Data Privacy and Cookie Privacy

ALBA CARS DATA PRIVACY STATEMENT

This Digital Platform, and each webpage forming part of this Platform, including but not limited to the Alba Cars website, Alba Cars mobile website, applications for mobile and tablet devices, the Alba Cars app, Dealers by Alba, and Suppliers by Alba, collectively referred to as the "Digital Platform", is solely owned, hosted, and operated by Alba Motors LLC, a mainland company incorporated pursuant to the prevailing laws of Dubai, United Arab Emirates, referred to as the "Company". References to the "Company", "we", "us" or "our" mean Alba Motors LLC as the controller of your Personal Data and, where relevant, include its parent company, affiliates and related entities within the group in the UAE. This Data Privacy Statement also applies to Personal Data we collect offline, including at our showrooms, by telephone, by email and through WhatsApp.

The Company, through its Digital Platform, is engaged in the business of providing a unique opportunity to meet and connect with buyers, sellers, and visitors, and to obtain information pertaining to vehicles listed on the Digital Platform, as well as the purchase, sale, trade-in, inspection, financing facilitation and bank valuation of vehicles. Personal Data is collected, stored, processed, used, disclosed, transferred, retained and protected when you access the Digital Platform or use our services. Your privacy is important to us.

It is the Company's policy to respect your privacy concerning any information we may collect from you across our Digital Platform and other sites owned and operated by us. The Digital Platform is hosted on third party servers, for which the Company uses a security certificate that encrypts your connection with the Digital Platform.

Protecting the privacy of visitors is important to us. We therefore conduct our business in line with applicable laws on data privacy protection and data security. of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and any other applicable laws.

Information We Collect

Log Data

When you visit our Digital Platform, our servers may automatically log the standard data provided by your web browser. This may include your Internet Protocol address, browser type and version, the pages you visit, the date and time of your visit, and other relevant details.

Device Data

Data may be collected about the device being used to access our Digital Platform. This data may include the device type, operating system, unique device identifiers, device settings, and geolocation data. What we collect may depend on the individual settings of your device and software. We recommend that you check the policies of your device manufacturer or your device settings to understand what information is made available to us.

Personal Data

Personal Data is any data relating to an identified natural person, or a natural person who can be identified directly or indirectly. The Personal Data we collect includes, but is not limited to, name, email address, date of birth, gender, nationality, passport number, Emirates ID number, phone or mobile number, home address, mailing address, P.O. Box number, work address, payment information, vehicle details (including make, model, VIN, registration card (Mulkiya), ownership, inspection, insurance and service history), trade-in, consignment and loan settlement details, financing and credit information and records of your communications with us.

The Digital Platform gathers information and personal data in the following ways:

Directly, for instance, when you provide information to sign up for a newsletter, register on the Digital Platform or extranet, wish to leave a comment on a forum, enquire about, buy, sell, trade in or consign a vehicle, apply for financing, book an inspection or test drive, visit our showroom, or contact us by telephone, email or WhatsApp.
Indirectly, for instance, through our Digital Platform's technology or through our affiliates.
Through information you supply on the Company's social media pages, including but not limited to Facebook, X, Google, Instagram, LinkedIn, TikTok, and YouTube.

Legal Processing of Data

We will process your personal data lawfully, fairly, and in a transparent manner. We collect and process data about you only on legal bases. These legal bases depend on the services you use and how you use them, meaning we collect and use your information only where:

It is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract, including when we provide a service you request from us.
You have given us consent to do so for a specific purpose. You have the right to withdraw your consent at any time, but this will not affect any processing that has already taken place.
We need to process your data to comply with a legal obligation.
It is necessary to protect your interests, including your vital interests.
It is necessary to establish, exercise or defend legal claims or rights, or relates to judicial or security procedures.
The Personal Data has been made publicly available by you.
It is otherwise permitted under Article 4 of the PDPL or its Executive Regulations.

