DATA PROTECTION DECLARATION FOR VEHICLES WITH INTERNET ACCESS AND FOR THE USE OF MOBILE ONLINE SERVICES (CONNECT)

1. General information

With this data protection declaration, we inform you about the collection, processing and use of your personal data arising from the use of a vehicle with Internet access and when using the CUPRA CONNECT mobile online services, (referred to below as “CONNECT Online Services”) in accordance with the provisions of regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, "GDPR"); as well as the Spanish Data Protection Spanish Act 3/2018; and other local regulations that complement it. The entity responsible for data processing is:

Data controller identity: SEAT, S.A.U. with Tax Identification Number A-28049161 (referred to below as the “Entity”) Adress: Autovía A-2, Km. 585, Martorell (Barcelona, Spain) Email: customercare@cupraofficial.com.

2. What personal data do we process, how do we use it and what is the legal basis?

In general, the type of data processed in your vehicle may include the following categories, which may be considered personal data when processed under certain premises and in certain circumstances:

2.1. Data processing’s regarding Internet connectivity

In this section we inform you about the processing of your personal data when using a vehicle with Internet access in both offline and online mode.

A) Data processing for the connectivity activation

The vehicle is factory fitted with a SIM card for the Internet access. Therefore, in order to ensure connectivity as soon as the SIM card has been included in the vehicle, the telecommunications provider receives information about the vehicle identification number (hereinafter, “VIN”) to which the SIM card has been assigned.

The vehicle needs to connect to the data server before it is handed over to you at the dealer point of sale or, at least, when the vehicle has an initial mileage of 25 km. This connection is necessary to certificate the registration on our data server. In case of the vehicle was in offline mode immediately before the start of the update process, the vehicle will automatically return to offline mode, once the update process has been completed, due to the importance of this function. Once this update is done, if the vehicle is in offline mode, no data will be sent from the vehicle and therefore, the data processing will only take place locally in the vehicle. Likewise, all mobile online services will be deactivated except from the legal required and security-relevant service known as “emergency call system - eCall”. This service can go online.

Additionally, it is technically necessary that the telematics box (Online Connectivity Unit) installed in the vehicle, (which is necessary to establish the connectivity of the vehicle), restarts itself regularly and dials into the local radio network so that the vehicle is able to establish online connection, e.g. when the vehicle user switches the vehicle to online mode, or when the eCall is used due to an accident. This process only takes place if the vehicle is currently not in operation, but regardless of whether it is in offline or online mode. If the vehicle was in offline mode, it is automatically switched back to offline mode when the restart is completed.

The kind of data to be processed for these activities are the mileage of the vehicle, the IP address, the VIN, and the SIM number. The purpose of these processing activities is to ensure connectivity that will allow you the activation and use of the mobile online services which are already available in the vehicle. All these data processing’s are based on the fulfilment of the contract between you and the dealer where you have purchased your vehicle with internet access., as well as to fulfil our legal obligation as manufacturers to provide our vehicles with the "eCall - Emergency Call System" (Art. 6.1.b as well as Art. 6.1.c GDPR).

B) Emergency call system - eCall

The emergency call system (“eCall”) works in online and offline mode and is already available if no CONNECT Online Services contract has been concluded. If the vehicle is in offline mode, a data connection is only established if you are involved in a traffic accident or if you make an emergency call using the SOS button in the vehicle.

If you are involved in a traffic accident, an automatic emergency call will be sent to the rescue control centre. Sensors in the airbag and seatbelt tensioner enable the vehicle to detect when an accident has occurred and, in this case, activate the legally required “eCall - emergency call system”. On the other hand, you can also manually report your own emergency call at any time. When activated, a voice connection is established with the rescue control centre, via which – depending on the individual case – further data can also be called up and transmitted (e.g. on the type and severity of the accident).

The following data are also transmitted automatically and directly from the vehicle to the rescue control centre: vehicle type, time, location, direction of travel, number of people in the vehicle. The automatic data transfer to the rescue coordination centre is based on the protection of vital interests (Art. 6.1.d. GDPR) as well as on a legal obligation (art. 6.1.c. GDPR) in conjunction with Regulation (EU) 2015/758 of the European Parliament and of the Council of 29 April 2015 concerning type approval requirements for the introduction of in-vehicle eCall systems based on the 112-emergency call and amending Directive 2007/46/EC.

