hmg-Partner ID System Privacy Policy

By providing your personal information and using the Service, you understand and consent to Hyundai’s collection, transfer, use, and disclosure of your personal information in accordance with this Privacy Policy. Specifically, you consent to Hyundai’s transfer to and retention of your information within South Korea, which may have less protections for your personal information than the jurisdiction where you live. We will take appropriate safeguards, such as standard contractual clauses or other mechanisms permitted under applicable law, to protect your personal information in such cases.

If required by applicable law, we will obtain your explicit consent for certain types of processing, including international transfers. You may withdraw your consent at any time, but this will not affect the lawfulness of any processing carried out prior to the withdrawal. IF YOU DO NOT AGREE WITH ANY PART OF THIS PRIVACY POLICY OR OUR TERMS, THEN PLEASE REFRAIN FROM PROVIDING PERSONAL INFORMATION TO US OR USING THE SERVICE OR SITE.

We collect information about you from several sources: directly from you, from third parties, and automatically through your use of the Service and interactions with us. For example, we collect personal information that you provide directly by completing one of the forms on the Service. We and our third-party service providers automatically collect usage data such as log files when you use the Service. We only use cookies that are strictly necessary for login and session management purposes and do not use cookies or other tracking technologies for analytics or advertising. We may combine the information we collect from these sources. We will not use cookies for purposes other than those described in this Policy.

Certain privacy laws, such as the General Data Protection Regulation (“GDPR”), and the California Consumer Privacy Act (“CCPA”), require that we disclose the categories of personal information that we may collect about individuals and the sources of that information. While the actual information we collect varies depending upon the circumstances, generally we may collect the following categories of personal information:

• Identifiers: information such as real name, language, IP address and online identifier, or email address. We collect this information when you fill out a form on the Service or use the Service. Sources: directly from you.
• Internet or other electronic network usage data: including, but not limited to, browsing history, clickstream data, search history, and information regarding your interactions with the Service or Site, application, or advertisement, including access logs and other usage data related to your use of the Service. We collect this information through the use of cookies and other tracking technologies, in compliance with the GDPR. Sources: from analytics providers, advertising providers and service providers through use of cookies and other tracking technologies.

Hyundai uses the information collected above in several different ways. And we may use your information individually or combine it with other information to generate aggregate statistical information. The primary uses of your information include:

• Providing our Service: to provide, maintain and improve the Service; to authenticate users; to perform technical operations; to communicate with you about our Service; to respond to your requests; to provide technical support; and for other customer service and support purposes.
• Analyzing and improving our Services: to better understand how users access and use our Service; for research and analytical purposes, such as to evaluate and improve our Service; to develop new features; and to otherwise improve user experiences.
• In support of our general business operations: where necessary to the administration of our general business, accounting, record keeping, and legal functions.
• Securing and protecting our rights: to protect our business operations, secure our network and information technology, assets, services, and legal rights; to prevent and detect fraud, unauthorized activities, access and other misconduct; where we believe necessary to investigate, prevent or take action regarding suspected violations of our agreements with you, as well as fraud, illegal activities, and other situations involving potential threats to the rights or safety of any person or third party.
• Complying with legal requests and obligations: to comply with the law or legal proceedings. For example, we may use information in response to subpoenas, court orders, and other lawful requests by regulators and law enforcement, including responding to national security or law enforcement disclosure requirements, in accordance with GDPR and other applicable privacy laws.
• Anonymous and De-identified Information: we also may de-identify information and create anonymous and aggregated data sets and reports to assess, improve, and develop our business, products, and services; prepare benchmarking reports; and for other research and analytics purposes.

