Privacy policy

OTOKAR EUROPE DATA PROTECTION INFORMATION 1-Purpose of this document The purpose of this policy (hereinafter referred to as “Policy”) is to inform you about the Processing of your Personal Data by OTOKAR Europe SAS, registered under number 534 167 796 RCS Pontoise (hereinafter referred to as “Otokar Europe” and/or “we”). 2 – WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA? Otokar Europe imports and distributes Otokar public transport vehicles and related spare parts in France and Europe through its network of distributors. As part of its activities, Otokar Europe authorises and obliges the distributors, service outlets and authorised repairers in its network (hereinafter referred to as “Otokar Europe partners”) to offer support and customer service in technical and non-technical areas to current and prospective customers.Otokar Europe also manages the www.otokareurope.com website and promotes the Otokar brand in France and Europe.Unless otherwise indicated, Otokar Europe partners are legally and economically independent companies, not affiliated with Otokar Europe. They use the Otokar brand as authorization holders to market public transport vehicles, original parts, and maintenance and repair services under the said brand.Pursuant to the General Regulation on the Protection of Personal Data (“GDPR”), Otokar Europe is responsible for processing all of your personal data which is processed through the aforementioned website, your MyOtokar application, your dealings with the Otokar After-Sales Service (hereinafter collectively referred to as “Otokar Europe Customer Service”) and in the context of direct marketing by electronic or postal means.Otokar Europe may also process your data transferred to it by Otokar Europe’s partners in accordance with legal requirements relating to data protection. Otokar Europe’s partners are responsible for processing the personal data you provide to them in connection with the business activities and services they offer (repair, maintenance, etc.) Otokar Europe’s partners also process your data when it is transferred by Otokar Europe, in accordance with applicable regulations. This data protection information also describes some of the processing carried out by Otokar Europe’s partners, without being exhaustive. In fact, Otokar Europe’s partners may collect other personal data referred to in their own data protection information documents. You may contact these Otokar Europe partners to find out how they use your personal data. 3 – WHEN DOES OTOKAR EUROPE COLLECT AND USE PERSONAL DATA? Otokar Europe collects and processes your personal data, in particular in the following cases:

• When you contact us directly (e.g. through our website, Otokar Europe’s Sales Department) with questions about our products, services or otherwise;
• When you purchase an Otokar vehicle;
• When you subscribe to services (MyOtokar application, etc.) from Otokar Europe;
• When you request information about our vehicles and services (e.g. by sending us brochures);
• When you respond to our marketing activities (e.g. sending an email or communicating your data on our website(www.otokareurope.com);
• When third parties or Otokar Europe’s partners transfer your personal data to us, in accordance with applicable regulations (e.g. you have given your consent or have not objected to the transfer of your data to Otokar Europe after being informed of your right to object, for customer management purposes, to identify you when you contact Otokar Europe’s After Sales Service;
• When data concerning your vehicle (including the chassis number) is transmitted to us as part of maintenance/repair services provided by Otokar Europe’s partners;
• Where third parties (e.g. authorised address providers) have a legitimate right to transfer your personal data to us.

In order to enable us to keep your personal data up to date, we would be grateful if you could inform us of any changes in this respect, particularly with regard to your contact details. 4 – WHAT PERSONAL DATA DO WE COLLECT? Otokar Europe may collect the following categories of personal data through the various services and contact channels described in the data protection information:

• Contact details: surname, first name, company name, address, telephone number, e-mail address.
• Other personal data: information you have provided concerning, for example, your position in your company, etc.
• Contractual data: for example, customer number, contract number, Otokar services subscribed to.
• Current and/or preferred Otokar reseller.
• Identification data, including: customer number, contract number.
• Customer history, including: Otokar vehicle purchase data (model, configuration, purchase date, first registration date, purchase order date, delivery date, owner, etc.).
• History of campaigns and responses (customer service programme – current and potential customers – and direct marketing actions).
• Participation in trade fairs and/or events.
• History of queries and complaints to Otokar Europe After Sales Service.
• Application/website/social network data.
• Online account data: information about your accounts associated with MyOtokar, for example.
• Website Usage and Communications: Information about your use of our website, messages you open or forward from us, and data collected through cookies and other tracking technologies. Further information on this subject is available in our legal notice on Otokar’s cookie policy.
• Transaction and interaction data: information about purchases of products and services, interactions with Otokar Europe’s Customer Service (requests, complaints), Otokar Europe’s partners and your participation in quality and/or satisfaction surveys.
• Use of Otokar services and applications: information about your use of the Otokar application (on your mobile device) and MyOtokar services.
• Vehicle technical data: data that may be created and/or processed in the vehicle.

