it, what we may process it for and who we may share it with.

2. Full privacy policy

2.1 Controller Of Personal data

Any personal data processed in connection with this Privacy Policy is controlled by ALJ Motors, having its registered office at Abdul Latif Jameel Motors Company-Head Office. Al-Safa District, Prince Majed Street, Jeddah, P.O. Box 248, Jeddah 21411, Kingdom of Saudi Arabia, which is considered the “data controller” of your personal data under the Kingdom of Saudi Arabia’s Personal Data Protection Law and its Implementing Regulations.

To contact ALJ Motors Data Protection Officer, please send a request using the contact details specified at the end of this Privacy Policy.

2.2 What Do We Mean By Personal Data?

Personal data means any data, regardless of its source or form, that may lead to identifying you specifically, or that may directly or indirectly make it possible to identify you, including your name, personal identification number, addresses, contact numbers, license numbers, records, personal assets, bank and credit card numbers, photos and videos of you, and any other data of a personal nature.

2.3 When Does This Policy Apply?

This Privacy Policy applies to personal data about you that we collect, use, or otherwise process in connection with your relationship with us as a customer.

2.4 How We Collect and What Types of Personal Data Do We Collect About You?

2.4.1 Direct Collection

We collect and generally process personal data that you provide directly to us when you interact with us through any of the following channels:

• Through the Toyota website: When you interact with us on the Toyota website to avail of any of our services.

• Walk-in Channel: When you visit the center and provide your information while availing of any Toyota service.

• Email: When you reach out to us from your email ID to submit their relevant details and share the official documents.

• Express mail: When you courier your documents to us through our delivery service vendor.

• Through our ChatBot: When you interact with us through our Chatbot to avail of any of our services.

• Through our Teleservices channels: When you interact with our toll-free channel for any Toyota service-related inquiries or updates.

In that respect, we collect the following types of personal data:

• Name

• Address

• Bank Account Details

• Email Address

• Contact Number

• IBAN number

• VIN Number

• Vehicle Number

• Gender

• Signature

• Contact Number

• ID Number

• Signature

• CR Number

• VAT Certificate

• Owner ID

• Representative ID

• National ID

• Letter from the Ministry of Chamber of Commerce

• City

• Driving License

• Geolocation

• Vehicle Registration Details

• Vehicle Details

• Vehicle Owner Details

• Authorization Letter of the Authorized Representative

• Iqama ID

• Bank Statement

• Personal Identification Number

• Nationality

• Marriage Status

• Istimara (registration card image)

• Car images

We will inform you at the time of collection of your personal data whenever the provision of such personal data to us is mandatory in order to allow us to achieve the purposes described below. Otherwise, the provision of personal data is optional. If you do not provide the personal data we require this may affect our ability to provide goods or services to you.

2.4.2 Indirect Collection

We may also collect and process personal data about you indirectly when you interact with our wholesalers or when you share your personal data with us at events held by our Internal Marketing and Communications Team.

In that respect, we collect the following types of personal data:

• Name

• Email Address

• Contact Number

• ID

• VIN Number

• Vehicle Number

• Gender

• Address

• Driving License

• National ID

2.5 What Do We Use Your Personal Data For and Our Legal Basis?

We will only process your personal data where we have a legal basis to do so. The legal basis will depend on the reason or reasons we collected and need to use your data, as described below:

2.5.1 Performance Of A Contract With You

It will be necessary for us to use your personal data to:

• Provide the agreed-upon services, including vehicle maintenance, repairs, and any other services outlined in the repair agreement.

• Communicate with you regarding the status of your vehicle, updates on the service process, and any necessary follow-ups.

• Billing purposes, including generating invoices, processing payments, and managing financial transactions related to the services provided.

• Quality assurance purposes, to ensure that the services provided meet the agreed-upon standards and to identify areas for improvement in service delivery.

• Facilitate the processing of insurance claims related to the repair of your vehicle.

• Determine the extent of damage to the vehicle and obtain approval for necessary repairs.

• Obtain approval from the insurance company before proceeding with repairs.

• Verify the customer's ID card for special corporate discounts as agreed upon in the contract.

• Facilitate secure transactions through the payment gateway, ensuring smooth processing of payments for parts services.

• Book appointments for services, and other follow-ups to enhance your customer experience.

• Address parts-related inquiries, facilitate sales transactions, and provide notifications via SMS, or chat based on your preferences.

• Transfer the ownership of the vehicle purchased by ALJ Motors.

• Finalize the selling process of the vehicle purchased by ALJ Motors or by you.

• Conduct an in-house inspection of your vehicle purchased by ALJ Motors.

