indiGO Auto Group Holdings, LLC
PRIVACY STATEMENT

Scope

This Privacy Statement governs the collection, use and other forms of processing of personal data by indiGO Auto Group Holdings, LLC (“indiGO”) related to our services, our products and this website.

Who is responsible for processing your personal data?

indiGO (indiGO Auto Group Holdings, LLC, 13921 North Freeway, Houston, TX 77090, USA) is the legal entity responsible for all collection and all processing of your personal data in connection with indiGO’s products, services and websites.

indiGO is part of Pon Holdings B.V. its affiliates and its subsidiaries (“Pon”). indiGO and Pon are committed to respecting and safeguarding your privacy and the security of your personal data you share with us.

Why do we process your personal data?

Personal data is information that identifies you as an individual or relates to an identifiable individual. When you choose to register your personal data, contact us, visit our websites, or apply to a job posting, we will process some personal data about you. We process these personal data for the following purposes:

1. communicate with you in a personal way or to inform you about indiGO products or services, consistent with your choices;
2. provide customer service, including service around the purchase of services and products, fulfil warranty obligations and product recalls for our own services and those of related companies, and to deal with any enquiries or complaints;
3. administer and fulfil your purchases of indiGO products including the financial and logistic handling;
4. administer your indiGO account;
5. administer your participation in any contests, promotions, surveys or website features;
6. perform market research and improve our business, services and indiGO products or to develop new business, services and products;
7. perform statistical analyses and reporting;
8. providing services on the internet;
9. offering a loyalty program and communicating with participants;
10. provide app functionality, including providing relevant commercial messages;
11. to communicate future promotional and marketing information including direct marketing purposes and retargeting;
12. to aggregate and/or anonymize personal data in order to generate other data for our use;
13. to comply with our legal obligations, resolve disputes, or enforce our agreements;
14. as otherwise stated at or about the time information is collected.

Which personal data we process?

Which personal data we exactly process, depends on which websites, products or services you use. We collect the following categories of information from and about you:

• Contact information, such as name, postal address, email address, and phone number.
• Information regarding your lease or finance terms and monthly payment amounts, that we may obtain from third-party sources.
• Information regarding the mileage on your vehicle, which is collected when you bring your vehicle to our dealership’s service department, or that we may obtain from third-party sources.
• Geolocation information
• Online identifiers, such as username and IP address.
• Usage information, such as how you and your device interact with our website (e.g., the pages you visit, search terms you enter, referring/exit pages, platform type, date/time stamps.)
• Other information, such as your car preferences, or information regarding your potential trade-in vehicle, that you provide or that we may obtain from third-party sources.

How do we process your personal data?

In the table below we describe the purposes for which we process data that we collect as well as the legal basis for the processing:

Our legitimate interests include: marketing, advertising, security, (crime) prevention, IT management, research and analysis of our products or services, business management, legal affairs, internal management.

If you chose to provide your personal data in one of the above listed ways and provide explicit consent or visit our website and accept cookies, you authorize indiGO and its service providers to collect, store, use, disclose, and otherwise process your personal data in connection with the purposes as described above.

You have the right to withdraw your consent which you may have given to the processing of your personal data at any time by sending your withdrawal request via email to privacy@pon.com. Because email communications are not always secure, please do not include sensitive information in your emails to us.

How do we share or transfer your personal data?

You should be aware that indiGO is part of a business group within Pon and that departments (such as IT or Marketing) can be located in Pon companies around the world. As a consequence, your personal data may be shared within and/or transferred to other business group companies or other Pon companies around the world. You may consult the list and location of our companies here: https://pon.com/en/about-pon/companies/.

indiGO may share or disclose your information to the following categories of third parties and for the following reasons:

• To third-party service providers, agents or independent contractors who help us maintain our Services and provide other administrative services to us. (Specifically, these services may include website hosting, data analysis, payment processing, order fulfilment, information technology and related infrastructure provisioning, customer service, email delivery, and auditing.)
• To unaffiliated third parties whose products and/or services we believe might be of interest to you.
• We may share your personal information in the course of any reorganization process including, but not limited to, mergers, acquisitions, and sales of all or substantially all of our assets.
• We may disclose your personal information to law enforcement, government agencies, and other related third parties, in order to comply with the law, enforce our policies, or protect our or others’ rights, property or safety.

indiGO requires the third parties with whom we share or disclose information to diligently process and protect your personal data.

How do we protect your personal data?

indiGO takes reasonable and appropriate technical and organizational security measures to protect against loss or unlawful processing of personal data and to ensure the security of your personal information. This may include using secure registration forms, encryption of data and restricting access to your personal data. Please understand, however, that no data transmission over the Internet can be guaranteed to be 100% secure. Consequently, indiGO cannot ensure or warrant the security of any information you transmit to us and you understand that any information that you transfer to us is done at your own risk.

