The Giltrap Group Holdings Limited group of companies (“Giltrap Group”), including Giltrap Group
Holdings Limited and each of its related and affiliated entities (collectively referred to as “our”, “us” or
"we") is committed to protecting the privacy of the personal information of our current, former and
potential customers (referred to as “customers”, “you” and “your”) and to complying with our obligations
to you under the Privacy Act 2020 (“Act”).

This privacy policy sets out how we manage your personal information held by us, including how we
collect, use, hold, disclose and otherwise process personal information. You will also find information
about how to contact us if you have any privacy queries, including how to update or access your
personal information or make a complaint.

By providing us with your personal information (whether directly or indirectly) you accept and consent
to the provisions of this privacy policy. If you have any questions or concerns regarding this privacy
policy, please contact us.

It is important to note that, if we are unable to collect, use, hold, disclose and otherwise process your
personal information in the manner authorised by this privacy policy then we may not be able to provide
you with the full benefit of our products, services and offers or our online and digital platforms.

2. What types of personal information do we collect?

Generally, the types of personal information that we collect from or about you depends on the
circumstances in which the information is collected. We have described below examples of the types
of personal information that may be collected, however this is not an exhaustive list:

• Your name and contact details, including physical and postal address, email addresses, phone
numbers, and mobile numbers.

• Our Giltrap Group motor vehicle dealers and our independent authorised motor vehicle dealers
(together, “Authorised Dealers”) will collect your driver’s licence details when you participate
in a test drive or when you purchase a vehicle brand that we distribute or sell and we may be
recipients of this information.

• Demographic information about your age, gender and occupation, as well as information about
your hobbies, favourite sports and other interests and preferences may be collected if you
choose to provide us with that information, for example when entering a competition or
promotion or taking part in a customer experience survey following the purchase or service of
your vehicle.

• Your airline membership number for the purpose of facilitating the award of airpoints in relation
to your purchase (if applicable).

• Financial and credit information if you are seeking to obtain finance from a third party finance
provider in relation to the purchase of a vehicle from an Authorised Dealer. Where you do
obtain finance for the purchase of a vehicle from an Authorised Dealer, we may collect
information about the finance, such as the amount financed and the type of finance product.

• Information about your vehicle, including its number plate, vehicle identification number (VIN),
and service plan schedule.

• Information relating to your dealings with the manufacturers and their respective related or
affiliated entities of the relevant vehicle brands that we distribute and/or sell in New Zealand
through our Giltrap Group and independent Authorised Dealers (“Manufacturers”).

• Information relating to your dealings with the distributors and their respective related or affiliated
entities of the relevant vehicle brands that we sell through our Giltrap Group Authorised Dealers
(“Distributors”).

• Information relating to your dealings with Authorised Dealers.

• If you request or receive roadside assistance services, we may collect information about where
(e.g. location) and when (e.g. date, time) you requested roadside assistance services and the
assistance service that is required.

• Recordings of you from our Closed Circuit Television (CCTV) system (for example, when you
enter the premises of one of our Giltrap Group Authorised Dealers).

• Information about your use of or interest in the products and services that we provide (either
directly or through our Authorised Dealers), for example enquiry details, your feedback or
opinion on products and services, and records of your communications with us.

• Information that you share as part of your public profile on a third-party social network, or
information you create and share with us by posting it to one of our social networks.

• Information relating to the way you use or navigate any of our websites, customer portals and
mobile applications so that we can improve your experience and our communications with you
online.

• If you use any customer portals or mobile applications associated with the vehicle brands that
we distribute and/or sell we may collect information entered into or generated by those mobile
applications.

• Other personal information that we are permitted or otherwise required by law to obtain, as well
as any other information that you choose to provide us.

3. How is personal information collected?

We collect personal information from or about you in a variety of ways. Where possible we will collect
personal information directly from you. We may also collect information from persons you have
authorised to share your personal information with us, or from whom you authorise us to collect personal
information. The most common ways we collect personal information are:

• from you directly either in person, over the phone, by email, or through our digital and online
channels, for example, when:

o you make an enquiry about vehicles, parts, accessories or services, or if you request
a test drive, brochure, specification sheet, information or other materials about vehicles,
parts, accessories or services;

o if you interact with us online, including via our websites or through our social media
channels;

o if you use any customer portal and/or any mobile applications relevant to the vehicle
brands that we distribute and/or sell;

o if you enter a promotion or competition carried out by us or by a third party with official
affiliation or support from us;

o if you participate in a marketing, product development, profiling, survey or market
research campaign, including on social media channels; or

o if you request roadside assistance services;

• from our Authorised Dealers (e.g. information you provide when you purchase a new or used
vehicle, part or accessory from an Authorised Dealer, arrange finance for the purchase of your
vehicle, take a test drive at an Authorised Dealer, or have (or book in to have) your vehicle
serviced or repaired at an Authorised Dealer);

• from Distributors and Manufacturers and their respective suppliers, service providers,
contractors, and agents (e.g. if you participate in a customer survey managed or organised by
a Manufacturer);

• from any third party provider of motor vehicle finance;

• from other third parties, including our business associates, service providers, contractors, and
agents.

