XPENG takes privacy issues very seriously and we are fully committed to protecting your privacy. In this Privacy Notice we describe who we are, how and for which purposes and on what legal basis we process your personal data through XPENG website and App, as well as your experience at stores, or contact us via phone or email, etc., how you can exercise your privacy rights and all other information that may be relevant to you. A reference to “XPENG,” “we,” “us” is a reference to XPENG European Holding B.V. and its relevant affiliates involved in the collection, use, sharing, or other processing of Personal Data.
We did our best to provide you with all information in a clear and readable format. However, if you have any questions about our use of your personal data after reading this Privacy Notice, you can of course always contact us through the contact details provided at the end of this Privacy Notice.
This Privacy Notice may be changed over time. The last modifications to this Privacy Notice have been made on 14/08/2024.
This Privacy Notice is applicable to the processing of personal data in relation to the use of XPENG App, website, or the experience in XPENG stores. This Privacy Policy does not address the processing of personal data of applicants or employees in the context of their employment relationship with XPENG.
This Privacy Notice applies to the processing of personal data where XPENG acts as a controller in the sense of applicable data protection laws. . This Privacy Notice indicates what personal data are collected and used (processed) by XPENG and for what purpose, and to which persons or entities the data may be provided.
When we provide our services, we have a need to process personal data. We typically process the following personal data when you use our APP or website, visit our stores, or contact us via phone or email, etc.:
We use personal data to manage our service and meet your information requests, to understand the use of our XPENG APP and website use, and to make our products and services as effective as possible.
To realize our product functions and services:
Data Processing Purposes | Type of Personal Data | Legal Basis for Processing |
---|---|---|
To create and activate your XPENG account |
| Performance of a contract with you |
To fulfill and complete your orders, including reservations, orders and pre-orders, leasing, fleet sales, and other transactions entered with us |
| Performance of a contract with you |
To provide connected-vehicle service through XPENG APP |
| Performance of a contract with you |
Vehicle authorization (authorize others to remote control your XPENG vehicle via XPENG App) |
| Performance of a contract with you |
To provide you with charging service |
| Performance of a contract with you |
To handle bills, invoices, and taxation |
|
|
To provide you with XPENG Trade-in service |
| Performance of a contract with you |
To provide insurance or finance solutions for you (upon your request) |
| Necessary in order to take steps at your request prior to entering into a contract |
Note: If you choose a direct payment gateway to complete your purchase, then our authorized payment provider collects and stores your bank card data. Adyen's Privacy Policy.
To communicate with you:
Data Processing Purposes | Type of Personal Data | Legal Basis for Processing |
---|---|---|
To fulfill requests or service appointments you make to us, including test drives, service and event appointments, partnership requests. |
|
|
To respond to any feedback, requests, questions, or complaints you may have regarding our products and services (in person, online, telephone, email, etc.) |
|
|
Sign up for XPENG marketing communications |
|
|
Advertising and marketing purposes, including displaying online ads based on your online profile and analysing the effect of such online marketing campaigns. We may use cookies and similar technologies ("cookies") for this. Some cookies create unique identifiers and may collect data while you are using our websites or applications or other content, which help us to personalise content or advertisements. Read our Cookie Policy for more information about cookies. |
|
|
To participate in surveys about your experience with our products and services |
| Necessary for our legitimate interests: to understand, analyze and improve customer experience |
Process job candidates’ personal data to evaluate applications for employment | Job application data (including name, contact details, employment and education information, CV) | Necessary to take steps at your request prior to entering into a contract |
To understand and improve our products and services, or to ensure information security.
Data Processing Purposes | Type of Personal Data | Legal Basis for Processing |
---|---|---|
To detect and defend against unauthorized access to data, and to enhance information security |
| Necessary for our legitimate interests: to protect the confidentiality, integrity, and availability of IT systems |
To upload crash logs for troubleshooting |
| Where you have provided your consent |
To understand and analyze app and website UI behaviour and usage, so as to improve our services. We also use cookies like Google Analytics to collect usage data of our app and website; we only use this kind of analytics tools to understand usage and effectiveness of our online services. To know more about how Google Analytics process data, please see: https://policies.google.com/privacy?hl=en-US |
|
|
Other circumstances
Data Processing Purposes | Type of Personal Data | Legal Basis for Processing |
---|---|---|
To demonstrate compliance with regulatory requirements |
| Necessary to comply with a legal obligation |
To prevent thefts, and to ensure safety in Stores |
| Necessary for our legitimate interests: to monitor the security of store assets and ensure Data Subjects' safety |
We retain the information we collect from or about you for the period necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by law. When the information is no longer necessary for these purposes, we delete it or keep it in a form that does not identify you.
When determining this retention period, we take into account various criteria, including the type of services requested by or provided to you, the nature of our relationship with you, the impact on the services we provide to you if we delete some information from or about you, and retention periods required by law. We will take reasonable and appropriate measures to protect your Personal Data from loss, misuse, unauthorized access, disclosure, alteration and destruction. However, please note that no security measures can be 100% secure and perfect, and in the unfortunate event that a Personal Data security incident occurs, we will report it promptly and take remedial measures in accordance with the requirements of the law and regulatory authorities.
If you sell or transfer your vehicle to another person, please inform us promptly so that we can determine whether additional steps are needed to be taken to avoid disclosing Personal Data from or about you to the purchaser or transferee of the vehicle.
XPENG is a global company. Your personal data is stored within the European Economic Area (EEA), but your personal data might be accessed from XPENG's affiliates outside of the EEA for the provision of services, such as IT system operations and maintenance. With respect to personal data transferred outside the EEA, we comply with applicable data protection laws providing adequate safeguards for the transfer of personal data to countries outside of the EEA. Before each transmission, we analyze the transmission scenarios and the risks they may pose before deciding whether to transmit. We use Standard Contractual Clauses as transfer tool to implement the cross-border transfer of your personal data; we also implement technical, organizational, and contractual measures to ensure lawful data international transfer.
If you want to know more information about the international transfers of personal data, you may contact us according to the instructions in "How to Contact us" section below.
We will not sell your Personal Data to anyone at any time for any purpose. We will only share your Personal Data in the following ways:
As a data subject, you have specific legal rights granted by the General Data Protection Regulation (GDPR) relating to the personal data we process about you. We enable you to access and control the data that we collect, use and share from or about you, or your use of services.
(f) You can also lodge a complaint to your local data protection authority in the EEA. However, we will appreciate if you first contact us to try and solve your problem – you can find our contact details below.
We do not knowingly collect or use any Personal Data from children (we define ‘children’ as minors younger than 16) without prior, verifiable consent which is given or authorized by the holder of parental responsibility over the child. We do not knowingly allow children to order our vehicles, communicate with us, or use any of our online services.
If you become aware that a child has provided us with Personal Data, please contact us as indicated in the “How to contact us” section below. We will take all reasonable measures to delete the information as soon as possible and to not use such information for any purpose, except where necessary to protect the safety of the child or others as required by law.
For questions or comments, or to submit a data subject request, please contact us.
Contact our EU Legal department by email: [email protected];
Or contact XPENG European Holding B.V. at Hoogoorddreef 11, 1101BA, Amsterdam, the Netherlands.
We may update this Privacy Notice according to changes in our business functions and measures concerning the protection of personal data. If we make changes to this Privacy Notice, we will update it through our website or App. Where changes to this Privacy Notice will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice to ensure you have the opportunity to exercise any data subject rights.