Vehicle Data Privacy Notice – Outlander

SUMMARY

This summary briefly explains our Privacy Notice, the complete version of which follows the summary.

Information Collected by MME

• If you use the Connected Vehicle Services, MME collects information about you, including your contact information, information about your vehicle (including, in certain cases, its location) and your use of your vehicle, information from your mobile device and your use of the Mitsubishi Motors mobile application, Information collection varies depending on the type of Service or Subscription Package you are using.
• We collect information from a variety of sources, including from you directly, from your vehicle, from your use of the Mobile App, from your contact with us, and from third parties who work with us to provide the Services.

• Users can start the app using their biometric information instead of entering a passcode by selecting the authentication method. The choice of authentication method and starting the app using biometric information are at the user’s discretion and responsibility. This feature is only available on communication devices with the required functionality. MME does not require any biometric data to benefit from any services that are offered by MME.

How MME Uses Collected Data

• We use information we collect from you to provide you with the Services, to provide customer and vehicle support and service, to communicate with you about your account or your vehicle, and, if you consent, to offer you products or services. We use information for other purposes as further described in the Privacy Notice.

How MME Shares Collected Data

• We share certain information we collect from you (including Personal Data) with third parties who work with us to provide the Services. If relevant, we share that information with third parties in connection with financing your vehicle.
• We share aggregated data (which excludes your Personal Data) with our business partners and other third parties.

Retention

• We will retain Collected Data only for as long as it is needed for the purposes for which it was collected. This includes for the purpose of satisfying any applicable legal or regulatory requirements. We retain your Collected Data for a longer period in the event of a complaint from you or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

Managing Your Privacy Preferences

• You review and update any Personal Data that you provided to MME during your registration process by logging in to the Mobile App.
• You opt out of receiving certain communications from MME, such as communications regarding marketing or promotions, by indicating your preference through the Mobile App.
• You can prevent collection of geolocation data by selecting “Privacy Mode” in the Mobile App, however location data may still be collected in order to provide mandatory eCall. Other Vehicle Data will continue to be collected as well. If you would prefer MME not to collect any Vehicle Data, you will need to cancel your Subscription Service Package or contact us. This will also disable your ability to receive any Services.

Safeguarding Your Information

• MME is committed to maintaining the security of the data you provide us. However, please note that there is always some risk in transmitting information over the internet.

Your Obligations

• It is your responsibility to tell your vehicle occupants and users about the Services and how they work, what data is collected (e.g., collection of geolocation data) and how that data is shared, and what the limitations of the Services are (e.g., they may not work in remote areas).

International Transfer of Personal Data

• The Personal Data that we process are transferred to one or more countries outside the European Economic Area which has not yet been deemed by the European Commission to offer adequate data protection. In such cases, we will take appropriate steps to ensure an adequate level of data protection in the country of the recipient as required under EU data protection law.

Your Privacy Rights

• You have certain rights in relation to your Personal Data, including a right to access and correct your Personal Data, to request that your Personal Data not be used to contact you, and to ask that your Personal Data be deleted from our production systems.

Exclusions

• The Privacy Notice does not apply to websites owned by other companies.
• We do not seek to, nor do we knowingly collect, information from children.

Updates to Privacy Notice

• If we update the Privacy Notice, we will note at the top of this page the date that any changes are made or become effective.
• If we significantly change our practices described in the Privacy Notice in a way that could reasonably be seen to decrease your privacy (such as collecting more Personal Data, using it in certain new ways or sharing it with new types of third parties, or reducing our data security), we will provide you with additional notice of the specific changes using the contact preferences you have given us, and ask that you agree to the changes.
• If the changes are not that material, we may not specifically ask for your consent, although you may contact us to update your privacy preferences as described above. Otherwise, we will understand your continued use of the Services after any such updates or notices as your agreement to these changes.

