privacy terms and conditions

Your personal data is processed by Auto Sales Limited , Renault Authorised Network (« RENAULT » or « we »), as joint controllers. 
Renault Malta is located at Mosta Road, Lija. The data protection officer (DPO) can be contacted via; 

Data Protection Officer 
Auto Sales Limited 
Mosta Road
Lija LJA 9011
Malta 
dataprotectionofficer@autosales.com.mt

Auto Sales Limited and Renault SAS, its parent company, share some liabilities depending on the purposes for which your personal data are processed. Renault SAS is located in France, 13/15 quai le Gallo 92100 Boulogne-Billancourt. Contact details of its data protection officer (DPO) are the following: Renault SAS, Direction juridique – Délégué à la protection des données, 13/15 quai le Gallo 92100 Boulogne-Billancourt and dpo@renault.com.    

We may collect personal information from you where you fill in any forms on any of our brand websites. We may also collect your information where you make enquiries or correspond with us by phone, email or otherwise. The purposes for which we use your information and the legal basis under data protection laws on which we rely to do this are as follows:

• It is necessary for the performance of the contract with you or to take steps to enter into it. This includes information that we collect and process: in order to enable you to make use of any of our brand websites, o in connection with a contract concerning connected vehicles; o where you purchase any service plan or extended warranty; or o for the purpose of any other services we provide to you through our brand websites or otherwise.
• It is necessary for our legitimate interests or those of a third party such as breakdown or insurance providers, where you have said you would like to receive such services. These include: analysis to inform our marketing strategy, and to enhance and personalise your customer experience; o creating a profile of you to determine what products and services you may be interested in for direct marketing purposes; o operating our loyalty schemes; o responding to online enquiries (including but not limited to test drive, brochure and part exchange valuation enquiries) o customer satisfaction or market research surveys; o for product development, statistical analysis market research in order to continually improve the vehicles and/or services that we deliver to you (however you can ask us not to contact you for this purpose at any time); o marketing activities (other than where we rely on your consent) e.g. following up on marketing leads, sending you renewal reminders, tailoring marketing communications or sending targeted marketing messages via social media and other third parties; o advising you about the products and services that we are providing to you in response to a request from you about this o prevention of fraud and other criminal activities; o to verify the accuracy of data that we hold about you and create a better understanding of you as a customer; o to correspond or communicate with you; o monitoring communications between us (calls, letters, emails and texts) to prevent and detect crime, to protect the security of our communications, systems and procedures, and for quality control and training purposes o network and information security in order for us to take steps to protect your information against loss or damage, theft or unauthorised access; o to comply with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this on our suppression lists in order to be able to comply with your request); o assess and improve our service to customers through recordings of any calls with our contact centres; o providing you with customer service, including answering questions and responding to feedback and complaints o for management and audit of our business operations including accounting and analysis of orders placed via our website
  
• It is necessary for compliance with a legal obligation. This includes when you exercise your legal rights under data protection law, to verify your identity, for the establishment and defence of our legal rights, for activities relating to the prevention, detection and investigation of crime, to conduct credit, fraud prevention and anti-money laundering checks and for compliance with our legal and regulatory responsibilities.
  
• You have given us your consent to use it for direct marketing communications (by us, the RCI Group your Dealer and the other third parties listed at the end of this notice).For the avoidance of doubt, your data will only be shared with RCI for marketing purposes if you have indicated an interest in finance. Please see ‘Marketing’ below for more information on marketing, including details on how to stop receiving marketing communications.

 When we send you marketing information, we make sure to send you information that fit your needs or that are really of interest to you. Indeed, thanks to your personal data you provided to us directly or via or one of our partners, or that we collect automatically (when you visit our websites or use our mobile applications), we create a profile of you which allows us to assess and predict as well as possible your personal preferences and/or interests for our products and services. Better knowing you helps us improving your satisfaction. More generally speaking, we undertake to collect only the personal data that are necessary for each purpose for which we process your data. Your information is provided to us voluntarily. However, where you complete a sales enquiry, lead form or order a vehicle through one of our brand websites, and do not provide us with required information that we request from you (indicated by a star (*)), we will not be able to proceed with your online enquiry or order. 

We undertake to keep your personal information for no longer than is necessary for the purposes for which we process them, in accordance with the regulations. In order to calculate the retention period of your personal data, we use notably the following criteria:

• The duration of your contract, if you have entered into such contract with RENAULT,
  
• The time required to proceed your request or your claim,
  
• The duration for which your user account is opened, unless you have been inactive for 3 years,
  
• Your reactivity to our marketing information,
  
• The need to keep a record of your interactions with us, for a good management of our commercial relationship,
  
• Our legal or regulatory obligations.
  