We may also collect personal information, including your name and address information, from the Motor
Vehicle Register, in accordance with our authorisation to access this register for specified purposes
under section 241 of the Land Transport Act 1998. If you do not wish for us, or other authorised users,
to access this personal information, you may opt-out by visiting the following webpage:

https://transact.nzta.govt.nz/transactions/PersonalInfoAccess/entry. Opting-out is subject to the
limitations set out in the Land Transport Act 1998 and there may be circumstances where your personal
information is still accessible through the Motor Vehicle Register. Before you opt-out, keep in mind that
we have a legitimate need to access personal information held on the Motor Vehicle Register. Opting-
out may mean that it will take us longer to provide you services and may affect the price at which we
can provide goods and/or services to you.

4. Why we collect personal information and what we do with it

We, and the Permitted Recipients referred to in paragraph 5, may collect, hold, use, disclose and
otherwise process your personal information for the following purposes (and for any related purposes
which you would reasonably expect):

• to enable us to correspond with you and do business together and for reasons related to our
business operations, such as to ensure we and our Authorised Dealers continue to deliver
quality products and services to our customers and potential customers;

• to administer or assist in administering your vehicle purchase, lease, warranty, any extended
service plan, roadside assistance, or ongoing vehicle service, and arranging for our Authorised
Dealers to obtain required vehicles and parts on a timely basis to meet your needs;

• to facilitate your application for finance for the purchase of your vehicle;

• to facilitate your application to open a trade account with one of our Giltrap Group Authorised
Dealers;

• to lodge or assist in an insurance claim;

• if you have a credit history with us, to provide trade references on your behalf;

• to respond to your enquiries, comments, concerns or requests for information about our
vehicles, parts, accessories, services or offers;

• to process sales orders and administer accounts, warranty records and vehicle service records;

• to provide you with any necessary support in relation to your dealings with us, our Authorised
Dealers, Manufacturers and/or Distributors;

• to provide our Authorised Dealers with any necessary support for the purposes of their business
activities, including to assist them in performing the purposes set out in this privacy policy;

• to attend to or assist in facilitating the servicing or repair of your vehicle, including the provision
of roadside assistance services and online vehicle service and repair booking facilities with or
for Authorised Dealers;

• for product development, market research, and customer surveys (for example, to obtain your
feedback and find out your level of satisfaction with our products and services and with our
Authorised Dealers and service providers);

• for marketing and promotional activities, including to contact you directly or through
authorised service providers;

• to compile aggregate data and generate reports and data about our and our Authorised Dealers’
customer and service usage patterns;

• to carry out our legal compliance obligations, such as to conduct a product safety recall where
necessary or inform you of a customer notification or field service action affecting your vehicle;

• if you use any mobile applications relevant to the vehicle brands that we distribute and/or sell,
to provide you with notifications and information about your vehicle;

• to send you service and Warrant of Fitness reminders;

• to contact you with details of new vehicles, automotive products and services, and any other
products or services offered by us or by other parties, or special offers or promotions, that we
think may be of interest to you;

• we may use information collected from our websites to enable the features of the websites, to
improve the websites by determining which of our products, features and services are most
popular, and to personalise the experience of the users of our websites;

• for other purposes which are disclosed to you, and to which you consent, whether expressly or
by implication by providing us with your personal information with knowledge of how we intend
to use it; and

• without your consent for purposes that are required or authorised by or under any applicable
law, including but not limited to meeting our legal obligations, assisting in the investigation of a
breach of an agreement or a law, assisting in law enforcement purposes, and protecting our
and our customers’ business interests.

