C886905

Processing of personal data in connection with Leapmotor International B.V. (“LPMI”)’s car maintenance management activities in relation to Leapmotor vehicles (“Vehicles”), including Vehicles and data-log upload, Vehicles recalls, IoT platform operations, software distribution, Vehicles repairs, and warranty management, carried out through digital platforms and direct access to repair points in the role of LPMI as Data Controller.

Leapmotor International B.V., acting as data controller, processes personal data for car maintenance management activities, including vehicle recalls, repair support, warranty management, after-sales assistance, IoT platform operations, software distribution and vehicle fault analysis. The processing combines two distinct but connected operational layers. The first concerns after-sales activities, where personal data may be used to support these activities, such as repairer and dealer workshop interactions, maintenance reminders, warranty interventions, service history management, vehicle-dealer association and customer communications linked to maintenance or recall needs. This layer is mainly supported by the CRM and after-sales ecosystem and may involve direct interaction with repair points, while excluding processing carried out by dealers or repairers as independent data controllers. The second layer concerns the Vehicles Data and Log Upload process, where vehicle data, logs and status information are collected from the vehicle and processed to support diagnostics, troubleshooting, OTA (Over-the-air) related activities, remote vehicle functions, app-key services and after-sales fault resolution. In this context, limited data may be made available to Zhejiang Leapmotor Technology Co., Ltd. (“LPM China”) in China only where necessary to troubleshoot vehicle faults or support technical analysis connected with product compliance, recalls, repairs or warranty management, under LPMI’s control and trigger, and subject to documented transfer safeguards without access to direct personal information of the vehicle owner or driver. The data subjects concerned are primarily customers, vehicle users and drivers. Depending on the specific maintenance scenario, the categories of data may include identification and contact details, vehicle identifiers such as VIN and plate number, vehicle model and age, consent or communication preferences, service contract information, workshop visit history, warranty and repair information, dealer or repairer association, connectivity flags and relevant after-sales records. For the Vehicle Data and Log Upload layer, the processing may also include vehicle log data, vehicle status information, component and software information, charging status, remaining battery, mileage, range, malfunction information, door, window and air-conditioning status, vehicle condition reports, remote-control records, app-key data, and location data where the relevant sharing function is enabled. Data are retained for defined periods, and access to data by LPM China is limited, permission-based controlled by LPMI, without the possibility to download data, logged, time-restricted and supported by contractual and transfer safeguards.

EU, UK

Documentation review, Interviews (face-to-face meetings, online and remote meetings, written questions), examinations, data/records sample analysis, tests (in situ, remotely)

Leapmotor International B.V. demonstrates strong control over the certified car maintenance management processing activities, including after-sales support, vehicle and data-log upload, recalls, software distribution, repair assistance and warranty management. The processing is supported by Stellantis’ technical and organisational framework, which contributes to a clear separation of responsibilities in the context of a vehicle manufacturer established outside Europe and the need to maintain appropriate safeguards for individuals in the EU and UK. The assessment confirmed that the relevant data are primarily processed either within the vehicle environment or within Europe. Any access from outside Europe is triggered and subject to control by the EU legal entity, occurs only for defined technical or after-sales purposes such as troubleshooting, warranty handling, recall support or service improvement, and is limited to what is necessary for those purposes. Where such access is required, the data may include vehicle log data, vehicle status and diagnostic information, component and software information, charging status, remaining battery, mileage, range, malfunction information, vehicle condition reports, remote-control records and app-key data, without access to direct personal information identifying the vehicle owner or driver, with the exception of the Vehicle Identification Number (VIN). The assessment confirmed a mature and well-structured privacy governance framework covering the relevant operational processes and digital platforms. Privacy notices (also named, privacy polices), web interfaces, app functionalities and the in-vehicle user experience provide clear and accessible information to users and support the effective exercise of data subject rights and consent management. Internal documentation, including DPIAs and contractual arrangements, was reviewed as legally complete and substantively sound. The documentation is supported by evidence gathered during the assessment and demonstrates that the legal analysis is complemented by effective technical and organisational measures, including controlled, permission-based and logged access where support from outside Europe is necessary. The privacy information provided to data subjects is fluent, understandable and appropriate to the complexity of the processing activities. The assessment positively acknowledges the effort made to explain technical vehicle-related processing, the interaction between LPMI, LPM China, retailers and partners, and the applicable safeguards in a way that remains accessible to users. On this basis, the assessment outcome is positive and supports the issuance of the certificate.

The Applicant’s Data Processing Activities included into the Target of Evaluation, and referred to the applicable parts of the scheme, has been found compliant with requirements specified by the Certification Scheme and relevant for the Data Processing role. The evaluation process did not find any substantial non-conformities and the decision to certify is consistent with the collected evidences.