BMW Egypt.

PRIVACY NOTICE

Current Version: 1

Effective Date: November 1, 2026

Introduction

This Notice sets forth how Global Auto for Cars, S.A.E. collects, uses, stores, shares, and otherwise processes personal data relating to individuals who interact with us through our websites and mobile applications. This Privacy Notice has been prepared in accordance with the provisions of Egyptian Personal Data Protection Law No. 151 of 2020 and its Executive Regulations No. 816 of 2025.

1. Data Controller

Global Auto for Cars, S.A.E

Headquarters: 258 Al-Moltaqa Al-Arabi – Al-Nasr Street – Almaza – El-Nozha – Cairo – Commercial Register No.: 156961, Cairo Investment Commercial Registry

Data Protection Officer (DPO) Email: dpo@gac-egypt.com

2. Personal Data We Process

• Identity and Contact Data: Associated with accounts used to access our website and/or mobile applications, including name, phone number, and email address.
• Technical & Website Data: IP address, browsing data, cookies, device information, and account credentials (including username and password) for accessing our website and/or mobile application. We only use strictly necessary cookies required for the operation of the website or application; we do not use non-essential cookies such as analytics or social media cookies for this purpose.
• Communication Records: Email or telephone correspondence, and contact forms.
• Payment Details: Transaction information when purchasing through our online store via the mobile application.
• Geolocation Data: Physical location details when booking and tracking shipments made via our online store.

We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have inadvertently collected personal data from a minor under 18 without explicit written consent from a parent or legal guardian, we will delete such data from our records. Where deletion is not reasonably feasible, we will take all reasonable and available steps to anonymize the data associated with that individual.

3. Lawful Basis for Processing

We process your personal data based on the following legal grounds pursuant to Article (6) of Law No. 151 of 2020:

• Contractual Necessity: Execution of contracts based on requested services.
• Legitimate Interests: Operating, securing, and maintaining the continuity of the website, managing customer relationships, and preventing fraud.
• Establishment, Exercise, or Defense of Legal Claims: Retaining necessary documents in the event of disputes or legal proceedings.
• Legal & Regulatory Compliance: Complying with judicial rulings, investigative authority orders, or requests from Egyptian regulatory and judicial authorities.

4. Purposes of Processing

Personal data is processed for the following purposes:

• Identity verification.
• Processing and managing your requests regarding our products and services.
• Providing real-time tracking and delivery updates for online store shipments.
• Retaining copies of your correspondence with us.
• Managing our IT infrastructure and ensuring the security of our services and systems.
• Establishing, exercising, or defending against legal claims or rights, and/or assisting our customers or third parties regarding the same.
• Investigating and responding to complaints or incidents related to our business, maintaining service quality, and training employees to handle complaints and disputes.
• Ensuring compliance with our terms and conditions.
• Complying with applicable laws in the Arab Republic of Egypt.

5. Recipients of Personal Data

We may share your personal data with the following parties where necessary:

• Affiliates & Subsidiaries: Global Auto Group affiliated entities for operational and administrative support purposes.
• Service Providers: Contracted hosting providers (acting as Data Processors bound by data protection obligations).
• Payment Processors: To process payments made via the online store.
• Governmental Authorities: When mandated by law or regulation.
• Drivers & Suppliers: To facilitate the fulfillment of purchased services requested by you.
• We do not sell your personal data to any third party, nor do we use it for commercial purposes outside the scope of Global Auto Group’s services.

6. International Transfers of Personal Data

Where the provision of services requires transferring your personal data outside the Arab Republic of Egypt, we implement the following safeguards in accordance with Executive Regulations No. 816 of 2025:

• Verifying that the receiving country provides an adequate or equivalent level of data protection.
• Executing contractual agreements binding the recipient to the same standards we uphold.
• Relying on statutory mechanisms approved by the Personal Data Protection Center (PDPC).
• Obtaining cross-border data transfer licenses from the PDPC where required.

Countries to which data may currently be transferred—depending on contracted technology service providers—include, but are not limited to, European Union (EU) member states, the European Economic Area (EEA), and the United States of America. You may request a complete and updated list of countries and applicable safeguards from our Data Protection Officer at: dpo@gac-egypt.com.

7. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, or for the duration mandated by applicable law, whichever is longer.

8. Data Subject Rights

Under Law No. 151 of 2020, you are entitled to exercise the following statutory rights. The Data Controller commits to responding within six (6) business days from receipt of your request:

• Right to Information and Notification: The right to know how your data is processed, and to be notified of a data breach within three (3) business days of notifying the PDPC.
• Right of Access and Copying: The right to access your personal data and obtain a copy thereof.
• Right to Rectification: The right to request the correction or amendment of inaccurate personal data.
• Right to Erasure ("Right to be Forgotten"): The right to request the deletion of your personal data once the processing purpose is fulfilled or consent is withdrawn.
• Right to Restrict Processing: The right to restrict the processing of your data to storage only under specific conditions.
• Right to Object: The right to object to processing conflicts with your rights or causes material or moral harm.
• Right to Data Portability: The right to request the transfer of your data to another controller in a structured, commonly used, and machine-readable format.

To exercise any of these rights, please contact the Data Protection Officer using the details provided in Section 1 above.

9. Sources of Personal Data

• Directly from You: Via registration and contact forms.
• Automatically via Strictly Necessary Cookies: Browsing data and IP address upon visiting the website.
• Via Email: Copies of correspondence retained for documentation and regulatory compliance.
• Via Telephone Communications: Calls may be recorded when you contact us for purposes of documenting instructions and orders, verifying transactions, resolving complaints and disputes, improving service quality, staff training, and compliance with legal and regulatory requirements.

10. Complaints and Grievance Mechanism

A. Contacting Global for Cars, S.A.E

We encourage you to contact our Data Protection Officer (Section 1) to resolve any issue regarding your data. We will respond within six (6) business days.

B. Lodging a Complaint with the Personal Data Protection Center (PDPC)

If the issue remains unresolved, you have the right to lodge a complaint directly with the Egyptian Personal Data Protection Center:

Authority: Personal Data Protection Center (PDPC)

Website: www.pdpc.gov.eg

11. Amendments to This Notice

We review this Notice periodically. In the event of material changes, we will notify you prior to their taking effect.