If we learn of a security system breach, we may attempt to notify you electronically so that you can take appropriate protective steps. By using the Services or providing personal information to us, you agree that we can communicate with you electronically regarding security, privacy and administrative issues relating to your use of the Services. We may post a notice via our website if a security breach occurs. We may also send an email to you at the email address you have provided to us in these circumstances. Depending on where you live, you may have a legal right to receive notice of a security breach in writing.

International data transfer

indiGO is based in the U.S. If you choose to provide us with information, please understand that your personal information may be transferred to the U.S. and that we may transfer that information to our affiliates and subsidiaries or to third parties, across borders, and from your country or jurisdiction to other countries or jurisdictions around the world. If you are visiting from the EU or other regions with laws governing data collection and use that may differ from U.S. law, please note that you are transferring your personal information to the U.S. and other jurisdictions which may not have the same data protection laws as the EU. We put in place appropriate operational, procedural and technical measures in order to ensure the protection of your personal information.

How long do we retain your personal data?

We retain personal data for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law.

The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide our services to you (for example, for as long as you have an account with us or continue using our services);
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); or
• Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

Cookies, web beacons and similar technologies

If you are using our websites, services, applications, communications (including email) and accessing or using tools, we, and third parties we allow, use cookies, web beacons and other similar technologies for storing information to provide you with a better, faster and safer browser experience.

A "cookie" is a small text file that a website can place on your computer’s hard drive or on your mobile device’s memory in order to collect information about your activities on our website. An "image tag," also known as a clear GIF or web beacon, works together with cookies and is a small image file that may be located in various areas of our website. Most browsers automatically accept cookies, but you have the option to change your browser setting to decline them.

We may use session cookies or persistent cookies. Session cookies only last for the specific duration of your visit and are deleted when you close your browser. Persistent cookies remain on your device’s hard drive until you delete them or they expire. Different cookies are used to perform different functions, as explained below:

• Essential: Some cookies are essential in order to enable you to move around our website and use its features, such as accessing secure areas of our website. Without these cookies, we cannot enable appropriate content based on the type of device you are using.
• Analytics: We use Google Analytics to measure how you interact with our website and to improve your user experience.
  To learn more about Google Analytics privacy practices and opt-out mechanisms, please visit https://support.google.com/analytics/answer/6004245?hl=en.
• Targeted Advertising: We use cookies to compile information on our user’s interaction with our website. We use this information to serve ads to you based on your past visits to our website and to show our ads on sites across the Internet.

There are several ways to manage cookies. You can control the use of cookies at the browser level, by instructing your browser to accept cookies, disable cookies or notify you when receiving a new cookie. Please note that if you reject cookies, you may still use our website, but your ability to use some features or areas of our website may be limited. The Network Advertising Initiative also offers a means to opt-out of a number of advertising cookies. Please visit www.networkadvertising.org to learn more. Note that opting-out does not mean you will no longer receive online advertising. It does mean that the company (or companies) from which you opted-out will no longer deliver ads tailored to your preferences and usage patterns.

How we respond to do-not-track signals

Some browsers have a "do not track" feature that lets you tell websites that you do not want to have your online activities tracked. These features are not yet uniform, so we are not currently set up to respond to those signals.

Your rights

If you would like to request to review, correct, update, suppress, restrict or delete personal data, object to the processing of personal data, or if you would like to request to receive an electronic copy of your personal data for purposes of transmitting it to another company (to the extent these rights are provided to you by applicable law), you may contact us via privacy@pon.com. We will respond to your request consistent with applicable law.

In your request, please make as clear as possible what personal data your request relates to. For your protection, we may only implement requests with respect to the personal data associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable and in any event within any applicable legally required timeframes.

Collection and use of information from children

Our Services are not intended for children. We do not knowingly collect personal information from children, and none of our Services are designed to attract children. In the event that we learn that a person under the age of 13 has provided personal information to us, we will delete such personal information as soon as possible.

Opt-out

We provide you the opportunity to opt-out of marketing communications by clicking the “unsubscribe” link in email communications or by contacting us using the contact information provided below. We will endeavour to process your request as soon as possible in accordance with applicable law, but please be aware that in some circumstances you may receive a few more messages until the unsubscribe is processed. Additionally, we may send you information regarding our Services, such as information about changes to our policies and other notices and disclosures required by law. Generally, users cannot opt-out of these communications, but they will be primarily informative in nature, rather than promotional.

Third-party links

Our website contains links to other sites such as third-party online retailers, advertisers, or unrelated sites that we may link to or web sites that link to our website. These sites may collect personal information directly from you. The information policies and practices of these unrelated parties are not covered by this privacy policy. We do not control the privacy policies of third parties even if we may provide hyperlinks or other access to their web sites. We are not responsible or liable for their independent policies and practices. Please review their privacy policies and practices. It is your responsibility to review them and decide if you are satisfied with their protections.

