My Bentley APP Personal Information Protection Statement

Publish and Effective Date: 2020.09

Update Date: 2024.03

Volkswagen Group Import Co., Ltd. (hereafter “VGIC” or “we”) is a nation-wide sales company which covers the brand of Volkswagen import vehicles (including passenger car and light commercial vehicle) and registered in the People’s Republic of China. The registered domicile of VGIC is Room 316, Kaili Building, No.188 Tianbao Road, Tianjin Free Trade Pilot Zone , China.

The following My Bentley APP Personal Information Protection Statement (hereafter the “Statement”) will apply to My Bentley App and it describes how VGIC, VGIC affiliates and VGIC authorized entities collect, use, and process customer’s (hereafter “Customer” or “you”) personal information. Please read the following terms carefully. Your agreement to the following Statement should precede your registration on and use of My Bentley APP services ( hereafter the "Service” ).

Personal information under this Statement refers to various information related to identified or identifiable natural persons recorded electronically or by other means, excluding anonymized information . VGIC affiliates includes CARIAD (China) Co., Ltd., and VGIC authorized entities refer to authorized dealerships and qualified third-party service providers who process information on our behalf, such as call center service provider and IT service provider.

If you have any question, please contact: 400-650-8626 .

This Statement will provide our Customers with the following information:

1. Collection and Usage of Personal Information

2. Protection of Personal Information

3. Your Rights

4. Children’s Personal Information

5. Global Transfer of Your Personal Information

6. Update of the Statement

7. Contact Us

Responsible processing of personal information is part of the social and legal responsibilities of VGIC, and we are fully aware of the fact that personal information is important to Customers and will do our utmost to ensure the security and reliability of Customer’s personal information. This Statement is made to ensure adequate protection of Customer’s personal information under the Cyber Security Law, Personal Information Protection Law and other applicable laws and regulations of the People’s Republic of China. We will protect our Customers’ personal information following the principles of fairness and lawfulness, definite purpose of data processing, proportionality, transparency, consent, security etc. as defined in applicable laws and regulations and VGIC internal policy. We will implement appropriate technical and organizational security measures to protect the personal information against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access.

We highly recommended that you to review the specification below.

1. Collection and Usage of Personal Information

We collect your personal information strictly in accordance with relevant laws and regulations. For the purpose of this Statement, Sensitive Personal Information refers to the personal information that is likely to result in damage to the personal dignity of any natural person or damage to his or her personal or property safety once disclosed or illegally used, including such information as biometric identification, religious belief, specific identity, medical health, financial account and whereabouts and tracks, as well as the personal information of minors under the age of 14; vehicle whereabouts, audio, video, images and other information involved in the process of car design, production, sales, use, and operation and maintenance. We have marked up sensitive personal information (if any) in bold for your special attention.

1.1 Collection and Usage of Personal Information during Registration

When you register for and use My Bentley service infrastructure, personal information are collected, processed, and used, and may be transmitted to third parties as described below, in order to provide you with all services with regard to My Bentley services infrastructure and to fulfil our contractual obligations that exist in this context. We perform all of the data processing described in this section either - to the extent indicated - based on your consent or to fulfil our contract with you.

1.1.1 Registration process

To use My Bentley, registration on the My Bentley service infrastructure is required. Registration can take place in two ways, and you are free to choose the method of registration:

1.1.1.1 Registration facilitated by authorized dealer

Subject to the Customer’s choice, the authorized dealer will enter the following information via the dealer’s access to our systems: name, email address, phone number, VIN, address, province. In this case, you will then receive a link sent by e-mail via which you are required to confirm your registration.

1.1.1.2 Self-registration

In the event that registration has not taken place via an authorized dealer, you may register yourself. As proof of successful verification, we will also store the name, address, as well as the vehicle identification number(VIN), owner name, and address shown in the ownership documentation. Following successful verification, you will receive a link sent by e-mail via which you are required to confirm your registration.

Information required during self-registration include: your e-mail address (Bentley ID), password, your name and title, contact and address information. Such information is necessary for setting up and managing a Bentley ID user account for you so that you can use the full range of services and functions offered by My Bentley. We also store the time of your last login. During registration, we will perform a verification check of your name and address information.

