Privacy Notice

We, SAIC Motor Europe BV (hereinafter referred to as “we”/“us”), offer modern electric cars with an onboard audio, visual & navigation system (“AVN”) and an intelligent connectivity system (“iSMART”) that allows you to connect to your vehicle via our MG iSMART app on your mobile phone. In context with the provision of the intelligent connectivity system and the app, we process personal data.

This notice describes what types of personal data we collect from you when you use AVN/iSMART, how it is used by us, how we share data with others, how you can manage the information we hold and how you can contact us.

As a company registered in the Netherlands, we are legally bound by the laws of the Netherlands and the General Data Protection Regulation (“GDPR”). Laws regarding personal data protection and cybersecurity of other jurisdictions may also be taken into account, due to the global character of our business. Where applicable, you will find a country-specific supplement to this Privacy Notice regarding the protection of personal data.

The contents of this notice may change from time to time, so you should review it periodically. Where possible, we will also contact you directly to notify you of any substantial changes. The latest version of the Privacy Notice can be found at the following link, Privacy Notice . If this page is not available to you on your vehicle screen, please read the privacy notice in your iSMART mobile app.

This version of our Privacy Notice was last updated on 11th May, 2024.

A.     General information about the processing of personal data

I. Data Controller

Responsible for the data processing is:

SAIC Motor Europe BV
Oval Tower, 15th floor
De Entree 159
1101 HE Amsterdam

info@mgmotor.eu
Tel.: +31 (0) 202255401

II. Data protection officer

You can contact our Data Protection Officer at the above address with the addition of "For the attention of the Data Protection Officer" or by e-mail at dpo@mgmotor.eu

If you are located outside of the European Economic Area and Switzerland, you can find a more specific State-based data protection policy and the local data protection contact in the end of this Privacy Notice.

B.     What information do we collect?

We receive information about you and your vehicle when you use our iSMART functions in the vehicle or our iSMART app on your mobile phone or when you use the onboard Audio, Visual & Navigation system (“AVN”). If you contact us for support with regards to the iSMART app, we will process the data you provide. We only process information that is necessary, relevant and appropriate for the purpose for which you provide it.

The information we use may include the following data, depending on the vehicle function used:

C.     For what purpose do we process your data?

Depending on your vehicle model and the features and services you use, we collect and use your relevant personal information to provide you with a variety of in-vehicle services.
When providing the following vehicle-based services, we may collect information about your vehicle, such as information about vehicle charging status, parking brake status, range, alarm status, maintenance status, seat belt status, collision status, vehicle travel time or power consumption.
Please note that most of the vehicle information alone cannot identify you and is not part of your personal data. We will treat your vehicle information as personal data if it is used in combination with your personal data.
Some of the following features and services are made available by third parties under their own responsibility and as an own data controller. Unless expressly stated otherwise, this Privacy Notice does not apply to third parties who independently provide products or services to you. We recommend that you carefully read the privacy notices of third parties before using these services in order to understand how they process and protect your personal data and how you can exercise your corresponding rights.

Vehicle remote functions

With the iSMART APP you can access certain vehicle functions via your smartphone and control your vehicle remotely. You have the following remote-control functions via iSMART APP:

a) You can remotely access and view vehicle status information via the iSMART APP.

Data collected: vehicle identification number (VIN), vehicle status data (door status, window status, remaining gas/power, remaining mileage, total mileage, tire pressure, battery voltage, engine status, EPS status, handbrake status, temperature), vehicle abnormal alert (Low battery alert, Security alert, geo-fence alert, speed alert, engine start alert).

b) You can access vehicle security information remotely.

Data collected: vehicle status data (brake system status, EPS status, airbag status, battery status, clutch status, Impact sensor, illegal unlock status), vehicle abnormal alert (engine status, vehicle abnormal status, vehicle GPS, speed alert, engine start alert), surrounding camera of the vehicle (depending on the vehicle model).

c) You can also share your travel plan and position of interests from your mobile app to your vehicle through the iSMART APP.

Data collected: Mobile phone GPS, destination, calendar itinerary.

d) You can manage your account, customize services based on your personal profile and manage your vehicle using the iSMART APP.