C) Secure communication between vehicle and data server, technical availability of mobile online services.

If the vehicle is in online mode, certain data are transmitted from the vehicle. This means that the vehicles “communicate”. Communication is partly necessary to ensure that the Car2X function available in the vehicle run technically safely and flawlessly. Detailed information on data processing in connection with Car2X function can be found in the Legal section of the infotainment system and in the Car2X Privacy Policy. You will be able to activate the mobile online services of CONNECT Online Services for your vehicle at any time at your request. In addition, the vehicle compares data in online mode with the data server to ensure that any CONNECT Online Services activated in the vehicle are technically available and that secure communication between the vehicle and the data server take place.

Every time the vehicle goes online or the ignition is operated while the vehicle is in online mode, it must authenticate itself on the data server; the Entity process the following personal data: The VIN, the IP address including the SIM card number of the vehicle and, only if the CONNECT Online Services are activated, your user ID. The user ID is processed to check whether the CONNECT Online Services have been activated by a main user for the vehicle so that the services can be provided accordingly. In addition, the time of the vehicle systems is synchronised with the time of the data server when the ignition is activated. To check the validity of the certificates sent from the vehicle for secure communication, the vehicle must have the correct time. Only in this way can secure communication with the data server be established and cyber-attacks by third parties be counteracted. The data processing is carried out based on our legitimate interest in establishing secure communication between the vehicle and our data server and to be able to technically provide the basic services which are available to you in the vehicle without the conclusion of a separate contract, as well as the CONNECT Online Services if applicable (art. 6.1 f) GDPR).

D) Online software updates

For legal reasons, we provide you software updates (e.g. of the control unit software) via the vehicle's online connection ("Online software updates") if you become "CONNECT" customer. In case you do not contract CONNECT Online Services; you can also obtain necessary software updates by contacting your authorised dealer and service partner. Therefore, before making a software update available online, it is necessary to determine the vehicles for which a "CONNECT" contract has been concluded or not. For this purpose, it is necessary to check the VIN of all ID vehicles that are due for an update and to check the status of their "CONNECT" contract. If a CONNECT contract has been concluded, the data processing takes place for the purpose of fulfilling the contract (Art. 6.1.b GDPR) while, for all other owners, the processing is carried out due to our legitimate interests in being able to adequately provide the "Software Update/Online System Update" service. (Art. 6. 1.f GDPR).

2.2. Data processing’s regarding CONNECT Online Services (CONNECT)

In this section we inform you about the processing of your personal data when activating and using CONNECT Online Services (also referred below as “CONNECT”).

A) Activating CONNECT Online services

To activate and use CONNECT Online Services, you first need to create a User ID account. With the User ID you can register with CONNECT Online Services or services offered by third parties such as the Importer in your country. If you do so, the online service you have selected will be linked to the User ID account. The data processing necessary for this is carried out for the purpose of performance of the contract, meaning the T&C to be accepted at the time of creating the user ID account in accordance with art. 6.1 b. GDPR. The User ID serves as a central user account in which you can centrally manage your personal data. Information on data processing in context of User ID can be found in the Privacy Policy of CUPRA User ID.

If you decide to activate the CONNECT Online Services, the Entity processes your identification and contact data in connection with the performance of the contract for CONNECT Online Services. (Art. 6.1 b) GDPR). Additionally, the Entity may process the invoice and payment data you provide in connection with your VIN for the purposes of correct accounting and fraud prevention. The legal basis is our legitimate interest in fulfilling our obligations regarding proper accounting (art. 6.1 f. GDPR).

The Entity processes personal data that come from the vehicle in order to provide the activate CONNECT Online Services you have contract, insofar as this is necessary for the performance of itself (art. 6.1.b GDPR). In any case, VIN is processed and, in addition to the VIN and User ID, we also log the time and type of a service used to identify and analyse faults. This is done to safeguard out legitimate interest in improving mobile online services so that they can be made available to all our customers with as little disruption as possible (art 6.1.f GDPR).

Finally, resulting from the contact data provided by you in the CONNECT registration, SEAT may invite you to participate in a customer satisfaction and/or market research surveys with regard of your new purchased connected vehicle. These studies may be sent by SEAT as responsible for CONNECT services on the basis of its legitimate interests (article 6.1, letter f of the GDPR) as vehicle’s manufacturer given that the information obtained by these kinds of studies can be used by an aggregated way to product improvement and optimization of our sales processes. It is a very valued and interesting information for SEAT. If you want to object to this processing, please, follow the instruction given on point 7 of this declaration. We recommend you read Data Protection information included in the market study before participating.

