1. DATA CONTROLLER

This is the Privacy Policy of OK MOBILITY ESPAÑA, S.L.U. (hereinafter, “OK MOBILITY”), a company belonging to OK MOBILITY GROUP, with Tax ID (CIF) B-57334609 and registered address at Avda. Gran Via Asima, 36, Polígono Son Castelló, 07009 – Palma de Mallorca. OK MOBILITY ESPAÑA, S.L.U. is the Data Controller responsible for processing your personal data.

This Privacy Policy provides relevant information about how OK MOBILITY processes your personal data when you request information, when OK MOBILITY purchases a vehicle owned by you, when you make a reservation and/or purchase a vehicle owned by OK MOBILITY, including associated products and services, as well as sales and after-sales services.

It is important that you read this Privacy Policy carefully to understand how we process your personal data.

This Privacy Policy may also apply to third parties if you provide us with information or personal data relating to such third parties, for example, in case you authorize a third party to collect the vehicle on your behalf.

2. COLLECTION OF YOUR PERSONAL DATA

OK MOBILITY may collect your personal data or that of third parties through various channels:

• Personal data provided directly by the customer, via OK MOBILITY’s website, its App, the Customer Service department, or at our dealerships (hereinafter, the “Showrooms”), when requesting information about a vehicle, making a reservation and/or purchasing a vehicle, including related products and services, during the sales process, and thereafter (for example, when using after-sales services or submitting complaints or information requests through OK MOBILITY’s Customer Service) as well as in the event of the sale to OK MOBILITY of a vehicle owned by the data subject.
• Personal data provided by third parties: at times, OK MOBILITY may combine the personal information you provide with other information received from other sources and/or third parties. Such information may include any data relevant to providing you with information about a vehicle, managing the vehicle purchase and/or its sale and any related products and services, as well as handling after-sales procedures. These third parties may include, for example:
• Third-party websites where OK MOBILITY’s vehicles are promoted.
• OK MOBILITY partners who promote and/or market OK MOBILITY vehicles and related products or services associated with their sale.

In the event that you visit a dealership of a third-party partner (Showroom), it will provide OK MOBILITY with your personal data, who will process your personal data in accordance with the provisions set out in this policy.

• OK MOBILITY partners who offer their services, such as vehicle valuation companies.
• Financial institutions offering OK MOBILITY vehicles to their customers.
• Financial institutions providing financing services related to the purchase of a vehicle from OK MOBILITY.
• Insurance companies providing services to OK MOBILITY customers.
• Public administrations.

Please note that some of your personal data may be mandatory to fulfil the purposes of processing, as well as OK MOBILITY’s legal obligations. You can identify these mandatory data fields on the web forms as those marked with an asterisk (*). They may also be requested when contacting our Customer Service department. You are responsible for ensuring that the personal data you provide is accurate and up to date. If you do not provide the mandatory personal information requested, we will not be able to provide the information requested and/or complete the reservation, purchase or sale of the requested vehicle, nor will we be able to offer you after-sales service, as applicable.

3. CATEGORIES OF PERSONAL DATA AND OTHER INFORMATION

• Identification data: e.g., first name and surname; information contained in your identity document (type of document, document number, date and place of birth, expiry date, country and city of issuance, and any other details included in the document itself, such as your photograph where applicable), details shown on your driving licence, signature and voice. A copy of your identity document will only be requested if you apply for financing through OK MOBILITY’s partner entities and/or for administrative purposes relating to the transfer of vehicle ownership.
• Contact details: e.g., email address and other written means of communication (including message content); address; landline or third-party phone number; mobile phone.
• Financial data: e.g., payment information (anonymised or tokenised details of the credit/debit card used for payments) and bank account number. In the case of financing, your latest payslips, employment record and bank account holder certificate will be requested. The bank account holder certificate will also be requested in the event of a refund.
• Reservation and contract data: e.g., reservation number; pro forma invoice number; invoice number; vehicle details (identifier, make, model, version, colour, fuel, chassis number, registration plate, date of registration, mileage, extras and price); vehicle delivery address.
• Web and App browsing data: e.g., IP address and browsing data.
• Other personal data: e.g., details relating to a company representative or contact person (in the case of a corporate customer); vehicle insurance policy data (e.g., policy number); personal discount codes and promo codes; membership number in OK MOBILITY’s commercial partners’ affiliation programmes.