Contact, questions, feedback and data protection officer

If you have any questions about this Privacy Statement, please contact us at privacy@pon.com.

You may also contact our Data Protection Officer (DPO) via privacy@pon.com. You have the right to lodge a complaint with a data protection authority for your country or region or where an alleged infringement of applicable data protection law occurs.

Policy Changes

We may change this Privacy Statement from time to time. Any changes will become effective when we post the revised Privacy Statement. If necessary, we will inform you when a change occurs. This statement was last revised on January 1, 2020.

Privacy notice addendum for California residents

Pursuant to the California Consumer Privacy Act of 2018 (“CCPA”), we hereby provide additional details regarding the categories of Personal Information* about California residents that we have collected or disclosed within the preceding 12 months.

* “Personal Information” as defined in Section 1798.140 of the CCPA means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

We collected the following categories of personal information:

• Identifiers, such as name, contact information, online identifiers, and government-issued ID numbers;
• Personal information, as defined in the California customer records law, such as name, contact information, signature, [payment card number, medical information, insurance information, education information, employment information,] and government-issued ID numbers;
• Characteristics of protected classifications under California or federal law, such as gender and marital status;
• Commercial information, such as transaction information and purchase history;
• Biometric information, such as fingerprints and voiceprints;
• Internet or network activity information, such as browsing history and interactions with our website;
• Geolocation data, such as device location and IP location;
• Audio, electronic, visual, and similar information, such as call and video recordings;
• Professional or employment-related information, such as work history and prior employer;
• Education information subject to the federal Family Educational Rights and Privacy Act, such as student records; and
• Inferences drawn from any of the Personal Information listed above to create a profile/summary about, for example, an individual’s preferences and characteristics.

As described above, we collect this Personal Information from you and from other categories of sources: publicly available databases, joint marketing partners and OEMs when they share the information with us. Also as described above, we may use this Personal Information to operate, manage, and maintain our business, to provide our products and services, and to accomplish our business purposes and objectives, including, for example, using Personal Information to: develop, improve, repair, and maintain our products and services; personalize, advertise, and market our products and services; conduct research, analytics, and data analysis; maintain our facilities and infrastructure; undertake quality and safety assurance measures; conduct risk and security control and monitoring; detect and prevent fraud; perform identity verification; perform accounting, audit, and other internal functions, such as internal investigations; comply with law, legal process, and internal policies; maintain records; and exercise and defend legal claims.

We disclosed the following personal information to third parties for our operational business purposes:

• Identifiers, such as name, contact information, online identifiers, and government-issued ID numbers;
• Personal information, as defined in the California customer records law, such as name, contact information, signature, payment card number, medical information, insurance information, education information, employment information, and government-issued ID numbers;
• Characteristics of protected classifications under California or federal law, such as gender and marital status;
• Commercial information, such as transaction information and purchase history;
• Biometric information, such as fingerprints and voiceprints;
• Internet or network activity information, such as browsing history and interactions with our website;
• Geolocation data, such as device location and IP location;
• Audio, electronic, visual, similar information, such as call and video recordings;
• Professional or employment-related information, such as work history and prior employer;
• Education information subject to the federal Family Educational Rights and Privacy Act, such as student records; and
• Inferences drawn from any of the Personal Information listed above to create a profile/summary about, for example, an individual’s preferences and characteristics.

We share Personal Information with our affiliates, service providers, third-party sponsors of sweepstakes, contests, and similar promotions, and our business partners.

For purposes of this Privacy Policy, “sold” or “sale” means the disclosure of Personal Information for monetary or other valuable consideration but does not include, for example, the transfer of Personal Information as an asset that is part of a merger, bankruptcy, or other disposition of all or any portion of our business.

We have not “sold” personal information for purposes of the CCPA.

California residents may request that we:

• Disclose the following information covering the 12 months preceding their request:
  • The categories of Personal Information we collected about you and the categories of sources from which we collected such Personal Information;
  • The specific pieces of Personal Information we collected about you;
  • The business or commercial purpose for collecting Personal Information about you; and
  • The categories of Personal Information about you that we otherwise shared or disclosed, and the categories of third parties with whom we shared or to whom we disclosed such Personal Information (if applicable).
• Delete Personal Information we collected from you.

To make a request for the disclosures or deletion described above, please contact us in accordance with the “Contact Us” section below. We will respond to your request consistent with applicable law.

You have the right to be free from unlawful discrimination for exercising your rights under the CCPA.

Contact Us - Information for California Residents

If You Have Any Questions, Comments or Concerns About Our Privacy Practices or This Policy, Please Contact Us Via Toll Free Number or Email.

• PHONE (Toll Free): (866) 979-5937
• EMAIL: privacy@pon.com