Privacy Policy

Valeo Personal Data Protection General Principles 
Valeo Privacy notice 

1. Who are we? 
2. What information do we collect? 
3. How do we collect personal data 
4. Who receives your Personal Data? 
5. How long do we store your Personal Data 
6. How do we use Personal Data? 
7. What legal basis do we have for processing your Personal Data? 
8. How do we share Personal Data? 
9. How do we secure Personal Data? 
10. Your rights in relation to Personal Data 
11. How to contact us? 
12. Updating of the Privacy notice 

Valeo Personal Data Protection General Principles

As a global automotive company, Valeo continuously develops and maintains relationships with
clients, suppliers, prospects, employees, candidates, students and other stakeholders. For purely
business or professional related purposes, Valeo needs to gather, store and use some of their Personal Data.
 

Valeo also develops products that may collect, use and transfer Personal Data (drivers, passengers, pedestrians….). On very rare occasions, Valeo may act as a Data Processor. This is the case, when Valeo handles personal data on behalf of others.

In any event, Valeo is committed to processing Personal Data in compliance with Data Protection
Regulations including the European Global Data Protection Regulation (GDPR) and to respecting therights of Data Subjects. A Data Subject is a human being whose Personal Data is processed.

Valeo company's policy is aimed at collecting Personal Data in a fair, lawful and transparent
way, using it for legitimate purposes only, implementing measures to protect its integrity, retaining it for no longer than necessary and fully supporting the exercise of their rights as Data Subjects.

Where Valeo needs to outsource European Personal Data Processing and/or to transfer European
Personal Data outside of the European Union, the selected Data Processors must comply with the
Data Protection laws and Valeo Data Protection Contractual terms.
They include Valeo’s requirements in terms of Data Breach, Data Subject rights or claims
management and the prohibition of using unapproved sub processors. International transfer clauses are to be signed as legally required.

When Valeo develops, engineers and manufactures products that may trigger Data Protection
obligations under the GDPR or other legislations, Valeo takes Privacy and Security by Design intoaccount at the time of engineering and developing such products. The Data Protection obligations where applicable are described in the related product Data Protection specifications, thus allowing the customer to fully understand the actions taken to comply with regulations.

To ensure the proper development and safety of our products, Valeo’s prototypes, at the stage of
engineering, have to be tested. Some of these tests and associated pilots may need to be conducted in a real life environment and may involve drivers, passengers or pedestrian data collection. Data is collected, analysed and used for testing only, in relation to the technology under development within a specific Data Protection framework meant to protect Data Subjects.

The Valeo Data Protection Statement and Privacy Notice addresses specifically and in detail the way Valeo processes Personal Data in connection with those tests and Pilots.

The above commitments are supported by the Valeo Data Protection Compliance Program that
encompasses numerous policies, procedures, tools, forms and contractual clauses as well as a
detailed training and awareness program. Valeo Whistleblowing System is also available to anyone who has reason to believe that the Valeo Data Protection Compliance Program is not being complied with or wants to report potential violations of this program in the law.
The Global Data Protection Officer can be reached for any request, question, or claim at:
dpo.external@valeo.com.

Valeo Privacy notice

The current notice aims at informing Valeo’s stakeholders and business partners of Valeo’s overall approach to Data Protection. It provides them with indication as to their rights and the way their Personal Data is processed and protected.

This notice applies to the data collected in particular as part of our contractual or pre-contractual
relationships, during the recruitment process or during some innovative products pilot or test
phases.

1. Who are we?
Valeo is a global company operating in approximately 30 countries. The full list of Valeo entities is available on Valeo.com.

Concerning your Personal Data, usually the Valeo entity you or your organisation is mainly
cooperating with, is a Data Controller. Concerning job applicants, the Valeo entity you are applying with is the Controller.

The Valeo Global Data Protection Officer is based at the Paris headquarters and can be contacted
here:

     Valeo Management                                                       Email address:
     Data Protection Officer                                                dpo.external@valeo.com
     100 rue de Courcelles
     CS 86960
      75173 Paris Cedex 17
      France

2. What information do we collect?

We collect and process the contact details and information necessary to conduct our activities and
to develop or maintain business and contractual relationships in a business to business environment.

The personal information we process mostly relates to employees, candidates, clients, suppliers,
vendors, stakeholders, journalists, intermediaries, banks or financial institutions and/or from
administrations and authorities.

We usually do not collect, nor process private life related data.

