Privacy Policy of AIMA GO Overseas Version APP

Apart from the common rights, users in the EU have the following rights (click the separate link for exclusive clauses for the EU to view detailed information):

• Right to Delete (Right to be forgotten): You have the right to request the deletion of your personal data where the data are no longer necessary, where you have withdrawn your consent, or where the processing is unlawful, among other circumstances;
• Right to Restrict Processing: You have the right to request the restriction of processing where you have objections to the accuracy of the data, or where the processing is unlawful but you object to deletion, among other circumstances;
• Right to Data Portability: For personal data processed by automated means based on your consent or in the performance of a contract, you may obtain a copy in a format, such as .csv/.json, or request that the data be transmitted directly to another controller;
• Right to Object: You have the right to object to processing based on legitimate interests (including marketing profile), unless we can demonstrate overwhelming legitimate grounds; you have the right to object to direct marketing processing at any time;
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection regulatory authority (https://edpb.europa.eu/about-edpb/about-edpb/members_en).

Exclusive to users in California, USA (click the separate link for exclusive clauses for the Americas to view detailed information):

• Right to Know: You have the right to inquire about the categories and content of your personal data that we have collected, used, shared, or sold within the past 12 months;
• Right to Delete: You have the right to request the deletion of your personal data we have collected (unless retention is required by applicable law (such as for completing transactions or ensuring security));
• Right to Restrict Processing of Sensitive Information: You have the right to restrict the use and disclosure of sensitive data, such as exact location information;
• Right to Opt Out: You have the right to opt out by clicking on "Settings - Privacy - Do Not Sell or Share My Personal Information". The opt-out will take effect within 15 days;
• Protection of the Minor: For users under the age of 16, consent from the minor themselves (if aged 13–16) or from a legal guardian (if under 13) is required before their personal data may be shared or sold. Legal guardians may exercise the rights as data subjects on behalf of the minor;
• Right to Non-discrimination: You will not be discriminated against for exercising your privacy rights (such as through price increases or reduced service quality).

Supplementary Provisions for Other Regions in the Americas: We comply with applicable laws and regulations, such as Canada's PIPEDA. Cross-border transmission of personal data to U.S. Access Points are protected by contractual arrangements designed to ensure an adequate level of data protection. In the event of a data breach that is likely to result in significant damage, we will notify affected users and the relevant regulatory authorities in a timely manner.

The following rights shall be exercised in accordance with the applicable laws and regulations of the corresponding country; (click the separate links for exclusive clauses for each country to view detailed information):

• Southeast Asia (Indonesia's PDP Law or Malaysia's PDPA): Sensitive data must be stored within the respective territory. Data correction requests will be completed within the time limit required by local laws (for example, 21 business days in Malaysia). You may also claim compensation for unlawful or non-compliant processing;
• Brazil (LGPD): You may request access to data processing reports and the list of entities with which your data have been shared, file a complaint with ANPD, and ensure that cross-border data transmission comply with the permission requirements under the LGPD;
• South Africa (POPIA): Personal data shall be stored locally in South Africa. Processing of special categories of personal data requires prior authorization. You may object to direct marketing free of charge;
• Turkey (KVKK): Processing of sensitive personal data requires the express consent of the data subject. Personal data shall be stored locally in Turkey. Data controllers must complete registration and announcement with the VERBIS system;
• Middle East (Saudi Arabia, etc.): Collection of sensitive information requires the express consent of the data subject. You may request the transfer of your personal data to a designated service provider, and data localization requirements must be satisfied;
• Japan and the Republic of Korea (APPI/PIPA): In the event of a data breach, users and the relevant regulatory authorities will be notified in a timely manner. Cross-border data transmission require either a user's separate consent or the implementation of other compliance measures to ensure that users are entitled to a broad range of rights;
• Mexico (FDPL): You are entitled to the ARCO rights (access, rectification, cancellation and opposition). Processing of sensitive personal data requires separate consent, and you may opt out of marketing by clicking one button.