We disclose personal information to third parties to provide and improve our Service; to reach you with more relevant information and offers; to provide you with information about the third-party offers you may be interested in; and to honor your consent or authorization. We also disclose personal information to the entities listed and for the purposes set out below:

• Hyundai Motor Group affiliates: We may share your personal information with Hyundai Motor Group affiliates for the following purposes:
  • Providing integrated customer services
  • Developing and improving products and services
  • Managing customer relationship across Hyundai Motor Group Companies
• Other service operators utilizing the Service: We may disclose personal information to service operators who utilize the Service for authentication and login. This may include their own services, such as websites, applications, etc., that are implemented with the Service.
• Service providers and suppliers: We may disclose personal information to our vendors, service providers, suppliers, contractors, or agents who use such data in order to perform functions on our behalf. These entities are contractually required to use the personal information we disclose exclusively to provide their respective services, and not for their own independent purposes.
• Business transfers: We may disclose and transfer personal information as part of any merger, acquisition, financing, sale of company assets or interests in the company listed above, or in the case of insolvency, bankruptcy, or receivership, including during negotiations related to such business transfers.
• Protecting rights and interests: We may disclose your information to protect or defend the safety, rights, property, or security of Hyundai, third parties, or the general public, including to protect the services, to detect, prevent, or otherwise address fraud, security, technical issues, or other activity which we, in our sole discretion, consider to be, or to pose a risk of being, illegal, unethical, or legally actionable activity. We may also use personal information as evidence in litigation in which we are involved, and as necessary to enforce this Privacy Policy, our Terms of Conditions, and other applicable agreements with you.
• Legal compliance and lawful requests: We may disclose your information in accordance with applicable law to comply with applicable legal or regulatory obligations, including as part of a judicial proceeding, in response to a subpoena, warrant, court order, or other legal process, or to cooperate with investigations or lawful requests, whether formal or informal, from law enforcement or government entities.
• De-identified and Aggregated Data: We may share aggregate or de-identified information with third parties for research, analytics, and other purposes, provided such information does not reasonably identify you.

The following categories of personal information may be shared with Hyundai Motor Group affiliates:

• Identifiers (name, email address, id)

You have the right to opt-out of having your personal information shared with Hyundai Motor Group affiliates. To exercise this right, please contact us at hmgid-developers@hyundai.com. Please note that opting out may limit your access to certain integrated services and benefits across Hyundai Motor Group companies.

Categories of Personal Information Disclosed.

Certain privacy laws, such as the General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (“CCPA”), require that we tell you about the categories of personal information that we have disclosed for a business purpose, as well as the categories that we have “sold.” Please review the section Categories of Personal Information Collected above for further descriptions of each category of personal information. This information is not limited to California users.

Personal Information Disclosed for a Business Purpose.

In general, we may disclose the following categories of personal information for the business purposes described above:

Sale.

We do not disclose personal information through the Service to third parties in exchange for direct monetary compensation from such third parties. We may disclose or make available personal information collected through the Service to third parties to receive certain services or benefits from them—for example, when we allow third-party tags to collect information such as browsing history on our Service to improve and measure our ad campaigns. This disclosure can be considered a sale under certain laws, like the CCPA, and the information “sold” in this manner includes identifiers, customer records, commercial information, Internet or other electronic network usage data, and profiles and inferences to affiliates and subsidiaries, and analytics providers. These entities are contractually required to use the personal information we disclose exclusively to provide their respective services, and not for their own independent purposes.

Please note that under the GDPR, such activities would require either your explicit consent or another lawful basis for processing.

Subject to applicable law, including the GDPR and the CCPA, you have the following rights regarding your personal information:

• Access: You may request access to the personal information we hold about you.
• Correction: You may request correction of any inaccurate or incomplete personal information.
• Deletion: You may request the deletion of certain personal information that we have or collected from you, subject to exceptions provided by law.
• Data Portability: You may request to receive your personal information in a structured, commonly used, and machine-readable format.
• Restriction of Processing: You may request the restriction of processing under certain circumstances and in certain jurisdictions.
• Object to Processing: You may object to the processing of your personal information where it is based on legitimate interests or for direct marketing purposes or for targeted advertising, profiling, or automated decision making in certain jurisdictions.
• Withdraw Consent: Where processing is based on your consent, you may withdraw your consent at any time.

To exercise any of these rights, please contact us at hmg-partnerid@hyundai-autoever.com We will endeavor to respond to those requests in the time periods required by applicable laws. We may request certain information from you to verify your identity before responding to a request. We offer these options to you as general rights, but you may have further specific rights that are outlined in our jurisdiction-specific sections below (for example, residents of California, Canada, the European Union, and the United Kingdom should refer to jurisdiction-specific sections within this Privacy Policy).

Opting Out of Certain Communications.

