BrightDrop NEW Connected Product Services Privacy Statement

Last Updated: November 15, 2021

The General Motors Family of Companies (including General Motors Company, BrightDrop Motors LLC, and their affiliates (collectively, "BrightDrop" or "we" or "us") provides this Connected Products Privacy Statement (this "Privacy Statement") to let you know how we collect, use, and share your information when you download or use the BrightDrop software application (the "Application") or use connected products services we make available (the "Services") via the compatible electronic device that you own or control, such as your Apple or Android mobile device, or such other compatible computing system that you use to access the Services (each, your "Device") in connection with the BrightDrop connected services-capable products that are owned or controlled by your or the company you represent and that have been registered with us (the "Product" or "Products"). This Privacy Statement excludes products and services with separate privacy statements that do not incorporate this Privacy Statement.

Key points about our information practices:

Collection

We may collect information about you, the Product and your Device, such as name, address, Product diagnostics, and Product location, through your use of the Services, and through others who provide information to us. See below to learn more.

Use

We may use your information to provide you or the company you represent with the Services, improve the quality, safety, and security of the Services, to develop new products and services, and for marketing. See below to learn more.

Sharing

We may share your information to provide you or the company you represent with the Services, to improve the quality, safety, and security of the Services, to comply with applicable law, to respond to your requests, and to allow recipients to use for marketing or other purposes subject to your consent where required. See below to learn more.

Choices

You have choices regarding how we use and share your information for marketing and other purposes. See below to learn more.

Your Obligations

Given the nature of our products and services, there may be times when someone

other than you is using the Services we provide to you ( for example, you let someone else use your Product ). We rely on you to inform such person about this

Privacy Statement and the privacy choices you have made. See below to learn more.

Cookies and Tracking

We may use cookies and similar technologies to help provide the Services, understand and customize your preferences, and display relevant advertising. See below to learn more.

Third Party Services

In connection with our Services, you may be offered the opportunity to use third party products and services that are not owned or controlled by BrightDrop and are governed by separate user terms and privacy statements. See below to learn more.

Access and Update

You may access your online accounts to update your information or you may contact us or the company you represent to request to access, update or correct information about you in our records, subject to limited exceptions under applicable law See below to learn more.

California Privacy Rights

California residents have certain rights regarding the personal information we disclose to third parties for their own marketing purposes. See below to learn more.

Security Measures

We maintain reasonable and adequate security controls to protect your information and require our service providers by contract to do the same. See below to learn more.

Retention

We keep information for as long as necessary to provide the Services, operate our business, and comply with legal obligations. See below to learn more.

Children's Privacy

We do not target or knowingly collect any information from children under the age of 13. See below to learn more.

International Data Transfers

We maintain appropriate protections for cross-border transfers as required by law for international data transfers. Your information may be accessible by law enforcement, governments or courts in accordance with the laws of the foreign jurisdiction. See below to learn more.

Changes

We will notify you of any material changes by posting the updated version of this Privacy Statement and taking other steps as needed. See below to learn more .

Contact Us

Please contact us or the company you represent by mail, email, or phone with any questions. See below to learn more .

INFORMATION WE MAY COLLECT

We may collect the following information through your use of the Application or the Services, and otherwise with your consent if required.

The types of your information that we may collect include:


Information about you and your accounts with us: such as your name, business contact information (address, telephone number, e-mail address), payment information, login information, and password.

Information about your Product: such as Product identifiers, diagnostic information and logs of users who have accessed the Product.


Information about the use of your Product:

such as GPS location of the Product.

Information about your Device and how you interact with the Services: such as mobile device location, IP address, browser type, unique device identifier, cookie data, associated identifying and usage information from your mobile device.


HOW WE MAY USE YOUR INFORMATION


We may use your information in order to:

  • provide the Application and the Services to you and the company you represent, including to enable you to remotely access Products for which you have permission
  • evaluate and improve the quality, safety, and security of the Application and the Services
  • develop new products and services
  • maintain customer relationships and communicate with you
  • administer your account(s) and process your payments for Products and Services
  • operate our websites and applications, including online registration processes
  • provide customer and Product support and service (such as recall information)
  • provide product and service updates
  • administer and validate warranties
  • for research, evaluation of use, and troubleshooting purposes
  • protect the safety of you or others
  • for marketing and analytics purposes, including interest based marketing and
  • advertising across your devices (with necessary consents where required)
  • administer your participation in contests, quizzes, surveys, promotions and offers
  • customize and improve communication content and your experience with us and
  • comply with legal, regulatory or contractual requirements

Where required, we will anonymize your information in a way that it can't reasonably be associated with you, the company you represent, or the Products. We may use anonymized information or share it with third parties for any legitimate business purpose.