We may have to keep some of your personal data for a longer duration, in an archive file, in order for us to be able to defend in a legal action, until the end of the statute of limitation provided by applicable law. 

• Companies and consultants providing services to us (for example, marketing agencies, mail outsourcing service providers, information technology service providers who provide and maintain our systems and our website host). Those companies and consultants providing services to us will only use your information to provide those services to us;
  
• Other members of the Renault group for product development, statistical analysis and audit purposes;
  
• Credit/debit card payment processors (including WorldPay);
  
• RAC, AXA or other provider of services directly to you;
  
• A purchaser or potential purchaser of our business or otherwise in the event of a merger, re-organisation or similar event;
  
• Any associated or connected motor manufacturer from whom we purchase or hire goods (and their group companies).
  
• Third party insurance providers.
  
• Credit reference and fraud prevention agencies to help us make credit decisions and fraud prevention checks (they may also share information about you with us).
  
• Debt collection agencies.
  
• The police, fraud prevention and identity authentication entities, other law enforcement agencies, government and tax authorities in Malta or abroad in order to detect, investigate and prevent crime (please note that fraud prevention agencies may also enable law enforcement agencies to access and use your information to detect, investigate and prevent crime).
  
• The courts Malta or abroad as necessary to comply with a legal requirement, for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations.
  

 As far as possible, we store your information on servers located within the European Economic Area (EEA). However, if some of our services providers are located outside of the EEA, your personal information will therefore be processed in those countries. Some of those countries may have a different regulation on data protection than the European Union. In such cases, we pay special attention to make such transfer compliant with applicable regulation and put in place equivalent safeguards with respect to the protection of your privacy, fundamental rights and freedoms to the ones offered by the European Union (notably by using Standard Contractual Clauses of the European Commission). Upon written request sent to the address mentioned in the below section “Your rights”, we may provide you with further details on those data transfers (especially the Standard Contractual Clauses of the European commission). Finally, we may have to share your personal data with third parties as necessary to comply with a legal obligation or administrative or judiciary decision. 

• To request access to your information, in other words to receive a copy of them,
  
• To have your information corrected, if it is inaccurate or not up to date, which will help us to comply with our obligation to have up-to-date information about you,
  
• To have your information erased (also known as the right to be forgotten), although such right might be limited in view of our contractual or legal obligations,
  
• To receive a copy of your information in a structured, commonly used and machine-readable format, and transmit it to another data controller (also known as the right to data portability),
  
• To object to processing of your information, on grounds relating to your particular situation, and to restrict processing of your information, in the cases provided by the regulation,
  
• To object to marketing information (notably when profiling is used), you can unsubscribe by using the unsubscribe link in the email we send you,
  
• To withdraw your consent at any time, for the purposes for which we collected your consent
  

To exercise any of these rights, you may contact us, providing a proof of your identity, by email at dataprotectionofficer@autosales.com.mt , by post at:   

Data Protection Officer
Auto Sales Limited
Mosta Road
Lija LJA9011
Malta   

You can unsubscribe from receiving our mailings at any time by sending a request to the above. Finally, you have the right to lodge a complaint with the Information Commissioner’s Office about the processing of your personal data. We encourage you to contact us before making any complaint and we will seek to resolve any issue or concern you may have. 

The purpose of Regulation (EU) 2023/2854 (the "Data Act"), which enters into application on 12 September 2025, is to foster innovation and economic growth in the EU by facilitating the flow of data generated by connected products and related services.

Under the Data Act, users of connected products and related services have a righttoaccess some of the data generated by these products and services and a rightto share this data with third parties.

For example, users of connected vehicles manufactured by Renault could, under certain conditions, have access to odometer data extracted from their vehicles and available on Renault's server in order to share this data with their mechanic or insurance company.

This Policy reflects the application of rules from the Data Act to the relevant activities conducted by Renault Group.

A connected product is a product (such as a vehicle) that obtains, generates or collects data concerning its use or environment and is able to communicate this data via an electronic communications service, physical connection or on-device access (e.g. Wi-Fi, Bluetooth, or a mobile internet network). Products whose primary function is the storing, processing or transmitting of data on behalf of a party other than the user (e.g. servers operated entirely on behalf of third parties) are excluded from this definition.

For example, a vehicle built by Renault of which certain data can be viewed via the mobile application My Renault or any other electronic method qualifies as a connected product. 

A related service is:
- a digital service other than an electronic communications service (for example, an internet service provider),
- connected to the product at the time of purchase, rental, or lease, and
- essential to performing one or more product functions.