Where a collection or delivery service is provided, OK MOBILITY will process the address where the vehicle will be delivered or collected, as well as any additional information you may provide.

Likewise, OK MOBILITY may process any other additional personal data necessary to sell you a vehicle, provide the purchased products and/or render the contracted services, or for the related procedures, provided that such personal data is necessary for the purpose of the processing.

4. PURPOSES OF THE PERSONAL DATA PROCESSING

4.1. Request for information about a vehicle

If you request information about an OK MOBILITY vehicle, OK MOBILITY or, where applicable, a partner, will process your personal data in order to provide the information requested. The personal data processed will be that necessary for this purpose, e.g., identification and contact details, as well as the information relating to the vehicle you are interested in and about which you have requested information.

We inform you that, if you authorise us to do so, OK Mobility will contact you by telephone or via the WhatsApp application. By using WhatsApp as a means of communication, the personal data processed through this application will be subject to WhatsApp's Privacy Policy (Privacy Policy)

Legal basis: your consent (Art. 6.1.a GDPR).

4.2. Request for a CARFAX® Vehicle History Report

If you request a CARFAX® Vehicle History Report through OK MOBILITY’s website form, OK MOBILITY will process your personal data to provide the report requested.

The personal data processed will be that necessary for this purpose, e.g., identification and contact details, as well as the details of the vehicle you are interested in and about which you have requested information.

Legal basis: your consent (Art. 6.1.a GDPR).

4.3. Test drive

If you request it, OK MOBILITY will process your personal data to arrange a test drive of the vehicle you are interested in purchasing.

The personal data processed will be that necessary for this purpose, e.g., identification and contact details, as well as information relating to the vehicle you have requested to test drive.

Please note that to take the test drive, you must properly identify yourself by showing your identity document and show your driving licence, so that its validity and current status can be verified.

Legal basis: OK MOBILITY’s legitimate interests (Art. 6.1.f GDPR) and performance of the contract (Art. 6.1.b GDPR).

4.4. Vehicle reservation

OK MOBILITY will process your personal data during the vehicle reservation process, for the purpose of formalising the reservation. To do so, OK MOBILITY needs to process certain personal data, such as your identification and contact details, reservation details, vehicle details, as well as financial information relating to the payment of the reservation fee.

Legal basis: performance of the contract (Art. 6.1.b GDPR).

4.5. Vehicle purchase

OK MOBILITY will process your personal data to formalise the purchase of the vehicle you intend to purchase. To fulfil this purpose, OK MOBILITY will process your identification data, contact details, financial information, reservation and contract data, and other relevant details.

A copy of your identity document will only be requested where it is essential for the agency to process the change of ownership.

The processing of your personal data to formalise the purchase includes all actions required for the proper transfer of ownership, including vehicle details, billing data and any other information required to process the change of ownership before the relevant authorities. Please note that certain administrative procedures related to the sale and transfer of ownership are carried out by external agencies providing these services to OK MOBILITY.

If you request home delivery of the vehicle, OK MOBILITY will need the delivery address, as well as contact details of the person designated to receive delivery.

Legal basis: performance of the contract (Art. 6.1.b GDPR).

In the event that you authorize a third party to collect the Vehicle on your behalf, OK MOBILITY will process the third party’s personal data in order to manage the delivery. The data processed may include, for example, their name and surname, identification document number, and address. In order to proceed with the vehicle collection, the third party authorized to collect it must properly identify themselves by presenting their identification document.

The legal basis for this processing is the performance of the contract (Art. 6(1)(b) GDPR).”

4.6. Intermediation and/or marketing of additional products and services

OK MOBILITY provides individuals interested in acquiring a vehicle with information on additional products and services related to the vehicle.
If you wish to obtain further information or contract such additional products or services (e.g., financing, insurance policy, or extended warranty), OK MOBILITY will process your personal data to provide the requested information.

Likewise, if you request financing for the acquisition of the vehicle through OK MOBILITY, OK MOBILITY may request additional information from you, for example financial information, so that the banking institutions it works with can provide you with the terms of the requested financing and assess whether to grant the transaction. This processing of personal data will only be carried out if you have requested financing through the financial institutions with which OK MOBILITY works in order to provide financing options to its customers.