1. INTRODUCTION

Mitsubishi Motors Europe B.V. (“MME” or “we”) offers those who purchase or lease the Model Year 2025 Outlander Mitsubishi vehicle the ability to receive Connected Vehicle Services (“Services”). This Privacy Notice explains how Personal Data about you is collected, used, and disclosed by MME with respect to the Services, including by the telematics device on your vehicle (the “Device”), through the Mitsubishi Motors mobile application (the “Mobile App”), through contact with us (see Section 13 ‘Contact Us’), and through dealership records provided to MME in connection with the Services. “Personal Data” means any information relating to an identified or identifiable individual. This Privacy Notice does not apply to vehicles, products and services that are unrelated to the Services, that are not offered by MME or that do not otherwise link to or incorporate this Privacy Notice.

MME is the “controller” in respect of the above Personal Data for the purposes of the EU General Data Protection Regulation 2016/679 (“GDPR“). This means that we are responsible for determining what Personal Data will be collected as well as the purpose for which and the means by which the Personal Data is processed.

For more information about the types of Services or Subscription Packages that are offered in connection with the Connected Vehicle Services, please review the MME Connected Vehicle Services website at https://www.mitsubishi-connect.eu.

Terms that are used but not defined in this Privacy Notice are defined in the MME Connected Vehicle Services Outlander Terms and Conditions (the “Terms”), available at https://www.mitsubishi-motors-europe.com/disclaimer/ .

You should read this Privacy Notice in which we describe in general terms how we collect your personal data and why we collect it, what we do with your personal data, with whom we share it, how we protect it, and the choices you can make about your personal data.

MME will collect certain Personal Data from you at the time you buy or lease your vehicle, which we will use for the purpose of managing our contractual relationship with you, including service of your vehicle, notifying you of warranty issues and the like.

You should be aware that MME collects certain data from your vehicle. Depending on the circumstances, including whether or not you have activated the Services or purchased or renewed a Subscription, this data includes your odometer value, vehicle error codes and other vehicle-related data, and at times will include Vehicle Geolocation Data (as defined below). This data will be collected, used, disclosed and shared by MME in accordance with the Terms, this Privacy Notice and laws, rules and regulations in effect in the country where you purchased your vehicle. MME may also use this data for marketing purposes to offer products and other services to you, upon your consent.

MME will only start collecting this data upon your agreement to the Terms.

If you agree to the Terms and subsequently decide at any time that you do not want us to collect or use any of this data, you can cancel your Subscription Service Package or contact us and request that we stop collecting (part of) this data. Unsubscribing will deactivate your vehicle’s telematics-enabling Device (as defined below). Upon deactivation of the Device, you will no longer be able to receive any Services, you will not be able to activate any new Services, and any Subscription Service Package you had subscribed to, whether as a Trial or a paid subscription, will immediately terminate.

If you sell, lease, transfer or surrender your vehicle, we will continue to collect Collected Data (as defined below), and attribute such Personal Data to you, until we are notified of such sale, lease, transfer or surrender.

2. INFORMATION COLLECTED BY MME

2.1 General Types of Information Collected

We collect the following types of Personal Data from you, your vehicle, and/or your devices (collectively, “Collected Data”) when you use the Services:

• Customer Information: Customer Information includes your name, address, telephone number, date of birth, email address, personal preferences (e.g., opt-in preferences, language preferences), and other Personal Data about you including, in certain cases, information about the acquisition and financing of your vehicle and billing information (e.g., credit card number).
• Vehicle Information: Vehicle Information includes your vehicle’s vehicle identification number (“VIN”), licence plate number, mileage (odometer information), diagnostic trouble codes, Device errors, oil status, vehicle CAN signals (i.e., signals transmitted to, from and across the various software modules contained in your vehicle) and other information regarding your vehicle.
• Vehicle Usage Data: Vehicle Usage Data includes your latitude and longitude at a particular point in time (“Vehicle Geolocation Data”), vehicle speed at a particular point in time, air bag deployments, information about the status of certain vehicle systems (e.g., status of powered doors), vehicle settings, vehicle direction, anti-lock events, information from your vehicle’s event data recorder (“EDR Data”), infotainment system usage, and other information relating to your use of the vehicle. The exact data collected depends on the Services selected and other factors, including the occurrence of certain events (deployment of air bags, or use of certain remote features such as Door Lock or Unlock).
• Mobile Device Information: Mobile Device information includes information regarding your mobile device that you use to access the Mobile App, such as the location of your mobile device (mobile geolocation information), mobile device type, mobile device operating system, internet protocol (IP) address, unique mobile device identifier, type of browser, internet service provider, and mobile phone number; and information about your use of the Mobile App, including screen view time, scrolling, specific actions to activate features and/or otherwise navigate the Mobile App, reactions to alerts, searches, and your interactions with in-application marketing offers.
• Access Information: Access Information is information that is collected automatically in connection with your use of the Mobile App, and includes IP addresses, browser types, internet service providers (ISP), MAC address, device or session ID, referring/exit pages, operating systems, date/time stamps), device type, log files, campaign engagement (e.g., clicking through campaign emails), and other access-related information. This information is gathered by certain tools and methods such as log files, cookies, web beacons, and embedded scripts.

For purposes of this Privacy Notice, irreversibly anonymised information, which includes data that is related to you but does not identify you specifically, is not considered to be Personal Data.

2.2 Information Collected by the Device/Vehicle

Depending on the type of Service you are using, the following information is collected:

2.4 Information Collected by the Mobile App

We collect the following types of information from you when you use the Mobile App:

• Customer Information (e.g., your name, address, telephone number, email address, communication and language preferences, other user preferences, billing information, card information)
• Vehicle Information (e.g., VIN, Vehicle Geolocation Data)
• Access Information (e.g., mobile operating system, usage transaction logs, remote service transactions)
• Mobile Device Information (e.g., mobile geolocation information)

2.5 Information Collected by contacting us

We collect the following types of information from you when you contact us or sign up for an account:

• Customer Information (e.g., your name, address, telephone number, email address, communication and language preferences, other user preferences, credit card information)
• Vehicle Information (e.g., VIN, Vehicle Geolocation Data)
• Mobile Device Information (e.g., mobile geolocation information)

2.6 Information Collected by Other Means

We also collect Personal Data from you through other sources, including Mitsubishi Motors Corporation, dealers, and distributors. We collect Vehicle Information from Mitsubishi Motors Corporation and information such as dealership records, service repair order information and registration date from our dealers and distributors. For a list of our current distributors and dealers who provide us with Personal Data, please contact us using the contact details below.

We combine Personal Data collected from third parties with the information we collect directly from you. If we receive Personal Data from a third party source and/or if we combine the information we receive from these third party sources with your Personal Data, we will treat that information as Personal Data. We are not responsible for the accuracy of the information provided by third parties or how such third parties collect, use and share such information.

2.7 Special categories of Personal Data

We generally do not collect or process any special categories of Personal Data about you, such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, or trade union membership, or information about your genetic and biometric data. We also do not collect or process any information about criminal convictions and offences from you.

In the context of mandatory eCall, we or our service providers collect limited information about your health in connection with providing those services to you and share that information with emergency services personnel.

2.8  Consequences of not providing Personal Data requested by us

Where we need to collect Personal Data, whether by law, where we have a legitimate interest, or under the terms of a contract we have with you, and you do not provide that data when requested or have asked that we discontinue collecting any information from you, we may not be able to perform the contract we have or are trying to enter into with you or provide you with any Services. Where this is the case, we will use reasonable attempts to tell you at the time what will be the effect of your decision.

3. USE OF COLLECTED DATA

We have set out below, in a table format, a description of all the ways we plan to use your Personal Data and which of the legal bases we rely upon to do so.

3.3 Use of Anonymised Information

We irreversibly anonymise the Collected Data so that it does not identify you or your vehicle specifically. We use such irreversibly anonymised data or share it with third parties for any legitimate business purpose.