Communications with you in connection with these uses may be via mail, telephone, e-mail, text message and other electronic messages or via our websites and applications. See " Your Choices " below to learn how to manage your communication preferences.

HOW WE MAY SHARE YOUR INFORMATION

We may share your information as described below (and where required we will obtain additional consent or anonymize the information):


BrightDrop Family of Companies: Within the BrightDrop family of companies for the above uses.

Your Employer : With the company you represent in connection with the above uses and Services we provide to them.

Business Partners and Independent Third Parties (with necessary consents where required): With business partners not within the BrightDrop family of companies in connection with our or their products and services; with research institutes, for research and development purposes; with third party Product service providers, for service maintenance of the Products; and with third parties for marketing activities.


We may also share data with business partners and independent third parties where you have elected to receive a product or service from them and authorized them to request data from BrightDrop or for promoting joint marketing programs. Please see their respective privacy policies for information on how they use your personal data.

Service Providers: With our product and service providers who work on our behalf in connection with the above uses, companies that administer our contests and promotions, host and/or operate our applications, send communications, and perform data analytics.

Where Required or Permitted by Law: As required or permitted by applicable law, such as


in conjunction with a subpoena, government inquiry, litigation, dispute resolution, or similar legal process (which may include lawful access by US or foreign courts, law enforcement or other government authorities), when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, to detect, investigate and prevent fraud, or to conduct screening to ensure you are not on any government list of restricted parties.

Business Transfers: With a prospective or completed sale, transfer, or financing of all or a part of a BrightDrop business or its assets.


YOUR CHOICES

You have certain choices regarding how we use and share your information, such as for marketing and related purposes. Please contact us to make choices about telephone, email, text message and other communications. See "How To Contact Us" below to make choices about telephone, email, text message and other communications. You can also opt-out from promotional email and text message communications at any time by following the unsubscribe instructions in the email or by responding "STOP" to a text message you receive.

If you exercise choice regarding certain marketing communications, your information may still be used for the other purposes described in this Privacy Statement (for example, Product support and

service), including marketing communications where you have not exercised choice, or communications we are required or permitted by law to send to you ( for example, certain types of transactional or account-related messages ).

In addition, some collection and sharing practices are tied to the products and services we offer. To stop the collection or sharing of some information, you may have to decline those products and services or be willing to accept limited functionality.

For your choices regarding cookies and interest-based advertising, see "Cookies and Other Tracking

Technologies" below.

YOUR OBLIGATIONS

The nature of our products and services means that there may be circumstances where you might let someone else use a product or service that we provide to you ( for example, you let someone else use the Products). It is important that if you do let someone else use one of our products or services that you inform them of this Privacy Statement and of the privacy choices that you have made.

COOKIES AND OTHER TRACKING TECHNOLOGIES

BrightDrop products and services use cookies, web beacons, pixels and other device tracking technologies that allow us to identify you on your devices in a unique manner, such as through IP

address ("cookies"), to gather information about your activity, such as demographic data, browser type, pages visited, activities conducted on the page, and the day and time of your visit. We use cookies, sometimes across devices, to measure your activity, remember your preferences, maximize and improve the performance of our website and products and services, and customize your experience (for example, maintaining your account login or contact information, or to autofill fields on forms).

We may also combine this information with other information collected online or offline about you, including information provided by third party sources, and it may be used or shared for the purposes described in this Privacy Statement. We may also allow third party advertising and personalization partners to use cookies in order to develop personalized content and appropriate advertising based on your visits over time on BrightDrop websites and applications and non-BrightDrop websites and


applications. This information may also be used to evaluate our online advertising campaigns or to tailor promotions and other marketing messages to you.

Similarly, we may also place cookies in our emails to measure the effectiveness of our email campaigns by identifying the individuals who open or act upon an email message, when an email message is opened, how many times an email message is forwarded, the type of software, device, operating system and browser used to deliver the email and any URL accessed through our email message.

Please refer to your browser Help instructions to learn more about cookies and other technologies and how to manage their use. If you elect to refuse or delete cookies, you will need to repeat this process if you use another computer or device, or change browsers. If you choose to decline cookies, some of the functionality of a website may be impaired. Please contact us with further questions about how to opt- out of cookies and other technologies.