Data collected: mobile phone number, email, password, date of birth, gender, email, emergency contact number, destination, important days scheduled, VIN number, engine number, brand, model, color of vehicle.

e) You can manage charging from your iSMART APP to your vehicle.

Data collected: remaining power, remaining charging time, charging current, charging voltage, remaining mileage, Mobile phone GPS, destination, bluetooth address.

f) You can access energy consumption information from your mobile device through the iSMART APP.

Data collected: mileage, cumulative power consumption, average speed, travel time.

The legal basis for data processing is the performance of a contract in accordance with Article 6 paragraph 1 lit. b) GDPR.


Digital services via Onboard Audio, Visual & Navigation system (AVN).

a) Maps & Navigation

This service updates the map material online directly in the vehicle. This function enables route calculation, map updating, display of charging stations, parking spaces and online traffic information. You can only use the Maps & Navigation services if you activate this function in the AVN privacy settings. For unconnected vehicles, the map resource is pre-installed onboard. Data collected: vehicles GPS, destination. The legal basis for data processing is the performance of a contract in accordance with Article 6 paragraph 1 lit. b) GDPR. Third Party Data Recipients: To provide the Maps & Navigation services, we employ the third-party service provider and independent data controller HERE Europe B.V., Kennedyplein 222-226, 5611 ZT Eindhoven, The Netherlands.

b) Ecosystem Services

If your vehicle is equipped with Ecosystem Services in your onboard AVN, you can search local services, receive vehicle system alert and receive local weather information. Data collected: vehicle GPS, remaining power, tyre pressure, encrypted VIN.

c) Driving Recorder

If your vehicle is equipped with a vehicle build-in driving recorder, you need to open camera permissions when you use the driving recorder function. The videos recorded by the driving recorder are stored locally offline, and we will have no access to the videos you have recorded. Data collected: data from the use of camera and microphone The legal basis for data processing is the performance of a contract in accordance with Article 6 paragraph 1 lit. b) GDPR.

d) Voice Recognition

The voice recognition function enables you to operate certain functions on the AVN using only your voice. This function may be used for several different functions such as the navigation. Setting a new destination, zoom in or out of the map or cancelling the route are only some examples for voice commands. Voice recognition may also be used for switching to the next song in the music app. When using the voice recognition function, your voice commands are converted into machine-readable commands by our voice recognition provider. Data collected: encrypted VIN, Voice Command Data, GPS of the Vehicle. The legal basis for data processing is the performance of a contract in accordance with Article 6 paragraph 1 lit. b) GDPR. Data Processor: CERENCE, CBS Weg 11, 6412 EX Heerlen, The Netherlands

e) Third-party media services / Online Music

The audio visual and navigation (AVN) system provides the possibility to use third-party media services. Third-party apps are not activated by default but first need to be activated by you in the relevant settings. Once the respective app is activated, the provider of the respective app may receive personal data from you. We do not have any knowledge about the personal data the provider actually obtains. We also do not have any knowledge about specific purposes of the processing of data collected by the provider of the relevant third-party app or about any further details of the data processing of the relevant provider. In particular, we also do not know whether the relevant provider only processes the data collected to provide the function of the relevant plug-in (e.g. to stream music) or, beyond this, for any other purposes (e.g. to create usage profiles or to personalise advertising). The third-party provider for streaming of music is Amazon Music. Data collected: Voice Command Data, Data processed by Amazon Music as own data controller (see Amazon Music Privacy Notice). The legal basis for data processing is the performance of a contract in accordance with Article 6 paragraph 1 lit. b) GDPR. Third Party Data Recipients: Amazon Music as independent data controller. It depends on your country of residence which entity provides the Amazon Music App to you. Possible entities are Amazon.com Services LLC, Amazon.com.ca, Inc., Amazon Digital UK Ltd, Amazon Digital Germany GmbH, Amazon.com Sales, Inc.,

f) Digital Key

You can create a digital key that you can use to open, close and start the vehicle and share with other users. To create a digital key, it is necessary that you have a Bluetooth connection activated on your smartphone. To create the key, we process the vehicle identification number (VIN) and basic vehicle information, your username and user ID and calibration values. When you use the digital key, we also process information about the door status, lock status, usage mode and engine status. When you share the digital key, we process additional information to enable the sharing of the key and to verify the recipient's authorization (including email address, user ID, key ID, as well as the timing and duration of release). Data collected: vehicle identification number (VIN) and Vehicle information (door status, lock status, usage mode and engine status), username and user ID, calibration values, key ID, timing and duration of release. The legal basis for data processing is the performance of a contract in accordance with Article 6 paragraph 1 lit. b) GDPR.