3.4 Automated decision-making

We do not envisage that any decisions will be taken about you using automated means (other than complying with your requests, such as a request not to receive further marketing communications). In the event that this position changes, we will notify you in writing.

4. HOW WE SHARE THE COLLECTED DATA

We share the Collected Data with:

• MME’s affiliates, parents and subsidiaries;
• Dealers from whom you purchase the vehicle, for vehicle servicing and for their own marketing purposes.
• MME’s Distributors.
• if you are financing your vehicle, with third parties who require the Collected Data to provide financing;
• emergency service providers, such as law enforcement, roadside assistance providers, and ambulance providers, in order to deliver related services or in emergency situations to protect vehicle occupants, MME and the safety of our customers, employees or any third parties;
• certain unaffiliated third parties to provide select products and services to you such as insurance companies to provide usage-based insurance;
• companies or organisations where you have asked us to or agreed that we share your Personal Data with them;
• vendors, contractors, consultants and other service providers who are working on our behalf and need access to your information to carry out their work for us, such as providers of connected vehicle services, call centres, data aggregators, tax processors, credit card payment processors or providers of wireless mobile services;
• to the maximum extent permitted by applicable law, with our legal advisors, with courts or regulators, or with law enforcement authorities, to (i) comply with laws or to respond to lawful subpoenas, government inquiries, litigation, dispute resolution, requests and legal process, or if in our good faith opinion such disclosure is required or permitted by law; (ii) at the request of governmental authorities conducting an investigation; (iii) to protect our rights, security, safety and property and those of our agents, customers and others, including to enforce our agreements, policies and Terms and Conditions; (iv) to detect, investigate and prevent fraud; or (v) to conduct screening to ensure you are not on any government list of restricted parties;
• with our legal advisors if we believe your actions are inconsistent with our user agreements or policies, including our Terms and Conditions;
• to the maximum extent permitted by applicable law, we also use IP addresses, mobile device identifiers or any other information we collect to identify users, and do so in co-operation with copyright owners, internet service providers, wireless service providers or law enforcement agencies in our discretion to assist with investigations of legal violations or fraud. Such disclosures may be carried out without notice to you; and with the counterparty in connection with, or during negotiations of, any merger, sale of company assets (including a liquidation, realisation, foreclosure or repossession), restructuring, reorganisation, financing, disposal, conveyance, transfer lease, or any other type of acquisition of all or a portion of our assets or business to another company.

Sharing of Anonymised Information

We irreversibly anonymise the Collected Data so that it does not identify you or your vehicle specifically. We use such irreversibly anonymised data or share it with third parties for any legitimate business purpose.

5. RETENTION

We will retain Collected Data only for as long as it is needed for the purposes listed here. This includes for the purpose of satisfying any applicable legal or regulatory requirements. We retain your Collected Data for a longer period if we reasonably believe that the information is relevant to any possible legal action, whether initiated by you or any other party.

Where information is used for more than one purpose, we will retain it until the purpose with the latest period expires.

If we keep any Collected Data after the Collected Data is no longer needed for these purposes, we will store it in anonymised form. Otherwise we will delete it.

For more information about our retention policies, please contact us using the contact details below.

6. MANAGING YOUR PRIVACY PREFERENCES

6.1 Personal Data provided during registration process

You may review and update any Personal Data that you provided to MME during your registration process by logging into the Mobile App. On removal of any such Personal Data from your registration details, we will delete the corresponding Personal Data from our systems. For further information on how to manage your registration details please contact us at the contact details below.

6.2 Transmission of Vehicle Data

Except as enabled by “Privacy Mode” as described immediately below, the Connected Vehicle Services do not permit users to share some types of Vehicle or Access Data but not other types. If you wish to disable all collection of Connected Data, please cancel the Subscription Service Package or contact us and request that your Device be inactivated and your Services discontinued. Please note that we will not be able to provide any Services to you once this has taken place, unless you call to reactivate your Device, and any applicable Subscription Service Package, including any Trial Subscriptions, pursuant to which you were receiving Services will immediately terminate.

