PRIVACY POLICY

THIS JAGUAR LAND ROVER SOUTH AFRICA PROPRIETARY LIMITED PRIVACY POLICY ("PRIVACY POLICY") APPLIES TO HOW WE COLLECT, USE AND PROCESS YOUR PERSONAL INFORMATION. PLEASE READ THIS PRIVACY POLICY CAREFULLY.

Last Updated: 1st November 2022.

1. WHAT YOU CAN EXPECT TO SEE FROM READING THIS PRIVACY POLICY

1.1 Jaguar Land Rover Automotive PLC, ("JLR Group" or "our group") whose registered office is at Abbey Road, Whitley, Coventry CV3 4LF, and whose registered number is: 1672070, is one of the world's leading producers of premium cars.

1.2 When we refer to "Jaguar Land Rover SA", "JLRSA", "we", "our", or "us" in this Privacy Policy, we refer to: Jaguar Land Rover South Africa (Pty) Limited, whose registered office is at: 28 Victoria Link Route 21 Corporate Park, Nellmapius Drive, Irene X30, Centurion, Tshwane, Gauteng, South Africa, and whose registered number is: 2001/027269/07.

1.3 This Privacy Policy describes how we will treat your Personal Information whether provided by you to us or collected by us through other means in your access and use of our website at www.buy.jaguar.co.za and www.jaguar.co.za ("Website") and when you purchase any goods or services from us, or agents acting on our behalf.

1.4 This Privacy Policy must be read together with any Website terms and conditions and any other documents or agreement that describe the manner in which we, in specific circumstances, collect or process Personal Information about you. This will enable you to understand the manner in which JLRSA will process your Personal Information. This Privacy Policy supplements such other documents and agreements but does not supersede them and in the event of any conflict, ambiguity or inconsistency between this Privacy Policy and such other documents and agreements, the terms of the particular document or agreement will prevail.

2. WHAT IS PERSONAL INFORMATION

2.1 We may collect, acquire, receive, record, organise, collate, store, update, change, retrieve, read, process, analyse, use and share your Personal Information in the manner as set out in this Privacy Policy. When we perform one or more of these actions, we are "Processing" your Personal Information.

2.2 "Personal Information" refers to private information about an identifiable person, and where applicable and identifiable existing juristic person, which includes your name and surname, gender, date of birth, contact details (e.g. your email address or number) and physical address.

2.3 We may process various types of Personal Information about you, which may include:

2.3.1 Identity Information, which includes information concerning your name, surname, date of birth, gender, race and marital status;

2.3.2 Contact Information, which includes your physical and postal addresses, email addresses and telephone numbers, as well as company secretarial information that has been disclosed in relation to you, as well as information pertaining to your employer and employment history;

2.3.3 Financial Information, which includes bank account and payment card details, insurance information, financial statements and VAT registration numbers and credit ratings;

2.3.4 Transaction Information, which includes details about payments made to or received from you and company information, which may consist of financial activity and regulatory disclosures, as well as your bank account details;

2.3.5 Technical Information, which includes your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devise you use to access the Website;

2.3.6 Device and Device event information, which may include information such as your IP address, unique device identifier, the nature of the device which you used to access the Website (e.g. tablet or smart phone, and which type thereof), the geographic location from which you accessed the Website (i.e. the geographic location of your device), hardware model and settings, operating systems type and version, browser language, system activity and crashes;

2.3.7 Log information, which includes information in server logs (i.e. our web servers automatically record and maintain a log of their activities when users access the Website), which may include your "activity information", such as details of how, when and for how long you accessed the Website and what features you utilised;

2.3.8 Profile Information, which includes your username and password, purchases or order made by you, your interests, preferences and feedback;

2.3.9 User Content, such as content of communications, suggestions, questions, comments, feedback, and other information you send to us, that you provide to us when you contact us, or that you post on our websites (including the Website), applications, mobile applications, or social media portals or platforms including information in alerts, folders, notes, and shares of content), and similar data;

2.3.10 Usage Information, which includes information as to your access to and use of the Website, products and services;

2.3.11 Location Information, which includes geographical information from your device (which is usually based on the GPS or IP location);

2.3.12 Marketing and Communications Information, which includes your preferences in respect of receiving marketing information from us and our third parties, and your communication preferences;

2.3.13 Vehicle Information, which includes vehicle data for trade-ins, such as the make, model, vehicle identification number and odometer reading as well as vehicle data relating to vehicle warranties, service history and vehicle re-calls;

2.3.14 Social Media Information, which includes, your interactions with our social media pages, anycomments made on our social media pages and any information or personal information which you submit to us using our social media pages' direct messaging functionality.