g) Software Update through “Over-the-Air”

The vehicle software (infotainment system, ECU firmware) can be updated via "over the air" updates to gain new features, provide system updates or fix bugs and errors. Data collected: vehicle identification number (VIN), software versions, hardware versions, hardware serial numbers, vehicle status information (including car mode, speed, gearbox status, remaining power). The legal basis for data processing is the performance of a contract in accordance with Article 6 paragraph 1 lit. b) GDPR.

h) Vehicle Security Operation Centre

The Vehicle Security Operations Centre (VSOC) protects your vehicle from potential and new cyber threats. This is done by detecting, monitoring and coordinating necessary actions in response to cybersecurity events and incidents. The vehicle's systems are continuously monitored for abnormal and non-compliant activity that could indicate potential cyber threats. The main purpose of this monitoring is to ensure the functionality and integrity of the vehicle's electronic components - thereby protecting the vehicle itself, its drivers and passengers. Data collected: vehicle identification number (VIN), impacted components alarm with occurrence log. The legal basis for data processing is compliance with a legal obligation according to Art. 6 paragraph 1 Lit. c) GDPR in conjunction with Regulation (EU) 2019/2144.

i) Driver Drowsiness and Attention Warning (DDAW)

The DDAW system captures the driver's entire face through an infrared camera, and the infrared camera transmits the collected image feature points to the onboard electronic control unit (ECU). The algorithm embedded in the ECU analyzes and calculates the driver's behaviour through characteristic values, such as yawning, closing eyes and the duration of eye closure, making a real-time judgment on whether the driver is tired or not, and providing real-time feedback on the vehicle end. When implementing the default function of DDAW, the infrared camera only captures the driver's facial area and does not involve other areas in the car. The entire captured facial information is not stored and the associated feature values are not used for personal identification. All collected data is deleted immediately upon completion of processing. Data collected: Driver facial features for fatigue detection, vehicle information (speed, steering system status) The legal basis for data processing is compliance with a legal obligation according to Art. 6 paragraph 1 lit. c) GDPR in conjunction with Regulation (EU) 2019/2144.

j) E-call (EU & UK only)

The "EU emergency call" is an emergency call system regulated and legally required by the European Union. It is mandatory for all new vehicle models that received their EU type approval after March 31, 2018. Sensors integrated in the vehicle, such as airbag deployment, belt tensioners, etc., automatically trigger the “EU emergency call”. An “EU emergency call” is made uniformly via the European emergency number 112. The recipients of the data processed by the on-board e-call system are the emergency answering points designated by the relevant public security authorities in the respective EU country (e.g. local police, hospitals, emergency services). The data contained in the system memory is only available outside the system when the on-board system is triggered. The data in the internal memory of the vehicle's E-Call system will be deleted automatically and continuously. Vehicle location data is continuously overwritten in the system's internal memory to maintain the most current vehicle location data necessary for system operation. The activity data logs in the on-board e-call system are retained for no longer than the time required to process an emergency call. Data collected: emergency call trigger mode (automatic/manual), vehicle identification number (VIN), energy type of the vehicle, vehicle location, direction of travel, vehicle type, vehicle speed, number of people in the vehicle, collision direction, latest three positions. The legal basis for data processing is compliance with a legal obligation according to Art. 6 paragraph 1 lit. c) GDPR in conjunction with Regulation (EU) 2015/758. Regulation (EU) 2015/758 was retained and assimilated into UK domestic law and is therefore also valid in the UK.

k) Advanced Driver Distraction Warning systems (ADDW) (EU & UK only)

