ALPAN GROUP LTD
Privacy Policy

This Privacy Policy (the “Policy”) applies to ALPAN GROUP LTD (hereinafter the “Company” or “ALPAN Group”), the official representative of BYD in Cyprus, and to the personal data that the Company holds about natural persons. Information relating to companies or other entities does not fall within the scope of this Policy.

ALPAN GROUP LTD is established in Cyprus at 8 Aiolou Street, 2540 Dali Industrial Area, Nicosia, Cyprus. E‑mail: info@bydauto‑alpan.cy, tel. 7777 1199 / +35722322005

Among the Company’s activities are the distribution and representation of passenger motor vehicles, spare parts and other related accessories. The Company also operates a network of authorised repairers that are independent businesses providing after‑sales services for the motor vehicles marketed by the Company.

In the context of its commercial activities and for the fulfilment of its corporate purposes, the Company collects, stores and processes personal data. The purpose of this Policy is to inform you about how we collect and process your personal data.

The effective protection and security of customers’ and partners’ personal data is a primary concern of ALPAN GROUP LTD. We are committed to safeguarding such data in compliance with applicable national and EU legislation.

Data Controller
ALPAN GROUP LTD is the data controller of the personal data concerning you that it processes in the course of providing its products and services. ALPAN GROUP LTD collects and processes personal data of existing and potential customers of its products and services, authorised representatives and beneficial owners (where applicable) in the context of long‑term vehicle leasing, as well as personal data relating to suppliers of products and services to ALPAN GROUP LTD.

Personal Data We Collect About You
“Personal data” means any information relating to an identified or identifiable natural person. It does not include anonymous data where the identity has been removed (e.g., data that have been encrypted or pseudonymised).

ALPAN GROUP LTD may collect and process various categories of your personal data, grouped as follows:
• **Identity data:** such as full name, identity or passport number, tax identification number, date of birth, gender, nationality, marital status, etc.
• **Contact data:** such as address, street, city, postal code, telephone number, e‑mail address.
• **Financial data:** such as bank‑account number, credit‑card details and financial‑behaviour data (e.g., income, but only in the case of long‑term vehicle leasing).
• **Transaction data:** information about previous purchases of products and services, transactional behaviour (e.g., transactions, payments, complaints, recorded calls).
• **Marketing and communication data:** your preferences regarding receipt of promotional materials from us and third‑party service providers acting on our behalf, as well as your communication preferences.
• **Website usage and communications:** For the terms of website use see [here].
• **Use of Cookies:**how we use cookies to improve your browsing experience. For more details, see [here].
• **Health data:** in the context of selling vehicles to persons with disabilities, in accordance with the applicable legislation.
• **Identification data of beneficial owners** (in the context of long‑term vehicle leasing) to verify their identity for the purposes of customer due‑diligence measures under Article 59(4) of the Prevention and Suppression of Money Laundering Activities Law 2007 (Law 188(I)/2007).

How Personal Data Are Collected
We collect information about you, inter alia, in the following cases:
• When you communicate with us directly via our call centre, e‑mail, our website or the online portal of our dealer and authorised‑repairer network.
• In the context of commercial transactions for products and services (including the conclusion of a long‑term lease contract with an independent leasing company).
• When you apply for our products or services.
• When you visit one of our websites.
• If other ALPAN Group companies or commercial partners lawfully transfer your personal data to us.
• If you subscribe to our newsletters or publications.
• If your vehicle data (including chassis number) are transferred to the manufacturer when maintenance or repairs are carried out, e.g., at authorised workshops.
• If you respond to our direct‑marketing actions (e.g., by filling in a response card, entering your data online on our website, or participating in a competition or survey).
• Where appropriate, from third parties or public sources that may lawfully provide us with personal data about you.
• If you are under 18 years of age, we process your data only if the relevant consent has been given by the person(s) exercising parental responsibility.

Purposes and Legal Basis for Processing
Under EU data‑protection law, processing must rely on one or more “legal bases.” We therefore identify the purposes and corresponding legal bases for each use of data under this Policy.

Your personal data are collected for the following purposes:
(a) **Handling your request** (e.g., providing a quotation for vehicle purchase/financing, arranging a test drive). The legal basis is the performance of your request and the provision of the requested service.
(b) **Contract performance** if you enter into an agreement with us, including customer‑service operations and the fulfilment of all contractual rights and obligations. Provision of the relevant data is a contractual requirement; failure to provide them may impede or render impossible the proper performance of the contract.
(c) **Customer‑satisfaction research**, statistical purposes and the overall improvement of our services and our relationship with you.
(d) **Credit assessment** and transfer to the financial institution and/or leasing company of your choice if you wish to purchase a vehicle with financing or enter into a long‑term lease.
(e) **Compliance with legal obligations** to police, regulatory and judicial authorities (e.g., traffic offences, fines, criminal‑code violations) and third parties in connection with legal proceedings, where we have a legal duty. Where permitted, we will forward any such request to you or notify you before responding, unless doing so would prejudice the prevention or detection of crime.
(f) **Direct marketing and promotion** of products and services, subject to your consent. Consent may be withdrawn at any time with future effect.
(g) **Product recalls** if it becomes necessary to recall motor vehicles marketed by the Company (e.g., for safety reasons). We will process your data to contact you and carry out the recall procedure.

