Privacy Notice

1. Introduction

AW FRZ Distribution Ltd., a member of the AutoWallis Group, as the data controller (hereinafter referred to as the "Controller") is committed to the safeguarding and protecting the rights of its customers and all persons who have contact with it (hereinafter referred to as the "Data Subject") in relation to personal data.

In line with its commitment to fully enforce these rights and comply with all applicable data protection laws, the Data Controller provides detailed information about its data processing activities in this Privacy Notice (referred to hereinafter as the "Notice").

Please note that the information in this Notice only applies to data relating to natural persons.

1.1. Data controller and contact details

Name: AW FRZ Distribution Kft.
Registered office: 2040 Budaörs, Szabadság utca 117.

Registration number: 13-09-234554

E-mail address: farizon@autowallis.com

1.2. Data Protection Officer and contact details

The Data Controller, together with other companies belonging to the AutoWallis group, employs a joint data protection officer under the authorisation of Article 37(2) GDPR.

E-mail address: privacy.farizon@autowallis.com

1.3. Purpose of the Notice

This notice is intended to address the following questions:

1. What personal data we collect about you when we process your personal data.

2. For what purpose and on what legal basis we do this.

3. How long the personal data is stored.

4. If we transfer them to someone else.

5. What rights and remedies you have in relation to the processing.

1.4. General rules on data processing

Source of data
Personal data is typically obtained directly from the data subject. If we obtain your personal data through other means, we will inform you of the details of this in the specific section.

Transfers to third countries
As a matter of general business practice, we also use service providers reside outside the EEA. Due to the third country headquarters, personal data processed in these services could in some cases be transferred outside the EEA. For example, in the case of Microsoft's office software or our Facebook page, to the USA. We monitor the adequacy of these services and services from a data protection perspective on an ongoing basis. For example, whether these service providers are registered under the EU-US data protection framework. In order to comply with our own data protection policies and procedures, we only engage with service providers that can demonstrate a proven commitment to data protection compliance.

Profiling or automatic decision-making
We do not typically use profiling or automated decision-making in our data processing. If we do, we will inform you of the details of this in the specific section.

Data processors
Our subcontractors who may have access to personal data are contractually guaranteed to comply with our instructions on data processing and the applicable data protection standards.

2. Description of each processing operation

2.1. General communication and contacts

2.2. Preparation and performance of the contract (test driving, request for proposal, contracting, sales)

2.3. Warranty and guarantee management

2.4. Newsletter

2.5. General marketing activity

2.6. Personalised advertising

2.7. Customer satisfaction surveys

2.8. Social media

2.9. Sweepstakes, promotion

2.10. Data subjects’ requests

2.11. Data processing of service providers' employees

2.12. Data processing in connection with Google maps

Please find details of each processing operation below.

2.1. General communication and contacts

Purpose and legal basis for processing
The purpose of data processing is general communication about issues related to our services and sales activities. This includes answering and handling all enquiries relating to the operation of our business and technical information. The legal basis for processing - Article 6 (1) (f) GDPR - is the legitimate interest of the Data Controller to maintain contact.

You have the right to object to the processing of your personal data based on legitimate interests at any time.

Categories of the data processed
· Name (identification data)

· E-mail address / mailing address / telephone number (contact details)

· Other personal data provided in the request

Retention time
Personal data will be stored for the duration of the case in question.

Data processors
· IT service provider

· Hosting

· Web designer

· Social media provider

Recipients of data transfers
· AutoWallis Nyrt.

· AW Distribution Kft.

· The specific dealership/service

2.2. Preparation and performance of the contract (test driving, request for proposal, contracting, sales)

Purpose and legal basis for data processing
We process your personal data when you register for a test drive, request a quotation, make a service appointment, purchase a part, vehicle or use our other services. Legal basis for processing is the performance of a contract between the Data Controller and the Data Subject. - Article 6(1)(b) GDPR.