Vehicle Chassis Number and other related specifications. 5 – FOR WHAT PURPOSES DOES OTOKAR EUROPE PROCESS YOUR DATA? Otokar Europe only processes your data if this is permitted by the applicable regulations. In particular, we process your data in accordance with the GDPR in the following cases:

• Otokar Europe and its partners, dealers and authorised service points, use your personal data for the management of contracts (e.g. vehicle order, repair / workshop order, subscription to Otokar services) or any request from you (e.g. offer, test drive). This processing is necessary for the performance of contracts or the management of your requests. In the case of the latter, Otokar Europe may contact you to follow up your request.
• Otokar Europe may also contact you if your Otokar vehicle is the subject of a technical campaign or recall. In such cases, given the highly important nature of these campaigns (avoiding risk to vehicle passengers, damage to the vehicle, etc.), Otokar Europe will contact you either directly or through its authorised dealers or service points, using the contact details you have provided, in order to comply with its legal obligation to provide information.
• Otokar Europe may also contact you in carefully defined cases, for marketing or commercial purposes, in particular as part of its legitimate interest in improving its knowledge of its customers and developing its customer base. For example, you may be contacted by:
  • during commercial prospecting operations (product and service offers, etc.)
  • on a personalised basis according to your customer profile
  • for satisfaction surveys
  • to inform you of the end of a warranty or service contract
  • to make you an offer concerning your vehicle (inspection, etc.).

Otokar Europe will, where appropriate, deploy such communications in accordance with legal requirements relating to data protection and will obtain your express consent in advance where required by law.Otokar Europe also processes your Personal Data in order to provide you with the best possible experience with its various services (e.g. by fully identifying you at all points of contact).This Personal Data is necessary for the management of Otokar Europe’s activities. If you do not provide this Data or if you refuse their collection, it will make the management of Otokar Europe’s activities difficult or impossible. 6 – Who has access to your Personal Information? Otokar Europe is committed to maintaining the confidentiality of your Personal Information and to complying with all legal requirements regarding the sharing and disclosure of Personal Information. In this regard, your Personal Information will only be accessible by a limited list of recipients on a need-to-know basis and on a case-by-case basis. Otokar Europe may provide information to the following recipients:

• Otokar Europe employees working in the departments responsible for processing Personal Data within the limits of their functions (e.g. marketing department; sales department; etc.);
• Partner companies and public authorities authorised to receive your data;
• Service providers acting on behalf of Otokar Europe (e.g. to send newsletters) who may also have access to your Personal Data.

The transfer in full compliance with applicable regulations on the protection of personal data, to carefully selected service providers and partners with whom we cooperate to offer you products and services. We carry out this transfer only in strict compliance with the conditions for processing by a subcontractor, as provided for by the RGPD. One of our IT service providers is located outside the European Economic Area. This Transfer is covered by the Standard Contractual Clauses. Please note that we only share your Personal Data where such recipients have a legitimate need to access it. 7 – HOW DOES OTOKAR EUROPE PROTECT YOUR PERSONAL DATA? Otokar Europe and, where applicable, its duly selected partner subcontractors, implement several security measures such as state-of-the-art encryption and authentication tools to protect and preserve the security, integrity and availability of your data. Although it is impossible to guarantee absolute security against unauthorised access when transferring data over the Internet or on a website, Otokar Europe, its service providers and partners make every effort to protect your personal data in accordance with applicable data protection regulations by implementing state-of-the-art physical, electronic and process-oriented security measures. We apply the following measures, among others:

• Strict criteria to authorise access to your data on a “need-to-know” basis (limited to as few people as possible) and exclusively for the purposes intended.
• Transfer of collected data in encrypted form in the majority of cases.
• Firewall protection of IT systems to protect data against unauthorised access, by hackers for example.
• Continuous monitoring of access to IT systems to detect and prevent misuse of personal data.

