Privacy statement product

Privacy Statement
Moove Connected Mobility B.V.
May 2022

Moove Connected Mobility B.V. (“Moove”) is an expert in the field of automotive telematics. Incooperation with, among others, our partner Geotab Inc. (“Geotab”), we connect vehicles to theinternet and provide access to a wide range of relevant data.This data comes from the engine management (on board diagnostics) and from additional devicesand sensors (internet of things). Based on this data, which we provide to our customers via customisedinterfaces and dashboards, referred to as the "Connected Mobility Services", Moove enables leasecompanies, insurers and other vehicle fleet managers to adjust their business operations and thusimprove road safety, carry out vehicle maintenance more efficiently (or have this done by others)and/or reduce the burden on the environment.

Moove is located in Utrecht. Our contact details are as follows:

Visiting address:
Moove Connected Mobility B.V.
Email: info@mooveconnected.com
Stadsplateau 113521 AZ Utrecht

Postal address:
Moove Connected Mobility B.V.
PO Box 30503 3503 AH Utrecht

Moove processes and collects personal data, possibly including your data. In most cases, we do this on the basis of agreements executed with our clients, which can be regarded as data controllers within the meaning of the General Data Processing Regulation (EU) ("GDPR"), and in that role also determine the purpose and means of processing and collecting personal data. If we also process your personal data because, for example, you have been designated by our client as the actual user of a vehicle belonging to the client's vehicle fleet (referred to below as the "Fleet") and which we have connected to the Internet by means of one of our Connected Mobility Services at the client's requests, you are a data subject within the meaning of the GDPR and this Privacy Policy also applies to you.

The processing and collection of personal data is an important part of the delivery of our products and services. Moove is responsible in its capacity as a data processor for protecting this data as well as possible. In doing so, we must meet the requirements of the GDPR. We also want to be transparent about the types of data we process and collect from the drivers, the purposes and basis for this processing, with whom we share data and what rights the drivers have with regard to their own data. We would like to inform you about this by means of this Privacy Policy.

If you have any questions after reading this Privacy Policy, please feel free to contact us. This can bedone by contacting our Data Privacy Officer using the above email address and telephone number, orby sending a letter to the postal address provided above.

1. Types of data
1.1 Moove strives to process only personal data that is strictly required, relevant and proportionate to the purposes for which it was collected. If a function or Connected Mobility Service can be achieved with anonymous data, we will try to anonymise that personal data. In cases where anonymous or non personal data is combined with personal data, we will treat this as personal data.
‍
1.2 Depending on the Connected Mobility Service provided by us to the client, we may process the following personal data of the driver provided by the client or (indirectly) by the driver of a vehicle:
• your contact details, such as name, address, residence, telephone number and email address;
• your age and sex;
• your driving licence details;
• details of your employment, profession and employer;
• the registration number, vehicle identification number and data related to the vehicle used by you, such as the date of purchase, mileage, data related to previous maintenance and damage, etc;
• location data of the vehicle generated by actions actively performed by you, such as navigation aids, searches entered into the navigation system, etc
• In addition, the vehicle being used by you automatically collects data that is not directly related personally to you. This data recorded by the vehicle or by a dongle installed in thevehicle for the purpose of the Connected Mobility Services is usually linked to the vehicle'sregistration number or vehicle identification number and can therefore be traced back to youand for this reason is considered to be personal data. The data recorded by the vehicle may include the following data:
• technical safety related data, such as information on the activation of airbags and belt tensioners, windows and doors that may or may not be closed, etc;
• technical data relating to engine status, control, braking, maintenance, remaining mileage and months for next service, etc;
• driving information such as speed, use of brake and accelerator pedals, direction of thevehicle, fuel consumption, how much fuel a vehicle still has, driving time, etc;
• location information, such as the actual position of the vehicle at that moment, determination of the zone in which the vehicle is located, geofencing, etc;
• ambient data, such as outdoor temperature; and
• all other data required for the execution of the agreement with the client and the improvement of vehicle-related information and (mobile) electronic communication services, including data that enables a connection to be made between the driver of a vehicle and thevehicle.

2. Purposes and legal grounds for the processing of data
We process and collect the personal data first and foremost in order to execute the contractual agreement which we have concluded with our client and which is aimed at improving road safety, carrying out maintenance on vehicles more efficiently and/or reducing the burden on the environment.It is also possible that legal obligations may require us to retain your personal data. In the context of our business operations, the data recorded by the vehicle can also be used by us to offer new or current mobility services to the client, for the improvement and/or further development of the current or future services provided to the client and for other functionalities that may be relevant to the client,for analysis purposes and/or for research purposes.