At this time, we do not honor "do no track" signals from a web site browser. However, you may refuse

or delete cookies, and otherwise express your choices on marketing issues as described above.

THIRD PARTY SERVICES

Certain third party services or applications you download, that are pre-installed, that are linked to from our sites, or which you may sign up for may have separate user terms and privacy statements, which are independent of this Privacy Statement. BrightDrop is not responsible for the personal information practices of these third party services or applications. We recommend that you carefully review the user terms and privacy statement of each third party service or application prior to signing up, downloading, or using them.

ACCESS AND UPDATES TO YOUR INFORMATION

You can access your online account to view or update your information in that account. You may also contact us, as provided below, under "How to Contact Us" or contact the company you represent to request to access, review, correct, update, or delete the information about you in our records, subject to limited exceptions under applicable law. If we receive a request involving personal information we process on behalf of the company you represent, we will refer the request to the company you represent. We may need to retain certain information for recordkeeping purposes, to complete any transactions that you began prior to your request, or for other purposes as required or permitted by applicable law, or if the information is relevant to a law enforcement investigation or legal proceeding.

Please Note: Except as required by applicable law, we may not provide access to records of service events (for example, when you request service from us, or when we provide services to you). We may, however, release those records (including audio records) if we receive a subpoena or production order, if release is otherwise required by applicable law, or if the information is relevant to a law enforcement investigation or legal proceeding.

CALIFORNIA PRIVACY RIGHTS

If you are a California resident you have the right to request information from BrightDrop regarding the manner in which BrightDrop shares certain categories of your personal information with third parties, including affiliates, for the third parties' direct marketing purposes. California law provides that you have the right to submit a request to BrightDrop at its designated address and receive the following information:

· The categories of personal information BrightDrop disclosed to third parties for the third parties' direct marketing purposes during the preceding calendar year; and

· The names and addresses of third parties that received such information, or if the nature of their business cannot be determined from the name, then examples of the products or services marketed.

You are entitled to receive a copy of this information in a standardized format and the information will

not be specific to you individually. See "How To Contact Us" to make a request.

HOW WE SAFEGUARD YOUR INFORMATION

We maintain appropriate technical, administrative, organizational and physical security and confidentiality measures designed to help protect your information from unauthorized access or acquisition and to ensure a level of security appropriate to the risk of varying likelihood and severity for your rights and freedoms related to personal data. We also require by contract (other than in an emergency situations) that third party services providers acting on our behalf or with whom we share your information also undertake to provide such measures in accordance with industry standards.

HOW LONG WE KEEP YOUR INFORMATION

We may keep the information we collect for as long as necessary to provide products or services to you and the company you represent, to operate our business, to enable us to communicate with you, for our safety, research, evaluation of use, or troubleshooting purposes, or to satisfy our legal or contractual obligations. Where required, we will anonymize or dispose of the information we collect when we no longer need it for the uses described above.

CHILDREN'S PRIVACY

BrightDrop does not target or knowingly collect any information from children under the age of 13.

INTERNATIONAL DATA TRANSFERS

We store or otherwise process your information in the United States, the European Economic Area (EEA), and other locations where we or our service providers maintain servers or operations. We provide appropriate protections for cross-border transfers as required by law for international data transfers. With respect to such transfers from the EEA to the United States and other non-EEA jurisdictions, we implement standard contractual clauses and other mechanisms to protect such data.

Your information may be accessible by law enforcement, governmental agencies or courts pursuant to a lawful access request in accordance with the laws of the jurisdiction in which we or our service providers are located.

CHANGES TO THIS PRIVACY STATEMENT

We may need to update this Privacy Statement from time to time as our business and products or services expand or change, or as required to by law. If we do, we will ask for your consent to the changes if legally required.

HOW TO CONTACT US

If you have any questions or concerns about the manner in which we or our service providers treat your personal information, you can contact us at any time by emailing us at support@gobrightdrop.com with the term "Privacy" in the subject line.

Or you can contact the Privacy Manager by email atprivacy@gm.com

You can also contact the company you represent about this Privacy Statement.

CALIFORNIA PRIVACY STATEMENT

This PRIVACY STATEMENT FOR CALIFORNIA RESIDENTS (" California Privacy Statement"), provided by BrightDrop Solutions LLC and its affiliates ("BrightDrop" or "we" or "us"), supplements the information contained in Connected Products Services Privacy Statement and applies solely to visitors, users, and

others who reside in the State of California (" consumers" or "you"). We adopt this notice to comply with the California Consumer Privacy Act of 2018 (" CCPA"). Any terms defined in the CCPA have the same meaning when used in this California Privacy Statement.