2.4 JLRSA may also process, collect, store and/or use aggregated data, which may include historical or statistical data ("Aggregated Data") for any purpose. Aggregated Data may be derived from your Personal Information but is not considered Personal Information, as this data does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your Personal Information in a manner that has the result that it can directly or indirectly identify you, we will treat the combined data as Personal Information, which will be managed in accordance with this Privacy Policy.

3. HOW WE COLLECT YOUR PERSONAL INFORMATION

3.1 We collect your Personal Information in three ways, namely:

3.1.1 through direct or active interactions with you;

3.1.2 through automated or passive interactions with you; and

3.1.3 from third parties, including third party service providers.

3.2 Direct or active collection from you

3.2.1 We may require that you submit certain information to enable you to access portion of the Website, to make use of our services, to purchase our goods or services, to facilitate the conclusion of an agreement with us, or that is necessary for our fulfilment of our statutory or regulatory obligations. We also collect Personal Information directly from you when you communicate directly with us, for example via e-mail, telephone calls, feedback forms, site comments or forums.

3.2.2 We may also collect Personal Information directly from you though other online means, for example, through our various official social media pages such as Twitter, Facebook and Instagram.

3.2.3 If you contact us, we reserve the right to retain a record of that correspondence, which may include Personal Information.

3.2.4 The Personal Information that we actively collect from you may include any of the Personal Information listed in clause 2 of this Privacy Policy.

3.3 Passive collection from your Access Device

3.3.1 We may passively collect certain of your Personal Information from the Access Device that you use to access and navigate the Website (each an "Access Device"), by way of various technological applications, for instance, using server logs to collect and maintain log information.

3.3.2 We also use cookies and anonymous identifiers which enable our computer system to recognise you when you next visit the Website to distinguish you from other users and to improve our service to you, and which can be used to enhance the content of the Website and make it more user-friendly, as well as to give you a more personalised experience.

3.3.3 A cookie is a small piece of data (an alphanumeric identifier) which our computer system transfers to your Access Device through your web browser when you visit the Website and which is stored in your web browser. When you visit the Website again, the cookie allows the site to recognise your browser. Cookies may store user preferences and other information.

3.3.4 You may disable the use of cookies by configuring your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do so, you may not be able to enjoy all the features and functionality of the Website.

3.3.5 The Personal Information that we passively collect from your Access Device may include your Identity Information, your Contact Information, your Technical Information, your Profile Information, your Usage Information, your Location Information and your Marketing and Communications Information, or any other Personal Information which you permit us, from time to time, to passively collect from your Access Device.

3.4 Personal Information collected from third parties

3.4.1 We receive Personal Information about you from various third parties and public sources, including:

3.4.1.1 agents appointed to act on our behalf;

3.4.1.2 third party service providers, such as credit vetting agencies, agencies performing checks against restricted and ordinary persons and sanctions lists, money laundering, financing of terrorism and other (financial) crime as well as our agents and dealerships that are associated with us;

3.4.1.3 third parties (including public bodies) that maintain public information about you, including regulators, professional or industry organizations and certification/ licensing agencies, marketing, sales generation, and business partners, SAPS, Home Affairs, Credit bureaus, TransUnion and similar entities; and

3.4.1.4 our information technology suppliers.

4. HOW WE USE YOUR PERSONAL INFORMATION

4.1 We use the Personal Information we collect from you to maintain and improve our services and transactions onsite or in person via our Website and to improve the experience of our users, to facilitate the sale of our products and the provision of our services and to fulfil our statutory and regulatory obligations.

