Persónuverndarstefna Nissan

At Nissan we are committed to protecting your privacy, as a priority – this means that we will make sure that any personal data you give to us by purchasing our goods and services, visiting our websites and/or our social media pages is only used for the purposes set out in this policy (hereinafter “Privacy Policy”) and in compliance with the privacy laws applicable.

The aim of this Privacy Policy is to provide you with detailed information on how we process your personal data where you purchase our goods
or services as well as your rights to protect your privacy. This Privacy Policy also applies to everyone who visits our website and social media pages.

For the purpose of this Privacy Policy, the main legal entity responsible for any personal data
you provide to us (known as a “data controller”) is BL ehf. Please note that your personal data may also be processed by Nissan Automotive Europe
S.A.S., acting as well as data controller. Both Nissan entities are referred in this Privacy Policy as “Nissan”, “us” or “we”.  

Please read this Privacy Policy carefully and should you have any questions, please contact
Nissan by sending an email to hrafnhildur@bl.is.

When you purchase our products and services, visit our websites and/or our social media pages, Nissan processes your personal data. Personal
data refers to any information that can be used to identify you either directly (such as your name) or indirectly (such as your customer number).  

The personal data we collect depends on our interaction with you and may include (but are not
limited to): 

Please note that the products and services that we offer are primarily for adults. Therefore, we do
not carry out any specific personal data processing on minors.

Any personal data we hold is collected via the purposes outlined in Section 2. We may also rely on anonymized statistical data or work with third party companies to enrich our knowledge
about you. Certain personal data may be mandatory or optional, depending on your request or your use of our products / services. Mandatory data will be marked as such at the point of collection. If you refuse to provide mandatory
data, we may not be able to provide the products / services you have requested.

We encourage you to keep us updated of any changes to your personal data, in particular by exercising your rights as further detailed in Section 5 of this Privacy Policy.

Nissan processes your personal data for the purposes listed below.

We conduct marketing activities, which notably allows us to:

·        launch marketing campaigns;

·        analyze your personal data to better understand your preferences and interests and suggest you more adapted and personalized ads or content on our websites and apps as well as on social media.

When you have given your consent to receive direct marketing electronic communications from Nissan (such as email or SMS) (e.g., when creating your Nissan account or through a dedicated form), we process your personal data to provide you with content tailored to your needs. Using your personal data allows us to know a bit more about you and helps us targeting you with personalized advertising. You can withdraw your consent at any time by using the unsubscribe link in the communications sent to you or by contacting our Contact Centre (Tel: +354 5258000 or through our contact form).

In particular, we:

·        collect and analyze the personal data you directly provided to us to build internal profiles about your interests and preferences (e.g., hybrid car rather than diesel car, a SUV rather than a city car) and keep them in our database;

·        collect and analyze the personal data provided by our business partners to enrich your profiles (e.g., age range, green profile, etc.);

·        send or display to you relevant and personalized online advertising on social media (such as Facebook or Instagram) based on your profiles. Determining your profile also enables us not to send you advertising or offers that would not correspond to your interests as well as to limit the number of times the same advertising is presented to you;

·        ask social media providers such as Meta to identify profiles similar to yours in order to create “lookalike” audiences to which relevant and personalized online advertising will be sent or displayed.

We never process special category of personal data for marketing purposes.

Please see below the legal bases on which we rely to conduct such marketing activities:

As a general rule, we are committed to holding your personal data only for the time necessary to achieve the objective pursued, to meet your needs, or to meet our legal obligations.

In the absence of applicable exceptions, we will retain your personal data:

• until the deletion of your account, or three (3) years since the last activity on your account;
  
  
• if you do not have an account, for the duration of our commercial relationship.

In addition to this, we will retain your personal data for three (3) years from the end of our commercial relationship for personal data processed for marketing purposes, five (5) years from the end of the commercial relationship for personal data retained for the proof of legal
claims, and for ten (10) years from the end of the relevant fiscal year for personal data retained for accounting purposes.

When we no longer need to use your personal data, it is deleted from our systems and records or made anonymous so that we can no longer identify you. However, it may be necessary
to archive some of your personal data in order to be able to respond to any legal proceedings, throughout the statute of limitations provided for in the applicable legislation.

We share your personal data with our partners and/or service providers in order to provide you with the services, as well as continuously improve them. We make sure that they are as committed as we are to protecting your personal data and information.

Our dealers use your personal data to provide you with a high quality service. This includes handling special requests, personalised offers, and keeping you informed of information or news.

In most cases, Nissan and the dealers will process your personal data as “independent data controllers”.

We share your personal data to social media (such as Google and Meta) for marketing purposes as described in Section 2.4. Nissan and Google
or Meta are regarded as “joint controllers” for such processing.

For instance, when you visit our Nissan Facebook
Fanpage, Nissan and Facebook jointly process your personal data (including but not limited to your username, any comments that you post, direct messages that you send to us and your activities (such as the time and date of your posts and
“likes”), via the Facebook Insights services).

Social media are solely responsible for any further
processing of your data, with no input or influence from Nissan  – please refer to Facebook’s privacy policy here: www.facebook.com/privacy or Google’s privacy policy here: https://policies.google.com/privacy, for a description of their processing activities and
information on your rights.

We share your personal data  with companies that provide services on our behalf or as as “independent data controllers”. This includes:

For all of this data sharing, we ensure that we only work with trusted companies and secure these
relationships (contracts, audits, guarantees and security tests, etc.). These companies all have strict obligations to protect your information.

We may share information with other Nissan companies and transfer it to a third party in case of a merger, reorganisation or similar event.