Hyundai offers you the opportunity to opt out of certain disclosures of personal information to third parties.

If you wish to opt-out, you may do so by submitting a request to hmg-partnerid@hyundai-autoever.com

If the processing of personal information about you is subject to European Union or United Kingdom data protection law because it was collected from you as a European Union or United Kingdom resident, you have certain rights with respect to that personal information:

• You can request access to, and rectification or erasure of, personal information.
• If any automated processing of personal information is based on your consent or a contract with you, you have a right to transfer or receive a copy of the personal information in a usable and portable format.
• If the processing of personal information is based on your consent, you can withdraw consent at any time for future processing.
• You can object to, or obtain a restriction of, the processing of personal information under certain circumstances; and
• For residents of France, you can send us specific instructions regarding the use of your data after your death.

To make such requests, please email hmg-partnerid@hyundai.com. The controller of your personal information is Hyundai Autoever, [510 Teheran-ro, Gangnam-gu, Seoul , Republic of Korea]. If you have any concerns about data protection, you can also contact our representative in the European Union which is Hyundai Autoever Europe GmbH [Address: Kaiserleistr. 8A, 63067 Offenbach] [Email: hmg-partnerid-eu@hyundai-autoever.com]. If you are a European Union resident, you have the right to lodge a complaint with a supervisory authority of the European Member state in which you reside. If you are a resident of the United Kingdom, you can submit a complaint to the Information Commissioner Office (see https://ico.org.uk/make-a-complaint/). However, we encourage you to first contact us with any questions or concerns.

We rely on different lawful bases for collecting and processing personal information about you, for example, with your consent and/or as necessary to provide the products and services you use, operate our Service, business, and meet our contractual and legal obligations, protect the security of our Services and our customers, or fulfill other legitimate interests.

If you are a resident of the European Union, please be sure to review the Additional Information for EU Residents section below for vital information, as required by the GDPR.

Your personal data may be transferred to a third party located outside your country of residence as outlined below. We ensure that, in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws, your personal data is protected with appropriate safeguards during and after the overseas transfer.

• Personal data transferred: ID, name, email address
• Purpose of transfer: To provide hmg-Partner ID System services
• Destination country: Republic of Korea
• Recipient: Hyundai AutoEver
• Timing and method of transfer: Data is transferred in real time via electronic transmission when you register for a partner account or use the relevant service.
• Retention and use period: Personal data is retained during the period of your registration in the partner account system, and deleted upon the expiration of mandatory retention periods as required by law.
• Level of protection in the destination country: The Republic of Korea is recognized by the European Commission as offering an adequate level of personal data protection through an adequacy decision.
• Safeguards applied: The transfer is based on the European Commission’s adequacy decision. Where required, additional safeguards such as Standard Contractual Clauses may be implemented.
• Technical and organizational measures: We apply appropriate technical and organizational measures, including encryption and access controls, to ensure the security of your personal data during and after the transfer.
• Your Rights under GDPR: In accordance with the GDPR, you have the following rights with respect to your personal data transferred overseas:
  • The right to access your personal data
  • The right to rectify inaccurate or incomplete data
  • The right to request erasure of your personal data
  • The right to restrict processing
  • The right to object to processing
  • The right to data portability

To exercise your rights, please contact us at hmg-partnerid@hyundai-autoever.com. We will respond promptly to your requests.

If you have any questions or require further information about overseas transfers of your personal data, please feel free to contact us.

We use security policies, procedures, and tools which are reasonably designed to safeguard the personal information we collect. However, the security of information transmitted through the Internet can never be guaranteed regardless of the level of security. We are not responsible for any interception or interruption of any communications through the Internet or for changes to or losses of data. Users of our Service are responsible for maintaining the security of any password, user ID, or other form of authentication involved in obtaining access to password-protected or secure areas of any of our Service. In order to protect you and your data, we may suspend your use of any of the Service, without notice, pending an investigation, if any security issue arises. Access to and use of password-protected and/or secure areas of any of the Service, if any, are restricted to authorized users only. Unauthorized access to such areas is prohibited and may lead to criminal prosecution or civil action.

We will also take reasonable and practical measures to ensure that unnecessary personal information is not collected. We will only retain your personal information for the period of time necessary to achieve the purposes stated in this Privacy Policy, unless longer retention is required or allowed by applicable law.

