C873222

Processing of personal data in connection with Leapmotor Vehicles’ Connected Services, including navigation features, remote vehicle control and positioning, driver assistance services, and in-vehicle safety and safety-enhancing applications in the role of Leapmotor International B.V. (“LPMI”) as Data Controller.

In the context of Leapmotor Connected Services, Leapmotor International B.V. processes personal data as data controller to enable and manage connected vehicle functionalities made available through the vehicle, the mobile application and related technical platforms. The processing covers services such as online navigation, remote vehicle control and positioning, vehicle and data-log upload, driver assistance functions, vehicle monitoring, in-vehicle safety and safety-enhancing applications, and other connected features that require interaction between the vehicle, the App, the telematics service platform and selected technical suppliers. The activities mainly concern customers, vehicle users and drivers and may involve identifiers such as VIN (Vehicle Identification Number), vehicle-generated identifiers, SN codes or virtual IDs, geolocation data, vehicle status and diagnostic information, application usage information, connectivity flags, data logs. The processing architecture is designed to prioritise local processing in the vehicle wherever feasible, with cloud or platform processing used only where necessary for the provision of the connected service and remote control functionality (through App). EU-based technical infrastructure managed by Stellantis is used as a key component of the processing model, while any access or transfer involving entities outside Europe is limited, controlled and linked to specific technical needs, such as bug fixing, vehicle fault analysis or support to the manufacturer. In this context, the respective roles of Leapmotor International, Stellantis, LPM China and specialised suppliers have been assessed, together with the applicable legal bases, transparency information provided to users, DPIAs, cross-border transfer safeguards and the extent to which data minimisation, local processing and user control mechanisms are embedded in the connected services ecosystem.

EU, UK

Document review, Interviews (face to face meetings, online and remote meetings, written questions), examinations, Data/records sample analysis, Tests (in situ, remotely)

Leapmotor International B.V. (“LPMI”) demonstrates strong control over its data processing activities, supported by Stellantis’ extensive expertise and technical solutions designed to ensure a clear and effective separation of responsibilities in the specific context of a vehicle manufacturer located in China and the need to maintain appropriate safeguards for EU citizens. In the cases assessed, data are structurally processed either in the vehicle or in Europe. Any incidental access from outside Europe is controlled by the EU legal entity, occurs only in specific cases required to fulfil the vehicle manufacturer’s role—such as bug fixing, warranty management, or service improvement—and is limited to data that are not directly identifiable. The assessment confirmed a mature and well-structured privacy governance framework. The privacy policies, web interfaces, app functionalities, and vehicle user experience provide clear and accessible information to users and support the effective exercise of data subject rights and consent management. The possibility to access relevant privacy information directly from the vehicle represents an advanced and valuable user experience. Internal documentation and contractual arrangements, waERE reviewed as legally complete and substantively sound. The documentation is supported by evidence gathered during the assessment and demonstrates that the legal analysis is complemented by effective technical and organizational measures. In particular, the residual risks associated with access to data from outside Europe are mitigated through strong technical controls managed by LPMI and Stellantis. For safety-related functionalities—such as eCall, Pedestrian Autonomous Emergency Braking (Pedestrian AEB), lane departure warning/lane keeping assist, and blind spot detection—the company decided not to conduct a DPIA, as these processing activities were assessed as unlikely to result in a high risk to individuals’ rights and freedoms under Article 35 GDPR and are strictly governed by specific EU automotive legislation. For all other services, a DPIA was carried out and assessed as adequately covering the relevant data protection safeguards. The privacy information provided to data subjects is fluent, understandable, and appropriate to the complexity of the processing activities. The assessment positively acknowledges the effort made to explain highly technical concepts and the relationship between LPMI, LPM China, retailers / dealers / repairers, and partners in a way that remains accessible to users. On this basis, the assessment outcome is positive and supports the issuance of the certificates.

The Applicant’s Data Processing Activities included into the Target of Evaluation, and referred to the applicable parts of the scheme, has been found compliant with requirements specified by the Certification Scheme and relevant for the Data Processing role. The evaluation process did not find any substantial non-conformities and the decision to certify is consistent with the collected evidences.