In the same regard, if you are interested in taking out insurance to cover the risks associated with financing the purchase of the vehicle with insurance companies collaborating with OK MOBILITY, OK MOBILITY may request additional information from you at the request of such entities so that they can assess the underwriting of the policy.

Legal basis: your consent (Art. 6.1.a GDPR).

OK MOBILITY will inform you about these additional products and services; however, they are contracted with partner entities.

If you request OK MOBILITY’s intermediation for financing with a partner financial institution, OK MOBILITY will process your identification, contact, financial, contract and other personal data.

In the event that you request the intermediation of OK MOBILITY for the contracting of an insurance policy with an insurance company with which OK MOBILITY collaborates, OK MOBILITY will process your identification data, contact details, financial data, contract data and other personal data.

If you request to purchase an extension of the Vehicle warranty, OK MOBILITY will process your identification and contact details, and contract data (vehicle information only).

Legal basis: your consent (Art. 6.1.a GDPR).

4.7. Valuation and purchase of a vehicle

If you are interested in selling your used vehicle to OK MOBILITY, OK MOBILITY will process your personal data in order to appraise the vehicle and take the necessary steps to formalise the purchase. Specifically, it will process: your identification details, contact details, financial details, booking and contract details, as well as other data.

You will only be asked for a copy of your identification document if it is essential for the agency to process the change of ownership of the vehicle.

Legal basis: performance of the contract (Art. 6.1.b GDPR)

4.8. Sending customer satisfaction surveys

OK MOBILITY sends satisfaction surveys to its customers to evaluate their experience in connection with the vehicle purchase and/or contracted products and services. OK MOBILITY also analyses the most in-demand services and products and identifies potential improvements to its processes, products and services.

Legal basis: OK MOBILITY’s legitimate interests (Art. 6.1.f GDPR).

4.9. Handling queries and complaints

You may contact OK MOBILITY to resolve queries and to lodge complaints regarding the vehicle. If you submit a query or complaint, OK MOBILITY will process your personal data to manage and resolve it.
Calls made to OK MOBILITY’s Customer Service may be recorded to improve service quality and for internal training purposes.

We inform you that, if you authorise us to do so, OK Mobility will contact you by telephone or via the WhatsApp application. By using WhatsApp as a means of communication, the personal data processed through this application will be subject to WhatsApp's Privacy Policy (Privacy Policy)

Legal basis: performance of the contract (Art. 6.1.b GDPR) and OK MOBILITY’s legitimate interests (Art. 6.1.f GDPR).

4.10. Breach of Contract or Law

OK MOBILITY will process your data for purposes associated with any potential breach of contract and of the law (e.g., failure to meet your contractual obligations or violation of traffic regulations during the test drive).

Legal basis: performance of the contract (Art. 6.1.b GDPR) and compliance with a legal obligation (Art. 6.1.c GDPR).

4.11. Sending of marketing communications

OK MOBILITY may process your data to send marketing communications, e.g., special offers or discounts on OK MOBILITY products and/or services, invitations to follow OK MOBILITY on social media, participation in contests, prize draws and other promotions, or promotional communications. These may be sent by email, SMS, push notifications or post. For such actions, OK MOBILITY may rely on database segmentation to tailor and personalise promotions and benefits.

OK MOBILITY may send you:

• Marketing information about OK MOBILITY promotions and offers related to the sale of vehicles or of potential interest to you. Legal basis: OK MOBILITY’s legitimate interests (Art. 6.1.f GDPR) and pursuant to Art. 21.2 of the LSSI (Spanish Law on Information Society Services).
• Marketing information via any channel about offers and promotions concerning other products and services of companies belonging to OK MOBILITY and OK GROUP. Legal basis: your consent (Art. 6.1.a GDPR).
• Marketing information via any channel about offers and promotions concerning products and services from OK MOBILITY business partners. Legal basis: your consent (Art. 6.1.a GDPR).

You may object to this processing of your personal data or revoke your consent by contacting OK MOBILITY by post at Avda. Gran Vía Asima, 36-A, 07009 Palma de Mallorca (Spain), or by email at rgpd@okmobility.com.

4.12. OK MOBILITY management processes

OK MOBILITY may process your personal data to ensure the effective administration and management of the company and its relationship with customers.

OK MOBILITY also takes actions to protect its business against fraud (e.g., verifying fraud or verifying the identity of the contracting party) and non-payment, among others, which may require personal data processing.