We may offer links to or from our Service to other websites within the Hyundai family as well as to websites, services, and resources operated by third parties. We may offer links to third-party websites so that you can conveniently visit our vendors and advertisers or locate other content likely to be of interest to you. We are not responsible for the privacy practices, content, or policies of websites operated by third parties and urge you to inquire about their privacy and information-sharing practices before providing any personal information. In the event that you provide personal information to any third-party website or service, you understand that Hyundai is not responsible for such third parties’ use or misuse of your personal information. You further acknowledge and agree that Hyundai shall not be responsible or liable, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with use of or reliance on any such content, goods or services available on or through any such third-party website, service, or resource.

Hyundai reserves the right to change this Privacy Policy at any time. Hyundai will use, share, and disclose all personal and other user information in accordance with the Privacy Policy in effect at the time the information is collected. We will post any changes to this Privacy Policy on this page so check back frequently so that you are always aware of what information we collect, how we use it, and under what circumstances we may disclose it. Continued interaction with us following changes to this Privacy Policy will mean that you accept the changes.

Please contact us at hmg-partnerid@hyundai-autoever.com if you have any complaints or questions about this Privacy Policy or our information practices.

California residents have the right to limit the use or disclosure of sensitive personal information for purposes other than those specified in the CCPA. We do not offer this right since we do not use or disclose sensitive personal information for such other purposes or for inferring characteristics about individuals.

Subject to certain exceptions, California residents have the right to make the following requests:

• Right of Deletion: California residents have the right to request deletion of their personal information that we have collected about them, subject to certain exemptions, and to have such personal information deleted, except where necessary for any of a list of exempt purposes.
• Right to Know: Specific Information: California residents have the right to request a copy of the specific pieces of personal information that we have collected about them in the prior 12 months and to have this delivered, free of charge.
• Right to Know: Categories of Personal Information: California residents have the right to request that we provide them certain information about how we have handled their personal information in the prior 12 months, including the categories of personal information collected.
  • Categories of sources of personal information.
  • Categories of personal information about them we have disclosed for a business purpose or sold.
  • Categories of third parties to whom we have sold or disclosed for a business purpose their personal information.
  • The business or commercial purposes for collecting or selling their personal information; and a copy of the specific pieces of personal information we have collected about them.
• Right to Non-discrimination: California residents have the right not to be subject to discriminatory treatment for exercising their rights under the CCPA.

You may submit requests to us at hmg-partnerid@hyundai-autoever.com In order to make a request, you will need to provide us with your name, email address, telephone number, and mailing address.

Please note that we may require additional information from you in order to verify your request. Authorized agents may submit requests to us at hmg-partnerid@hyundai-autoever.com If you are submitting a request through an authorized agent, the authorized agent must confirm their relationship with you. We may also request that any authorized agents verify their identity, including by providing information about themselves, such as their name, email, phone number, and address. We may reach out to you directly to confirm your own identity or that you have provided the agent with your permission to submit the request on your behalf.

There may be circumstances where we will not be able to honor your request. For example, if you request deletion, we may need to retain certain personal information to comply with our legal obligations or other permitted purposes. However, we will only use personal information provided in a verifiable consumer request to verify your identity or authority to make the request.

If you are a resident of another state in the United States that has data privacy laws, you may have the following rights, in each case to the extent set out in the applicable law:

• The right to confirm whether we process personal information about you and request access to such personal information (including, if applicable, in a portable and readily usable format).
• The right to correct inaccuracies in certain personal information we may hold about you.
• The right to delete personal information we have collected from or about you, subject to certain exceptions.
• The right to opt-out of the sale of your personal information or disclosure or use of your personal information for targeted advertising, profiling, or automated decision-making, but only to the extent we are engaging in such activities.
• The right not to be discriminated against if you exercise these rights.

To make a request, please send an email to hmg-partnerid@hyundai-autoever.com. As required under applicable law, we will take steps to verify your identity before granting you access to information or acting on your request to exercise your rights. We may limit our response to your exercise of the above rights as permitted under applicable law. When you submit a request to exercise your rights described above, we will use the information you provide to process your request and to maintain a record of your request and our response, as permitted under applicable law.