5. Who has access to your personal information?

We respect the privacy of your personal information and will take all reasonable steps to keep it strictly
confidential. However, we may disclose your personal information to third parties if required in
connection with one or more of the purposes set out in paragraph 4 of this privacy policy. This may
include disclosure to the following persons (in each case, a “Permitted Recipient”):

• our employees, officers, contractors, suppliers, service providers, agents, partners, and
licensees (for example, mailing houses, marketing agencies, airline programme partners,
market research providers, printers, roadside assistance service providers, insurance
providers, financiers, website and data hosting providers, online messaging providers, data
analytics providers, and other IT suppliers);

• our affiliated or related entities and their respective employees, officers, contractors,
suppliers, service providers, agents, partners, and licensees;

• our independent Authorised Dealers and their affiliated or related companies and to the
employees, officers, contractors, suppliers, service providers, agents, partners, and licensees
of our independent Authorised Dealers and their affiliated or related companies;

• Manufacturers and Distributors and their respective affiliated or related entities and the
employees, officers, contractors, suppliers, service providers, dealers, agents, partners, and
licensees of Manufacturers and Distributors and their respective affiliated or related entities;

• our accountants, insurers, lawyers, auditors and other professional advisors;

• if your vehicle is provided by your employer as part of a corporate or government fleet policy,
we may also disclose personal information to your employer;

• any other third parties to whom you direct or permit us (whether expressly or by implication) to
disclose your personal information (e.g. third parties with whom we have directly or indirectly
arranged services for your benefit);

• third parties that require the information for law enforcement or to prevent a serious threat to
public safety; and

• as otherwise permitted or required by or under any applicable law.
In each case, the disclosure of personal information to a Permitted Recipient may be made directly by
us to a Permitted Recipient or by a Permitted Recipient to another Permitted Recipient (for example,
Manufacturers may disclose personal information directly to their suppliers).

In the unlikely event that we sell a part of or the whole of the Giltrap Group or its business, or we are
no longer authorised to distribute and/or sell a particular vehicle brand, our records of personal
information may be transferred to (and become subject to the privacy policy of) the new owner, or to
the relevant Manufacturer or Distributor or any other entity as they may direct (as the case may be).

6. Disclosure of personal information offshore

Some of the Permitted Recipients to whom we disclose personal information may be located outside
New Zealand. As above, we will disclose personal information to Manufacturers and Distributors that
may be based offshore (for example, by making our customer relationship management systems
accessible to the relevant Manufacturer and/or Distributor as the case may be). In addition, our
websites and systems may also be based on servers located outside of New Zealand. Please note that
the privacy laws of countries outside of New Zealand may not be as comprehensive as the laws of New
Zealand. In addition, if a Permitted Recipient is in a jurisdiction outside of New Zealand, the information
held by that Permitted Recipient may be subject to that jurisdiction, including access requests from
government, courts or law enforcement in that jurisdiction.

If we disclose personal information to third parties based offshore, we will comply with the requirements
of the Act that relate to the transfer of personal information offshore.

7. Cookies

Our websites use a technology called cookies to record the preferences of visitors and enable us to
optimise the design of our websites. A "cookie" is a small data element that a website transfers to your
computer for record keeping and experience customisation purposes. The length of time that a user’s
computer stores cookies is determined by the user’s browser settings.

The use of "cookies" is an industry standard and helps us monitor the effectiveness of our advertising
and how visitors use our websites. During normal website usage our website "cookies" do not store
your email address or other personal information about you unless you have given your consent, or if it
is essential for technical reasons (i.e. secure login). We use this technology to generate statistics and
measure website activity to improve the usefulness of customer visits. Each time you access our
websites, our server may deliver certain customised information (such as advertisements) to you based
on the data stored in your cookie. Third party vendors may utilise cookies to collect information about
the content you view on our websites, customer portals or mobile applications and use that information
to show and/or serve our advertisements on other websites based on a user’s prior visits to our websites
and other internet activity. We may also use analytics data supplied by third party vendors to inform and
optimise our ad campaigns. We may utilise third party cookies in some parts of our websites.

Some of the tags that are used on our websites include, but are not limited to, container tags (such as
Google tag manager), which include retargeting tags and analytics tags. These tags provide us with
aggregated knowledge and information on website behaviour and user preferences.
By using our websites, customer portal and mobile applications you consent to the use and storage of
cookies on your end device. You can also view our websites without cookies. If you do not wish to
receive any cookies you may set your browser to refuse cookies. Not all features of our websites,
customer portals and mobile applications may be available if you do not enable cookies. We
recommend you enable cookies in order to enjoy our websites, customer portal and mobile applications.

8. Storage and Security

Any personal information that falls within the scope of this privacy policy is collected and held by us or
by Permitted Recipients that we may engage or authorise to store information on our behalf. Personal
information may be stored both in New Zealand and offshore.
We will take reasonable steps to protect your personal information from misuse, interference,
corruption, loss or unauthorised access, modification or disclosure, including through physical,
electronic and procedural safeguards. However, we do not promise that your personal information
cannot be accessed by an unauthorised person or that unauthorised access will not occur. To the
extent permitted by law, we will not be responsible for and exclude all liability arising in relation to any
misuse, interference, corruption, loss or unauthorised access, modification or disclosure of your
personal information.