In line with the foregoing, OK MOBILITY may process your data to protect its facilities and systems in the protection and defence of the rights pertaining to the Group and its employees.

Legal basis: OK MOBILITY’s legitimate interests (Art. 6.1.f GDPR).

4.13. Compliance with OK MOBILITY’s legal obligations

To comply with any legal obligation applicable to OK MOBILITY, it may be necessary to process personal data. For example, to respond to information requests from Authorities or Law Enforcement agencies; to make mandatory incident notifications to competent authorities; and to establish, exercise or defend legal claims arising from such incidents.

Legal basis: compliance with a legal obligation applicable to OK MOBILITY (Art. 6.1.a GDPR, as stated in the original text).

4.14. Website and App operation

OK MOBILITY uses analytics software such as AB Tasty, Clarity, Google Analytics, among others, to better understand the functionality of its software on its Websites and Apps on your device. These tools record technical information including, by way of example, information about your device together with usage information such as the frequency with which you use our website or App, the features you use or do not use on the website, which pages you visit, aggregate usage, performance data, when the App was downloaded, and information about your visit to the site, including clickstream details to, through and from our website (URLs). Please refer to our Cookies Policy for more information.

In short, the purpose is to understand how users use OK MOBILITY’s websites and applications, detect any issues related to such use and improve the user experience.

Accordingly, when you use OK MOBILITY’s website and App, technical information about your devices will be collected whenever permitted.

Legal basis: OK MOBILITY’s legitimate interests (Art. 6.1.f GDPR) or your consent (Art. 6.1.a GDPR).

5. DATA RECIPIENTS

Personal data processed by OK MOBILITY may be disclosed to the following recipients:

• OK MOBILITY GROUP, S.A.U. and other companies within OK MOBILITY GROUP, for any necessary procedures, e.g., managing the reservation and purchase of the vehicle and associated procedures (including additional products and services), after-sales service, and any formalities required for OK MOBILITY’s operations. Your personal data may also be disclosed if you have given your consent.
• Partner companies, in the context of:
  • The purchase of the vehicle through third-party intermediaries.
  • Managing the vehicle transfer (e.g., agencies responsible for processing vehicle ownership changes), as well as for the provision of sales and after-sales services.
  • Managing the appraisal of the vehicle (e.g. companies that carry out vehicle valuations)
  • Collaboration with third-party buyers of used vehicles (e.g. in case you are willing to sell your vehicle to such third-party).
• Financial institutions, if you have requested financing through OK MOBILITY.
• Insurance companies, insurance intermediaries, actuaries and/or brokers, if you have requested insurance through OK MOBILITY.
• Transport companies, if you have requested home delivery of the vehicle.
• Lawyers and legal advisers, e.g., for the defence of our interests or to file claims.
• Public authorities, in compliance with legal obligations, including national, regional and local Public Administrations; Law Enforcement authorities; Courts and Tribunals; and/or the Public Prosecutor’s Office.

OK MOBILITY works with service providers who, acting as data processors, may access and process your personal data (e.g., administrative agencies handling change-of-ownership procedures). OK MOBILITY has entered into the contracts required by law with these providers to ensure the appropriate protection and confidentiality of your personal data.

6. INTERNATIONAL TRANSFERS

Your personal data may be subject to international transfers, and may be processed outside the European Economic Area (EEA). If your data is transferred to such third countries, OK MOBILITY will adopt sufficient measures and safeguards to protect your personal data in accordance with applicable law.

Your data is stored in our own IT management systems and hosted in Ireland via Amazon Web Services.

In addition, given OK MOBILITY’s global nature, your personal data may be subject to international transfers to OK MOBILITY group companies located in a third country, considering the corporate activities and functions carried out by the different OK MOBILITY companies.

International transfers to a third country are made on the basis of an adequacy decision of the European Commission, where the destination country benefits from such a decision. In the absence of an adequacy decision, transfers will be subject to appropriate safeguards pursuant to Art. 46.2 GDPR. You may request copies of such safeguards by emailing rgpd@okmobility.com.

For recipients located in the United States, these will be certified under the Data Privacy Framework (DPF) or, otherwise, the transfer will be subject to appropriate safeguards pursuant to Art. 46.2 GDPR.