Under applicable law, you may designate an authorized agent to make a request on your behalf. You may make such a designation by providing the agent with written permission to act on your behalf. We will require the agent to provide proof of that written permission. To the extent permitted by law, we may require you to verify your own identity in response to a request, even if you choose to use an agent.

If your rights request is denied, you may have the right to lodge an appeal with us. If applicable, the response to your rights request will inform you of any appeal rights you may have and how you may exercise them.

Withdrawal of Consent.

In circumstances where you granted us your consent to process your personal information, you may, at any time, withdraw your consent to the use of your personal information in the future and to the communication of your information to third parties. We will then stop the processing of your personal information, subject to legally permissible exceptions. Please note that your withdrawal has effect for future processing operations only. Please contact us by sending an e-mail to our Privacy Officer at the address below.

If you withdraw your consent, you may no longer be able to use the services affected by the withdrawal. Apart from that, you will not suffer any further disadvantages.

Personal Information May Be Located Outside of Canada.

Third-party service providers to whom we disclose personal information pursuant to this Privacy Policy may be located outside of Canada. The data protection laws of these jurisdictions may differ from Canadian laws. Subject to applicable laws in such other jurisdictions, we will ensure that appropriate protections are in place to require the processor of personal information in that country to maintain protections with respect to such information that are equivalent to those that apply in Canada.

Additionally, if our service provider is located in a foreign jurisdiction, they are bound by the laws of the country in which they are located. As a result, they may be required to disclose your personal information in response to authorized demands from government authorities, law enforcement, or courts of their jurisdictions.

Questions, concerns.

If you have any questions or concerns about our Privacy Policy or about how we are complying with the Privacy Policy, let us know. You can contact our Privacy Officer at: pricacy@hyundai-autoever.com.

The terms below apply to the processing of personal information (referred to as personal data in the GDPR) in the context of activities of a controller or processor in the European Union as well as to the processing of personal information of data subjects who are in the European Union by a controller or processor not established in the European Union, where the processing activities are related to:

• the offering of goods or services, irrespective of whether payment by the data subject is required, to such data subjects in the Union, or
• If any automated processing of personal information is based on your consent or a contract with you, you have a right to transfer or receive a copy of the personal information in a usable and portable format.
• the monitoring of data subjects’ behavior as far as their behavior takes place within the Union.

We process your personal information for the aforementioned purposes based on the following lawful bases:

• If we process your data in order to run our business and to provide our Service, Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR are our legal bases for processing. We have a legitimate interest in maintaining an online presence in order to provide general information about our company.
• If we process your data for analyzing and improving our Service, Art. 6(1)(f) GDPR is the legal basis. We have a legitimate interest in obtaining information about the use of the Service.
• If we process your data in support of our general business operations, Art. 6(1)(f) GDPR is the legal basis. We have a legitimate interest in supporting our general business where necessary to the administration of our general business, accounting, record keeping, and legal functions.
• If we process your data for securing and protecting our rights, Art. 6(1)(f) GDPR is the legal basis. We have a legitimate interest in asserting and defending our rights and in particular to prevent and detect fraud, unauthorized activities, access, and other misconduct.
• If we process your data for complying with legal requests and obligations, Art. 6(1)(f) GDPR is the legal basis. We have a legitimate interest in complying with the law or legal proceedings.

We use data processors in the course of processing your data. A processor is a natural or legal person, public authority, agency or other body, which processes personal information on behalf of the controller. Processors do not use the data for their own purposes; instead, they carry out data processing exclusively on the controller’s behalf. Processors only act according to our instructions and have been contractually obligated to comply with data protection regulations in accordance with Art. 28 GDPR.

Recipients outside the EU. Where processing in third countries takes place, in certain cases, this occurs only if the adequacy of the level of data protection in the third country has been confirmed by the European Commission in accordance with Article 45 GDPR, based on the EU standard contractual clauses, or if it has otherwise been ensured that the level of protection afforded to data at the recipient’s end is adequate.

Recipients (or categories of recipients) of the personal information: Our company, our subsidiaries and affiliates (to the extent necessary to process and answer your request), and our third-party service providers (to the extent necessary to process and answer your request)