B) Using of the CONNECT Online Services

If you have any doubts or questions about CONNECT Online Services you can contact your Service Partner (service partner and/or dealer), the Importer in your country (by phone, mail, app or contact form) or our customer service department via customercare@cupraofficial.com. In these cases, the following data will be processed by us: Contract data, user ID (name, address, email, telephone number), VIN, service-specific processing data and associated time stamps as well as other data which you provide us with in the context of your enquiry. The Entity processes the data in accordance with art. 6.1.b GDPR for the purpose of implementing the CONNECT Online Services contract or – if you are not already a customer – for the initiation of a contract for CONNECT Online Services.

Note that if CONNECT Online Services have been activated by one vehicle user (“Main User”) with his/her User ID, any other vehicle user can also use CONNECT Online Services in the same vehicle. However, it is not possible for different users to login as main user at the same time. Please, be aware that if you use CONNECT Online Services in a vehicle without being a CONNECT Online Services customer for this vehicle (“Main User”), the Main User may view vehicle related data generated while your use.

When using the CONNECT Online Services, such vehicle data is processed that is necessary to provide the respective contracted services, among others, the VIN number, the location, the speed, the position, traffic information, battery state of charge etc. For further information please see your Service Porfolio. For the main user, the data processing is carried out for the purpose of fulfilling the contract (art. 6.1. b) of the GDPR). For all other users, the processing of their vehicle usage data is carried out on the basis of our legitimate interest in providing the services on the basis of the concluded CONNECT Online Services contract for the vehicle (art. 6.1. f) GDPR).

Every vehicle user has the possibility to set the vehicle to offline mode in the settings. By setting “Offline mode” you can prevent the processing of personal data by us, as the data connection will be disconnected (for data processing in offline mode, read the section “Data processing in offline mode”). The main user is not able to view data about the trips in offline mode. Therefore, mobile online services can then no longer be provided.

For information regarding data processing when using My CUPRA App, please refer to its privacy policy.

B.1. Data Upload for Learning Map for semi-automated driving

The Entity processes your personal data for the purpose of data upload Learning Map for semi-automated driving. The aim of the Learning Map data upload is the continuous improvement of Travel Assist function with swarm data for semi-automated driving. The collected data is used so that “Travel Assist with Swarm Data” learns routes and can assist drivers of all vehicles equipped with Travel Assist with Swarm Data on these learned routes. The data sent is anonymised in a period of 24 hours in our data servers, so no conclusions can be drawn about individual drivers. The data upload is initially deactivated and requires a specific consent of the user in the CUPRA App.

B.2. Online Voice Control with location data

When using the Online Voice Control function, the Entity will process you location and your current vehicle position each time you provide voice input in vehicles with the CONNECT Plus Package, and will link it - if appropriate when processing the voice input - to potentially interesting locations in your surroundings in order to provide you with better results (such as navigation destinations or charging stations) more quickly. If doing so is not appropriate when processing the voice input, the current vehicle position will not be processed any further. The basic Online Voice Control function will remain covered by the contractually guaranteed scope even if you do not give consent.

2.3. Processing activities related to the safety and conformity of your connected vehicle

The Entity will monitor the statuses and alerts transmitted by your vehicle in order to assure safety-related aspects, and also to detect possible errors, analyse them, propose and implement improvements and solutions. Once collected, this data may be linked to technical production data and previous visits to the garage, in order to draw conclusions that are important for the vehicle's safety and proper functioning. Appropriate security measures will be applied at all times to ensure the security of the data processed, including their anonymisation, unless it is necessary for the Entity to process the VIN. The legal basis for this data processing is the Entity's legitimate interest (art. 6.1 f) of the GDPR) as manufacturer of the vehicle and provider of the CONNECT service, in order to detect errors that affect the safety and quality of the product and service, thereby resulting in a direct benefit for the user.Without access to this information, the Entity would be unable to detect errors and improvements. With respect to this processing, the Entity has determined the existence of compelling legitimate grounds which, as provided in article 21.1 of the GDPR, do not allow the data subject to exercise his or her right of objection.