You can put your vehicle into “Privacy Mode” using the Mobile App. The vehicle will remain in Privacy Mode until you take it out of Privacy Mode. While the vehicle is in Privacy Mode, the Device will not send the location of the vehicle to us other than for mandatory eCall purposes. Whilst in “Privacy Mode” you will not be able to use the “Car Finder” to locate the vehicle. In addition, you may still use the Smart Alert’s Geofence function as described in the Owner’s Manual while your vehicle is in Privacy Mode.

6.3 Marketing Communications

By purchasing a product or a service from us [or any of our affiliates] you agree that we may from time to time, send you mail, emails, text messages and telephone communications, including communications regarding product information, marketing or promotions, research, and/or other topics about goods and services that we may be able to provide to you, which may be the same or similar to those that you already receive from us. We will process your Personal Data to contact you in this way and the legal basis for this processing will be either your prior consent or our legitimate interest in marketing and advertising products and services that may be of interest to you. To contact you, we may use the information you provide to us, including email, direct (postal) mail, mobile number or other telephone number.

You may, at any time, inform us that you do not want MME to contact you with marketing communications or withdraw your consent to marketing communications from third parties using certain or all methods by contacting us.

In addition, you may also opt out of promotional email communications from MME and third parties by clicking on a link provided in the promotional email message. You may also opt out of promotional text message communications from MME and third parties by texting STOP from the mobile device that you have registered with MME. After opting out, you will no longer receive marketing or promotional communications through the applicable method, but will continue to receive other messages, such as Remote Services notifications and specific information related to your use of the Services or vehicle (e.g., warranties, service reminders).

Note that deactivating your Device will not automatically opt you out of receiving such marketing or promotional communications.

6.4 Service and Other Safety Notifications

Regardless of what may be said above, at the point of information collection, or your stated privacy preferences, MME reserves the right to contact you in the event of a service notification for your Device or vehicle (e.g., a recall notice), or to issue other notices concerning the safety of your vehicle.

7. SAFEGUARDING YOUR INFORMATION

We value your privacy and will take all reasonable measures to help protect your Personal Data against misuse and unauthorised access, disclosure and alteration. You should understand that transmission via the internet or over wireless mobile channels is not completely secure, and MME cannot guarantee the security of your information collected from your vehicle or through the use by you of the Services.

8. YOUR OBLIGATIONS

It is your sole responsibility to tell your vehicle occupants and users about the Services and how they work, what data is collected (e.g., collection of Vehicle Geolocation Data) and how that data is shared, and what the limitations of the Services are (e.g., they may not work in remote areas). If you choose to activate Smart Alerts such as Curfew, Geofence or Speed Alerts, you have the obligation to explain that remote monitoring of the vehicle will be conducted using parameters that you set. You agree to make all vehicle occupants and users aware of this Privacy Notice and the privacy choices you have made.

If you sell, lease or otherwise transfer your vehicle directly to another person, it is your responsibility to notify such subsequent owner of the Services (including the Vehicle Data Collection and any other collection of data) and this Privacy Notice and the Terms and Conditions. In addition, prior to such transfer, you should delete all information (such as contacts and saved map addresses stored in the vehicle) from the vehicle and cancel your Account. Cancelling the Account deletes all Personal Data and resets the Device to initial settings, although some collection of Vehicle Data may continue, including information required to provide Safety Services. If you do not cancel your account, any information you do not delete may be accessible to future users of the vehicle. Please refer to your Owner’s Manual for instructions on how to delete information from your vehicle’s system.

9. INTERNATIONAL TRANSFER OF PERSONAL DATA

Where necessary or desirable to carry out the data processing described in this Privacy Notice, we transfer your Personal Data internationally, including to third party companies (designated Processors). We will require these recipients to protect your Personal Data to the same extent as ourselves, and will take appropriate measures to oversee their activities with regard to protecting the Personal Data entrusted to them.

