PRIVACY STATEMENT

1. Introduction

Petromin BAIC Saudi Arabia ("Petromin BAIC" or "we" or "us") respects your privacy and is committed to protecting your personal data.

This Privacy Statement applies, where applicable, when you:

• visit or use our website;
• interact with the Chatbot or virtual assistant;
• create an account;
• submit an enquiry;
• request a quotation;
• request or book a test drive;
• purchase or enquire about a vehicle;
• request financing information;
• book a vehicle service or maintenance appointment;
• contact customer service;
• participate in a campaign, promotion or event;
• subscribe to marketing communications; or
• otherwise interact with Petromin BAIC.

For purposes of this Privacy Statement, "personal data" means any data relating to an identified or identifiable individual, in accordance with applicable laws and regulations of the Kingdom of Saudi Arabia.

2. Personal Data We May Collect

Depending on the nature of your relationship and interaction with Petromin BAIC, we may collect the following categories of personal data:

Identity and Contact Data may include:

• full name;
• mobile or telephone number;
• email address;
• postal or delivery address;
• city or region;
• customer identification data where required; and
• any other contact information you provide.

Vehicle Data may include:

• vehicle type and model;
• model year;
• Vehicle Identification Number (VIN);
• registration information, where applicable;
• odometer reading;
• vehicle specifications and features;
• warranty information;
• service and repair history; and
• any other vehicle-related information.

Transaction and Purchase Data may include:

• vehicles or services purchased;
• quotations and order information;
• invoices;
• payment status;
• transaction records;
• warranty records;
• service and maintenance records; and
• relevant customer service records.

Financing-Related Data: When you request information about vehicle financing, we may collect the information necessary to facilitate your enquiry or referral to an authorized bank or finance company.

Payment Data: When payment services are available, payment-related data may be processed by Petromin BAIC and/or authorized payment-service providers.

Test-Drive, Service and Booking Data may include:

• preferred vehicle;
• preferred showroom;
• requested date and time;
• service appointment details;
• vehicle service requirements;
• communication preferences; and
• relevant booking information.

Chatbot and Customer-Service Data: When you contact the Chatbot, customer-service representatives or other digital channels, we may collect:

• conversation content;
• questions and requests;
• vehicle preferences;
• contact information;
• booking requests;
• feedback;
• complaint information; and
• any other information you voluntarily provide during the interaction.

Technical and Device Data: When you use our website or digital services, we may automatically collect certain technical information, such as:

• Internet Protocol (IP) address;
• device type;
• browser type;
• operating system;
• language settings;
• login dates and times;
• website-usage activity;
• referring pages;
• session information; and
• security and diagnostic information.

Cookies and Similar Technologies: We may collect information using cookies, pixels, tags and similar technologies, in accordance with applicable laws and your relevant preferences.

3. How We Collect Personal Data

We may collect personal data in the following ways:

Directly from you: For example, when you:

• fill in a form on the website;
• create an account;
• contact us;
• interact with the Chatbot;
• request a quotation;
• request a test drive;
• make a booking;
• purchase a vehicle or service;
• submit a complaint;
• participate in a promotion; or
• subscribe to marketing communications.

Automatically: Certain technical and usage information may be collected automatically when you access our website or interact with our digital services.

From authorized third parties: Where permitted by applicable laws, we may receive personal data from entities such as:

• authorized service providers;
• payment-service providers;
• authorized financing partners;
• technology providers;
• customer-support providers;
• marketing or communications providers; and
• other parties involved in delivering services you request.

We will not process information received from third parties except for appropriate purposes and in accordance with applicable legal requirements.

4. Purposes of Processing Personal Data

Depending on the circumstances and applicable legal basis, we may process personal data for the following purposes:

• responding to enquiries and requests;
• providing vehicle information;
• preparing quotations;
• processing vehicle orders and purchases;
• arranging test drives;
• managing service and maintenance appointments;
• maintaining warranty and service records;
• providing customer support;
• handling complaints;
• facilitating financing enquiries with authorized financing partners;
• processing or facilitating payments;
• sending important vehicle or service information;
• managing accounts;
• verifying user identities;
• preventing fraud and unauthorized activities;
• maintaining website and system security;
• improving the website, Chatbot and digital services;
• conducting analytics and service-quality assessment;
• managing campaigns, events and promotions;
• sending marketing communications where permitted;
• maintaining appropriate business and transaction records;
• establishing, exercising or defending legal rights;
• complying with applicable legal and regulatory obligations; and
• responding to lawful requests from competent authorities.

We will not process personal data for a purpose incompatible with the purpose for which it was collected, except where such processing is permitted by applicable laws.

5. Legal Basis for Processing

Petromin BAIC processes personal data only where an appropriate legal basis exists under applicable laws and regulations of the Kingdom of Saudi Arabia.

Depending on the relevant processing activity, the legal basis may include:

• your consent;
• taking steps at your request before entering into a contract;
• performing an agreement or transaction with you;
• complying with a legal or regulatory obligation;
• protecting legitimate interests or rights where permitted by applicable laws; or
• any other legal basis permitted by the Personal Data Protection Law and its related regulations.