1.2 My Bentley Service Infrastructure: Data Processing after Registration

If you have registered a Bentley ID user account, we will share, transfer or disclose basic information about your user account and your vehicle with authorized Bentley dealers in order to provide you with Services via our dealers. In addition to the vehicle identification number, we transfer your user name (Bentley ID), as well as relevant events associated with the creation, modification or deletion of your user account and the connection with vehicles You may check the relevant information of the Bentley dealer in your sales contract.

1.3 Deletion of your Bentley ID User Account

If you delete your Bentley ID user account, your My Bentley profile will also be deleted. My Bentley APP will then no longer be available to you.

For more details of Bentley ID, please refer to Bentley ID personal information protection policy.

1.4 Collection and Usage of Personal Information after Registration

We collect Customers’ personal information in order to provide Customers with product and service, as well as to improve the product and service experience of the Customers.

With our Customers’ consent, for the purposes as provided in the chart below, we will collect the following types of information under each of the listed scenarios:

We will only collect Customers’ personal information in accordance with relevant laws and regulations. If you refuse to provide us with the above listed personal information, you will be prevented from enjoying the respective service.

1.5 System Permission

When you use the following service, My Bentley App will apply the following system permission as below:

1. Location permission;

The permission will be applied when you use the Navigation service.

1. Calendar permission;

The permission will be applied when you use the Navigation service

1. Notification permission:

The permission will be applied when you use the Notification service

1. Contacts permission:

The permission will be applied when you use the Navigation service

An inquiry window will pop up automatically to request this permission the first time a service is accessed that requires this system permission. These permissions can be turned off in the settings of the mobile device. After turning off a permission, the APP features requiring that permission will no longer be able fully function. Please check with your mobile device provider for more detailed information related to the permission settings in the system.

SDK

In order to ensure the realization and stable operation of relevant functions, we may access software development kits (SDKs) provided by third parties to achieve related purposes. We will strictly monitor the security of the software tool development kit (SDK) used by our partners to obtain information to ensure data security. You can view the data usage and protection rules of third parties in the table below.

1.6 Entrusting to process, Sharing, Transfer and Disclosure of Personal Information

1.6.1 Entrusting to process your personal information

To realize the following purposes, we engage the following VGIC affiliates and VGIC authorized entities to process your personal information:

• To provide the App maintenance and storage service, we engage T-system P.R. China Co. Ltd and CARIAD (China) Co., Ltd.;

• To provide the call center service, we engage China Unicom Smart Connection Technology Ltd.;

VGIC affiliates and VGIC authorized entities are required to strictly follow this Statement, and take necessary measures to ensure confidentiality and security of our customers’ personal information. VGIC will not and does not allow third parties to share, transfer, or disclose our customers’ personal information for unauthorized purposes.

1.6.2 Sharing and Transfer

We will not share, transfer or disclose our Customers’ personal information with any other entities or individuals, unless under one of the following circumstances:

• We may share, transfer or disclose our Customers’ personal information upon explicit consent from our Customers.

• We may share, transfer or disclose our Customers’ personal information according to laws and regulations, law enforcement or compulsory requirements from government agencies or courts.

• We may, in the event of a reorganization, merger or sale, require the new company or organization that will hold your personal information to continue to be abided by this Statement; otherwise, we will require the new company or organization to ask for your authorization and consent again.

• We may share or transfer your personal information with VGIC dealers who is chosen by you as the “preferred retailer” for purposes of providing sales and pre-sales service, aftersales service and information service.

  The following types of Customer personal information may be shared with, transferred to, accessed or otherwise processed by VGIC dealers: Email address, phone number, VIN, address, name. We will ensure that our Customers’ personal information receives equivalent protection from VGIC dealers as it does under this Statement.

  VGIC dealers are required to strictly follow this Statement, and take necessary measures to ensure confidentiality and security of our Customers’ personal information. We will not and do not allow third parties to share, transfer, or disclose our Customers’ personal information for unauthorized purposes.

1.6.3 Public Disclosure

We will publicly disclose your personal information only under the following circumstances:

1. After obtaining your explicit consent;
2. Disclosure in accordance with the Law: we may publicly disclose your personal information as required by laws, under legal procedures, in lawsuits or upon compulsory requirements of competent government authorities.