If required to provide Services to you, we may use the services of third parties located in countries outside the European Economic Area (“EEA“), such as to provide support or technical services. While we will use reasonable efforts to minimise the international transfer of your Personal Data, these third parties may require access to some of your Personal Data. If the country in which they are located has not yet been deemed by the European Commission to offer adequate data protection, then we will take the following steps to ensure an adequate level of data protection in the country of the recipient as required under the Regulation, including imposing contractual terms approved by the European Commission that enable the transfer of personal data in countries outside the EEA, requiring that specific technical and organisational processes be followed, that we be permitted to audit their systems, processes and actions, and that they report to us about any threats to Personal Data. If you wish to obtain a copy of these safeguards, please contact us at the contact address above.

Personal Data may be transferred to the following countries outside the EEA:

• Japan (Mitsubishi Motors Corporation, KDDI Inc., Station Digital Media, Inc.)
• United States of America (Aeris Communications, Inc., Station Digital Media, Inc.)
• India (Aeris Communications, Inc.)
• Israel (Harman International Industries, Inc.)

In all cases, however, MME will ensure that any transfer of your personal data is compliant with data protection law and conduct a Data Transfer Impact Assessment (if necessary). Where the recipient is located in the US, it might be a certified member of the EU-US Data Privacy Framework.

10. YOUR PRIVACY RIGHTS

If you are a resident of the European Economic Area, then you have certain rights, under certain circumstances, with respect to the Personal Data that we collect about you. These rights may include:

In addition to using the Mobile App to view your Personal Data, you can also exercise these rights at any time in writing by contacting us at our contact details below. Please note that we may be required to retain some or all of your Personal Data even after a request for erasure where there is a lawful reason or obligation to do so.

You always have the right to make a complaint concerning processing of your Personal Data by contacting the relevant supervisory authority. You can do this with the data protection authorities at your place of residence, at your place of work or at the place of the alleged data breach. You can find contact details for all the EU data protection authorities at https://edpb.europa.eu/about-edpb/board/members.

11. EXCLUSIONS

11.1 Children

The Services, including the Mobile App, are not intended for and are not targeted to children deemed as a minor under the laws of your country (“Minors”). Minors are not permitted to use the Services and should not send any information about themselves to us through the use of the Services. It is your sole responsibility to tell your vehicle occupants and users that the Services are not to be used by children.

We do not knowingly collect any Personal Data from Minors and, if we learn that we have received information from a user under the age of 13, we will delete this information.

11.2 Third Party Links

The Mobile App may contain links to third-party websites and services, including but not limited to social media sites and applications. This Privacy Notice does not apply to the linked sites, and we do not control, nor are we responsible for, the content or privacy and security practices of those sites. Any Personal Data you provide to a linked site or service is provided directly to a third party and is subject to such third party’s privacy policy. We encourage you to learn more about such third party’s privacy and security practices and policies before providing any of your Personal Data.

12. CONTACT US

We take your privacy seriously. That is why we want to make it easy for you to learn more about how we use your personal data and to exercise your privacy rights:

• Visit your account on the Mobile App: This is the best place to find the account information that we hold about you. You can directly rectify your account-related personal data or choose to delete your account.
• Contact your preferred Mitsubishi Motors Dealer or Mitsubishi Motors Distributor in your country. We will do our best to respond to your requests promptly and in accordance with the law. Please note that we may ask you to provide proof of identity to prevent unauthorised access to your personal data.

You may contact our Data Protection Officer at connected.car.services@mitsubishi-motors-euro.com to exercise your privacy rights.

If you have any questions or concerns about this Privacy Notice, please contact MME by emailing connected.car.services@mitsubishi-motors-euro.com

13. UPDATES TO PRIVACY NOTICE

MME may update this Privacy Notice from time to time. The effective date of the current version of the Privacy Notice is noted at the top of the notice. MME encourages you to periodically review this notice.