The ADDW system monitors a driver’s eyes, facial features and/or head whilst his/her driving exists through an infrared camera, and the infrared camera transmits the collected image feature points to the Driver-status Monitoring System (DMS) Unit. By the embedded algorithms in the DMS and the data input listed below, ADDW determines if the driver is looking forward at the road ahead or has their attention diverted somewhere else. When the driver’s input data exceeds the threshold of distraction, acoustic and visual warning will be triggered. And the driver can manually turn it off in the vehicle setting of the AVN. The ADDW share the infrared camera with the DDAW. When implementing the default function of ADDW, the infrared camera only captures the driver's facial area and does not involve other areas in the car. The entire captured facial information is not stored and the associated feature values are not used for personal identification. All collected data is deleted immediately upon completion of processing. Data collected: Driver features for distraction detection (Gaze area of driver, Head pose of driver),vehicle information (transmission shift status, speed, steering wheel angle, DMS system switch, alert switch.) The legal basis for data processing is compliance with a legal obligation according to Art. 6 paragraph 1 lit. c) GDPR in conjunction with COMMISSION DELEGATED REGULATION (EU) 2023/2590.

Further processing

a) Marketing Consent

Where you have provided your marketing consent, we may use and process your information to contact you from time to time about promotions, events, products, services or information which we think may be of interest to you as well as market analysis and research (don’t worry, we won’t bombard you). You can withdraw your consent at any time by contacting us on the details given above or, in relation to any email marketing messages you receive, by using the unsubscribe option included in those messages. The legal basis for data processing is your consent according to Art. 6 paragraph 1 lit. a) GDPR.

b) Processing necessary for us to support customers with enquiries

To respond to correspondence, you send to us and fulfil the requests you make to us (for example: support requests in order to use the iSMART app) and to provide vehicle support and services (for example warranty services), if applicable. The legal basis for data processing is the performance of a contract in accordance with Article 6 paragraph 1 lit. b) GDPR or our legitimate interest in answering your requests, Article 6 paragraph 1 lit. f) GDPR.

c) Processing necessary for us to respond to understanding customers’ and drivers’ needs

To make using our applications more useful and enjoyable for you, we analyze how you use our applications (we generally use aggregated data so that you cannot be identified personally) and collect your feedback. The legal basis for data processing is our legitimate interest in optimizing our products and services, Article 6 paragraph 1 lit. f) GDPR.

d) Processing necessary for us to communicate with you and to assess and respond to complaints, claims and regulators

To communicate with you (including through social media) including to respond to queries, complaints or claims and to manage legal and regulatory requests and requirements. To enforce or protect our legal rights or to establish, bring or defend legal claims. The legal basis for data processing is our legitimate interest, Article 6 paragraph 1 lit. f) GDPR.

e) Processing necessary for us to operate the administrative and technical aspects of our business efficiently and effectively

For network and information security purposes i.e. in order for us to take steps to protect your information against loss, damage, theft or unauthorized access and to comply with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this on our suppression lists in order to be able to comply with your request) and to inform you of updates to our terms and conditions and policies. The legal basis for data processing is our legitimate interest, Article 6 paragraph 1 lit. f) GDPR.

D.     How we share information & transfer data across borders

Within our company, only those departments will receive access to your data that need it to fulfill our contractual and legal obligations. Additionally, we work closely with our dealer network, our group companies and with third party suppliers who fulfil business activities for us (like customer support, application development and server hosting services etc.).
Service providers / Data processors. Service providers used by us may also receive data for the above-mentioned purposes. These service providers work for us as data processors within the meaning of Art. 4 no. 8 GDPR. We have concluded corresponding data processing agreements with our service providers. Our service providers are companies in the categories of: customer contact centers, hosting providers, data cleansing and verification providers, direct marketing agencies and software development providers. We will only disclose personal data that is necessary for them to provide the service that they are undertaking on our behalf. Wherever possible, we will aim to anonymize your information or use aggregated non-specific data sets.
Dealers. We will share your data with our dealer network in situations where we need to pass your information to them in order to manage any request, provide a service (including to fulfil and manage your support requests) or handle any complaint you may have made to us.
Sharing for legal reasons. We will also share your personal information if we have a duty to do so, e.g. to enforce or protect our legal rights or to establish, bring or defend legal claims.
Group companies. There are also circumstances where we share your information with our parent (or other companies within our Group) in order to understand you as a customer, handle complaints or provide you with a service or information that you have requested.
Cross-border Transfers. All information collected is generally stored and processed in compliance with applicable laws in our server infrastructure located in Paris, France. If you are located outside of the European Economic Area and Switzerland, according to applicable national data protection law, your personal data may store locally. You can find your personal data protection detail in the Addendum of this Privacy Notice. Due to the international character of our business, there may be some instances where your data is transferred internationally. In those instances, we will ensure that appropriate safeguards are in place for that transfer as required by applicable data protection law.
In particular, the development of the iSMART app and the operation of the iSMART infrastructure is carried out by our Group company SAIC MOTOR overseas intelligent mobility technology CO., Ltd, 7th Floor, Intelligent Connected New Energy Vehicle Innovation Incubator, No.36 South YuTian Rd. JiaDing District, Shanghai, P.R. China as a data processor. Technical data required for vehicle performance analysis and fault identification may be therefore transferred outside the EU for third level support. International data transfer of such technical data will be minimized, well-secured and purpose-specified. There is no adequacy decision of the European Commission for China. Transfers to China take place on the basis of standard contractual clauses of the European Commission for the transfer of personal data to processors in third countries. A copy of the standard contractual clauses can be obtained from our Data Protection Officer. For countries with specific restrictions on international data transfers, personal data is processed and stored locally. This applies to the EU, but also to Turkey and Israel.