• Process the demand letter shared by you for selling your vehicle to ALJ Motors.

• Facilitate cash payments for ownership transfer.

• Facilitate financing schemes for your purchase.

2.5.2 Legitimate Interests

We have a legitimate business interest in processing your personal data to:

• Engage with you and provide you with information and assistance through the website, toll-free channel, and live chat.

• Process your requests for services submitted via the website, toll-free channel, and live chat.

• Collect delivery details at checkout and share them with the shipping company for order fulfillment and delivery purposes.

• Maintain communications with you regarding your orders, service requests, and other inquiries.

• Process and verify the official documents couriered by you.

• Courier your official documents related to your request.

• Register B2B customers and their representatives in the ALJ Motors systems.

• Verify the authenticity and accuracy of the representative's information.

• Verify the validity of customer information via request letters and stamps from the chamber of commerce.

• Help the business serve new customers effectively by understanding their needs and preferences.

• Enable customers to create accounts on the website for accessing chat support.

• Provide follow-up support for customer inquiries.

• Help the business serve its customers by facilitating service appointments and addressing their requests.

• To handle complaints received from the customers.

• To facilitate the return process for customers.

• To facilitate secure transactions through the payment gateway, ensuring smooth processing of payments for parts services.

• To engage customers who have shown interest in campaigns, potentially leading to appointment bookings and increased sales.

• To book appointments for parts services, and other follow-ups enhancing customer experience.

• To address parts queries and provide personalized responses based on the status of the customer's request, via ChatBots.

• To offer different services to customers, including issuing plates and Istimara.

• To manage and follow up on test drive requests and feedback, both for walk-in and online customers.

2.5.3 Consent

We rely on your prior consent in order to:

• Send you promotional messages, newsletters, and marketing campaigns

• Use your feedback and interaction data to improve the services offered by the business.

• Create targeted marketing strategies, delivering relevant promotions or offers.

• Analyze data to suggest products that align with your preferences and past interactions.

• Utilize transaction-level data to understand the purchasing patterns, preferences, and trends of individual customers.

• Conduct surveys or feedback requests related to return experiences.

• Send personalized offers or promotions based on past return behavior.

• Provide targeted marketing communications or product recommendations based on return history.

• Send you promotional messages, newsletters, and marketing campaigns

• Use your feedback and interaction data to improve the services offered by the business.

You can withdraw your consent to such processing at any time, by visiting the consent withdrawal webpage on our Toyota website.

In case you receive any marketing communication from us, it will also have an unsubscribe option which will allow you to stop receiving further marketing communication.

Please note that if you tell us that you do not wish to be sent further marketing communications, you will still receive service communications (as described above) that are necessary, for example, to notify you of your account or payment status.

2.5.4 Compliance with Legal Obligations

There are situations where we are subject to a legal obligation and need to process your personal data to comply with those obligations. These legal obligations are as follows:

• Reporting customer complaints-related data with the Ministry of Commerce as required.

• Reporting on the vehicle ownership transfer on the Al-Muroor Platform by the Traffic Department.

• To comply with the requirements of Insurance Regulations.

• To comply with requirements from ZATCA (Zakat, Tax, and Customs Authority) by validating and fetching data from the internal system to ZATCA.

2.6 How Long Do We Keep Personal Data?

We will keep your personal data for no longer than is necessary for the purpose it is being processed for as identified in this Privacy Policy.

We will keep your information in electronic format for a period of 10 years to ensure comprehensive support and compliance across all business areas.

We will keep your information in hard copy format for a period of 5 years as required by our Business. Post the expiry of this period, we will archive your information in hard copy format.

We will keep the information for a period that enables us to handle or respond to any complaints, queries, or concerns relating to your account, including statutory requirements.

If you stop interacting with us as a customer, we will remove or anonymize your information after the passing of the statutory requirements.

On the expiry of the applicable data retention periods, we will delete it securely, or in some cases anonymize it.

If you wish to know more about our retention policy and retention periods that apply to your personal data, please send a request using the contact details specified at the end of this Privacy Policy.

2.7 Who Do We Share Your Personal Data With?

For the purposes referred to under this Privacy Policy, we share your personal data with processors, acting on our behalf and upon our instructions, providing us with the services necessary for the achievement of the purposes described above, i.e.:

• Different third-party providers for the following purposes:

- For sending the customer an update of their queries/complaints via SMS and WhatsApp.

- For utilizing customer data for providing delivery services.

- For utilizing customer data for direct marketing and promotional messages.

- For shipping and delivery service that is required to courier your documents.

- For the appointment of services for the customer.

- For the purpose of validation of invoice details.