Categories of the data processed
· Identification and contact details: name, address, e-mail address, telephone number.

· Financial information: bank account number, billing information.

· Contract-related data: order and performance data, contract documents.

· Communication data: content of correspondence, documents of meetings.

· Vehicle related data (e.g. Vehicle Identification Number, technical data for parts and accessories)

· Other: any other information necessary for the preparation and performance of the contract, such as:

o Identity card number

o Licence number

o Photo

Please be advised that the provision of personal data is a prerequisite for the conclusion of the contract. Without this information, we are unable to provide you with our service.

Retention time
The data will be processed within the general legal limitation period (5 years) following the termination of the contractual relationship, after which it will be deleted.

Data processors
· IT service provider

· Hosting

· Web designer

· Bank card terminal operator/Online payment provider

· Billing program operator

· Accounting partner

Recipients of data transfers
· The specific dealership/service

· AW Distribution Kft.

· AutoWallis Nyrt.

2.3. Warranty and guarantee management

Purpose and legal basis for processing
We process personal data in relation to warranties, guarantees and related administration for the purposes of complying with legal requirements and contractual obligations. Where applicable, this includes the processing of data related to a possible recall by the manufacturer. The legal basis for processing is the necessity to comply with a legal obligation to which the controller is subject - Article 6 1. (c) GDPR.

Categories of the data processed
· Name

· Address

· Phone number

· Description of the reported problem, content of the complaint

· Vehicle related data (e.g. Vehicle Identification Number, technical data for parts and accessories)

· Invoice or receipt number

· Subject, time of transaction

· Other relevant personal data generated in the course of the administration

Retention time
The general limitation period (5 years) following the statutory or contractual warranty and guarantee period.

Data processor
· IT service provider

· Hosting

· Web designer

· Billing program operator

· Accounting partner

Recipients of data transfers
· The specific dealership/service

· AW Distribution Kft.

· AutoWallis Nyrt.

· Car manufacturer - where justified, limited personal data (e.g. VIN) may be transferred to the car manufacturer Zhejiang Farizon Intelligent Technology Co. The China-based car manufacturer ensures the adequacy of the processing of data that is strictly necessary by accepting the General Data Protection Clauses (GDPR Article 46(2)(c) - SCC) published by the European Commission.

2.4. Newsletter

In the course of sending newsletters, the Data Controller regularly sends information, offers or promotions to the

Data Subjects who have subscribed to them.

Purpose and legal basis for processing
To inform Data Subjects about new products, services, events or promotions. The legal basis for processing personal data is the consent of the Data Subject - Article 6 1. (a) GDPR.

You may withdraw your consent at any time, in which case your data will be deleted and will no longer be processed for this purpose. The withdrawal of consent does not affect the lawfulness of the processing based on consent prior to the withdrawal.

Categories of the data processed
· Name

· E-mail address

Retention time
Until consent is withdrawn.

Data Processors
· IT service provider

· Hosting

· Web designer

· Newsletter service provider

Recipients of data transfers
· The specific dealership/service

· AW Distribution Kft.

· AutoWallis Nyrt.

2.5. General marketing activity

Purpose and legal basis for processing
The purpose of the is the general, non-personalized marketing activities, such as sending newsletters about our wigo carsharing service and related promotions. The purposes of the processing are direct marketing, marketing communications, sending newsletters, displaying in-app advertisements and sending push messages. Legal basis for processing the Data Controller’s legitimate interest in the economic benefit of marketing communications and the promotion of its services. - Article 6 (1) (f) GDPR.

You have the right to object to the processing of your personal data based on legitimate interests at any time.

Categories of the data processed
· Name (identification data)

· E-mail address / mailing address / telephone number (contact details)

· Vehicle-related data (e.g. manufacturer, type, model)

· Any data that you have disclosed to us in the course of your interaction with us.

Retention time
Until you object to the processing, but no later than the end of the contractual relationship between us.