These Clauses are formulated in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Portugal's Personal Data Protection Act (Lei n.º 58/2019 de 8 de agosto). They apply to users in EU member states and the European Economic Area (EEA), with the supplementary provisions set out as follows:

11.1.1 Details of Core Principles for Data Processing

As a data controller, we strictly adhere to the following principles (consistent with the core principles of the privacy policy of Portugal's AIMA (Agência para a Integração, Migrações e Asilo)):

1. Legitimacy and Transparency: For all processing activities involving advertising data, vehicle data and other such data, we will inform you in advance of the data processing parties (Chongqing Aima Car Service Technology Co., Ltd. and its EU Representative), technical methods (e.g., SDK collection) and legal basis (e.g., user consent and legitimate interests), with no concealed processing scenarios;
2. Limitation and Explicitness of Data Collecting Purpose: We collect data solely for explicit purposes such as providing personalized advertising and optimizing vehicle services. For example, only device identifiers and browsing behavior (excluding sensitive health/ religious information) are collected for advertising-related data, which will not be used for secondary purposes beyond the scope of the stated objectives;
3. Exceptions of Retention Period: Where data is used for archiving for public interest (e.g., statistics on vehicle safety accidents), scientific research (e.g., research on riding behavior and road safety) or historical statistics, it may be retained beyond the regular retention period. Prior to such extended retention, however, the data will be anonymized to ensure that it cannot be linked to any individual's identity.

11.1.2 Compliance Requirements for Advertising Monetization

For the scenarios of monetization through in-app advertising (e.g., accessory promotions and third-party insurance advertisements), the supplementary clauses are set out as follows:

1. Data Sharing Scope: Advertising data will only be shared with partners certified by GDPR (e.g., Google Ads and local compliant advertising service providers). The shared content will be limited to anonymized user profiles, excluding identifiable information such as full names and complete mobile phone numbers;
2. User's Right to Object: You may exercise your right to object to the processing of advertising data based on "legitimate interests" (e.g., ceasing the delivery of personalized advertising) at any time via the path: "Me → Settings → Privacy → Ad Settings". Such objection shall take effect within 15 business days, and will not affect the use of core vehicle services;
3. Privacy Policy Access Entry: A permanent access entry to this Policy and the Regional Clauses is provided in a prominent position (marked with a red icon), which you could find via the path "Settings → Privacy Center" on the APP. In addition, Upon the first launch of the APP, a pop-up prompt will be displayed to guide you to review the content.

11.1.3 Data Processing Records and Inquiries

You may request access to our "Records of Data Processing Activities" via the EU region-specific email address (dpo@aimago.eu). The records include the purposes of processing, categories of data involved, types of recipients, and details of transboundary data transfers (if any). We will provide a structured report (e.g., in PDF format) within one month of receiving your request.

11.1.4 Legal Compliance Requirements

The legal foundation of these Clauses is the General Data Protection Regulation (GDPR), integrated with the domestic implementation rules of Portugal's Personal Data Protection Act. As a regulation with direct effect under EU law, the GDPR establishes the highest compliance standards for our business operations within the EU/European Economic Area (EEA).

These Clauses are formulated in accordance with the California Consumer Privacy Act (CCPA/CPRA) of the United States and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). They apply to users in the Americas, with the supplementary provisions set out as follows:

11.2.1 Disclosure of Advertising Data "Sale/Sharing"

Pursuant to the definitions of "Sale" and "Sharing" under the CCPA/CPRA, the following shall be expressly clarified:

1. In the past 12 months, we didn't "sell" any personal information of users in the Americas (i.e., we have not disclosed data to third parties for the purpose of obtaining consideration);
2. "Sharing" for targeted advertising purposes: We shared or will only share device identifiers (e.g., Android ID) and in-app browsing records (e.g., accessory pages viewed) with advertising partners (e.g., Amazon Ads, local electric vehicle accessory merchants) for the delivery of relevant advertisements;
3. Opt-Out Mechanism: You may disable the sharing of advertising data via the path: "Settings → Privacy → Do Not Sell or Share My Personal Information". The operation will take effect within 15 days upon completion, and upon taking effect, only generic advertisements (without personalized relevance) will be displayed to you.

11.2.2 Data Boundaries for Personalized Services

For scenarios involving "the provision of personalized services" (e.g., recommending accessories compatible with your vehicle model, suggesting maintenance services based on your riding habits), the supplementary explanations are set out as follows:

1. The sources of personalized data are limited solely to your authorized vehicle data (e.g., vehicle model, riding mileage) and in-app operation records (e.g., service entry points you have clicked on); no data from other applications on your device will be collected;
2. If you disable "personalized recommendations" (path: Me → Settings → Privacy → Recommendation Management), it will only affect the accuracy of content and service recommendations, which will not impact core functions such as remote vehicle control and fault early warning.

