1. APPLICABILITY OF THIS POLICY

JSW MG Motor India, having its registered office at 10th Floor, Milestone Experion Centre, Sector 15, Gurugram, Haryana-122001 (“we”, “us”, “our”, “MG”) is committed to protecting the privacy and security of your personal data. Your privacy is important to us. This Privacy Notice “(“Policy”) applies to all services offered by us to all individuals (“you”, “your” or “user”). This Policy shall be referred to and read as an integral part of the Websites:

• https://www.mgmotor.co.in/
• https://www.cc.mgmotor.co.in
• https://www.mgselect.co.in
• https://www.evsahihai.com/
• https://www.mgreassure.co.in/

and Dealer Websites.

This Policy explains how we collect, receive, store, disclose, transfer, and use your personal data for the purpose of your participation and consumption of services offered by us through our MG Motor Websites (“Websites”) or during any interaction with us, and how you can exercise your privacy rights.

Before using our websites or availing any of our products and/or services at our dealership, you are advised to carefully read this notice. If you do not agree with this privacy policy at any time, do not use any of the services or give us any of your information. If you use the services on behalf of someone else (such as your child) or an entity, you represent that you are authorised by such individual or entity to accept this privacy policy on such individual’s or entity’s behalf. By visiting our websites and accessing our services, users agree to the terms as set forth in this Policy.

2. DISCLAIMER

The scope of this notice is limited to the product and/or services provided by us within the territory of India and applies to users who request for these products and/or services within the Indian territory.

3. PERSONAL DATA THAT WE COLLECT

When you interact with us, we collect different types of information from you based on the type of interaction.

“Personal Data” means any data about an individual who is identifiable by or in relation to such data.

“Processing”, “Processed”, “Process” in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment, or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure, or destruction.

Any personal data provided by you will not be considered as private and confidential if it is freely accessible in the public domain like any comments, messages, blogs, available on social media platforms like Facebook, Twitter etc.

We endeavour to collect only the essential information about you and your vehicle when you engage with our digital platforms (Websites, Applications and Social Media Platforms), customer service, and third parties, including group companies, data providers and authorised dealers, to provide services, deliver products, and address inquiries.

4. PRIVACY NOTICE

As you interact with us for products and services, we collect different types of information from you based on your interaction. The purposes for which we process your personal data will depend on the circumstances in which we collect it. We endeavour to inform you why we are collecting your personal data and how we intend to use that information.

Please refer to the respective privacy notices to understand the collection of personal data and purposes of such collection by us.

4A. Our Websites

This Privacy Notice applies to all products and/or services offered by us to all individuals (“you”, “your” or “user”) when they access, browse, or use the Websites.

1. PERSONAL DATA WE COLLECT

2. PURPOSE OF COLLECTION OF YOUR PERSONAL DATA

We collect your personal data for the following purposes.

a. To provide you with our products and services to:

• Make these websites and its content available to you and to further optimize & develop it
• Provide you with information, products and/or services that we offer you on our websites
• Look at site trends and customer interests
• Provide notices about your account, subscription or other services
• Provide chat services to you
• Book your vehicle of choice from our websites
• Verify your identity before booking a vehicle from our websites
• Book a test drive or service
• Communicate with you
• Configure your car
• Offer updates and reminders about service, maintenance, and warranty details, provided you haven’t opted out
• Give you service actions for your vehicle
• Respond to an enquiry or concern raised by you
• Notify you about changes to our websites or any products and/or services that we offer
• Contact you when your local authorized dealer opens, closes, moves premises or is no longer an authorized dealer
• Administer competitions for you and distribute prizes
• Inform you of the updates to our Terms and Conditions and policies
• Provide employment opportunities

b. For our internal business purposes to:

• Monitor the engagement and use of our websites
• Receive feedback to help in further development of our products and/or services
• Manage your accounts, service, and other personalized features
• Improve the user experience on the Websites
• Be able to recognize, prevent and investigate attacks on our websites
• Protect our rights and legitimate interests

c. For marketing to:

• Notify you about any new products or enhancements to our services, if you opt in for the same
• Deliver marketing and event related communications to you across various platforms, such as emails, telephones, text messaging, or WhatsApp, if you opt in for the same

4B. Products and services at dealership / offline events

This Privacy Notice applies to the services offered by us to all individuals (“you”, “your” or “user”) when you use the products and/or services provided by our dealership or in offline events on behalf of us.