2. Protection of Personal Information

2.1 Storage of Personal Information

Our Customer’s personal information will be stored in the databases located within the city of Beijing, Mainland China. We store your personal information for minimum period necessary for achieving the above-mentioned purposes or in accordance with the above-mentioned legal requirements. After such period, we will permanently delete or anonymize your personal information.

We treat our Customers’ personal information very seriously. Our Customers’ personal information is stored in databases which are housed in facilities using strict physical security measures and IT security measures with limited authorized access only. Personal information collected by us will be kept in our database only to the extent necessary to achieve the purpose.

2.2 Information Security

We adopt technical and organizational security measures which are in line with widely recognized industry standard in order to protect the personal information under our control against accidental or intentional manipulation, loss, destruction and against access by unauthorized persons. The security measures are updated as necessary to meet our business needs, changes in technology, and regulatory requirements, i.e. Access Control, System Hardening, Network Vulnerability Scan and Management, Awareness Training, Logging and Security Event Management, Transmission and Storage Encryption.

In case of personal information security incident, we will follow internal designed emergency plan to investigate and take all necessary measures to eliminate the potential risks in accordance with applicable laws and regulations. We will promptly inform you of such incident by email, letter, telephone, push notification, etc. If it is difficult to inform each of the personal information subject, we will adopt a reasonable and effective way to issue an announcement. At the same time, we will also proactively report the handling of personal information security incidents in accordance with the requirements of the regulatory authorities.

3. Customer Rights

Our Customers have rights to access, correct, delete their personal information, change the scope of their authorization or cancel their accounts through online contact channels, or you may contact us through400-650-8626 .

3.1 Online Channels

If you sell your vehicle or no longer wish to use the My Bentley services, you can remove the vehicle from your account by following the steps below: 1) Navigate the My Bentley APP Dashboard to select to the vehicle that you want to delete; 2) Select the information icon at the top-right of the vehicle image; 3)Select “delete vehicle”.

If you no longer wish to own a My Bentley Account, you can permanently delete it by following the steps below: 1) From the My Bentley APP Dashboard, click the profile icon at the bottom-right of the page; 2) Select the “account”; 3) Select “Delete account”.

3.2 Hotline

In order to access, correct, or delete your personal information, request to change the scope of authorization, or cancel your account, you may call 400-650-8626 to contact us. For security reasons, you may be required prove your identity by providing a written request or by other means. We may authenticate your identity before responding to your requests.

Generally, we will reply within 15 days. In principle, we will not charge fees for your reasonable request(s); however, if your request(s) is raised repeatedly or beyond a reasonable extent, we will charge a certain amount of fees depending on the costs. If your request(s) is repeated without any justified reason, or needs to be realized through excessive technical manner (for example, a new system needs to be developed or the common industry practice needs to be completely altered), or will bring risks to other person’s legitimate rights or interests, or is relatively unrealistic (for example, it involves the information stored on backup tapes), we may decline your request(s).

We will not respond to your requests under any of the following circumstances:

1. Where your request is related to the performance of our obligations provided under laws and regulations;
2. Where your request is directly related to national security and national defense security;
3. Where your request is directly related to public safety, public health and major public interests;
4. Where your request is directly related to criminal investigation, prosecution, court trial, and execution of rulings etc.;
5. Where we have sufficient evidence that you have subjective malice or abuse of rights;
6. Where it is difficult to obtain your consent when data processing is for the purpose of safeguarding your life or other individuals’ life, property and other major legal rights and interests;
7. Where responding to your request will cause serious damage to the legitimate rights and interests of you, or other individuals or organizations;
8. Where your request involves trade secrets.

If a Customer is unsatisfied with the received reply, the Customer may file the complaint to competent authorities. Upon receiving questions from the Customers about the information of authorities, we will endeavor to provide the Customer with information about relevant authorities which may be applicable to the Customer’s particular circumstances.

4. Children’s Personal Information

Our Services mainly target adults. If we discover that we’ve accidentally collected information from a child below 14, we will remove that child’s information from our records as soon as feasibly possible.

5. Global Transfer of Your Personal Information

Please refer to the Notification and Consent Letter for Bentley ID Cross-border Transfer of Personal Information.

6. Update of the Statement

We may update this Statement from time to time. When we update this Statement, we will revise the “Update Date” at the top of this Statement. We will also notify our Customers through a pop-up window when they log-in, and Customers need to consent again to the updated Statement.