4.2 We may also use your Personal Information to:

4.2.1 retain and make information available to you site;

4.2.2 create your user account and allow your use of the Website;

4.2.3 maintain and update our customer, or potential customer, databases;

4.2.4 establish and verify your identity on the Website;

4.2.5 operate, administer, secure and develop the Website and the performance and functionality of the Website;

4.2.6 detect, prevent or manage actual or alleged fraud, security breaches or the abuse, misuse or unauthorised use of the Website and contraventions of this Privacy Policy or any of the terms and conditions that apply to your use of the Website;

4.2.7 inform you about any changes to the Website, this Privacy Policy or other changes that are relevant to you;

4.2.8 create user profiles and to analyse and compare how you and other users make use of the Website, including your browsing habits, click-patterns, preferences, frequency and times of use, trends and demographic information;

4.2.9 provide you with marketing material that is relevant to you;

4.2.10 improve and inform our marketing strategies in order to improve Website information, functionality and the products and/or services we provide;

4.2.11 manage requests made by you (including on our Website), for example, where you request a brochure, sign up to 'keep me informed' or add your details into any other Website data form or field;

4.2.12 diagnose and deal with technical issues and customer support queries and other user queries;

4.2.13 protect our rights in any litigation that may involve you;

4.2.14 comply with security, administrative and legal requirements and obligations;

4.2.15 comply with our statutory obligations, including submissions to the Companies and Intellectual Property Commission ("CIPC"), as well as engaging with regulatory authorities;

4.2.16 enable us to participate in corporate acquisitions or disposals;

4.2.17 manage legal and regulatory requests and requirements and to defend legal rights;

4.2.18 improve customer relations and for such other customer relations purposes;

4.2.19 enter into agreements with you and fulfil any contractual obligations that we may have to you or any third party;

4.2.20 promote, administer and provide competitions, special offers and other promotional activities;

4.2.21 communicate with you and retain a record of our communications with you and your communications with us;

4.2.22 use such Personal Information for internal research, development, analytics, analysis and reporting purposes;

4.2.23 analyse and compare the types of devices that you and other users make use of in order to access the Website and your physical location;

4.2.24 use such Personal Information for other lawful purposes that are relevant to our business activities or regulatory functions;

4.2.25 for purposes of generating quotations or offers to purchase JLRSA vehicles;

4.2.26 to follow up on your satisfaction with our products and/ or services and conduct client satisfaction surveys relating to our products and/ or services.

4.2.27 perform client verification checks to verify the identification and address details you provide; and

4.2.28 to process your personal data as appropriate or necessary under applicable laws for purposes of reviewing restricted and ordinary persons and sanctions lists, preventing money laundering, financing of terrorism and other (financial) crimes and to respond to requests from public and government authorities.

5. COMPULSARY PERSONAL INFORMATION AND CONSEQUENCES OF NOT SHARING WITH US

5.1 Where JLRSA is required to process certain Personal Information by law, or in terms of a contract that we have with you, and you fail to provide such Personal Information when requested to do so, JLRSA may be unable to perform in terms of the contract we have in place or are trying to enter into with you. In this case, JLRSA may be required to terminate the contract and/or relationship, upon notification to you, which termination will be done in accordance with the terms of the contract and all applicable legislation.

6. WHO WE SHARE YOUR PERSONAL INFORMATION WITH

6.1 We may share your Personal Information with:

6.1.1 Those third parties who need to process it either on our behalf as an Operator or on their own behalf as a Responsible Party, so we can provide to you the products, services you have signed up to or requested or to further our research and development initiatives, for example, to banking institutes or finance houses for purposes of providing or offering finance or credit, for insurance purposes, to provide marketing and advertising support services and for optimised Website services and products;

6.1.2 With our network of retailers, authorised repairers and where relevant our importers network (together our "Retail Network"), so as to be able to fulfil requests for goods, services, etc, and for assessment and training, to be able to enhance the quality of the services you obtain when interacting with our Retail Network;

6.1.3 Our group, including all Jaguar Land Rover group companies in line with the data uses set out in this Privacy Policy;

6.1.4 Third parties in the event we sell or buy any business or assets; and

6.1.5 If we are under a duty to disclose or share your Personal Information in order to comply with any legal or regulatory obligation or requests, or in order to enforce these terms or to investigate actual or suspected breaches or to protect or pursue your, our or a third party's legitimate interest.

