This Privacy Notice explains how personal data (“Data”) provided by you to – and collected by – CNH Industrial AG and CE (Pty) Ltd – (“we”, “us”, “our”, or the “Company”) through this website will be handled in compliance with the Protection of Personal Information Act (POPIA). We are committed to protecting and respecting your privacy.

1. HOW WE OBTAIN DATA

Data that may be collected, processed and stored are the following:

• Data provided by you to us in order for you to receive a specific service or as part of business relationship (such as identification and contact information, professional data,)
• browsing Data or data arising from your interacting with our website.

Ordinarily, you will have provided such Data to us, but in some cases, we may collect Data about you from a third party or from public records. We protect Data obtained from such third parties according to the practices described in this privacy notice.

2. HOW WE USE DATA

Data collected may be processed by us for the following purposes:

1. Fulfilling your requests by providing information about our products, services, offers and commercial network;
2. Pursuing our interest to establish, maintain and improve our relationship with you;

• Subject to specific consent, sending commercial communications and newsletters as well as advertising on our products and services or performing market research. All these activities could be done in hardcopy, by automated or electronic means including via mail or e-mail, phone (e.g. automated phone calls, SMS, MMS fax) and any other means (e.g. web sites, mobile apps) – “Marketing”:

1. Subject to specific consent, communicating the Data to our subsidiaries and affiliates as well as our authorized dealer and distributor network. Such partners will process Data with the purpose of sending commercial communications as well as advertising on their products and services or perform market research – “Marketing Third Party”.

Data is collected and processed on the basis of the contract under points (i), our legitimate interest for the processing under points (ii) and subject to your express consent for the marketing purposes detailed under (iii), (iv). Please be aware that, if you have given your consent, you may withdraw it at any time in writing.

Data may be processed electronically within IT systems, and manually, in paper form. Data will be processed and stored for its whole required lifecycle, ensuring security and confidentiality of the same in compliance with principles of fairness, lawfulness and transparency and in accordance with the provisions of applicable laws and regulations.

3. CONSEQUENCES OF FAILURE TO PROVIDE DATA

Submitting Data is never mandatory. However, not providing Data that is necessary to provide a service or product and that is marked as mandatory may prevent us from providing the required service or the product or may result in suboptimal provision of the required service or product. On the other hand, not providing Data whose provision is marked as optional will allow you to access the service or to receive the product in any event.

4. HOW WE SHARE YOUR DATA

We are part of the CNH Industrial Group, a global leader in the capital goods sector. Data may be shares and communicated to our subsidiaries and affiliates of the CNH Industrial Group, trusted external parties, service providers, authorizes dealers and distributors and business partners, based in and outside South Africa, which are under specific contractual obligation and may use it solely for the fulfilment of the purposes listed above.

Data may be communicated to third parties to comply with legal obligations, to operate and maintain our and the CNH Industrial Group security, protect our and the CNH Industrial Group rights or property, to respond to order of Public Authorities, or to exercise our rights before judicial authorities.

5. HOW WE TRANSFER YOUR DATA

In order to perform Data processing activities as detailed above, we may transfer Data in countries outside of South Africa, including storing such Data in digital of physical databases managed by entities acting on our behalf. Database management and Data processing are limited to the purposes of the processing and are carried out according to applicable data protection laws and regulations.

In case Data are transferred outside of the South Africa territory, the Company will use any appropriate contractual measures to guarantee adequate protection of the Data.

6. RETAINING YOUR PERSONAL DATA

We maintain Data in our systems and archives for as long as necessary to pursue the purposes described in this Privacy Notice taking into account, when applicable, legal and contractual requirements.

When Data is no longer necessary for the purposes for which it is processed, Data is deleted or kept in a form which does not permit the identification of data subjects, provided that we are not legally required or permitted to hold such Data. We may continue to store Data for a longer period, as may be necessary to protect our interests related to potential liability connected to the provision of the services or products or the processing of Data.

Data processed for Marketing purposes will be retained until you withdraw your written consent and, in any event, in accordance with the above-mentioned principles and the guidelines provided by the relevant Privacy Authorities in this respect.

7. DATA CONTROLLER

CNH Industrial AG and CE (Pty) Ltd with registered office in 14 Industrie Road, Isando, Kempton Park, 1600 is the Controller for the Data it collects, processes and stores in the framework of this Privacy Notice.

8. YOUR RIGHTS REGARDING YOUR DATA

You may exercise your rights as defined by the Protection of Personal Information Act (POPIA), among these:

• Right of access: right to obtain from the Controller a confirmation as to whether or not your personal information is being processed, and, if so, to demand to gain access to your personal data.
• Right to correction: right to obtain from the Controller the rectification of your personal data that you may consider inaccurate and to have incomplete information being completed, including by means of providing a supplementary statement.
• Right to erasure: right to obtain from us the erasure of your personal data without undue delay, where the request is made in accordance with the applicable laws and regulations.
• Right to object to data processing: right to object at any time to the processing of your personal data based on the legitimate interest of the Controller.
• Right to make a complaint: without prejudice to any other administrative or judicial dispute, if you believe the data processing has been carried out illicitly or no compliant with applicable laws and regulations, you have the right to raise a complaint with the Data Regulator of the Member Country in which you reside or work habitually, or of the Member Country where any breach has occurred.

You can exercise the abovementioned rights by contacting us as follows:

• Filling the online form you can find here: Privacy Request Form | CNH Industrial
• Writing an email to privacy-EMEA@cnh.com
• Sending a letter to the Controller at the address indicated in the section 7 of this Privacy Notice, specifying “for the attention of Privacy Compliance”.

Should you send us a request, we may need to obtain additional personal information from you to verify your identity and contact you, if necessary.

This information together with other Data we already hold, will then be processed to meet your request, as required by applicable law. Where necessary, certain information may be transferred to other companies within or outside the CNH Industrial Group that act as data processors of your Data, in order to meet your request. Your Data will be processed for the necessary amount of time to evaluate and handle your request, after which your Data will be archived for a suitable time period allowing us to

demonstrate that the request has been handled correctly and timely.

9. UPDATES TO THIS PRIVACY NOTICE

This Privacy Notice was updated in March 2024. We reserve the right to amend or update the Privacy Notice from time to time to reflect changing legal requirements or our processing activities. We will publish any update on this website and it will be effective upon posting. We encourage you to periodically review this Privacy Notice to learn how we protect your Data.