Where we rely on your consent, we will request it in a clear, specific and unambiguous manner, separately from other terms (for example, through an unticked box), and we will keep a record of it. You may withdraw your consent at any time by contacting us using the details in the "Contact Us" section below. Withdrawal does not affect the lawfulness of processing carried out before withdrawal

Collection and Use of Information

We will not keep personal data for longer than is necessary. While we retain this data, we will protect it through commercially acceptable means to prevent loss, theft, unauthorized access, disclosure, copying, use, or modification. If necessary, we may retain your personal data for compliance with a legal obligation, or to protect your vital interests or the vital interests of another natural person.

As no method of electronic transmission or storage is 100 percent secure, we cannot guarantee absolute data security. We do not collect sensitive personal data through our Digital Platform unless required by law enforcement, local authorities, or applicable data protection and privacy requirements. Several data privacy regulations mandate special treatment when collecting sensitive personal information.

Under the PDPL, Sensitive Personal Data means data that directly or indirectly reveals a person's family or racial origin, political or philosophical opinions, religious beliefs, criminal record, biometric data, or health (including physical, psychological, mental, genetic or sexual condition). We also treat government-issued identification (Emirates ID and passport), financial and credit information, and precise location data with additional care. We use cookies to collect information about you and your activity across our Digital Platform. Please refer to the Alba Cars Cookie Policy for more details.

We may collect, hold, use, and disclose personal data for the following purposes, and personal data will not be further processed in a manner that is incompatible with these purposes:

To enable you to customize or personalize your experience on our Digital Platform.
To enable you to access and use our Digital Platform, associated applications, and associated social media platforms.
To facilitate vehicle purchases, sales, consignments, inspections, bank valuations, registration and transfer of ownership, warranties, insurance, delivery and the settlement of outstanding vehicle loans.
To verify your identity and vehicle ownership, and to detect and prevent fraud and other unlawful activity.
To assess financing eligibility and submit financing applications to our licensed financing partners
To contact and communicate with you.
For internal record keeping and administrative purposes.
For analytics, market research, and business development, including operating and improving our Digital Platform, associated applications, and associated social media platforms.
For advertising and marketing, where you have consented or as otherwise permitted by law, including sending you promotional information about our services and information about third parties that we consider may be of interest to you.
To share information within the Group Companies for integrated customer service, group reporting, compliance and the operation of shared systems
To comply with our legal obligations and resolve any disputes that we may have.

We may disclose personal data to:

Third party service providers for the purpose of enabling them to provide their services.
Other parties where necessary for the performance of a contract.
Our employees, affiliates, Group Company and related entities.
Sponsors or promoters of any services we run.
Debt collection agencies, courts, tribunals, and regulatory authorities in the event you fail to pay for services we have provided to you.
Courts, tribunals, regulatory authorities, and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise, or defend our legal rights.
Third parties, including agents or subcontractors, who assist us in providing information, services, or direct marketing to you.
Third parties who collect and process data on our behalf.
Licensed banks, financing and leasing companies, insurers and warranty providers, where you request financing, insurance or warranty products.
The RTA and other government authorities for vehicle registration, transfer and verification.

The personal information we collect is stored and processed in the United Arab Emirates, or wherever we, our partners, affiliates, or third party providers maintain facilities. By providing us with your personal data, you consent to the disclosure of such data to these overseas third parties where applicable.

We will ensure that any transfer of personal data to overseas countries is protected by appropriate safeguards.

Cookies and Similar Technologies

We and our partners use cookies, pixels and similar technologies on the Digital Platform, including essential, performance, analytics, functionality and advertising cookies. Essential cookies are necessary for the Digital Platform to work. Where required by law, we will ask for your consent before placing non-essential cookies (such as analytics and advertising cookies, including social media pixels), and you may withdraw that consent at any time through our cookie settings.

Most browsers and devices accept cookies by default. You can change your browser or device settings to block or delete cookies, although this may affect how some features of the Digital Platform work. For more details, please see our Cookie Policy.