2.4. Processing activities related to the optimisation and development of vehicle functions and the use of connected services

In order to optimise and improve your vehicle's functions and adapt them to customer expectations and market developments in general, and in particular to achieve further and new developments of innovative functions, your vehicle generates various functional and technical data (for example, vehicle use, fuel consumption, status, control and infotainment data). This information will be associated with your VIN and vehicle IP. The Entity will not use this data to create profiles or evaluate them on the basis of individualised vehicles. Furthermore, no data attributes will be used to create profiles or draw conclusions about your behaviour or behaviour patterns during use of your vehicle. As soon as this information has been collected, appropriate security measures will be applied to ensure the security of the data processed, including their anonymisation, unless it is strictly necessary for the Entity to process the VIN. The Entity will process the above data within the framework of time-limited activities in order to optimise the range of vehicle functions and adapt them to customer expectations, on the basis of safeguarding its legitimate interests or those of a third party unless overridden by interests or fundamental rights and freedoms which require the protection of personal data (Art. 6.1.f) of the GDPR). You can deactivate data transmission via your vehicle's privacy settings. If you wish to object definitively to the processing of your personal data, please contact our customer service department.

2.5. Third-party services and applications

You may be able to connect your smartphone to the vehicle in order to control it through the in-vehicle system (using apps such as Android Auto or Apple CarPlay). The integration allows use of selected Smartphone apps. The type of data processing performed is determined by the provider of the respective app used. You can obtain more information and set the selection via the respective app and your smartphone's operating system. Additionally, under some premises, you may be able to use apps for which third parties are responsible, for example, Google or Spotify, among others, in combination with the entertainment services offered by the Entity through the CONNECT services. As a preliminary step before starting use of these services, you must carefully read and accept the respective service provider's Terms and Conditions and Privacy Policy. The Entity will not be held liable at any time for such processing.

2.6. Compliance with legal obligations.

When so stipulated by law, the Entity, as the vehicle's authorised manufacturer, will be required, at the request of the competent authorities, to process and report certain data stored in the vehicle related to the vehicle owner. Some of these obligations may arise from the investigation of criminal offences, traffic accidents, control of second-hand sales, etc. Thus, data may be disclosed concerning the vehicle's functioning, use, control, status and technical data associated with its VIN, such as, for example: mileage, speed, acceleration, navigation control, seat belt status, environmental conditions, battery, fluid and pressure statuses, etc. Data processing and their notification to the Authorities is covered under the Entity's compliance with a legal obligation (Art. 6 para 1, Subs. 1 letter c) of the GDPR), as the vehicle's manufacturer. In addition, specifically, in compliance with Commission Implementing Regulation (EU) 2021/392 on the monitoring and reporting of data relating to CO2 emissions from passenger cars and light commercial vehicles, the Entity will report vehicle data recording on-board fuel and/or energy consumption. This data will be read at the garage when you take your vehicle to an Authorised Service Partner and will be sent to Volkswagen Group AG and the European Commission together with your vehicle identification number (VIN). You can access the complete information on your vehicle's Repair Order.

2.7. Vehicle events and maintenance alerts

Finally, in certain cases of your vehicle incidents and alerts, it may be necessary for the Entity to process certain data related to your vehicle (consumption, mileage, location, type of incident/alert…). These data may be processed by the Entity as well as by the Importer in your country in case of roadside or vehicle maintenance events and may be communicated to the Official Service Network (dealers and garages) and other third parties such as Insurance companies (in case of accidents or breakdown incidents) for managing the services, repairs, and assistance activities. The Entity may process these data under compliance with a legal obligation (Art. 6 para 1, Subs. 1 letter c) of the GDPR), as the vehicle manufacturer, and may disclose them to third-party Entities in the case of recall operations covered by law, or under your express consent ((Art. 6.1.f) of the GDPR) when applicable.

3. Data maintainment

We will keep your personal data from CONNECT Online Services as long as necessary to provide you with the functionalities included by CONNECT Online Services, and, in any event, until you ask for their erasure. The Entity will maintain your data while our contractual relationship is in force and, after completion, for a period maximum of 10 years according to local legal provisions. As soon as this period has elapsed, your personal data will be anonymised as stipulated in the above-stated premises related to product safety and compliance.