Where processing is based on consent, you may withdraw that consent in accordance with applicable laws.

Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

6. Chatbot and Artificial Intelligence

Petromin BAIC may use chatbots, virtual assistants, artificial-intelligence technologies and automated systems to support customer interactions.

When you interact with the Chatbot, we may process information including:

• conversation content;
• contact information you provide;
• your vehicle interests and preferences;
• quotation enquiries;
• financing enquiries;
• test-drive requests;
• service requests;
• customer-support enquiries; and
• technical information related to the interaction.

Chatbot conversations may be recorded, reviewed or analyzed, where permitted by applicable law, for purposes including:

• responding to your requests;
• customer support;
• quality assurance;
• security;
• fraud prevention;
• troubleshooting;
• improving Chatbot performance; and
• compliance purposes.

Users should not provide passwords, one-time passwords (OTPs), payment-card security codes, banking passwords or other confidential authentication data through the Chatbot.

Where an interaction requires human involvement, Petromin BAIC may transfer or escalate the conversation to an authorized employee or service provider.

7. AI Training and Service Improvement

Personal data will not be used for AI model training or materially different secondary purposes unless Petromin BAIC has established an appropriate lawful basis and satisfied applicable Saudi data-protection requirements.

Where appropriate and legally permissible, information may be anonymized or aggregated for analytics, quality assurance, statistical analysis, security, service improvement and digital-system improvement.

Information that has been properly anonymized so that an individual can no longer be identified from it will be treated as non-personal data, subject to applicable laws.

8. Automated Decision-Making

Petromin BAIC may use automated technologies to assist in operating and improving its services.

However, material decisions — such as final financing approval and other decisions requiring authorization or human review — will be processed through the appropriate authorized procedures.

Where applicable laws grant specific rights regarding automated processing or decisions, Petromin BAIC will implement the required safeguards.

9. Sharing and Disclosure of Personal Data

Petromin BAIC does not disclose personal data randomly or without restriction.

Where necessary and where permitted by applicable laws, personal data may be shared with appropriate parties, including:

Authorized Service Providers: Trusted companies that support our operations, including providers of:

• website hosting;
• cloud infrastructure;
• information technology;
• cybersecurity;
• customer-service systems;
• communications;
• analytics;
• payment processing;
• logistics services;
• marketing services; and
• Chatbot or AI technologies.

Authorized Financing Partners: When you request vehicle financing, relevant information may be shared with, or collected directly by, an authorized bank or finance company for the purpose of processing and assessing your financing application.

Authorized Agents, Service Centers and Business Partners: Where necessary to deliver the product or service you request, personal data may be shared with authorized parties involved in the sale, delivery, warranty, servicing or customer support of vehicles.

Government and Regulatory Authorities: We may disclose personal data where required or permitted by statute, regulation, court order or lawful request from a competent authority.

Corporate Transactions: Personal data may be disclosed, where necessary, in connection with a merger, restructuring, acquisition, sale or transfer of all or part of the business, subject to applicable legal requirements and safeguards.

Petromin BAIC does not sell personal data to third parties for their independent marketing purposes, except where expressly permitted by applicable laws and any required consent has been obtained.

10. International Data Transfers

Petromin BAIC or its authorized service providers may, where necessary, use technologies, infrastructure or services that involve the processing or storage of data outside the Kingdom of Saudi Arabia.

Any transfer or disclosure of personal data outside the Kingdom will be subject to the provisions of the Personal Data Protection Law, its implementing regulations and applicable regulations governing the international transfer of personal data.

Where required, Petromin BAIC will implement appropriate safeguards, assessments, contractual arrangements or other authorized mechanisms.

Your general acceptance of this Privacy Statement does not, by itself, constitute automatic authorization for international data transfers in situations that require additional legal requirements.

11. Data Security

Petromin BAIC implements organizational and technical security measures designed to protect personal data from risks such as:

• unauthorized access;
• unlawful disclosure;
• alteration;
• loss;
• destruction; and
• misuse.

Depending on applicable laws and relevant risks, security measures may include:

• data encryption during transmission;
• secure system configurations;
• access controls;
• authentication;
• role-based permissions;
• logging and monitoring;
• vulnerability management;
• security assessments;
• backup and recovery controls; and
• incident-management procedures.

While we implement reasonable measures to protect personal data, no information system or means of electronic transmission can be guaranteed to be completely secure.

12. Personal Data Breaches

Petromin BAIC maintains procedures for identifying, assessing, managing and responding to personal-data security incidents.

Where a personal-data breach triggers notification requirements under applicable laws and regulations of the Kingdom of Saudi Arabia, Petromin BAIC will take the required legal steps, which may include notifying the competent authority and/or affected data subjects, as applicable.

13. Data Retention

Petromin BAIC retains personal data only for as long as reasonably necessary to achieve the purpose for which it was collected, or for the period required or permitted by applicable laws.

Retention periods may vary depending on:

• the type of personal data;
• the purpose of processing;
• the duration of the customer relationship;
• vehicle warranty and service requirements;
• transaction and accounting requirements;
• tax requirements;
• regulatory requirements;
• complaint or dispute requirements;
• cybersecurity requirements; and
• applicable mandatory retention periods.