1. PERSONAL DATA WE COLLECT

2. PURPOSE OF COLLECTION OF YOUR PERSONAL DATA

We collect your personal data for the following purposes.

(b) To provide you with our products and/or service to:

• Book your vehicle of choice
• Enable you to finance your vehicle if you opt for the same
• Book a test drive
• Provide home charger installation services
• Provide you with offers
• Offer updates and reminders about service, maintenance, and warranty details, provided you haven’t opted out
• Give you service actions for your vehicle
• Respond to an enquiry or concern raised by you
• Enable RSA option for your vehicle
• Perform Know Your Customer (KYC) validation

(c) For our internal business purposes to:

• To receive feedback to help in further development of our products and services
• Manage your accounts, services, and other personalized features
• Respond to queries or requests submitted by you when you want to exercise your rights with respect to your personal data that was given to us
• For Training and quality purposes

(d) For marketing to:

• Alert you of any new products or enhancements to our services, if you opt in for the same
• Deliver marketing and event related communications to you across various platforms, such as emails, telephones, text messaging, and WhatsApp, depending on your preferred mode of correspondence, if you opt in for the same

5. BASIS FOR PROCESSING YOUR PERSONAL DATA

We will collect personal data by lawful and fair means and, where appropriate, with the knowledge of the individual concerned. We only collect and process personal data about you where we have a lawful basis. Lawful basis on which we would process information from you includes:

• Obtaining explicit consent from you
• Processing for legitimate uses where processing is necessary in order to provide you with our services, such as:
  1. To enforce our terms and conditions;
  2. To ensure compliance with our legal obligations and to also comply with our obligations towards public authorities;
  3. To enforce any legal right or claim;
  4. For responding to a medical emergency involving a threat to your health or life or that of any other individual;
  5. For taking measures to ensure safety of, or provide assistance or services to any individual any disaster, or any breakdown of public order;
  6. For legal and compliance reasons, such as the prevention, detection, or investigation of a crime, loss prevention or prevention of fraud;
  7. For our internal and external audit requirements and for information security purposes;
  8. As otherwise described to you at the time of collection of your personal data.

6. LINKS TO SOCIAL MEDIA AND THIRD-PARTY SITES

The Websites may contain links to other websites whose privacy practices differ from those of MG. We have no control over such websites and are not responsible for the privacy policies/notices/statements or the content of such websites even if:

• You accessed the third-party website using links from our websites; or
• You accessed our websites using links from a third-party website.

If you provide your personal data to any third-party website, then the use of your personal data is governed by their privacy notices. This notice applies to our websites only. We encourage you to be aware when you leave our websites and to read the privacy notices of other websites that you may choose to visit.

7. SHARING / DISCLOSURE OF PERSONAL DATA

As far as this is necessary for the purposes set out above, we will share your personal data with the third parties, Group Companies, Dealers and external service providers who either have a need to know and who will process it for us based on our instructions and for no other purpose.

8. PERSONAL DATA TRANSFER, STORAGE AND PROCESSING GLOBALLY

We operate globally and may transfer your personal data to group companies or third parties in territories outside India for the purposes described in this notice in accordance with applicable data protection laws, provided that no such restriction is notified by the Government/ appropriate authority.

9. YOUR RIGHTS IN CONNECTION WITH YOUR PERSONAL DATA

We respect your right to access and control your personal data, and we will respond to requests to exercise your rights under applicable laws for information and, where applicable, will correct, update, or erase your personal data.

Please note that applicable law might require that we cannot comply with every request. We will be required to retain your personal data due to legitimate business/ regulatory/ statutory retention requirements despite your request for erasure.

You have the following rights:

• Right to access information about your personal data: Upon request, you may obtain a summary of the personal data being processed, the activities undertaken with respect to such personal data, identities of the persons/ entities with whom the data has been shared and any other information related to personal data.
• Right to request correction: You may request the correction, completion and updation of your personal data if you find them to be incorrect, incomplete or misleading.
• Right to request erasure: You may request the erasure/ deletion of your personal information and upon receipt of such a request, we shall erase your personal data unless retention of the same is necessary for the specified purpose or for compliance with any law.
• Right of grievance redressal: We are committed to protect your personal data collected by us. Data Fiduciaries and Consent Managers must provide a visible grievance redressal system on their website or app and resolve all Data Principal complaints within 90 days. In case of any act or omission of our obligation in relation to the personal data, we encourage you to contact us using the contact details given in paragraph 14.
• Right to nominate: In the event of death or incapacity to exercise the rights, you can nominate any other individual to exercise such rights.
• Right to withdraw your consent to process personal data: You can withdraw/revoke your consent at any time, to the processing of your personal data for which consent was sought earlier. You can withdraw your consent easily by contacting us using the contact details given in paragraph 14 below. The withdrawal of consent previously granted for the processing does not affect the lawfulness of the processing until the withdrawal. However, opting out will result in cessation of the respective services.