7. DATA RETENTION PERIOD

We inform you that the personal data processed by OK MOBILITY will be retained for as long as necessary to fulfil the purpose for which it was collected. Furthermore, once that period has elapsed, OK MOBILITY will retain the personal data you provide to comply with all legal obligations, including statutory limitation periods for potential legal actions.

In this respect, the books and documentation to be deposited in the Commercial Register will be kept for six years and the documentation related to the offsetting of tax bases for 10 years.

If you have provided your identity document for the administrative agency to process the change of vehicle ownership, it will not be retained once transmitted to the agency for that procedure. Likewise, if you provided a copy of such document to apply for financing with OK MOBILITY’s partner entities, a copy will not be retained once the procedure has been completed.

If, once the data is no longer necessary for the purpose for which it was collected, you request its erasure, the data will be blocked in accordance with data protection regulations, and will only be made available at the request of Courts and Tribunals, the Public Prosecutor’s Office or the competent Public Administrations during the statutory limitation period for any potential actions.

In any case, if at the end of the contractual relationship there are pending disputes arising from invoice challenges or collection actions, the data may be retained for the duration of such proceedings until a final resolution is reached —at which time they will be blocked and subsequently deleted—and may only be used for evidentiary purposes.

8. AUTOMATED DECISION-MAKING

The processing of personal data by OK MOBILITY does not include automated decision-making within the meaning of Art. 22 GDPR.

9. PROFILING

OK MOBILITY may process your data in certain cases through automated means, analysing specific personal aspects in order to improve its Websites and customer relationship This can allow OK MOBILITY to offer tailored information about its products.

10. YOUR DATA PROTECTION RIGHTS

Under applicable data protection law, you have the following rights regarding the processing of your personal information:

• Right of access: to request a copy of your personal information held by OK MOBILITY and explanatory information on how it is used.
• Right to rectification: to request the rectification of inaccurate personal information concerning you.
• Right to erasure: to request the erasure of personal information concerning you.
• Right to restriction of processing: in certain situations, to request that OK MOBILITY does not use the personal information you have provided (e.g., if you believe it is inaccurate).
• Right to data portability: to receive certain personal information about yourself in a structured, commonly used and machine-readable format, and to transmit it to another controller.
• Right to withdraw consent: where OK MOBILITY processes your information based on consent (including direct marketing consents), you have the right to withdraw consent at any time. This will not affect the lawfulness of any processing based on consent before its withdrawal. In addition, even after you withdraw your consent, OK MOBILITY may continue to process your personal information to the extent permitted or required by law.
• Right to object: where OK MOBILITY processes your personal information based on its legitimate interests (or those of a third party), you have the right to object. OK MOBILITY may continue to process your information if it can demonstrate compelling legitimate grounds that override your reasons for objecting, or where the processing is relevant to legal claims. You also have the right to object where OK MOBILITY processes your personal information for direct marketing purposes; this also applies to profiling to the extent it is related to such direct marketing.
• Right not to be subject to automated decisions: you have the right not to be subject to a decision based solely on the automated processing of your data, including profiling, that produces legal effects concerning you or similarly significantly affects you.

If you wish to exercise any of these rights, or if you have any questions about how OK MOBILITY processes your personal information, you may contact OK MOBILITY by post at Avda. Gran Vía Asima, 36-A, 07009 Palma de Mallorca (Spain), or by email at rgpd@okmobility.com.

If you are not satisfied with how we process your personal data, you may lodge a complaint with the competent supervisory authority: the Spanish Data Protection Agency (AEPD).

11. RIGHT TO LODGE COMPLAINTS

You have the right to lodge a complaint with a supervisory authority in the EU Member State of your residence, place of work, or place of the alleged infringement.

12. DATA PROTECTION OFFICER (DPO)

You may contact the Data Protection Officer by post at Avda. Gran Vía Asima, 36-A, 07009 Palma de Mallorca (Spain) or by email at rgpd@okmobility.com. If you are not satisfied with how we process your personal data, you may lodge a complaint with the competent supervisory authority: the Spanish Data Protection Agency.

13. UPDATES TO THE PRIVACY POLICY

OK MOBILITY may modify parts of this Privacy Policy over time; please check its content periodically. Should OK MOBILITY make a change that affects how your personal information is used, you will be notified by prominent posting on OK MOBILITY’s websites and App, by email and/or post prior to the change taking effect.

Last updated: March 2026