The (joint) controller responsible for processing your personal data for the Risk Management processes specified below is:
Mercedes-Benz AG, Mercedesstraße 120, 70372 Stuttgart

Joint Controller for the development of risk instruments and internal reporting (“Reporting”), as well as for monitoring and reporting for Portfolio Risk Steering:
Data Protection Officer
Email: mbsm_dpo@mercedes-benz.com
 

Performance of Credit Decision: Depending on the size of the credit request, the decision is taken solely by Mercedes-Benz Financial Services Singapore Ltd. (“MBFS”) and Mercedes-Benz Fleet Management Singapore Pte. Ltd. (“MBFM”) (collectively referred to hereinafter as “SG Entities” and each an “SG Entity”) or jointly with Mercedes-Benz AG as Joint Controller (contact information see above).

The SG Entities and MB AG have concluded a Joint Controller Agreement. Upon request, we provide you with the essential contents of the Joint Controller Agreement.

The contact person for your data protection questions is our data protection officer:
Mercedes-Benz Group AG, HPC W079, 70372 Stuttgart, Germany data.protection@mercedes-benz.com.
 

We process personal data under the principles of data reduction and data minimization only to the extent necessary, as permitted due to applicable legal regulations, according to our obligations. Unless otherwise set forth below, the terms "process" and "processing" include, but are not limited to, the collection, use, disclosure and transfer of personal data (see Article 4 No. 2 GDPR).

The data processed for the Risk Management and Credit Decision activities mentioned below is taken from your financing or leasing application incl. corresponding documents, the Account Information Service (PSD2) or is provided by credit agencies or/and public official sources, that are requested by the SG Entities when applying for funding, and is provided by the SG Entities to MB AG:

The following data categories are processed:

• Customer number
• Customer name (only Dealer and Corporate Customers)
• Application information (such as application number, number of vehicles financed)
• Information on private customers (such as region, profession) and commercial customers (such as industry)
• Information on commercial borrowers/borrowers with Private ownership form (such as industry, region, experience in business)
• Information on management, shareholder and guarantors of commercial borrowers
• Contract data (such as contract number, term, financing product, VIN number)
• Vehicle data (such as model, list price, age of vehicle)
• Financial Statements
• Data from salary statements or the Account Information Service (PSD2)
• External credit agency files on the data subject's creditworthiness
• Information on payment history for past financing agreements

For the credit decision making and portfolio risk steering, the aforementioned data is processed with the customer name and application number.

Data processing by MB AG as the responsible party in the Mercedes-Benz group for steering all companies worldwide belonging to the segment “Mercedes-Benz Financial Services” for Risk Management, Portfolio Risk Steering and as far as the credit request exceeds the credit decision competence of the SG Entities for the Credit Decision is based on a legitimate interest under Art. 6 (1) (f) GDPR in conjunction with §§ 91 II and III, 93 I German Stock Corporation Act .

Information on the role of MB AG and the SG Entities for the data processing can be found under “Who is responsible for processing my personal data, and who can I contact on the topic of data protection?”

The purpose of those Risk Management processes is to use the data in order to create risk models, perform various analysis, make risk situation transparent and steer the segment “Mercedes-Benz Financial Services”.

Such processing includes, but is not limited to:
(1) Development of risk instruments that are used to determine customer creditworthiness, and thereby minimize the financial risk through an appropriate credit decision
(2) Calibration of risk provisioning parameter and monthly provisioning calculation as a requirement under the accounting standard IFRS9
(3) Planning activities with regards to forecasting as well as simulations of developments
(4) Risk steering of the segment “Mercedes-Benz Financial Services” which includes: calibration of risk parameter, economic capital calculation, risk adjusted profitability steering, monitoring and reporting to steer and control credit risks, assure quality of credit applications and to analyze the credit portfolio
(5) Reporting, e.g. monitoring the development of number of sales as well as financing and leasing contracts per vehicle model, monitoring of profitability, monitoring of the share of “green financing” (electric vehicles), monitoring the development of risk KPIs such as delinquencies, credit losses, provisions, quality of the acquisitions, monitoring the performance of the different risk models, etc.
(6) Market risk analysis especially interest rate and liquidity risk management for the purposes of asset and liability management
(7) Internal or external audit activities
Performance of Credit Decision: The SG Entities process as Data Controllers your data for the performance of Credit Decision within their credit decision competence, whereas MB AG provides as service provider the IT infrastructure and processes the data as Data Processor on behalf of the SG Entities. As far as the credit request exceeds the credit decision competence of the SG Entities, MB AG process as Joint Controller your data for the performance of Credit Decision.