E.     How long do we keep your information for?

We will store your personal data only for as long as the above purposes require or until you object to our use of your personal data (to the extent that we have a legitimate interest in using your personal data) or until you withdraw your consent (to the extent that you have consented to our use of your personal data). However, if a longer storage of your personal data is mandatory by law, we will process your personal data until the expiry of the relevant retention period.
For security reasons (for example, to clarify acts of abuse or fraud), log file information is stored for a maximum of 2 weeks and then deleted. Data whose further storage is required for evidentiary purposes is exempt from deletion until the respective incident has been finally clarified.
Data collected for the purposes set out will only be retained for as long as is necessary, in particular we process and store your personal data for the duration of our contractual relationship.
In addition, we are subject to various recording and storage obligations, which result from regulatory regulations. Based on these legal requirements, we are obliged to carry out further temporary storage based on Art. 6 para 1 lit c GDPR. In accordance with the retention periods provided for in these regulations, we store your data beyond the end of the contractual relationship (maximum of 10 years).
In addition, the preservation of evidence within the scope of the statutory limitation provisions may necessitate further storage. Further storage for a limited period is based on Art. 6 para 1 lit f GDPR, to safeguard our legitimate interests to assert, exercise or defend legal claims.

F.     How can you manage the information we hold about you?

You have the following rights in relation to your data and our processing of your data:

To exercise these rights, you are welcome to contact us directly using the contact details above.

If you believe that we process your personal data not in accordance with the criteria described herein or with the relevant data protection laws, you may at any time lodge a complaint with the data protection authority of the EEA member state in which you reside or with the data protection authority of the country or state in which we have our registered office. The competent supervisory authority at our registered office is:

Autoriteit Persoonsgegevens
Bezuidenhoutseweg 30
P.O. Box 93374
2509 AJ Den Haag/The Hague
Tel. +31 70 888 8500
Fax +31 70 888 8501
E-mail: info@autoriteitpersoonsgegevens.nl
Website: https://autoriteitpersoonsgegevens.nl/

A list of all data protection authorities in the European Union and the European Economic Area can be found here: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

G.     Is there an obligation for me to provide data?

In order to use the intelligent connectivity system (“iSMART”), you must provide the personal data required to open an iSMART account. The full use of the onboard audio, visual and navigation system (‘AVN’) may require the creation of an account with a third-party provider. If you do not provide the aforementioned data, you will not be able to use iSMART or the respective third-party app. Apart from third-party apps and iSMART, all of the vehicle's functions are available to you.

When contacting us by form or e-mail, you only have to provide the personal data that is required for the processing of the contract or the handling of your enquiry. Otherwise, we will not be able to process the contract or your enquiry.

H.     To what extent is there automated decision-making?

We do not use any methods of automatic decision-making, including profiling.

I.     Addendum

I.     Arabia (عرب .)

MG Motor Middle East
https://www.mg-uae.com/contact-us/enquiry/

II.     Australia & New Zealand

For users in Australia & New Zealand, the responsible of the data processing is SAIC MOTOR AUSTRALIA PTY LTD (ACN 608 096 519). And users’ data are stored in Syndey, Australia.