A related service can also be a service that is connected to the product at a later date by the manufacturer or a third party to add to, update, or adapt the functions of the connected product.

For example, remote charge programming and temperature control via the My Renault application qualify as connected services.

This Policy applies:
- to Renault, or potentially one of its subsidiaries, where Renault and/or the subsidiary is a data holder as defined by the Data Act (hereinafter "Renault", "we" or "us")
- to any user of connected products or related services for which Renault holds the data within the meaning of the Data Act, and
- any third party designated by a user to receive readily available data from Renault (the "third party" or, where the third party acts in a professional capacity, the "data recipient", it being specified that the data recipient may also receive data from Renault pursuant to another legal obligation).

Renault qualifies as a data holder where it has the right or obligation to use data and make it available pursuant to a legal or contractual obligation.

A user is any natural or legal person:
- who owns a connected product, such as a connected vehicle or charging station manufactured by Renault, or
- to whom temporary rights to use a connected product have been contractually transferred (e.g. as part of a rental or lease), or
- who receives a related service.

The Data Policy defines the rights and obligations of data holders, users, and third parties (including data recipients) under the Data Act.

Where appropriate, the Policy is supplemented by special provisions in the contracts entered into between Renault, users, and third parties. If any of those provisions conflict with this Policy, the contractual clause prevails.

This Policy supplements our privacy policies. In case of conflict between this Policy and our privacy policies, our privacy policies prevail.

Users may access:

- personal and non-personal data generated through the use of a connected product (such as a connected vehicle made by Renault) where that data has been designed to be retrievable by a user, data holder, or third party via an electronic communications service, physical connection, or on-device access (e.g. odometer data from the connected vehicle);

- personal and non-personal data representing user actions or events related to the connected product that were intentionally recorded by the user or are a by-product of the user's actions during the provision of the related service (eg. a request for remote charging via the My Renault application); and

- the metadata relevant and necessary to interpret and use this data (e.g. the time and date of each piece of reported data).

Users only have access to this data to the extent Renault has lawfully obtained or can lawfully obtain it from a connected product or related service, without disproportionate effort going beyond a simple operation (hereinafter "readily available data").

Users also only have access to "raw" or "primary" data, i.e. data points that have been automatically generated without any type of processing other than to make them useable and understandable. Users do not, however, have access to any "derived" data that results from an additional effort by the data holder (to enhance the raw data, in particular through the use of complex algorithms).

Lastly, there are specific rules listed below for certain types of data:

Below is a non-exhaustive list illustrating the type of data that may be generated from using connected vehicles and related services.

Please remember that the list only contains data already generated by the vehicle, which depends on the following (without limitation):
- the version, equipment, type of use, and changes to and reservations of digital services;
- services that you have activated in your vehicle;
- choices you made in the confidentiality settings for your vehicle.

We would like to remind that the examples of data listed below refer only to "raw" or "primary" data generated without any processing other than as needed to make it useable and understandable.

Starting on 12 September 2025, users will be able to view the different types of data generated by the connected vehicle and related services via the platform Mobilize Data Solution: https://datasolutions.mobilize.com/home

The procedure for accessing this data will be communicated to users at a later date, as soon as the access will be available.

If a user satisfies the applicable legal requirements, we will disclose readily available data and related metadata:

- without undue delay after the data has been made available to Renault,
- that is of the same quality as is available to Renault,
- easily and securely,
- in a comprehensive, structured, commonly used and machine-readable format (e.g. API or Streaming),
- where relevant and technically possible, continuously and in real time.

All user requests for data disclosure are free of charge.

Once users have been informed of the procedures for accessing the data, they will also be able to ask Renault to share readily available data with a third party, as well as metadata they are entitled to access under the Data Act. Third party access will also be provided without undue delay, and the data will be of the same quality as is available to Renault, easily and securely accessible, in a comprehensive, structured, commonly used and machine-readable format. However, third parties will have to pay a compensation to Renault, if applicable (see paragraph 14).

For example, users will be able to ask Renault to share readily available data generated by their connected vehicle with their mechanic or insurance company.

The user's data sharing request can involve any third party except for undertakings designated as a "gatekeeper" under the EU Digital Markets Act, such as Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft.

Users may not share readily available data with third parties in the context of the testing of new connected products, substances or processes that have not yet been placed on the market, unless such third party use is contractually permitted.

Starting on 12 September 2025, third parties will be able to view the different types of data that may be generated by the connected vehicle and related services via the platform Mobilize Data Solution: https://datasolutions.mobilize.com/home


Third parties will be able to obtain information about the conditions and procedures for accessing data by contacting Renault using the form available on the Mobilize Data Solution platform. Access will be available at a later date.