3. How do we collect personal data

We collect Personal Data most of the time, directly from our business partners’ representatives,
such as:
► Via business cards, emails
► Via invitations, conferences, events
► Via application forms, RFI, RFQ, proposals submission
► Through work orders, invoices, credit notes
► Via our internet portals or via “apps”, where visitors ask for questions, join our blogs, leave
messages, sign up for our newsletters or apply or via cookies
► Via resumes or applications

We also collect data with your consent if applicable, when users browse on or use the Valeo
Websites, via cookies about how they access or use the Website (“User Information”). The User
Information may notably include the type of browser, operating system, page displayed, the
products or services purchased, length of use and the pages previously viewed, the city and country where users are located or other unique device identification (UDI) regarding the computer, mobile device, technology or other apparatus (collectively called the “Device”) you use to access the Website. Device Identifier consists of a number automatically attributed to your Device when you access a website or its servers, which our computers use to identify your Device. Cookies are the technology used on the Website to collect User Information, including the Device Identifier. With your consent, we also collect data when users receive our professional emails via tracking pixels. Valeo’s use of cookies and tracking pixels is described in cookies policy available here.

Where we need to conduct due diligence in support of a selection process, we make sure to obtain relevant data from third party specialists and lawful sources. No automated decision is ever made on the basis of such due diligence.

We may also receive data through the Valeo Whistleblowing System which is available to Valeo
employees and to Valeo stakeholders. It is governed by Valeo’s detailed Whistleblowing procedures.

The names of the reported person and/or whistleblower and any other third parties mentioned are
kept strictly confidential. They are stored in a secured dedicated database and only shared on a need to know basis, subject to an individual Confidentiality Statement. The results of investigations are handled with the same level of care.

We may finally collect data in the context of tests and pilots of our products during their
development phases. Please, refer to the Valeo Test Cars Data Capture Privacy Notice.

4. Who receives your Personal Data?

Most Personal Data is processed and managed by Valeo employees, located in your country or in any country where Valeo operates. Irrespective of their location, all Valeo entities are subject to the Valeo detailed Data Protection Program. Some employees, such as HR employees or internal
auditors and investigators, are particularly trained and aware of the sensitivity of certain data.
Where Valeo needs to use sub contractors or Data Processors, they are bound by the necessary
terms and conditions and can only use the data for clearly identified purposes. Their employees are subject to strict Non Disclosure Agreements and training.

In some cases, data may be shared with advertising platforms to create similar audiences for targeted communication purposes. These transfers are strictly regulated and carried out in accordance with the policies of the platforms concerned (such as Meta or Google).
The data transmitted to the platforms is only used for the time strictly necessary for the technical creation of the audiences, then deleted by our partners. Your data is kept by Valeo for the entire duration of the contractual relationship, plus the duration of the legal requirements.

Where Valeo needs to transfer Personal Data outside of the European Union, all necessary
safeguards are implemented to maintain the protection of individuals’ Personal Data.
Valeo is not involved in any Personal Data transaction nor business; We do not sell personal data to third parties. As an example, if names and phone numbers have to be temporarily made available to a third party, an organiser for instance, it is temporary and for a specific reason and period of time; the third party having undertaken to destroy the Personal Data at the end of the event.

5. How long do we store your Personal Data
Valeo will keep your Personal Data in a secure environment for the time necessary to achieve the
purposes for which it was collected or during the minimum retention period provided by the
applicable legislation including civil, criminal and commercial law.