Collection of Personal Information

We may collect certain information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a consumer or household

("Personal Information"). Personal Information does not include de-identified or aggregated information. Please see the following disclosure regarding what we may collect, use, and share based on your use of the products and services and the consent(s) you have provided to us:

Personal Information Categories & Examples

  • Identifiers, such as email address or other similar identifiers; and
  • Geolocation data.

Source Categories

  • Consumers provided this information directly to us or automatically through their interaction with our products or services;
  • Licensors;
  • Service providers;
  • Marketing partners;
  • Business partners; and
  • Independent third-party sources.

Business or Commercial Purpose(s) for which the Information was Collected

  • Provide and improve our products and services;
  • Improve the quality, safety, and security of our products and services;
  • To administer your account(s) and process your payments for products and services;
  • To operate our websites and applications, including online registration processes;
  • To provide customer and product support and service (such as recall information);
  • For warranty administration and validation;
  • To provide product and service updates;
  • Develop new products and services;
  • For research, evaluation of use, and troubleshooting purposes;
  • To verify eligibility for product purchase or incentive programs;
  • For marketing and/or analytics purposes;
  • To customize and improve communication content;
  • To comply with legal, regulatory or contractual requirements;
  • To evaluate or conduct a merger, divestiture, acquisition, restructuring, reorganization, dissolution, or other sale or transfer of all of our assets;
  • To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and prosecute those responsible for that activity; and
  • To debug to identity and repair errors that impair existing intended functionality.

Categories of Third-Party Sharing

  • Our service providers;
  • The company you represent;
  • Emergency service providers, such as law enforcement and ambulance providers;
  • Business partners for marketing activities; and
  • Independent third parties, such as research institutions, in-vehicle app providers or usage-based insurance providers.

Your Rights and Choices

The CCPA provides certain consumers (i.e., California residents) with specific rights regarding their Personal Information. This section describes the CCPA rights that you may have and explains how to exercise those rights. You have a right not to receive discriminatory treatment for exercising these privacy rights.

Right to Opt-Out of the Sale of Personal Information

You have a right to opt-out of the sale of your Personal Information. We do not sell the Personal Information of minors under 16 years of age without affirmative authorization.

Right to Know About Personal Information Collected, Used, Disclosed, or Sold

You have the right to request up to twice in a 12-month period that we disclose certain information to you about our collection, use and disclosure of your Personal Information over the past 12 months.

Once we receive your request and verify your identity, we will disclose to you the information you request in the following areas: (1) the categories of Personal Information we collected about you; (2) the categories of sources for the Personal Information; (3) our business or commercial purpose for collecting or selling that Personal Information; (4) the categories of third parties with whom we shared that Personal Information; and (5) the specific pieces of Personal Information we collected about you in the preceding 12 months.

Right to Delete Personal Information Collected or Maintained

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your request and verify your identity, we will delete your Personal Information from our records, unless an exception under the CCPA applies. In our response to your request to delete, we will specify the manner in which we have deleted your Personal Information or, if we must deny your deletion request, the basis for this refusal.

Exercising Your Rights

To exercise the rights described above, please submit a verifiable consumer request to us by either:

Authorizing an Agent

You may designate an authorized agent to submit your consumer request on your behalf, so long as the authorized agent has your written permission to do so and you have taken steps to verify your identity directly with us.

Verifying Your Request

We cannot respond to your request to know or request to delete if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify your identity or authority to make the request. To verify your identity, we ask that you to provide us with the following information when you submit your request: (1) first name, (2) last name, and (3) phone number or email.

We will use the above information to verify your identity. We will require additional information to verify your identity and fulfill your request depending on the type of request or the information requested by you.

Changes to Our Privacy Notice

We reserve the right to amend this privacy notice at our discretion and at any time. When we make material changes to this privacy notice, we will notify you by email or through a notice on our website homepage.

Contact Information

If you have any questions or comments about this notice, our Privacy Statement, the ways in which we collect, use, and share your Personal Information, your choices and rights regarding such use, or wish to exercise your rights under the CCPA, please do not hesitate to contact us at:

Phone: 866-MYPRIVACY (697-7482)

Website:consumerprivacy.gm.com

Email: privacy@gm.com

Or please contact the company you represent.