11.2.3 Privacy Policy Accessibility

A permanent "Privacy Policy" access entry (in bold blue font) is placed at the top of "Home → Me → Settings" in the APP; a single click will direct you to the version of the Policy tailored to your region. Upon your first registration, you must actively check the box stating "I have read and agreed to the Privacy Policy" to proceed, which ensures your full informed consent.

11.2.4 Legal Compliance Requirements

These Clauses are intended to provide a unified response to the fragmented privacy legal requirements across the Americas, with the core objective of fulfilling the statutory obligations under the U.S. CCPA/CPRA and Canada's PIPEDA.

These Clauses are formulated in accordance with Indonesia's Personal Data Protection Law (PDP Law), Malaysia's Personal Data Protection Act (PDPA) and South Africa's Protection of Personal Information Act (POPIA). They apply to users in the corresponding regions, with the supplementary provisions set out as follows:

11.3.1 Localised Compliance for Advertising Data

1. Users in Indonesia: Advertising data (e.g., records of advertisements you have clicked on) may only be collected upon your separate consent, with a pop-up prompt for the consent entry displayed when advertisements are shown for the first time (featuring two equally weighted buttons for "Agree" and "Reject"). Sensitive data (e.g., precise location) will not be used for advertising delivery, which will only be utilized for the vehicle positioning function;
2. Users in Malaysia: Advertising partners shall complete filing with Malaysia's Personal Data Protection Commission (PDPC). They will sign a Data Processing Agreement complying with PDPA prior to the sharing of advertising data. You may inquire about the list of partners via "Settings → Privacy → Ad Management";
3. Users in South Africa: Advertising data shall be stored for no more than 6 months (unless an extension is required by law), and will be automatically anonymized upon expiration. Such data will not be used for cross-platform advertising tracking (e.g., no association with the data of your social media accounts).

11.3.2 Localized Time Limits for Data Subjects' Rights

For requests for "data access, correction or deletion" submitted, we will respond in accordance with the following time limits:

• Indonesia: For urgent requests (e.g., those relating to data breaches), we shall respond within 24 hours; for regular requests, feedback will be provided within 15 business days;
• Malaysia: The outcome of the request handling will be notified to you within 21 business days;
• South Africa: The handling of the request will be completed and a formal notification will be sent to you within 20 business days.

11.3.3 Multilingual Version of the Privacy Policy

For multilingual regions including Southeast Asia and the Middle East, the regional clauses are available in 4 languages: English, Indonesian, Malay and Arabic. You may switch the language via the "Region Selection" function to ensure barrier-free understanding. Such regional clauses shall have the same legal effect as the Chinese version; in the event of any ambiguity, the version in the local official language shall prevail.

11.3.4 Legal Compliance Requirements

These Clauses recognize and respect the increasingly stringent and distinct legislative developments across all jurisdictions in this region, and we undertake to implement tailored localized compliance adaptations.

These Clauses apply to users in Vietnam and Thailand, and are intended to meet the increasingly stringent local data protection requirements.

11.4.1 The Socialist Republic of Vietnam

Personal Data Protection Law of the Socialist Republic of Vietnam (Decree No. 13/2023/ND-CP, hereinafter referred to as the PDPL) came into force on Jul. 1, 2023, and all of its provisions shall formally enter into effect on Jan. 1 2026. We will make advance preparations for compliance, with the specific measures set out as follows:

1. Mandatory Data Protection Impact Assessment (DPIA) and Filing: Prior to processing sensitive personal data, conducting large-scale data processing or carrying out cross-border data transfers, we will complete a Data Protection Impact Assessment (DPIA) in accordance with the law and submit the filing to the Vietnamese Personal Information Protection Authority (affiliated to the Ministry of Public Security). You may inquire about the filing number of our major data processing activities via the Help and Feedback entry in the APP.
2. Strict Consent for Advertising Marketing and Sensitive Data Processing: Pursuant to the PDPL, where we use your personal data for direct marketing and advertising delivery, or process sensitive personal data relating to your health status, financial status and biometric data, we must obtain your free, specific, informed consent given by an unambiguous affirmative act. An independent consent pop-up will be displayed to you when the relevant functions are triggered for the first time.
3. Localized Contact Person: We will appoint a Data Protection Officer (DPO) within the territory of Vietnam, whose contact details will be posted on the "Privacy Center" page of the APP upon the entry into force of these Clauses. The DPO will be responsible for handling your inquiries, requests and complaints.

