C886899

Processing of personal data in connection with Leapmotor International B.V. (“LPMI”) marketing and profiling activities for sales and after-sales purposes, carried out through digital platforms/websites or direct dealer/repairer access, including sales process management, nurturing plans, win-back campaigns, brand contact plans, loyalty campaigns, online sales campaigns, and cookie management, and in connection with LPMI customers service communications based on legal obligation and/or legitimate interest referred in particular to vehicle’s safety in the role of LPMI as Data Controller.

Leapmotor International B.V. (“LPMI”), acting as data controller, processes personal data in the context of its CRM activities to carry out sales and after-sales marketing and profiling initiatives. The processing is based on separate and independent consents for marketing and profiling, which may be collected through several channels, including web forms, the reserved area, the App, dealerships, workshops, events and call/contact centres. Data subjects may provide one or both consents, and the related preferences are used to determine whether they may be contacted for general marketing purposes, included in personalised contact plans, or subject to more advanced profiling activities. For sales activities, the processing concerns customers and potential customers and includes initiatives such as nurturing plans, win-back campaigns, brand contact plans, loyalty campaigns, online sales follow-up and connected-services renewal communications. Where only marketing consent is available, communications are generally based on information such as brand or model interest, vehicle ownership, order status, customer lifecycle stage or contract renewal needs. Where both marketing and profiling consents are available, Leapmotor may further personalise communications by using more advanced segmentation criteria, including ownership history, web-navigation behaviour, customer reactions to campaigns, online purchase surveys, preferences, socio-demographic information and, where applicable, behavioural or usage data stored in CRM, Data Lake or Customer Data Platform environments. For after-sales activities, the processing concerns customers and vehicle users and supports strategical campaigns, annual contact plans, cross-selling and upselling of parts, accessories, service contracts, maintenance services, seasonal check-ups, connectivity services and mobility-related offers. The contact plan may extend over the vehicle lifecycle, with a strict defined maximum retention period and is intended to maintain customer loyalty by providing promotional offers and useful service information. Where mileage, last workshop visit, vehicle age, service history, dealer association or churn-risk information is available, such data may be used to segment customers, tailor discounts, identify the most relevant dealer or send timely maintenance reminders, subject to the applicable marketing and, where required, profiling consent. Personal data processed in connection with LPMI customer service communications based on legal obligations and/or legitimate interest, particularly regarding vehicle safety, relates to communications such as safety recalls or mandatory safety campaigns required by regulators, cybersecurity warnings, important software update notifications, and warranty or maintenance reminders. The personal data processed include identification and contact details, customer and prospect identifiers, vehicle-related information such as model, brand, plate, VIN (Vehicle identification number) and vehicle age, consent and communication-channel preferences, purchase and order information, service contracts, connectivity flags, last workshop visit, warranty or service interactions, online navigation or campaign interaction data, customer scoring, survey responses, customer segment and other behavioural or preference data relevant to the declared marketing and profiling purposes.

EU, UK

Documentation review, Interview (Face-to-face meetings, online and remote meetings, written questions), examinations, data/records sample analysis, tests (in situ, remotely)

Leapmotor International demonstrates strong control over the processing of personal data carried out for sales and after-sales marketing and profiling purposes. The assessed activities are supported by Stellantis’ expertise, CRM-related technical solutions, and governance arrangements designed to ensure a clear and effective separation of responsibilities. The assessment confirmed that the privacy governance framework is appropriate for the CRM, marketing, profiling, sales and after-sales activities. Privacy policies, web interfaces, app functionalities, Vehicle user experience and consent-management mechanisms provide clear and accessible information to users and support the effective exercise of data subject rights. Internal documentation, including DPIAs and contractual arrangements, was reviewed as legally complete and substantively sound in relation to the categories of personal data, purposes, consent flows, communication channels and customer lifecycle activities. The documentation is supported by evidence gathered during the assessment and demonstrates that the legal analysis is complemented by effective technical and organizational measures. The privacy information provided to data subjects is fluent, understandable, and proportionate to the complexity of the processing activities covered by the Target of Evaluation. The assessment positively acknowledges the effort made to explain the different marketing and profiling scenarios, the role of consent, and the relationship between LPMI, retailers and partners in a way that remains accessible to users. On this basis, and considering the processing activities, roles, purposes, categories of data and safeguards, the assessment outcome is positive and supports the issuance of the certificates.

The Applicant’s Data Processing Activities included into the Target of Evaluation, and referred to the applicable parts of the scheme, has been found compliant with requirements specified by the Certification Scheme and relevant for the Data Processing role. The evaluation process did not find any substantial non-conformities and the decision to certify is consistent with the collected evidences.