If you receive a password from Otokar Europe or if you have chosen one yourself to access certain services, areas of its website or other portals or applications offered by our brand, you are responsible for maintaining the confidentiality of that password and for complying with all other security procedures of which you are aware. In particular, we ask you never to divulge your password. 8 – HOW LONG DO WE KEEP YOUR DATA? We only keep your data for as long as is necessary for the purposes for which we process it. Where data is processed for different purposes, your data is automatically deleted or stored in a format that no longer allows you to be identified, as soon as the last specific task and purpose has been fulfilled. To ensure that all your data is erased in accordance with the data minimisation principle and Article 17 GDPR, Otokar Europe implements an internal erasure process based on the core principles described below.Use for purposes of compliance with a contract: To comply with contractual obligations, data collected from you may be retained for the duration of the contract and – depending on the nature and scope of the contract – for a specified period beyond its term in order to comply with applicable legal retention obligations and to be able to respond to any queries or complaints beyond the term of the contract. In addition, certain contracts for the supply of products and services require a longer retention period; see also “Use for Claims Assessment” below: Data that Otokar Europe believes will be necessary to evaluate and avoid claims against us or to initiate criminal proceedings or assert claims against you, us or third parties may be retained by us for as long as the relevant proceedings may be initiated and in accordance with applicable statutory limitation periods.Use for customer service and marketing purposes: In the context of customer service and for the purposes of commercial prospecting, the data collected from you may be kept for 3 years from the end of any commercial relationship, unless you request their deletion and no contractual or legal obligation to keep them prevents the execution of the said request.

9 – YOUR DATA PROTECTION RIGHTS As a person affected by the processing of your data, you are able to exercise certain rights established by the GDPR and other applicable regulations regarding the protection of personal data, including the following rights:Right of access to your data (GDPR – Art. 15):You may request access to your personal data stored by Otokar Europe at any time. This information includes the categories of data we process, the purposes for which we process them, the origin of the data when we have not collected it directly from you, and, if applicable, the recipients to whom we transmit your data. You may receive a free copy of your data on request. We reserve the right to charge for any additional copy requests.Right of rectification (GDPR – Art. 16):You may request Otokar Europe to rectify your personal data. We take all reasonable steps to keep the information we hold about you up to date, and we process it regularly, accurately, completely, as up-to-date and appropriately on the basis of the most up-to-date information available to us.Right to be forgotten (RGPD – Art. 17):You may request the deletion of your data if the legal preconditions below are met:

• The data is no longer necessary for the purposes for which it was collected or otherwise processed;
• You withdraw your consent, where consent is the sole legal basis for processing the data;
• You object to the processing of your data and there are no compelling legitimate grounds for the processing, or you object to the processing of your data for canvassing purposes;
• The data has been processed unlawfully.

unless the processing is necessary :

• In order to comply with a legal obligation requiring us to retain and process your data, in accordance with the retention periods imposed by the applicable regulations;
• To establish, exercise or defend legal claims.

Right to limit processing (RGPD – Art. 18): You may request that we limit the processing of your data in the following cases: – You dispute the validity of the data. Further processing of the data is restricted for the period necessary to verify its validity; – The processing is unlawful and you refuse the deletion of your data. Instead, you request that their use be restricted; – Otokar Europe no longer needs your data, but you require it for the enforcement, exercise or defence of your rights; – You have objected to the processing, during the verification as to whether Otokar Europe’s legitimate purpose overrides yours.Right to data portability (RGPD – Art. 20):You can have your personal data transferred to another controller where technically possible. However, this right is only available to you if the data processing is based on your consent or is necessary for the performance of a contract. Instead of receiving a copy of your data, you may also ask Otokar Europe to submit them directly to another person in charge designated by you.Right to object (GDPR – Art. 21):You may object at any time to the processing of your data necessary for the purposes of the legitimate interests pursued by Otokar Europe or by a third party on grounds relating to your particular situation. In this case, we will no longer process such data. This does not apply if we can demonstrate a compelling legitimate reason for processing the data which overrides your interests or if we need your data for the establishment, exercise or defence of legal claims.Fate of your data after your death (Law no. 78-17 of 6 January 1978 on data processing, data files and individual liberties, Art. 32):You also have the right to give instructions on the fate of your personal data after your death.Response times following exercise of the rights referred to above:We make every effort to respond to any request within 30 days. However, this period may be extended for reasons related to the complexity of your request and the number of requests.Cases of non-transmission of your data:In certain situations, Otokar Europe may find itself unable to transmit all of your data to you due to a legal obligation. In such cases, if we are required to refuse your request, we will immediately inform you of the reason for the refusal.Recourse to competent authorities:Your concerns and rights are important to Otokar Europe. However, if you feel that we have not responded to your complaints, you are entitled to take your case to the relevant administrative authority responsible for the protection of personal data (in France, the Commission Nationale de l’Informatique et des Libertés).

10 – CONTACTING US ABOUT YOUR PERSONAL DATA If you have any questions about our use of your personal data, you can contact one of our managers:

• By e-mail: rgpd@otokar.com
• By post to the address :

Personal Data Protection Officer Otokar Europe SAS 24 rue du Noyer Parc Les Scientifiques De Roissy Lot A-3 95700 Roissy-en-France