6.2 We have safeguards in place with our service providers to ensure that your data is kept confidential, safe and secure and used in accordance with the purposes set out in this Privacy Policy.

7. INFORMATION ABOUT DATA TRANSFERS

7.1 We may share the Personal Information described in this Privacy Policy with suppliers or group companies located inside or outside South Africa, where this is necessary for the purposes described above. Where this happens, we apply safeguards to add to the data protections that apply to those data transfers. This includes an assessment of the persons who we are sharing the data with, their security controls, the adequacy of data privacy laws applicable in any third country where the recipient of the information or data resides or is located, the use of European Commission or other country approved model contract terms.

8. HOW LONG WE HOLD PERSONAL INFORMATION FOR

8.1 We will keep your Personal Information for as long as we need it to provide the products and services to which you have signed up. We may also keep it to comply with our legal obligations, respond to queries and resolve any disputes, to meet our legitimate interests, including for our ongoing research and development initiatives, and to enforce our rights. The criteria we use to determine storage periods include, information we have told you about storage periods on our Website or in Website terms and conditions. We will also use criteria such as applicable contractual provisions that are in force, legal statutory limitation periods, applicable regulatory requirements and industry standards.

9. YOUR DATA PROTECTION RIGHTS

9.1 You have the following rights in connection with your Personal Information:

9.1.1 Block all cookies, by setting your browser to do so, including cookies associated with our products and services or to indicate when a cookie is being sent by us.

9.1.2 Request access to your Personal Information (commonly known as a “data subject access request”), thereby enabling you to receive a copy of the Personal Information retained about you.

9.1.3 Request the correction of your Personal Information, in order to ensure that any incomplete or inaccurate Personal Information is corrected.

9.1.4 Request erasure of your Personal Information, where there is no lawful basis for the retention or continued processing of it.

9.1.5 Object to the processing of your Personal Information for legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.

9.1.6 Request restriction of processing of your Personal Information. This enables you to ask JLRSA to suspend the processing of your Personal Information in limited circumstances, which may differ by jurisdiction.

9.1.7 Withdraw consent previously given in respect of the processing of your Personal Information at any time which withdrawal of consent will not affect the lawfulness of any processing carried out prior to your notice of withdrawal. Withdrawal of consent may limit the ability of JLRSA or a third party to provide certain products or services to you, but will not affect the continued processing of your Personal Information in instances in which your consent is not required.

9.2 As far as the law allows, we may charge a fee for attending to any of the above requests, and may also refuse to carry out any of your requests in whole or in part. You may also contact our Information Officer at the following email addresses where queries are data protection related:

jlrsaio@jaguarlandrover.com

9.3 If you are not satisfied, you also have the right to complain to the Information Regulator, whose details are available at https://inforegulator.org.za.

10. LINKS TO OTHER WEBSITES

10.1 The Website may contain links to other websites run by other organisations which we do not control. This policy does not apply to those other websites, so we encourage you to read their privacy statements. We are not responsible for the privacy policies and practices of other websites and apps (even if you access them using links that we provide) and we provide links to those websites solely for your information and convenience. We specifically disclaim responsibility for their content, privacy practices and terms of use, and we make no endorsements, representations or promises about their accuracy, content or thoroughness.

11. KEEPING YOUR INFORMATION SECURE

11.1 We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

11.2 We require all of our service providers to have appropriate measures in place to maintain the security of your information.

11.3 Where we have given you (or where we have chosen) a password that enables you to access any personalised area of the Website, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

11.4 Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your Personal Information, we cannot guarantee the security of Your Personal Information transmitted over the internet; any transmission is at your own risk. Your information will be kept in a secure environment protected by a combination of physical and technical measures such as encryption technologies or authentication systems to prevent any loss, misuse, alteration, disclosure, destruction, theft or unauthorised access.