If we provide you with any passwords or other security devices it is important that you keep these secret
and confidential and do not allow them to be used by any other person. You should notify us immediately
if the security of these devices is breached to prevent the unauthorised disclosure of your personal
information.

If we become aware of any breach involving your personal information, we will comply with the
requirements of the Act relating to the reporting of privacy breaches

9. How long do we retain your personal information?

We will keep your personal information for as long as it is required for the purposes for which it was
collected, taking into consideration our need to answer queries or resolve problems, provide improved
and new services, and comply with our contractual and legal requirements.
When the personal information that we hold is no longer required or is not required to be retained by
law, we destroy, delete or permanently anonymise it (except for any personal information that is stored
on an off-site server or which is stored as electronic backup data that cannot be readily accessed).

10. Email and other electronic communications

We are committed to full compliance with the Unsolicited Electronic Messages Act 2007.

By using our website and other online and digital channels and/or by providing us with your personal
information you consent to receiving communications from us or from Permitted Recipients using the
contact details you have provided (including, without limitation, via direct mailing, email, SMS, telephone
call, and other phone number based messaging) which promote and market our products and services,
or the products and services of others, from time to time.

You can opt out of those communications at any stage by contacting us using the contact details set
out below at paragraph 11 or by utilising the "unsubscribe" facility included on all such communications.
Once you have unsubscribed from these communications, we will remove you from the corresponding
marketing list as soon as is reasonably practicable.

If you wish to unsubscribe from marketing material you receive from an Authorised Dealer, please
contact that dealer directly.

11. Your rights to access and correct personal information

You may obtain confirmation from us as to whether or not we hold personal information about you. You
also have a right to access personal information about you if we hold that personal information in a way
that it can be readily retrieved.

You can make access requests in relation to your personal information by contacting our Privacy Officer
using the details set out below. Please quote your name and address and, if possible, provide brief
details of what information you want a copy of (this helps us to more readily locate your information).

We will provide you with access to your personal information unless we are required or authorised to
refuse such access by law. Please note that we will not be able to provide your personal information
if we do not know or don’t have reasonable grounds to believe that it is personal information about you
or if disclosing the information would involve the disclosure of the affairs of another individual.

In some cases, there may be a reasonable charge associated with retrieving and providing a copy of
your personal information to you. If so, we will advise you of this prior to sending your information.
You can also request correction of or amendment to the information held by us at any time by
contracting our Privacy Officer using the details set out below and specifying the information that you
would like changed. If it is reasonable in the circumstances for us to do so, we will make the requested
change or correction, otherwise we will take reasonable steps to mark that information as having been
subject to a change or correction request.

All such enquiries should be directed to:

Privacy Officer
Giltrap Group Holdings Limited
PO Box 959
Auckland
Email: bolliff@giltrap.com
Phone: 09 376 0911
Fax: 09 376 0911

12. Complaints

At all times we will strive to ensure that your personal information is treated confidentially and in
accordance with the Act. However, if you have any questions or complaints about the handling of your
personal information, please contact our Privacy Officer in the first instance using the contact details
set out in paragraph 11 above and we will do our best to assist.

If you are still not satisfied, you can make a complaint to the Privacy Commissioner. Further details on
how to do this are available on the Privacy Commissioner website at www.privacy.org.nz.

13. Links to other websites

Our websites may contain links to other sites that are owned or operated by third parties and which are
therefore not under our control, including the websites of independent Authorised Dealers or our third
party service providers. We take no responsibility for linked websites and provide them solely for your
information and convenience. We specifically disclaim responsibility for their content, privacy practices
and terms of use, and we make no endorsements, representations or warranties about their accuracy,
content or thoroughness. Your disclosure of personal information to or in connection with third party
websites is at your own risk.

Please note that our independent Authorised Dealers are independent business entities that sit outside
of the Giltrap Group and may have privacy policies which are different to ours. These Authorised
Dealers are responsible for their own privacy policies and privacy practices. Please contact your
Authorised Dealer directly for enquiries or further information.

14. Changes to this privacy policy

We reserve the right to amend this privacy policy from time to time by posting an updated privacy policy
here on this website. We will collect, use, hold and disclose your personal information in accordance
with our most recently updated version of the privacy policy. We recommend that you regularly review
this privacy policy when you visit this website.

If you do not agree with any aspect of the updated privacy policy, you must promptly notify us.
This privacy policy was last updated on 10 October 2022.

15. Privacy Act

Any reference in this privacy policy to the “Act” is a reference to the Privacy Act 2020 including any
amendments, re-enactments or replacements of that Act.
Nothing in this privacy policy affects your rights under the Act. Further information about the Act and
how it protects the personal information of individuals in New Zealand is available from the Privacy
Commissioner website at www.privacy.org.nz.