Data Processors
· IT service provider

· Hosting

· Web designer

· E-mail service provider

· In the case of advertising campaigns, he marketing agency

· Social media provider

· The specific dealership/service

Recipients of data transfers
· The specific dealership/service

· AW Distribution Kft.

· AutoWallis Nyrt.

2.6. Personalised advertising

Purpose and legal basis for processing
We process personal data in the course of advertising activities, including the promotion of services and products provided by our partners and third parties, as well as the use of targeted advertising and targeting systems. The legal basis for processing personal data is the consent of the data subject - Article 6 1. (a) GDPR.

Categories of the data processed
· Name, other identifier (identification data)

· E-mail address / mailing address / telephone number (contact details)

· Contact details based on the settings of the platform used

· Preferences

Source of personal data
· Data subject

· Third parties

· Purchased databases

Retention time
· Consent until revoked, but

· at the latest the contractual relationship between us or

· 5 years after the last contact.

Data Processors
· IT service provider

· Hosting

· Web designer

· E-mail service provider

· In the case of advertising campaigns, he marketing agency

· Displaying social media provider

· The specific dealership/service

Recipients of data transfers
· The specific dealership/service

· AW Distribution Kft.

· AutoWallis Nyrt.

Profiling or automatic decision-making
The processing of data reveals the interests and purchasing preferences of the data subjects, which are used to create a profile for targeted marketing activities, defining the categories of advertisements (e.g. by age group or by territory), without any other decision-making or legal consequences for the data subject.

2.7. Customer satisfaction surveys

Purpose and legal basis for processing
As part of our quality assurance, we carry out surveys to find out what our customers think and how they experience the quality of our services and their satisfaction. Legal basis for processing - GDPR Article 6 (1) (f): legitimate interest of the Data Controller in quality assurance and improvement of its services.

You have the right to object to the processing of your personal data based on legitimate interests at any time.

Categories of the data processed
· Name

· Identifier

· Fact and date of response

· Answers given

Retention time
Until you object to the processing, but no later than 5 years after the contractual relationship between us or the last contact.

Data Processors
· IT service provider

· Hosting

· Web designer

· E-mail service provider

· In the case of campaigns, the marketing agency

· Call center

· The specific dealership/service

Recipients of data transfers
· The specific dealership/service

· AW Distribution Kft.

· AutoWallis Nyrt.

2.8. Social media

Purpose and legal basis for data processing
Social media is one of the most important communication platforms today. We are present on these platforms to share breaking news, events and promotions, as well as to engage with our followers to build community, respond to their questions and support them in other ways. Social media also gives us the opportunity to run targeted marketing campaigns and market research activities to help us improve our services.

In this context, we process the personal data of data subjects for the purposes of maintaining our social media presence, promoting our services, and communicating and marketing through the Sites. Legal basis for processing is the consent of the Data Subject- Article 6(1)(a) GDPR.

You may withdraw your consent at any time. Upon doing so, your data will be deleted and will no longer be processed for this purpose. Please note that the withdrawal of consent does not affect the lawfulness of the processing based on consent prior to its.

Categories of the data processed
· View a page, post, video, story or other content associated with the site

· Actions and interactions related to the story, page, post (follow, like, forward, comment)

· Details of the operation or interaction (date and time, location, browser details)

· User ID

Source of personal data
· Contact

· The service of the social media site, e.g. Facebook

Retention time
Time spent on social media

Data processors
· Server provider

· Marketing agency

· The social media site (Facebook, LinkedIn)

o The Facebook (Meta) Privacy Policy is available here:
https://www.facebook.com/privacy/policy/

o LinkedIN's Privacy Policy is available here:
https://www.linkedin.com/legal/privacy-policy

· The specific dealership/service

Recipients of data transfer
· AW Distribution Kft.

· AutoWallis Nyrt.