We also assume when collecting and processing your personal data that our client (i) has sufficiently as certained your interests, (ii) has properly balanced these interests of yours, and his own - legitimate - interests in the collection and processing of relevant personal data, and (iii) has been able to make the reasoned decision that he has a legitimate interest in the processing of your data on these grounds or for these purposes. You can also restrict the collection and processing of your personal data at anytime by making use of the rights assigned to you by the GDPR.
‍
3. Storage and retention period of personal data
3.1 We will not keep your personal data for any longer than is necessary in light of the reason(s) for which it was first collected.
‍
3.2 We only retain your personal data for as long as and to the extent that we need it to be able to fulfil the agreement with our client, for our business operations, for the time required to fulfil our legal obligations or for a maximum of the statutory storage periods applicable to us.

4. Information, modification, deletion and objection
4.1 Moove strives to ensure that your personal data is accurate and up to date. We will at all times try to delete or change incorrect and incomplete personal data. Your personal data belongs to you and you therefore have specific rights with regard to how it is processed. You can always contact us about this, but we will have to consult our client, who is considered to be the data controller. We will refer youto the relevant client if required.

4.2 Under GDPR, you have the following rights, which Moove will always work to uphold:
A. The right to be informed about the collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact Us to find out more or to ask any questions using the contact details above.
B. The right to access the personal data we hold about you.
C. The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete.
D. The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we hold.
E. The right to restrict (i.e. prevent) the processing of your personal data.
F. The right to object to us using your personal data for a particular purpose or purposes.
G. The right to withdraw consent, if applicable. This means that, if Moove is relying on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time.
H. The right to data portability. This means that, Moove may transfer of your personal data to yourself or to another organisation at your request.
I. For more information about Moove use of your personal data or exercising your rights as outlined above, please contact the Privacy Officer using the contact details provided above.

4.3 If a vehicle connected to the internet by us has more than one driver, you as the data subject canonly inspect your own personal data (and only if this is technically possible). If you make a request forinspection, you must therefore state the period or periods during which you were the actual driver ofthe vehicle in question and provide supporting evidence of this.

4.4 Modifying or deleting personal data may not always be possible (technically or otherwise). In suchcases, we will provide you with a reasoned explanation as to why the change or deletion you want is not possible. If possible and desirable, we will then keep a separate note of the corrections you require.

5. Protection of your data
Moove makes every effort to adopt and implement such technical and organisational measures as may reasonably be expected to protect your personal data against accidental or unlawful destruction, accidental loss, unintentional modification, unauthorised disclosure or making available and all other forms of unlawful processing. We do this by taking the measures that may reasonably be expected ofus on the basis of the state of technology.

6. Provision of data to third parties
6.1 We will not share any of your personal data with any third parties without valid justification. We may do this if such provision serves the purposes of processing the personal data (as set out in article 2 of this Privacy Policy and only if the client has given the written permission to do so), If we or the parties involved in the proper performance of the agreement are obliged to do so by law or a court order, in order to safeguard our rights or those of the parties involved in the proper performance of the agreement, to protect the personal security of (the employees of) Moove or the parties involved in the proper performance of the supply agreement, or if you have given us permission for this to be done.
‍
6.2 For the purpose of our business operations and depending on the products and services we provide to our client; we may also provide your personal data to the following persons or parties:
• external parties that (on the request of the client) are or should be involved in the proper performance of an agreement with our client, such as loss adjusters, auditors, logistics service providers, suppliers of software and hardware, etc. Processing shall not take place outside countries belonging to the European Economic Area that consists of all EU member states, plus Norway, Iceland, and Liechtenstein, unless they offer at least such guarantees as the European Union.

6.3 External parties that process the personal data under our control and responsibility do soexclusively for the purposes and under the conditions agreed by the client and subsequently with thesethird parties. We lay this down in writing in processor's or sub-processor's agreements that also ensurethat these external parties assume at least the same obligations as we have agreed with our client. In addition, we oblige these external parties to treat the data provided by us safely and confidentially.

6.4 We reserve the right to share aggregated (not personally identifiable) information obtained in the course of providing its services to the client with third parties for any purpose whatsoever.

7. Amendments to the Privacy Policy
It is possible that we may amend this Privacy Policy from time to time. This may be necessary, for example, if the law changes, or if We change our business in a way that affects personal dataprotection. You will always find the most recent policy on our website. The latest change date is shownat the bottom of this Privacy Policy. If and as soon as we have made changes to our Privacy Policy, wewill make an amended version of this policy available on our website.

8. Right to complain
8.1 Do you disagree with how we process your personal data or deal with your rights as a datasubject? If so, please contact us via our Privacy Officer. This can be done using the email address andtelephone number given above or by sending a letter to the postal address also given above.
‍
8.2 If you are unable to reach agreement with us, you can also submit a complaint to the Dutch DataProtection Authority. For this purpose, we refer you to the website of the Dutch Data ProtectionAuthority Dutch Data Protection Authority.Get in touchmooveconnectedmobility.cominfo@mooveconnected.com