For exercising any of your rights, you can contact us using the contact details provided in paragraph 13 below. We will need you to furnish proof of your identity before you can exercise these rights. MGI may not be able to process any requests made in the event you fail to establish your identity or if MGI is unable to authenticate your identity.

10. SAFEGUARDING THE PRIVACY OF CHILDREN BELOW 18 YEARS AND/OR PERSON WITH DISABILITY

We do not knowingly collect or solicit personal data from minors and/or person with disability on our websites. Our services are not designed for any person who is under 18 years of age and/or person with disability, and we do not knowingly permit such persons to register for services or share information through any of the web forms without verifiable consent from the parents or lawful guardians of minors and/or person with disabilities. Further, we do not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.

If you are under 18 and/or person with disability, we request that you do not provide us with information relating to you or to others on any of our websites. Please seek the guidance of your parent or guardian before using our services.

If we learn that we have collected personal data from a minor and/or person with disability without verified parental and/or legal guardian consent, we will erase such personal data.

If you believe that a child under 18 years and/or person with disability may have provided us their personal data, please contact us using the contact details provided in paragraph 14.

11. ACCURACY OF YOUR PERSONAL DATA

Notwithstanding the obligation for MGI to put in place all necessary means to comply with the accuracy principle under applicable data protection laws, you agree to provide us with accurate Personal Data at all times and you will notify us promptly upon any changes to your Personal Data.

12. SECURITY MEASURES

We implement reasonable technical and organizational measures in relation to the information and personal data that is processed by us. We take reasonable measures to protect all personal data from unauthorized processing or accidental disclosure, acquisition, sharing, alteration, misuse, destruction or loss or unauthorized access and modification that compromises the confidentiality, integrity, and availability of such data.

While we endeavour to always protect our systems, websites, operations and information against unauthorized access, use, modification, and disclosure, due to the inherent nature of the Internet, we cannot guarantee that any information, during transmission or while stored on our systems, will be safe and secure from intrusion by others.

You too have an important role in protecting your personal data. You should not share your user id, password or other authentication data provided to you with anyone. If you have any reason to believe that your user id or password has been compromised, please contact us immediately by using the contact details given in paragraph 14 below.

13. RETENTION OF YOUR PERSONAL DATA

We will only retain your Personal Data for as long as necessary for the purposes outlined in this Privacy Policy. We will retain and utilize your Personal Data to the extent required to fulfil our legal obligations (such as retaining your data to comply with relevant laws), resolve disputes, and enforce our legal agreements and policies.

We will delete your personal data whenever you request us to do so. However, we may archive and/or retain your personal data for as long as there are statutory retention obligations or potential legal claims are not yet time barred.

Additionally, we will retain data for internal analysis purposes. This data is typically retained for a shorter duration, unless it is used to enhance security or improve the functionality of Our Service, or if there is a legal requirement to retain it for longer periods.

14. HOW TO CONTACT US

If you as an information provider have any grievances on the data collected, processed or stored by JSW MG Motor India Private Limited, you may reach out to the Data Privacy Officer with questions or concerns about these Privacy policies as follows:

• E-Mail: dpo@mgmotor.co.in

Requests will be addressed in accordance with the Digital Personal Data Protection Act 2023 and our internal policies.

JSW MG Motor India Private Limited shall not charge you for fulfilling any of the above requests. However, if the fulfilment of any such request leads to certain costs being incurred by MG Motor, then we will notify you prior to processing such request.

Kindly note that the consequences of the withdrawal of the consent shall be borne by you and such withdrawal shall not affect the legality of processing of the personal data before its withdrawal.

If you are not satisfied with the resolution provided, you may lodge your complaint with the Data Protection Board of India following the procedure prescribed by them.

15. CHANGES TO THIS PRIVACY POLICY

JSW MG Motor India Private Limited may change this privacy policy from time to time at JSW MG Motor India Private Limited’s sole discretion. Any material changes to this Policy will be posted on this page. We encourage you to review this Policy regularly for such changes. The updated Privacy Policy will take effect as soon as it has been updated.