6. How do we use Personal Data?
Personal Data may be used in relation to especially:
► Providing responses to your questions or delivering marketing and events communication
► Extending and managing invitations
► Sending and processing work orders, invoices, credit notes
► Providing goods and services
► Account set up and administration
► Exchanging information on RFI, RFQ, proposals, projects, quality or maintenance matters,
etc.
► Carrying out legal obligations (e.g. prevention of fraud, anti-bribery due diligence,
economic sanctions background check)
► Meeting internal audit requirements
► Carrying out polls and surveys
► Testing products and applications under development as described below as well as new
technology and innovation
► Optimize the dissemination of online advertising campaigns,
► Manage your subscriptions to loyalty programs, newsletters and others,
► Send newsletters (technical datasheets, product launches, assembly tutorials) the content
and frequency of which are adapted to each user,
► Provide real-time technical or sales support via our chatbot.
Where you visit our websites, your Personal Data may be used within the applicable data
protection legal framework :
► To send email alerts providing you with information about Valeo
► To send a newsletter about recent events, products and services provided by Valeo
► To process questions, comments and other requests you wish to make by contacting us via
the website
► To share certain content of the website on social platforms
► For commercial and marketing purposes, such as information on Valeo products and
services by email, sms et WhatsApp
► To send polls or satisfaction surveys
► For technical purpose through dedicated technical assistance
► For the administration and technical management of the website, its functionalities and
services
► To measure the website’s audience to obtain information on visitors’ browsing
Where Valeo as a high technology automotive company that significantly invests in Research and
Development needs to design and test innovative products or technology or applications in a real
life environment, you may be involved and your data may be used in support of our research,
analysis and/or verifications:
► As an example, the attitude and behaviour of pedestrians or other drivers on a street may
be captured by cameras for analysis, learning and development of the appropriate
detection sensors in new vehicles to be sold by car manufacturers. Similarly, drivers or
passengers reactions in the car can be studied during test phases but this data will never
be related to you as an individual, nor used in relation to you, as a data subject but used
for statistical purposes in order to develop products that are adapted to the highest
number of end users.
► Valeo has developed a specific protocol to manage the related data collection, the data
transfer, the use of the data and the associated confidentiality and security measures etc.
This protocol applies to all of those who contribute or are further involved in vehicle
testing.
► We may implement certain techniques known as profiling, i.e. automated processing of your
personal data intended to analyze or predict your preferences, interests or behaviors. To do
this, we use the data we have collected about you in the various scenarios mentioned above to
identify, within our databases or those of our partners (social networks, search engines or
other partners with whom we have entered into a contract), people with characteristics or
interests similar to yours, in order to offer them content likely to interest them. You can object
to this type of processing at any time by contacting us at the following address: [insert
contact].

What we usually do not do: We usually do not use profiling tools followed by automated decision-
making; we do not sell Personal Data.

7. What legal basis do we have for processing your Personal Data?

We generally collect and process Personal Data to support our business and/or contractual
relationships. We may have legal obligations to fulfil, such as issuing invoices.
We also have legitimate interests in processing Personal Data such as developing business with new clients, promoting new offerings and technologies. Also, ensuring compliance with international regulations such as export control or anti-bribery by carefully selecting our agents or intermediaries.

In addition, assessing the reliability of our products in a real-life environment in order to comply with our obligations relating to product safety.

Finally, and where so required, we obtain consent from the Data Subject we interact with, especially our web site visitors. You can withdraw and manage your consent as described in section 10.

8. How do we share Personal Data?

Valeo is and acts as a global company. As a result, some data may be shared with other Valeo
companies for processing. Such data will be subject to the Valeo Data Protection Compliance
program and will be treated with the same level of care and attention throughout the Valeo
organisation. To this end, Valeo has signed an internal data sharing agreement (Data Transfer
Agreement).

Where Valeo needs to outsource data processing to a third-party provider, the Data Processor is
carefully selected, data processing agreements and international data transfer clauses both
consistent with the Global Data Protection Regulation are duly signed.

Where required by law or contract or where Valeo has a respective legitimate interest, Valeo from
time to time may share your data with further external third parties, such as e.g. public authorities, consultants and auditors.

9. How do we secure Personal Data?
We are committed to ensuring data security, confidentiality and integrity.
Our Global Data Protection Compliance Program includes programs, controls and relevant policies, procedures and guidelines that help us develop and maintain cultural, organisational, physical and technical security measures.

The program includes:
► The Valeo Data Protection General Policy
► The Valeo Business Partner Code of Conduct under which business partners and providers
must commit to treat Personal Data as confidential information
► The Data Processor policy which imposes to Data Processors contractual terms consistent
with the European regulation
► The Valeo Policy for International Transfer of Personal Data with International transfer
clauses which are mandatory in case of the transfer of data outside of Europe
► The Valeo Personal Data Breach Notification Procedure
► A test and pilot products data use protocol
► Non Disclosure Agreements
► Mandatory training programs
► Tools and methods
► Audits and controls (including HR Policies relative to Payroll and Internal control rules)

The program is supported by a Global multidisciplinary team.
In addition, the Data Protection Office, the Information Security Office and the Information System

Department collaborate closely to provide adequate security to the Personal Data we process.
As an example, we have specific measures and plans:
► To protect data against accidental loss
► To prevent unauthorised access, use, destruction or disclosure
► To ensure business continuity and disaster recovery
► To restrict access to personal information
► To conduct privacy impact assessments in accordance with the law and your business
policies
► To train staff and contractors on data security
► To manage third party risks, through use of contracts and security reviews

We also have:
► Valeo Internal Security Policy
► Valeo Confidentiality Image and Social Media Policy
► Valeo IS Security Policy applicable for external partners
Please note this list is not exhaustive.