Profiling or automatic decision-making
In the course of marketing activities, the social media service provider independently creates target groups based on the advertising settings. The members of the target groups cannot be accessed or changed directly by the site owner (Data Controller). The data subject may decide not to allow targeted advertising activities when using social media.

2.9. Sweepstakes, promotion

Purpose and legal basis for processing
To promote our services, we organise competitions and offer promotional offers. We use the data of the participants to document their participation in the games and promotions and to administer them in order to verify their eligibility and to send the prize to the recipients. The legal basis for processing is the Data Controller’s legitimate interest in conducting the prize draw, promoting the service and verifying eligibility. - Article 6 (1) (f) GDPR.

You have the right to object to the processing of your personal data based on legitimate interests at any time.

Categories of the data processed
· Name

· Fact and date of application,

· Sweepstakes, subject of promotion, value

· Fact and date of the prize

Retention time
We will delete data related to competitions and promotions after five years from their closure. Exceptions to this rule are data related to financial accounting, which are stored for the period required by the Accounting Act (8 years).

Data Processors
· IT service provider

· Hosting

· Web designer

· E-mail service provider

· In the case of marketing campaigns, he marketing agency

· Displaying social media provider

· The specific dealership/service

Recipients of data transfers
· The specific dealership/service

· AW Distribution Kft.

· AutoWallis Nyrt.

2.10. Data subjects’ requests

Purpose and legal basis for processing
If you contact our company as a data subject about your personal data, we will process your data for the purposes of making the request and for enforcement purposes, as well as to comply with obligations under data protection rules and to ensure accountability. The legal basis for processing is the necessity to comply with a legal obligation to which the controller is subject - Article 6(1)(c) GDPR.

Categories of the data processed
· Name

· E-mail address

· Content of the request,

· The data provided by the data subject in the exercise of his or her rights

· Other personal data obtained during the identification process, etc.

Retention time
5 years from the date of receipt of the request

Data Processor
· Server provider

· The specific dealership/service

· DPO/Contractor

Recipients of data transfers
· The specific dealership/service

· AW Distribution Kft.

· AutoWallis Nyrt.

2.11. Data processing of service providers' employees

Purpose and legal basis for data processing
We process the personal data of employees of our contracted partners and our affiliated companies in order to maintain contact and cooperation with them. The legal basis for data processing - GDPR Article 6(1)(f) - is the legitimate interest of the Data Controller in maintaining contact with the contractual partner.

You have the right to object to the processing of your personal data based on legitimate interests at any time.

Categories of the data processed
· Name

· Contact details: e-mail address, telephone number

· Company name, position

· Content of communications and meetings.

· Dates and other administrative information.

Source of personal data
The data are provided by the employer of the contact person, the contractual partner.

Retention time
The duration of the contractual relationship or the relevant period of contact, up to the retention period of the document (e.g. invoices are stored in Hungary for 8 years, contracts for 5 years).

Data processors
· IT service provider

· Hosting

· E-mail service provider

Recipients of data transfers
· AW Distribution Kft.

· AutoWallis Nyrt.

2.12. Data processing in connection with Google maps

Purpose and legal basis for processing
In order to make it easy for you to find the nearest dealership and to facilitate the planning of routes to get there, our website uses Google Maps.

The legal basis for the processing - Article 6 (1) (f) GDPR - is the legitimate interest of the Data Controller to improve the quality of the service it provides and the customer experience.

You may object to the processing of your personal data based on legitimate interest at any time.

Categories of the data processed
· IP address

· Location data (if you allow it)

· Technical information about the use of the website

A személyes adatok tárolásának ideje

For as long as you use the Google Maps service on this site.

Adatfeldolgozó
· Google LLC.

Adattovábbítás címzettjei
Please note that Google may transfer and store your data on servers in the United States. Data protection rules in the United States are different from those in the European Union. The compliance of data transfers is ensured by the fact that the operator of the service, Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), is listed in the EU-US Privacy Shield Framework(https://www.dataprivacyframework.gov/list).

