Global Privacy Statement

Societe Generale Group takes your privacy seriously. Privacy has been a priority area for us for a long time, where we have implemented clear principles, especially considering GDPR (General Data Protection Regulation)

LeasePlan's global privacy statement

The European Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data has been in effect since May 25, 2018 (hereinafter referred to as "GDPR"). GDPR increases awareness among all actors in the European Union and beyond about various issues related to the handling, use, and storage of personal data. In this context, ALD SA's privacy statement aims to explain how we, as a data controller, collect, store, use, and disclose your personal data each time you use our products and services, our websites, or interact with ALD SA. This statement is intended to explain our privacy practices.

1. General principles.

ALD SA understands your concerns regarding the confidentiality of your personal information. Below, we describe how we obtain and use this information and outline your rights. Please read this carefully to ensure that the process is as fair, transparent, and secure as possible. The following principles are central to how we process your personal information:

Transparency and fairness: When we collect and process your personal information, we inform you of who is collecting and receiving this data, and the reasons for this. When required by law, we always seek your prior consent (e.g., before collecting sensitive information or sending direct marketing materials). We never use your personal information for purposes that are incompatible with the purposes outlined here.

Legitimacy: ALD Automotive does not collect or process personal information without a lawful basis. We use your personal information only for appropriate business purposes (e.g., providing services, managing customer relationships, managing customer vehicle fleets and accurate billing, or for marketing activities, profiling to better serve customers, conducting satisfaction surveys, or preparing reports, and complying with our legal obligations).

Minimization: We only collect personal information that is strictly necessary for data processing, as described in this document. We collect sensitive information only where relevant. We take all reasonable measures to ensure that your recorded personal information is accurate, complete, and up to date.

Privacy: We strive to ensure privacy by implementing the processing of personal information. To this end, we also conduct privacy impact assessments to ensure that our security measures are appropriate and that your information is protected.

2. About us

ALD SA is organized and exists under the laws of France, with registered offices at: 1-3 Rue Eugène et Armand PEUGEOT 92500 Rueil Malmaison, France, with registration number 417689395 (R.C.S Nanterre).

This privacy statement applies only to processing carried out by or on behalf of ALD. Although our websites may contain links to other third-party websites, we do not assume any responsibility or liability for these third-party policies regarding personal information or their collection or processing of personal information.

3. How we use your personal information and what personal information is used.

ALD SA and each of its customers perform, as data controllers or even joint data controllers, certain processing operations involving personal data necessary for the execution of lease contracts and the proper conduct of their respective activities. In this regard, ALD has listed the purposes of the processing carried out in connection with its business relationship with its customers:

Processing Handling of third parties.

Lease contract - international customer relationship management:

Legal basis for processing Contract performance.

Type of use

Processing Handling of third parties. Suppliers

Legal basis for processing Contract performance.

Type of use

Processing Fight against money laundering, anti-fraud / anti-corruption, anti-terrorism, and conflict of interest:

ALD must comply with a duty to be vigilant with respect to customers and potential customers by applying appropriate control procedures and measures.

Legal basis for processing Legal obligation.

Type of use

Processing White-Label partners:

We may share information with our white-label partners to enable fleet management services with reports and widgets, for key accounts and follow-up of international key-account fleets.

Legal basis for processing Contract performance.

Type of use

Processing Customer satisfaction / Survey:

We may send you qualitative surveys for our products and services only related to the performance of the service.

Legal basis for processing Legitimate interest.

Type of use

Processing Marketing purposes:

We may use your information to contact you, depending on your consent when applicable, about new offers or services and special offers we believe you will find valuable, or to send you marketing communications or newsletters; we may analyze your customer profile and preferences, and conduct multichannel marketing campaigns via automated tools, contact you via SMS, email, or send you brochures;

Marketing/CRM campaign carried out on behalf of the units/or for international customers.

Legal basis for processing Consent.

Type of use

Processing Cookie / audience measurement:

Use of cookies that may include profile and preference analysis to improve our understanding of your interests and concerns: we may use your personal information to improve our website and services, customize your experience with us, and tailor our marketing activities to suit your needs and interests.

Legal basis for processing Consent

Type of use

4. How long we retain your personal information.

Personal data is retained by ALD SA, in an active database, for the time necessary to achieve the purpose pursued at the time of their collection. The retention period is therefore determined first by ALD SA according to the operational needs necessary for the execution of each individual lease contract, taking into account any recommendations from local data protection authorities.

However, certain longer retention periods may be due to legislative and regulatory texts. Some laws also require that documents/information containing personal data be retained for a specific period for evidentiary purposes or pending potential legal disputes until the action in question is time-barred. For example, within commercial matters for liability documents, the obligations are generally prescribed for five years if they are not subject to special regulations. ALD is therefore obliged to retain certain personal data beyond the execution of the lease contracts, even if they no longer have any benefit from them, in the form of so-called intermediate archives.

At the end of these periods, the personal data is:

→ Anonymized;

and/or

→ Deleted.