7. Contact Us

If our Customers have any questions or concerns about this Statement or if our Customers would like to make a complaint about a possible breach of relevant laws and regulations, please contact us through 400-650-8626 or the contact person for user rights affairs: Mr. Yang Jiachun, data-protection@volkswagen.com.cn. If a Customer is unsatisfied with the received reply, the Customer may file the complaint to competent authorities. Upon receiving questions from the Customer about the authorities, we will endeavor to provide the Customer with information about relevant authorities which may be applicable to the Customer’s particular circumstances.

My Bentley APP Statement on the Processing of Sensitive Personal Information

Release Date: March 2024

Effective Date: March 2024

This Statement on the Processing of Sensitive Personal Information (hereinafter referred to as “Statement”) only applies to My Bentley applications and aims to provide you with information regarding how Volkswagen Group Import Company Limited and its affiliates as well as authorized service providers (hereinafter referred as “we”) will process and protect your sensitive personal information when you use all or part of the following functions through My Bentley applications.

Before using our services, please carefully read and fully understand the Statement and start using our services after you confirm that you sufficiently understand and agree with this Statement.

This Statement aims to assist you to understand the following content:

1. How We Collect and Use Your Sensitive Personal Information
2. How We Retain and Protect Your Sensitive Personal Information
3. Howe You Exercise Your Rights Associated with Sensitive Personal Information through Means and Procedures
4. Others
5. How to Contact Us

1.How We Collect and Use Your Sensitive Personal Information

We will evaluate the necessity of collecting and using your sensitive personal information in accordance with the requirements of relevant laws and regulations, informing the necessity and obtaining your separate consent by means such as relevant policies and rules, page notification, interactive procedures, and public notice at an appropriate time, and will limit the impacts to the rights and interests of your sensitive personal information within the minimum scope.

We will abide by the principles of legitimacy, legitimacy and necessity, collecting and using your sensitive personal information based on the following purposes, means and scope specified under this Statement. We will strictly follow the requirements of applicable laws, regulations and standards, and fulfil our legal obligations accordingly.

1. Car Finder

When we provide you with car finder services to assist you to check the location of the vehicle on application, we will collect and/or use the location data of the customer and vehicle.

1. Navigation

When we provide you with Navigation services to assist you to with Navigation, you will be able to search for locations to navigate to. we will collect and/or use the location of handset.

1. Call Center

When we provide you with the call center service, we will record the communication call with you to solve the problem from customer side and to improve the service quality.

2.How We Retain and Protect Your Sensitive Personal Information

Our Customer’s sensitive personal information will be stored in the databases located within the city of Beijing, Mainland China. We store your sensitive personal information for minimum period necessary for achieving the above-mentioned purposes or in accordance with the above-mentioned legal requirements. After such period, we will permanently delete or anonymize your sensitive personal information. We treat our Customers’ sensitive personal information very seriously. Our Customers’ sensitive personal information is stored in databases which are housed in facilities using strict physical security measures and IT security measures with limited authorized access only. sensitive Personal information collected by us will be kept in our database only to the extent necessary to achieve the purpose.

We adopt technical and organizational security measures which are in line with widely recognized industry standard in order to protect the sensitive personal information under our control against accidental or intentional manipulation, loss, destruction and against access by unauthorized persons. The security measures are updated as necessary to meet our business needs, changes in technology, and regulatory requirements, i.e. Access Control, System Hardening, Network Vulnerability Scan and Management, Awareness Training, Logging and Security Event Management, Transmission and Storage Encryption.

3. Means and Procedures for You to Exercise Your rights Associated with Sensitive Personal Information

In accordance with relevant laws, regulations and standards that are currently effective, as well as industry practices, we safeguard your exercise of relevant rights on your sensitive personal information. Detailed means and procedures for exercising the above-mentioned rights please refer to My Bentley APP Privacy Statement.

4.Others

The Statement provides supplementary rules to the My Bentley APP Privacy Statement. For matters not mentioned under this Statement, please refer to the My Bentley APP Privacy Statement.

1. How to Contact Us

If you have any questions, opinion or suggestion regarding this Statement, please contact us by the following means.

• Customer Hotline:400-650-8626 ;
• Contact Person for User Rights Affairs: Mr. Yang Jiachun (data-protection@volkswagen.com.cn)