Disclosures, International Transfers and Third Parties
For purposes (a) and (b), your data will be transferred to our official network of dealers and partners where necessary for better service. For purposes (a), (b) and (c), data may be transferred to companies providing support services to us. For purpose (d), data will be transferred to the financing bank(s) of your choice and any credit‑assessment agency, and to the leasing company of your choice. For purpose (e), data will be transferred to the competent authority as required by the applicable legal framework. For purpose (f), subject to your consent, data may also be transferred to other companies of the Sfakianakis Group, as well as to service providers supporting us in marketing. We will obtain your explicit consent before sharing your data with any third party for marketing purposes.

In every case of disclosure or transfer, we require all third parties to respect the security of your personal data and process them in accordance with the law. Service providers are not permitted to use your data for their own purposes and may process them only for specified purposes and in accordance with our instructions.

Personal data are preferably processed within the European Union; however, transfers outside the European Economic Area (EEA) may be required. Where processing occurs outside the EEA, we ensure that appropriate safeguards are in place. For countries regarded by the EU as providing an adequate level of protection, no special authorisation is needed. For others, transfers are based on your consent or on EU‑approved standard contractual clauses, unless otherwise permitted by applicable data‑protection laws.

Please contact us if you would like more information on the transfer mechanisms we use for data outside the EEA.

Security Measures
All information you provide is stored and transmitted securely, and every transaction is protected by appropriate technology. Once we receive your data, we use strict procedures and security features to prevent unauthorised access.

We have implemented suitable technical and organisational measures to prevent accidental loss, unauthorised use, access, alteration or disclosure. IT systems used for processing are technically isolated from other systems to hinder unauthorised access (e.g., hacking). Access to your data is limited to employees, partners, contractors and third parties who have a business need to know and who are subject to confidentiality obligations.

We have procedures to deal with suspected personal‑data breaches and will notify the supervisory authority and you, where legally required, if a breach poses a high risk to your rights.

Data Retention
Your personal data will be stored and used only for the specific purposes above and for as long as reasonably necessary to achieve those purposes. Data are kept throughout your relationship with ALPAN GROUP LTD and, after termination, for the period provided by law during which claims may be brought or, in the event of a claim, until final resolution. Data processed on the basis of your consent (e.g., for marketing) will no longer be processed after you withdraw consent.

To determine the appropriate retention period, we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes of processing and whether these purposes can be achieved by other means, and legal requirements.

In some cases, we anonymise personal data (so that they can no longer be associated with you) for research or statistical purposes, in which case we may use such information indefinitely without further notice.

Your Rights and How to Exercise Them
Subject to the conditions of Regulation (EU) 2016/679, you have the following rights:
• **Access:** obtain a copy of your personal data and verify lawful processing.
• **Rectification:** have incomplete or inaccurate data corrected.
• **Erasure:** request deletion where there is no reason for continued processing (subject to legal exceptions).
• **Restriction:** request suspension of processing in specific scenarios (e.g., verification of data accuracy, objection pending verification of overriding grounds).
• **Objection:** object to processing for direct marketing. In some cases we may demonstrate compelling legitimate grounds to continue processing.
• **Portability:** receive your data in a structured, commonly used, machine‑readable format or transfer them to a third party. Applicable only to automated data processed with consent or for contract performance.
• **Withdrawal of consent:** at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal but may limit our ability to provide certain services.

We may need to request specific information from you to confirm your identity and ensure your right to access your data (or exercise any other rights). This security measure prevents personal data from being disclosed to anyone who has no right to receive them. We may also contact you for further information to speed up our response.

We aim to respond to all legitimate requests within 30 calendar days. If more time is required, we will inform you accordingly.

Questions and Complaints
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at dpo@alpangroup.com.cy.

You also have the right to lodge a complaint with the Commissioner for Personal Data Protection:
Office address: 15 Kypranoros Street, 1061 Nicosia, Cyprus
Postal address: P.O. Box 23378, 1682 Nicosia, Cyprus
Tel.: +357 22818456 | Fax: +357 22304565
E‑mail: commissioner@dpc.cy