10. Your rights in relation to Personal Data
Your first right is to not provide Valeo with personal information. Please note that refusing to
provide certain Personal Data may prevent us from fulfilling our obligations or limit your use of the
Website and its functionalities and Services if such Personal Data are necessary for such use.
Where the collection of data results from on the road recordings, the recording vehicle provides
adequate notices to the Data Subjects which allows them to access the relevant privacy notices issued by the Valeo Group and understand further the purpose of such data collection and how it is processed.

As per GDPR, you also have the right to request:
► Access to personal information: you can ask to access the following information:
➢ The purposes of the processing
➢ The categories of the personal data concerned
➢ The recipients, or categories of recipients, of the data, if any, in particular any third
party countries or international organisations
➢ The length of time that the personal data will be stored for (or the criteria used to
determine that period)
➢ Whether the Personal Data will be subject to automated processing, including profiling
and, if so, the logic and potential consequences involved
➢ Where the data is transferred to a third party country or international organisation,
information about the safeguards that apply; Information about the source of the
data, if not directly from the data subject
► Withdrawal of consent: You may withdraw your consent any time without having to name
any reasons, but with effect for the future only.
➢ If we are processing your personal data on the basis of legitimate interests, you are
entitled to contradict such processing anytime for reasons of your specific situation.
The same applies for any potential profiling based on our legitimate interest. We will
then no longer process your data except in situations where we need to process
your data for reasons outweighing your interests. The same applies when your data
is processed for purposes of addressing, implementing or defending legal claims.
➢ Should we process your data for direct marketing purposes, you may contradict at
any time and without having to name any reason. The same applies for any direct
marketing based on profiling. As soon as you have issued your contradiction, we will
no longer process your data for direct marketing purposes.
► Correction of your personal data: where personal data is inaccurate you have the right to
request/claim that it be corrected and that incomplete Personal Data be completed based
on information you may provide
► Erasure, also known as “the right to be forgotten”: you have the right to require to erase
Personal Data without undue delay where one of the following applies:
➢ The Personal Data is no longer necessary for the purpose for which it was collected
➢ Consent is withdrawn and there is no other legal ground for processing
➢ The data subject objects to the processing of the Personal Data
➢ The Personal Data has been unlawfully processed
► Processing restriction: you can exercise the right to a restriction of processing of your
Personal Data in one of the following circumstances:
➢ You contest the accuracy of the data
➢ You need the data for legal claims

► Automated decision: you have the right to not be the subject of automated decision-
making where the decision has a significant effect on you, and can insist on human
intervention
► Data portability: you have the right to request/claim that your Personal Data be provided
to you in a “structured, commonly-used and machine-readable format” and to transfer
that data to another party e.g. service provider. This applies to personal data for which
processing is based on your consent or the processing is carried out by automated means.
Where feasible, you can also request/claim that the personal data be transferred directly
from our systems to those of another provider
► The right of lodging a complaint with the Information Commissioner’s Office: you may
file a complaint either with Commission Nationale Informatique et Libertés (French
national privacy authority), Valeo group Data Protection Officer, or the National Agency
for Data Protection having jurisdiction in the country where you are located You can also exercise your right to oppose and unsubscribe from Newsletters using the unsubscribe
link located at the bottom of each Newsletter.

You can exercise all the rights you are entitled to as a data subject any time and without having to
name any reason to Valeo. You can address your request by writing, at our registered headquarters or preferably by sending an email to dpo.external@valeo.com.

As part of the exercise of these rights, you may be asked for a proof of identity document, and if
necessary the information needed to process your request.

Please note, that illegitimate, excessive or further objectively unfounded requests may be subject to rejection as per applicable data protection law, as all requests may not be legitimate nor satisfied.

11. How to contact us?
Should you have questions or concerns about data protection, your personal information, or should you wish to file a complaint, please contact the Valeo Data Protection Officer at:
dpo.external@valeo.com

12. Updating of the Privacy notice
Valeo reserves the right to modify this Policy at any time.
Therefore, please consult our privacy notice from time to time so as to be sure to read the latest
version we have published.