It may be necessary for us to disclose your personal data to public and governmental authorities for reasons of national security,
law enforcement or other issues of public importance. In particular, we may share your personal data to:

• the police, fraud prevention and identity authentication entities, other law enforcement agencies, government, and tax authorities in the European Union or abroad in order to detect, investigate and prevent crime (please note that
  fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime);
  
  
• the courts in the European Union or abroad as necessary to comply with a legal requirement, for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations.

Where legally permitted we will inform you ahead of such transfer.

We may also disclose personal information if we
determine in good faith that disclosure is necessary to protect our rights, resolve legal conflict, enforce our terms and conditions, investigate fraud or protect our users or infrastructures.

Your personal data may be processed outside of the European Union (EU) / European Economic Area (EEA) (i.e. the Member States of the
European Union from time to time, together with Norway, Iceland, Switzerland and Liechtenstein).

In particular, we share your personal data with several stakeholders (such as social media platforms located in the United States,
invoicing service providers located in Japan or our corporate affiliates located in many countries of the world, including Nissan Motor Company Limited in Japan) for the purposes set forth in this Policy.

Please note that where your personal data are
transferred to a country outside of the EU / EEA that does not guarantee a level of data protection equivalent to that of the EU, such transfer will
either:

• rely on an adequacy decision (this
  is the case for transfers to Japan or recently to U.S, with the adoption of the Data Privacy Framework) or;
  
  
• rely on appropriate safeguards such as standard contractual clauses issued by the European Commission that we undertake to implement each time, after having conducted an assessment of your rights on the territory of the third country and implemented any relevant supplementary
  measures.

We want to make sure that your personal data is stored and processed in a way which is secure. We have implemented technical and organizational measures in order to protect your personal data, in particular against potential data breaches likely to cause, either by accident or unlawfully, the destruction, loss, modification, unauthorized access or divulgation of your personal data.
These measures will guarantee a level of security adapted to the data and will take into account the state of the art and the cost of implementation in
relation to the risks and nature of the data to be protected.

We guarantee that all members of our personnel and any other person processing your personal data will respect the internal rules and procedures related to the processing of personal data, including the technical and organizational security measures put in place to protect your personal data.

You have various rights in relation to the personal data which we hold about you. You can
exercise these rights at any time by contacting us through through our DPO (hrafnhildur@bl.is).

• Right to object

This right enables you to object to us processing your personal data. If you object, we will stop using your data unless we can demonstrate compelling legitimate grounds (which overrides your interests) or if our use of your data is necessary for the establishment, exercise, or defense of legal claims. In addition, you have a discretionary right to
object to direct marketing at any time (see section 8 below).    

• Right to withdraw consent

Where we have obtained your permission to process your personal data for certain
activities, you may withdraw this consent at any time.  If you ask us to do this, we’ll stop using your data unless we consider that there is an alternative legal reason to justify our continued processing of your data for this purpose, in which case we will tell you. 

• Right to access your data

You may ask us for a copy of the information we hold about you at any time thanks to
the form abovementioned. We will respond to your request within one month. That
period may be extended by two further months where necessary, taking into
account the complexity and number of requests. We may request proof of identification to verify your request.  If you request further copies of this information from us, we may charge you a reasonable administrative cost.  Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will always tell you the reasons for doing so.  

• Right to erasure

You have the right to request that we "erase" your personal data in certain
circumstances. We would only be entitled to refuse to comply with your request
for erasure in limited circumstances and we will always tell you our reason for doing so.

• Right to restrict processing

You have the right to request that we restrict our processing of your personal data in
certain circumstances, for example if you dispute the accuracy of the personal data that we hold about you or you object to our processing of your personal data for our legitimate interests. If we have shared your personal data with third parties, we will notify them about the restricted processing unless this is impossible or involves disproportionate effort. We will, of course, notify you before lifting any restriction on processing your personal data.

• Right to rectification

You have the right to request that we rectify any inaccurate or incomplete personal data
that we hold about you. If we have shared this personal data with third parties, we will notify them about the rectification unless this is impossible or involves disproportionate effort. You may also request details of the third parties that we have disclosed the inaccurate or incomplete personal data to. Where we think that it is reasonable for us not to comply with your request, we will explain our reasons for this decision.     

• Right to portability

You have the right to request to receive your data in a structured, commonly used, and machine-readable format and or request us to transmit such personal data to a third party, acting as a data controller.

• Right to communicate your “last wills and instructions”

If you reside in France, you may communicate your “last wills and instructions” to be applied to your personal data in the event of your death (for example, their deletion or transfer to a person of your choice).  

• Right to complain

You also have the right to lodge a complaint with a supervisory authority – depending on the country where you reside (e.g., for France, you may contact the CNIL and in the
United Kingdom the ICO). We encourage you to contact us first, so that we may
attempt to resolve your problem together.

You may change your marketing preferences and stop receiving marketing communications from us (including online targeted advertising) at any time
by:   

• using the unsubscribe link in the communications sent to you or;        

by contacting our Contact Center (Tel: +354 5258000 or via our webform.

If you have any queries about this Privacy Policy, including your rights in relation to your personal data, please contact our customer services team by email at: bl@bl.is

Alternatively, you can contact our Data Protection Officer by email at: hrafnhildur@bl.is or the DPO for Nissan Europe at: dpo@nissan-europe.com. 

We may amend this policy from time to time. We will inform you and/or seek your consent whenever necessary or required. We therefore recommend that you consult this policy each
time you visit our website in order to review the latest version.

Version 02 updated on 19.03.2024.