11.5 For transparency this Privacy Policy does not cover all Jaguar Land Rover branded websites, and we would always encourage you to click the Privacy Policy link of the website you are visiting to see the privacy information that applies.

11.6 Where you go from our websites to a third party, such as a retailer, repairer, importer, credit product provider, or contract hire product provider these are independent parties and not party of our group. This means Jaguar Land Rover will no longer control (and in some cases will not even see) the data you provide to third parties in these instances.

12. CHANGES TO THIS PRIVACY POLICY

12.1 This Privacy Notice may be amended from time to time and we will take reasonably practicable steps to inform you when changes are made. Without limiting the manner in which we may inform you, it could be that such notification may be by way of e-mail (if you provide your e-mail address when you register to use the Website), a "pop-up" notification on the Website, or a notification when you access the Website or notice and copies of the amended policy made available from the physical locations/dealerships operated by our agents.

13. CHILDREN

13.1 The Website and JLRSA's products and services are not targeted at children (a natural person under the age of 18 years). We will not knowingly collect personal information in respect of children without express permission to do so from a competent person (any person who is legally competent to consent to any action or decision being taken in respect of any matter concerning a child).

14. DIRECT MARKETING

14.1 When you register to use the Website, you will be required to provide your consent to agree to receive marketing communication from us.

14.2 You may refuse to accept, require us to discontinue, or pre-emptively block any approach or communication from us if that approach or communication is primarily for the purpose of direct marketing ("direct marketing communications").

14.3 You may opt out of receiving direct marketing communication from us at any time by requesting us (in the manner set out in the communication or by contacting our Information Officer) to stop providing any direct marketing communication to you.

14.4 If you have chosen to opt out, we may send you written confirmation of receipt of your opt out request (which may be in electronic form), and will thereafter not send any further direct marketing communication to you. Please note that you may continue to receive communication from JLRSA that is not marketing related.

15. CONSUMER PROTECTION ACT, PROTECTION OF PERSONAL INFORMATION ACT AND OTHER LAWS

15.1 If this Privacy Policy or any provisions in this Privacy Policy is regulated by or subject to the Consumer Protection Act, 2008 ("CPA"), the Protection of Personal Information Act, 2013 ("POPIA") or other laws, it is not intended that any provision of this Privacy Policy contravenes any provision of the CPA, POPIA or such other laws. All provisions of this Privacy Policy must be treated as being qualified, to the extent necessary, to ensure that the provisions of the CPA, POPIA and such other laws are complied with.

15.2 No provision of this Privacy Policy:

15.2.1 does or purports to limit or exempt us from any liability (including, without limitation, for any loss directly or indirectly attributable to our gross negligence or wilful default or that of any other person acting for or controlled by us) to the extent that the law does not allow such a limitation or exemption.

15.2.2 requires you to assume risk or liability for the kind of liability or loss, to the extent that the law does not allow such an assumption of risk or liability; or

15.2.3 limits or excludes any warranties or obligations which are implied into this Privacy Policy by the CPA (to the extent applicable), POPIA (to the extent applicable), or other applicable laws or which we give under the CPA (to the extent applicable), POPIA (to the extent applicable), or other applicable laws, to the extent that the law does not allow them to be limited or excluded.

16. GENERAL

16.1 You agree that this Privacy Policy our relationship and any dispute of whatsoever nature relating to or arising out of this Privacy Policy whether directly or indirectly is governed by South African law, without giving effect to any principle of conflict of laws.

16.2 Our failure to exercise or enforce any right or provision of this Privacy Policy shall not constitute a waiver of such right or provision.

16.3 Each provision of this Privacy Policy, and each party of any provision, is removable and detachable from the others. As far as the law allows, if any provision (or part of a provision) of this Privacy Policy is found by a court or authority of competent jurisdiction to be illegal, invalid or unenforceable (including without limitation, because it is not consistent with the law of another jurisdiction), it must be treated as if it was not included in this Privacy Policy and the rest of this Privacy Policy will still be valid and enforceable.