- For the purpose of utilizing the payment gateway and sending a web link for online payment to you.

- For transferring ownership and reporting the documents to the Traffic Department on their Al-Muroor platform.

- For the purpose of offering invoicing-related services to ALJ Motors.

• Our sister entity, for the purpose of handling the service appointment for the customer.

• The company of our group, for the purpose of providing financing for your purchase, if availed.

These third parties are only permitted to use your personal data to the extent necessary to enable them to provide their services to us. They are required to follow our instructions and to comply with appropriate security measures to protect your personal data.

We do not sell personal data to third parties, and we only allow third parties to send you marketing information where we have your consent to do so.

2.8 Do we Transfer Your Personal Data Outside KSA?

When we share your personal data with the entities mentioned above, it may imply transfers of your personal data outside KSA, namely to Ireland and Turkey.

We seek to ensure such transfers satisfy the conditions set out under the applicable privacy laws. We have in particular limited the transfer to the minimum personal data needed and implemented sufficient guarantees for preserving the confidentiality of the personal data transferred so that the standards of the protection of your personal data are not less than the standards set forth in the applicable privacy laws.

2.9 What Are Your Legal Rights In Relation To The Personal Data We Hold About You?

Under the applicable privacy laws, you have certain rights in relation to your personal data. Responses to exercise your rights will be provided within 30 days (or such other period under applicable law). If your request is particularly complicated we may extend the deadline for responding by a further 30 days (or such other period permitted under applicable law), but we will let you know if this is the case.

We will handle all requests in accordance with applicable law. However, depending on the right you wish to exercise, and the nature of the personal data involved, there may be legal reasons why we cannot grant your request. Further explanation of those rights and the exceptions to them are set out below.

Details of how to exercise your rights are set out in the section below “How can you exercise your legal rights and change how we use your data?”.

Your rights include the following:

· Right of access to your personal data;

· Right to be informed about our processing of your data [this Privacy Policy provides this information];

· Right to obtain personal data in a readable and clear format;

· Right to request correction, completing or updating of personal data;

· Right to request the destruction/erasure of personal data.

In any case, you also have the right to lodge a complaint with the competent data protection authority in accordance with applicable law if you consider that the processing of your personal data carried out by us infringes the applicable privacy laws.

2.10 How Can You Exercise Your Legal Rights And Change How We Use Your Data?

In order to exercise any of your rights mentioned above, or if you have any questions about our use of your personal data, please send a request using the contact details specified at the end of this Privacy Policy.

We may ask for some additional information to confirm your identity, which will only be used to process your request.

In your request, please try to make clear which right(s) you would like to enforce and provide any details which may help us answer to your request.

Where you fully or partially lack legal capacity (for example you are a child under 18) your legal guardian may be required by applicable law to exercise your rights on your behalf.

2.11 Security of Your Personal Data

To protect against the loss, misuse, and alteration of the information under our control, we have in place appropriate physical, electronic, and managerial procedures. For example, our servers are accessible only by authorized personnel, and your information is shared with respective personnel on need to know basis to complete the transaction and to provide the services requested by you.

Although we will endeavor to safeguard the confidentiality of your personal data, transmissions made by means of the Internet cannot be made absolutely secure.

To make sure your access to our services is secure, you should not share your login details with anyone else. When you finish using our services, you should log out if others may be able to access your computer or device. This is especially important if you are using a publicly accessible computer.

Be aware that there is an Internet fraud practice known as ‘phishing’ which is the illegal gathering of personal data by deception. Unsolicited emails are sent to individuals from lists illegally gathered by a third party, and recipients are asked to enter or reconfirm bank or password details into a cloned or illegal copy website.

3. How will we inform you of changes to this privacy policy?

If we change this Privacy Policy, we will let you know about the changes by publishing the updated version on the Toyota website. If such a change to the Privacy Policy requires your consent, you will have a choice to consent as to whether or not we may use your personal data in this different manner.

We are committed to protecting and respecting your privacy and will continue to do so in any future changes we make to this Privacy Policy.

4. How to get in touch with us and your right to complain to our supervisory authority?

If you want to exercise any of your rights, or if you have any questions about this policy or our use of your personal data, please contact the Data Protection Officer.

The Data Protection Officer for ALJ Motors can be contacted via email at ALJMDPOOFFICE@alj.com.

CONTENT

PRICES OF TOYOTA PRODUCTS

USE OF "COOKIE" TECHNOLOGY

PERSONAL DATA PROTECTION

USER INPUT

COPYRIGHT NOTICE

TRADEMARKS

HYPERLINKS

WARRANTY OF ACCURACY

LIMITATION OF LIABILITY

UPDATE OF POLICY