You can find out more about Google's privacy practices and other information about data protection at https://policies.google.com/privacy

3. Rights of data subjects

As a Data Subject, you have the right to request information about the processing of your personal data and access to such data. You also have the right to request the rectification, erasure or withdrawal of your personal data, except for mandatory processing. Furthermore, you may exercise your right to data portability by contacting us at the above contact details (1.1. and 1.2.). You may object to processing based on legitimate interest at any time.

Upon receipt of your request, we will provide you with the information you require without delay, but no later than one month after receipt of the request. This service is provided free of charge unless the request is deemed to be unfounded or excessive.

Right to be informed
We will provide you with information about the details of the processing in a concise, transparent, intelligible and easily accessible form, in clear and plain language. This document has been summarised for that purpose.

The right of access
You have the right to request feedback from us on whether your personal data is being processed. If you provide us with appropriate proof of your identity and we process your personal data, you have the right to be informed of the details of the processing and to receive a copy of your personal data.

Right of rectification
Any data subject may request the rectification of personal data that we hold about them if it is inaccurate for any reason, or the completion of incomplete data. We may ask for an additional statement in order to obtain clarification.

Right to erasure (‘right to be forgotten’)
You have the right to request the deletion of your personal data for one of the following reasons:

· the personal data are no longer necessary for the purposes for which they were collected;

· if you have withdrawn your consent and there is no other legal basis for the processing;

· if you object to the processing and we have no other legitimate grounds for processing that override the processing;

· the unlawful processing of personal data can be established;

· we are under any other legal obligation to delete it.

Right to restriction of processing
You may request the restriction of the processing of your personal data in the cases set out in the GDPR. For example, for a period of time to verify the disputed accuracy of personal data or if you request the retention of data that would otherwise be deleted in order to pursue a legal claim.
If the processing is subject to restriction, the personal data will only be stored and processed beyond storage in exceptional cases. We will inform you in advance of the lifting of the restriction on processing.

Right to data portability
As a data subject, you have the right to receive your personal data from us in a structured, commonly used, machine-readable format and to transfer this data to another data controller. Such a request will typically be in MS Word or Excel format. You have the right to data portability if the processing is automated and the legal basis for the processing is your consent or the performance of a contract.

Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on the legitimate interests of the Controller. As Data Controller, we may only continue to process your data where there are compelling legitimate grounds for doing so or where it is necessary to pursue legal claims.

Right to withdraw consent
In cases where we process your data on the basis of your consent, you have the right to withdraw your consent at any time, in which case we will cease processing. Please note that the withdrawal of consent does not affect the lawfulness of the processing that took place before consent was withdrawn.

4. Procedural rules, legal remedies

If you exercise your right as a data subject under the previous chapter, we will inform you of the action we have taken or, if not taken, of the reasons for not taking action without undue delay and in any event within one month of receipt of the request. If necessary and taking into account the complexity of the request and the number of requests, this time limit may be extended by two months. We will inform you of the extension, stating the reasons for the delay, within one month of receipt of the request.

If you submit your request to us in any form, we will respond by e-mail unless you specifically request otherwise.

We will inform all recipients to whom or with whom we have disclosed your personal data of any rectification, erasure or restriction of processing we have carried out, unless this is impossible or involves a disproportionate effort. We will inform you of these recipients upon request.

The Data Controller shall act in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation ("GDPR") and shall act on the basis of the relevant national law and other legal provisions and recommendations of the authorities on data protection when processing personal data.

If you believe that your right to informational self-determination has been violated, you can file a complaint with your local supervisory authority.

Furthermore, if you consider that the Data Controller is processing your personal data in violation of the legal provisions governing the processing of personal data, you may also initiate legal proceedings before the competent court of your place of residence or residence.

Effective from 2025. Jan. 24.