When personal data is no longer required and there is no legal basis for retention, Petromin BAIC will delete, destroy or anonymize it appropriately in accordance with applicable requirements.

14. Your Rights Regarding Personal Data

Subject to the terms, limitations and exceptions set out in applicable laws and regulations of the Kingdom of Saudi Arabia, you may have rights regarding your personal data, including the right to:

• be informed about the processing of your personal data;
• access the personal data we hold about you;
• obtain a copy of your personal data where applicable;
• request correction or completion of inaccurate or incomplete personal data;
• request deletion of personal data where the relevant legal conditions are met; and
• withdraw consent where consent is the legal basis for processing.

Other rights may apply depending on the nature of the processing activity and applicable laws.

Requests may require reasonable identity verification before Petromin BAIC can process them.

Certain requests may be subject to limitations in situations where laws require data retention or continued processing, or where another legal exception applies.

15. How to Exercise Your Rights

To exercise any right relating to personal data, or to submit an enquiry or complaint regarding privacy, please contact Petromin BAIC using the contact details set out at the end of this Privacy Statement.

Please provide sufficient information to enable us to identify your request and verify your identity where applicable.

Petromin BAIC will process valid requests in accordance with the procedures and timeframes required by applicable laws and regulations of the Kingdom of Saudi Arabia.

16. Marketing Communications

Petromin BAIC may use your personal data to send information about vehicles, products, services, campaigns and promotions where permitted under applicable law.

Where required, marketing messages will be sent based on appropriate consent.

You may withdraw your marketing consent or unsubscribe using the mechanism available in the relevant message or by contacting us.

Opting out of marketing communications will not prevent Petromin BAIC from sending non-marketing communications that are necessary and related to:

• an existing transaction;
• vehicle delivery;
• service appointments;
• warranty matters;
• security;
• safety;
• customer requests; or
• legal and regulatory requirements.

17. Cookies and Tracking Technologies

Our website may use cookies and similar technologies for purposes such as:

• essential website operation;
• managing user sessions;
• remembering preferences;
• analytics;
• performance measurement;
• security; and
• advertising or marketing where lawfully permitted.

Where required by applicable law, non-essential cookies will be managed through an appropriate consent or preference-management mechanism.

Users may also manage some cookies through their browser settings.

Disabling certain cookies may affect the availability or functionality of some website features.

Further information may be provided through a separate cookie policy or notice.

18. Third-Party Websites and Services

Our website may contain links to third-party websites, applications or services.

Petromin BAIC does not control the independent privacy practices of these parties.

When you leave our website or interact directly with a third-party service, we encourage you to review the privacy statement of that party before providing your personal data.

19. Children's Personal Data

The vehicle sales and related commercial services provided by Petromin BAIC are generally directed at adults.

We do not intentionally collect personal data from children through services exclusively intended for adult customers.

If personal data concerning a child is processed, Petromin BAIC will apply the applicable legal requirements under Saudi data-protection laws, including requirements relating to a parent or legal guardian where applicable.

If you believe that a child has provided us with personal data in an inappropriate manner, please contact us.

20. Accuracy of Personal Data

We take reasonable steps to help ensure that personal data is accurate, complete and suitable for the purposes for which it is processed.

We encourage customers to provide correct and up-to-date information and to notify Petromin BAIC of any changes to their personal data.

Petromin BAIC may request updates or corrections where reasonably necessary for the provision of services or compliance with applicable requirements.

21. Changes to This Privacy Statement

Petromin BAIC may update this Privacy Statement from time to time to reflect:

• changes in applicable laws or regulations;
• changes to our services;
• changes in personal-data processing activities;
• introduction of new technologies;
• changes in Chatbot or AI functionality;
• changes in service providers;
• security requirements; or
• other legitimate operational requirements.

The current version will be published on our website with an updated "Last Updated" date.

Where required by applicable law, Petromin BAIC will provide appropriate notice or obtain required consent before implementing any material change that affects the processing of personal data.

22. Data Protection Legal Framework

This Privacy Statement is intended to operate in accordance with the laws and regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law and its implementing regulations.

Nothing in this Privacy Statement is intended to reduce or waive any data-subject right that cannot lawfully be reduced or waived.

Where any provision of this Privacy Statement conflicts with a mandatory requirement under applicable Saudi data-protection laws, the mandatory legal requirement will prevail to the extent of that conflict.

23. Privacy Complaints

If you have any concerns or complaints about the way Petromin BAIC handles your personal data, you are welcome to contact us first so that we may review and address the matter.

Nothing in this Privacy Statement prevents a data subject from exercising any lawful right to lodge a complaint with the competent data-protection authority in the Kingdom of Saudi Arabia under applicable laws.

24. Contact Us

If you have any questions about this Privacy Statement, wish to exercise any of your rights relating to personal data, or wish to submit an enquiry or complaint regarding privacy, please contact us:

Petromin BAIC Saudi Arabia

Jeddah, Kingdom of Saudi Arabia

800 442 0030

Contact Us