Your privacy data is protected on the basis of the GDPR with appropriate adaption of applicable data protection regulations. Our Australian business is bound by the Australian Privacy Act 1988 (Privacy Act).

You can excise your rights by contacting our Data Protection Office:

SAIC MOTOR AUSTRALIA PTY LTD (ACN 608 096 519)

PO BOX 354
NORTH SYDNEY NSW 2059
privacy@mgmotor.com.au

If you are unhappy with our practice on your personal data rights, you can submit your complaint to the Office of the Australian Information Commissioner, at
https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us.

III.     European Economic Area & Switzerland

SAIC Motor Europe BV
Oval Tower, 15th floor
De Entree 159
1101 HE Amsterdam
dpo@mgmotor.eu
Tel.: +31 (0) 202255401

IV.     Indonesia

SAIC Motor Indonesia
https://www.mgmotor.id/contact

V.     Israel (ישראל)

ראשון לציון., מיקוד: 7559901

דואר אלקטרוני:Support@mg-israel.co.il

אם יש לכם חששות כלשהן לגבי הגנת נתונים או תלונה, אתם יכולים להגיש אותה לצוות הגנת הנתונים שלנו ב-Support@mg-israel.co.il

VI.     Malaysia

SAIC MOTOR MALAYSIA SDN BHD

Address: 6TH FLOOR, AKADEMI ETIQA NO.23 JALAN MELAKA 50100 KUALALUMPUR W.P. KUALA LUMPUR MALAYSIA
mgmalaysia@smil.com
Tel.: +60189568649

VII.     Middle & South America

SAIC MOTOR SUDAMERICA SPA
Av. Presidente Kennedy 4700, Oficina 1201, Vitacura, Santiago, Chile
i-SMARTservice@smil.com
Tel. +5622951204

VIII.     Mexico

SAIC International México, S. de R.L. de C.V.
Av. Presidente Masaryk 320, Polanco IV Sección,
Delegación Miguel Hidalgo, Ciudad de México, C.P. 11550
privacidad@mgmotor.com.mx

IX.     Thailand (ประเทศไทย)

MG SALES(THAILAND)CO., LTD.
อาคารสีลมคอมเพล็กซ์ ชั้น 25 191 ถนนสีลม บางรัก กรุงเทพฯ 10500
SILOM COMPLEX TOWER, 25TH FLOOR, I9I SILOM RD, BANGRAK, BANGKOK 10500
DPO@mgthai.com

X.     Turkey (Türkiye)

According to the Turkish Personal Data Protection Law No. 6698, personal data of users in Turkey will be processed and stored locally in Istanbul. No personal data will be transferred to any foreign countries.

Türk Kişisel Veri Koruma Kanunu No. 6698'e göre Türkiye'deki kullanıcıların kişisel verileri İstanbul'da işleyecek ve yerel olarak depolanacak. Hiçbir yabancı ülkeye kişisel veri taşınmayacak.
Dogan Trend Otomotiv Ticaret Hizmet Ve Teknoloji A.S.

Acıbadem Mahallesi Alidede Sokak No:4, Kadıköy 34718 İstanbul, Turkey
sinan.erbil@dogantrend.com

XI.     U.K.

You can excise your rights by contacting our Data Protection Office:

MG Motor UK Ltd
Main Gate, Lowhill Lane,
Longbridge, Birmingham
B31 2BQ United Kingdom
Contact form links: https://www.mg.co.uk/contact-us
E-Mail: dpo@mgmotor.eu

XII.     Vietnam (Việt Nam)

CÔNG TY TNHH SAIC MOTOR VIỆT NAM

Tầng 16, Vincom Center Đồng Khởi , số 72 Lê Thánh Tôn, Phường Bến Nghé , Quận 1, TP. Hồ Chí Minh, Việt Nam.
Mã số doanh nghiệp:0317714691
Đ iện thoại:18003366
Email:info.smv@smil.com

XIII.     Singapore

EUROKARS EV PTE. LTD.

12 SUNGEI KADUT AVENUE SINGAPORE (729648)
marketing@mg.com.sg
+65 6261 1181

<