Third parties must process data solely for the purposes and under the conditions agreed with the user and in compliance with personal data protection laws.

Third parties must erase data that is no longer necessary for the agreed purpose, unless otherwise agreed with the user with respect to non-personal data.

Third parties may not:
- make it difficult for users to exercise choices or rights, including by offering biased or coerced choices, deceiving or manipulating users, or impairing their autonomy, decision-making, or choices, including by means of a digital interface;
- use the data they receive for profiling, unless profiling is necessary in order to provide the service requested by the user and they comply with the GDPR;
- make the data they receive available to another third party, unless this is provided for in an agreement with the user and on condition the other third party takes all necessary steps agreed between the data holder and the third party to secure the confidentiality of trade secrets;
- make the data they receive available to a gatekeeper as defined by the EU Digital Markets Act;
- use or share the data they receive to develop a product that competes with the connected product from which the accessed data originates;
- use the data they receive or obtain information about Renault's economic situation, assets, or production methods or about the use Renault makes of that data;
- use coercive means or exploit any potential gaps in Renault's technical infrustructre aimed at protecting the data in order to gain access to that data;
- use the data in a way that adversely impacts the security of the connected product or related service;
- disregard the protections for confidential information and trade secrets agreed with Renault, or the trade secrets holder, and the user;
- prevent users who are consumers from making the data available to other parties.

The protection measures listed above also apply to (i) users or data recipients who alter or remove technical and organisational measures implemented by Renault or who do not maintain the measures to protect trade secret data implemented by the user or by the trade secret holder (if different) in agreement with Renault, and (ii) any other party receiving the user's data further to an infringement of the Data Act.

Users may also rely on the above protections if a data recipient makes it unduly difficult for the user to exercise their choices or rights, or uses the data received for profiling, unless profiling is necessary to provide the service requested by that user.

Users must:

- use the data solely for the purposes and in accordance with the law and the terms agreed with Renault,

- comply with protection measures agreed with Renault to preserve the confidentiality of shared data,

- not use the data obtained from Renault to develop a product competing with the connected product from which the data originates, and from sharing that data with any third party for the same purpose,

- not use the data to obtain information on Renault's economic situation, assets or production methods,
- not use coercive means or exploit potential gaps in Renault's technical infrastructure aimed at protecting the data in order to gain access to that data, and
- not share the data with third parties designated as "gatekeepers" under the EU Digital Markets Act.

In business-to-business relationships, Renault makes data available to data recipients on terms and conditions that are fair, reasonable, non-discriminatory and transparent.

Renault does not discriminate between comparable categories of data recipients in the terms and conditions for making data available. If a recipient considers that data has been provided on discriminatory terms and submits a reasoned claim to that effect, Renault will provide information demonstrating the lack of any discrimination without undue delay.

Renault does not use unfair contract terms within the meaning of the Data Act, or clauses that exclude, derogate from or vary the effects of the application of user's rights under Chapter II of the Data Act.

Renault only makes data available to a data recipient, including on an exclusive basis, if asked to do so by a user under Chapter II of the Data Act.

Renault and data recipients are not required to provide any information beyond what is necessary to verify compliance with the contract terms agreed for making data available or with their obligations under EU law and national law adopted in accordance with EU law.

Renault can require compensation from the data recipient for making the data available at the user's request. This compensation is non-discriminatory and reasonable, and may include a margin.

Compensation takes the following into account:

- costs incurred to make data available, including the costs necessary to format, electronically disseminate, and store the data;
- investments in collecting and producing data, where applicable, after taking into account whether other parties helped obtain, generate, or collect that data;
- the volume, format, and nature of the data.

However, the compensation charged by Renault cannot exceed the costs referred to in the first bulleted line above if the data recipients are SMEs or non-profit research organisations without any partner enterprises or linked enterprises that do not qualify as SMEs.

Renault will provide data recipients with sufficiently detailed information showing the basis for calculating compensation so the data recipient can determine whether the above requirements have been satisfied.

If you have a claim, please contact Renault using the form provided on the Mobilize Data Solutions platform (https://datasolutions.mobilize.com/contact-us).

We will endeavour to answer and process your requests as soon as possible.

If you are not satisfied with our response, you may apply to the designated forum for dispute resolution, without prejudice to your right to seek a remedy in the French courts.

The dispute resolution forum is competent to address claims pertaining to:
- contractual restrictions or prohibitions involving connected product security requirements or refusals or suspension of data sharing to protect data confidentiality;
- fair, reasonable, and non-discriminatory terms and conditions applying to the provision of data and the transparent method of making that data available in accordance with Chapters III and IV of the Data Act.