11.4.2 The Kingdom of Thailand

We comply with the provisions of Thailand's Personal Data Protection Act (PDPA), which has entered into full force. In light of the latest amendment developments in 2024, we pay special attention to and undertake to comply with its potential detailed requirements for cross-border data transfer rules.

1. Compliant Pathways for Cross-Border Data Transfers: In principle, your personal data shall only be transferred outside Thailand if the recipient country or international organization is deemed by Thailand's Personal Data Protection Commission (PDPC) to provide an adequate level of data protection standards, or if we have put in place legally recognized appropriate safeguards (e.g., Binding Corporate Rules and Standard Contractual Clauses). Otherwise, we will rely on the specific statutory exemptions prescribed by law (e.g., those necessary for the performance of a contract concluded with you) and inform you of the associated risks.
2. Protection of Children's Personal Data: Prior to collecting personal data of children under the age of 13, we shall obtain verifiable consent from their parents or legal guardians. Functions associated with child users (e.g., family account linkage) will be subject to additional verification steps.
3. Data Breach Notification: In the event of a personal data breach that is likely to pose a high risk to your rights and freedoms, we will notify PDPC in accordance with the law within 72 hours of becoming aware of the breach, and notify you without undue delay where it is reasonable and practicable to do so.

These Clauses apply to users in countries with notably distinctive regulatory regimes, including the Russian Federation, Turkey, the Republic of Korea, Brazil and Japan.

11.5.1 The Russian Federation

Pursuant to the Federal Law on Personal Data of the Russian Federation (Federal Law No. 152-FZ), we will comply with the following provisions:

1. Obligation of Data Localization: When collecting personal data of citizens of the Russian Federation, we undertake to record, systematize, accumulate, store, amend and retrieve such data using servers located within the territory of the Russian Federation, so as to comply with the statutory core data localization requirements. Cross-border transfers of such data will be subject to strict restrictions.
2. Registration as a Data Processor: As a data controller (or a designated representative) processing personal data within the territory of the Russian Federation, we have completed the statutory registration with the Federal Service for Supervision of Communications, Information Technology and Mass Media of the Russian Federation in accordance with the law.

11.5.2 The Republic of Turkey

Pursuant to the Personal Data Protection Law of the Republic of Turkey (KVKK, Law No. 6698), we will comply with the following provisions:

1. Data Controller Registration: As a foreign data controller processing personal data within the territory of Turkey, we have completed the registration in accordance with the law with the Data Controller Registration System (VERBIS) of the Turkish Personal Data Protection Authority (KVK Kurumu), and disclose our data processing activities to the public.
2. Express Consent Requirement: The processing of personal data shall, in principle, require the obtaining of your express consent, in particular with respect to sensitive personal data. At the time of obtaining such consent, we will inform you of all statutory information in a clear and comprehensible manner.

These Clauses apply to users in Latin American jurisdictions including Argentina.

11.6.1 Republic of Argentina

Argentina is a pioneer in data protection in Latin America, and its Personal Data Protection Law (Law No. 25,326) has been recognized by the EU as a jurisdiction providing an "adequate level of protection". We will comply with the following provisions:

1. Facilitated Exercise of Habeas Data: As a data subject, you are entitled to the extensive statutory rights to access, rectify, update and delete your personal data (collectively referred to as the "ARCO Rights"). You may exercise these rights free of charge and conveniently via the online form under "Me - Privacy Settings - Data Subject Requests" within the APP. We undertake to respond to a complete and verifiable request within a maximum of 10 business days from its receipt.
2. Recognized Mechanisms for Cross-Border Data Transfers: Since Argentina has obtained the EU's "adequacy recognition", the transfer of your personal data to entities located in EU or the EEA will follow a streamlined process. For transfers to other jurisdictions, we will ensure that a level of protection equivalent to that required by Argentine law is provided.
3. Clear Definition and Protection of Sensitive Data: We will pay special attention to the processing of sensitive data as defined by Argentine law (e.g., information relating to race, political opinions, religious beliefs, trade union membership, health or sexual life). The processing of such data is prohibited in principle, unless it is for the public interest, a medical emergency, or we have obtained your explicit and written special consent.