4. Data recipients

The disclosure of your personal and vehicle data to third parties will only take place in compliance with the corresponding legal obligations.

4.1. Advice on the conclusion of contracts and customer service

If you were advised by your Service Partner when you concluded your contract for mobile online services, the partner will receive a premium payment. This is processed via the sales company (the Entity’s importer in your country) responsible for your country. For this purpose, the Entity and the Importer receive the VIN for being able to assign the premium payments to the respective contracts via the mobile online services and to pay them out to the Entity’s service partner accordingly (art. 6.1 f) GDPR). The VIN is not linked to other personal data held by the Importer in your country.

4.2. Data servers and data disclosure to third parties

The Entity will give access to data to third parties acting as data processors for the purpose to be able of offering CONNECT Online Services. These third parties will always process this personal data on our behalf. The Entity uses data servers provided by the Volkswagen Group, which also provides maintenance and technical support for the IT systems. The suppliers of the Volkswagen Group will only process data on our behalf and under our direction. Finally, we hereby inform you that the Entity may communicate your data to entities of the VW Group for the purpose of quality control and optimising internal group sales and aftersales processes and channels. Such processing is based on the safeguarding of our legitimate interests and for the benefit of you as a client of our cars.

5. Will your personal data be sent outside the EU?

All processing of your data will be carried out within the European Economic Area and will receive the same level of protection as in the European Economic Area. Additionally, depending on the vehicle model, data might be processed on servers that contract their services outside the European Economic Area guaranteeing the processing of your data with the corresponding safeguards. In this sense, we inform you that our Entity, as part of the VW Group has contracted certainsubprocessors including SalesForce, Inc. Amazon Web Services (AWS) and Microsoft Corporation to provide data hosting services. These companies encrypt the data and process it exclusively on data servers located in the European Union. As these Entities are based in the United States of America, access to the data from the United States of America cannot be ruled out, and therefore, corresponding EU standard contract for data protection clauses have been signed to ensure that your personal data are sufficiently protected. You can contact us at dataprotection@seat.es if you would like to obtain a copy of these or if they have been made available to you.

6. Users and privacy settings

CONNECT Online Services are available to different users who may use the vehicle at any given time. In this respect, different roles have been enabled to allow them to enjoy the advantages of the connected vehicle. Depending on your vehicle's generation, you will be able to register as:

Please note that other guest users logged into this vehicle may see your parking position or settings preferences. You can manage the users and the privacy settings via the vehicle's Infotainment. The privacy settings of the car allow you, depending on the vehicle model, to set the vehicle to offline mode or to limit the sending of data. Anyway, communication may be established to ensure the vehicle's general Internet access or in the event of an accident, for the activation "eCall system”. You can also, manage your data in your CUPRA ID portal.

You can also reset the vehicle to factory setting. To do this, the car must be in online mode. This function resets settings stored in the car to factory settings and deletes the CONNECT Online Service’s main user – if any- from the car and returns the car to offline mode. It is possible to restore the CONNECT Online Services related data for 14 days if the same User ID is registered again using the code displayed in the vehicle. If this is not done within 14 days, the CONNECT Online Services related data is also deleted from the data server.

7. What are your rights and contact channels?

7.1. Rights definition

You can exercise the following rights in your condition of data subject below the Entity:

Please, note that we only process the VIN for offering some functions of CONNECT Online Services, in these cases, these rights are only available to a limited extent according to art. 11 of the GDPR. This means that we are only obliged to fulfil your rights if when exerting your rights, you have provided us with additional information which puts us in a position to be able to fulfil your right.

Finally, should you consider that the Entity has not processed your personal data in accordance with applicable law, you can lodge a complaint with the relevant supervisory authority, being in Spain the Spanish Data Protection Authority, www.aepd.es.

7.2. Contact channels

You can manage your privacy and personal data at any time in the vehicle’s infotainment and the User ID Portal: https://cupraid.vwgroup.io/. If you prefer, you can also contact customercare@cupraoffical.com directly. Exercising these rights is free of charge except in the case of manifestly unfounded or excessive requests. If you wish to assert your data protection rights before the Entity’s Importer or their Dealer and Service Partner networks, please contact them directly. If you have any doubts about data protection, or wish to get in touch with our data protection officer (“DPO”), you can also contact him by sending an email to dataprotection@seat.es.

Version: September 2023