5. Who ALD SA may share your personal information with.

ALD understands that you do not want us to provide your personal information directly to third parties for their own marketing purposes without your consent. However, ALD occasionally needs to use partners or processors to provide you with the requested services and a better experience, for the purposes described above. Therefore, we limit the sharing of your personal information on a need-to-know basis as follows:

6. Export of personal data outside the EEA.

In general, all of ALD's databases are located within the European Union. However, ALD may transfer your personal data from Europe to countries within or outside the European Economic Area. Countries outside the EEA may not provide the same level of protection as available in the EEA. If we transfer your personal data outside the EEA, we will ensure that there is an adequate level of protection in place regarding the processing of your personal data. Therefore, before transferring your personal data outside Europe, ALD will ensure to implement Binding Corporate Rules (BCR) or Standard Contractual Clauses (SCC).

However, certain countries outside the EEA have been approved by the European Commission to provide essentially equivalent protections as EEA laws on data protection, and therefore, no additional security measures are necessary to export personal data to these jurisdictions. These countries are listed online at: https://commission.europa.eu/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en

7. Your Rights

To protect data subjects affected by the processing of personal data, GDPR has implemented rights. The relevant rights are as follows:

Data Subject Right Right to Access.

Description of Right You can obtain information related to the processing of your personal data, and a copy of such personal data.

GDPR Article Article 15

Data Subject Right Right to Rectification.

Description of Right When you believe that your personal data is inaccurate or incomplete, you can request that such personal data be corrected accordingly.

GDPR Article Article 16

Data Subject Right Right to Erasure (Right to be Forgotten).

Description of Right You can request the deletion of your personal data, to the extent permitted by law.

GDPR Article Article 17

Data Subject Right Right to Restriction of Processing.

Description of Right You can request restriction on the use of your personal data.

GDPR Article Article 18

Data Subject Right Right to Data Portability.

Description of Right Where legally applicable, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format.

GDPR Article Article 20

Data Subject Right Right to Object.

Description of Right You can object to the processing of your personal data, for reasons relating to your particular situation.

GDPR Article Article 21

Please note that you have the right to lodge a complaint with the competent local supervisory authority, CNIL in France, at any time.

If you wish to exercise the aforementioned rights, you will find the privacy policy of each ALD entity on their respective corporate websites.

Country + URL

Algeria - www.aldautomotive.dz

Austria - www.aldautomotive.at

Belarus - www.aldautomotive.by

Belgium - www.aldautomotive.be

Brazil - www.aldautomotive.com.br

Bulgaria - www.aldautomotive.bg

Chile - www.aldautomotive.cl

Colombia - www.aldautomotive.co

Croatia - www.aldautomotive.hr

Czech Republic - www.aldautomotive.cz

Denmark - www.aldautomotive.dk

Estonia - www.aldautomotive.ee

Finland - www.aldautomotive.fi

France - www.aldautomotive.fr

Germany - www.aldautomotive.de

Greece - www.aldautomotive.gr

Holding - www.aldautomotive.com

Hungary - www.aldautomotive.hu

India - www.aldautomotive.in

Italy - www.aldautomotive.it

Kazakhstan - www.aldautomotive.kz

Latvia - www.aldautomotive.lv

Lithuania - www.aldautomotive.lt

Luxembourg - www.aldautomotive.lu

Mexico - www.aldautomotive.com.mx

Morocco - www.aldautomotive.ma

Netherlands - www.aldautomotive.nl

Peru - www.aldautomotive.pe

Poland - www.aldautomotive.pl

Romania - www.aldautomotive.ro

Russia - www.aldautomotive.ru

Serbia - www.aldautomotive.rs

Slovakia - www.aldautomotive.sk

Slovenia - www.aldautomotive.si

Spain - www.aldautomotive.es

Sweden - www.aldautomotive.se

Switzerland - www.aldautomotive.ch

Turkey - www.aldautomotive.com.tr

Ukraine - www.aldautomotive.ua

United Kingdom - www.aldautomotive.co.uk

8. Security and Data Storage.

ALD SA protects your data through technical and organizational security measures (including training and education of relevant personnel) against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing.

Only the teams and employees who need to know your information within our company can access it. ALD SA ensures the implementation of administrative rights and policies within our company, and we take all measures to ensure that employees, consultants, and service providers keep your files confidential.

9. Cookies and Website Policy.

ALD SA may collect data via cookies to enhance the user's browsing experience. Cookies are used, among other things, for tracking, storing preferences and settings to save time, enable logins, combat fraud, analyze the performance of the website and the services offered by the lessor, and compile visitor statistics.

10. Updates to this Privacy Policy.

We may change this privacy policy periodically to comply with any new regulations, so please review it regularly. If we change this privacy policy, we will notify you by providing a message on the homepage of our website. This notice was last updated on May 10, 2022.

11. How to Contact Us.

To exercise the rights outlined in article 10 at any time, please send us a letter or an email to the following address: ALD SA, 1-3 rue Eugène et Armand Peugeot, 92500 Rueil Malmaison, France, or contact ALD Automotive's Data Protection Officer at dpo.ald@aldautomotive.com, and we will address your inquiry.