Automated Processing and Profiling

We may use automated tools, analytics and profiling to support activities such as vehicle valuation, fraud prevention, financing pre-assessment, personalisation and marketing. Where a decision based on automated processing would have legal consequences for you or seriously affect you, you have the right to object to that decision, and we will apply appropriate safeguards, including review by a member of our team on request.

Data Retention

We retain Personal Data only for as long as necessary for the purposes described in this Data Privacy Statement, including to provide our services, complete transactions, meet legal, regulatory, tax and accounting obligations, prevent fraud, resolve disputes and enforce our rights. Retention periods depend on the type of data and the applicable legal requirements.

When Personal Data is no longer required, we will securely delete or anonymise it. Anonymised data that can no longer identify you may be retained for analytics and business improvement.

Data Security

We implement appropriate technical and organisational measures to protect Personal Data against unauthorised access, loss, theft, misuse, disclosure, copying, alteration or destruction, including secure hosting, encryption in transit, access controls, authentication protocols, internal security reviews and vendor due diligence. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

Data Breach Notification

If a personal data breach occurs that would prejudice the privacy, confidentiality or security of your Personal Data, we will notify the UAE Data Office in accordance with Article 9 of the PDPL and, where required, we will notify you and inform you of the measures taken.

Data Protection for Minors

The Digital Platform is intended only for users above eighteen years of age who are in a position to enter into legally binding contracts. The Digital Platform does not knowingly collect any information or data from persons who have not attained the age of eighteen years.

Your Rights

We respect your privacy. Subject to the PDPL, you have the following rights in relation to your Personal Data, which you may exercise free of charge:

Information and access: to know whether we process your Personal Data and obtain a copy of it, together with information about the purposes of processing, the recipients (including recipients outside the UAE), the retention period and the safeguards applied to cross-border transfers;
Portability: to receive your Personal Data in a structured, machine-readable format and have it transferred to another controller, where technically feasible;
Correction: to have inaccurate Personal Data corrected or completed;
Erasure: to have your Personal Data deleted where it is no longer required, where you withdraw consent, or where processing is unlawful, subject to legal exceptions (for example, where we must retain records by law);
Restriction: to restrict processing in the circumstances set out in the PDPL, for example while we verify the accuracy of data you have contested;
Objection: to object to, or ask us to stop, processing for direct marketing, for statistical surveys (unless in the public interest), or where processing breaches the PDPL;
Automated decisions: to object to decisions based on automated processing, including profiling, that have legal consequences or seriously affect you;
Withdrawal of consent: to withdraw consent at any time where we rely on it; and
Complaint: to lodge a complaint with the UAE Data Office if you believe your Personal Data is being processed in breach of the PDPL.

You may request that we erase the personal data we hold about you You may also request that we transfer this personal data to another third party. You can do the above by contacting our Grievance Officer using the details in the "Contact Us" section below. We may need to verify your identity before acting on your request, and we will respond within 7 working days.

Links to Other Sites

The Digital Platform contains links to advertisements, events, business partners, and third party websites. Those websites have their own privacy statements and policies. This Privacy Statement will not apply when you move to other sites. We are neither responsible nor liable for privacy practices employed by websites linked to us. We do not guarantee, assure, approve, or endorse any information, material, service, or product contained in these links.

These links are for reference purposes only, and you click on these links at your sole risk.

Amendments

We may update this Data Privacy Statement from time to time to reflect legal, regulatory, operational or business changes. The updated version will be posted on this page with a revised "Last Updated" date. Where changes are material, we will also notify you by appropriate means (for example, by email or a notice on the Digital Platform), and where a change requires your consent under applicable law, we will seek it.

Alba Motors LLC is the controller of your Personal Data. If you have any questions, requests or complaints about this Data Privacy Statement or our processing of your Personal Data, please contact:

Data Protection Officer/ Grievance Officer

Email: [email protected]

Telephone: +971 4 377 2503

Address: Al Quoz, Dubai, United Arab Emirates

Governing Law

This Data Privacy Statement is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai, without prejudice to any mandatory rights you have under applicable law.

Effective: February 2021

Last Updated: October 2026