The data is used for the calibration of risk provisioning parameters, monthly calculation of provisions and risk KPIs, forecasting the cost of credit risk as part of the plan-is comparison processes, economic capital parameter calibration and calculation, risk adjusted profitability steering, creation of various reports and dashboards and market risk analysis, such as interest rate and liquidity risk management.

MB AG builds precise risk models, makes risk situation transparent, gains specific knowledge about its portfolio, steers the company and perform efficient risk management so that the management can protect the economic interests of MB AG.

For the purposes of performing the different Risk Management activities mentioned above, the personal data processed is provided by the SG Entities to MB AG.

Auditors and IT suppliers have in certain cases also an access to the personal data.

Since MB AG provides as Data Processor the IT infrastructure to the SG Entities, the data processed within the Performance of Credit Decision and Portfolio Risk Steering is internally shared with MB Financial Services Credit Risk Department, Global Credit Committee and Heads of Mercedes-Benz Financial Services.

For the purposes of the credit check, data on creditworthiness is requested from the credit agencies. As part of the data request, customer data (such as name, commercial register no.) is provided to the credit agencies. As part of the processing, we use contractually obliged service providers, e.g. for the hosting of the data. In such cases, personal data is passed on to these processors. These processors are carefully selected and regularly reviewed by us to ensure that your privacy is protected. The processors may only use the data for the purposes specified by us and are also contractually obligated by us to treat your data exclusively in accordance with this privacy policy and the applicable data protection laws.

Your personal data might be transferred to and processed by MB AG affiliates (i.e. any member of the Mercedes-Benz Group companies) and appointed 3^rd parties both inside and outside the SG Entities.

The personal data used for the aforementioned risk management and credit decision processes is stored as long as the legitimate interest under Art. 6 (1) (f) GDPR persists. The legitimate interest ends when the contractual agreement between the data subject and the market ends. Four exceptions apply here:

(1) Retention period is prolonged if outstanding payments are expected from the customer, for example if the customer is involved in collection processes and the vehicle(s) have to be repossessed or they are stolen, etc.
(2) In accordance with the local legal regulations, booking relevant data is kept up to 10 years
(3) For the purposes of development and reporting, the data from credit checks is processed and joined with information on your payment history. In case no contract comes into force, data is anonymized upon cancellation of your application.
(4) For the credit decision, data retention will be handled in accordance with the local legal regulations, which is 7 years.

Upon expiry of the retention period, the personal data will be anonymized/deleted and hence it will not be possible anymore to trace back to the original customer.

According to EU GDPR, you have extensive rights regarding the processing of your personal data. Making you aware of these rights is very important to us:

• Right of access: You can request access to your personal data processed by us (Article 15 GDPR).
  
• Right to correction of inaccurate data: You have a right to demand from us the immediate correction of your personal data, should it be inaccurate (Article 16 GDPR).
  
• Right to deletion: You have the right to demand that we delete your personal data. The criteria allow you to demand the deletion of your personal data if we, for instance, no longer need the personal data for the purposes for which it was collected or otherwise processed, if we unlawfully process the data, or if you have rightfully objected to the use of your data, revoked your consent to the same or there is a legal obligation to delete (Article 17 GDPR).
  
• Right to restriction of processing: You have the right to demand a restriction of the processing of your data. This right especially applies for the duration of the review if you have disputed the accuracy of your personal data, as well as in the case that, for an existing right to deletion, you request restricted processing instead of erasure. Furthermore, there will be restricted processing if the data is no longer required for our purposes, but you still need the data in order to assert, exercise or defend legal rights, as well as if the successful assertion of an objection is in dispute between you and us (Article 18 GDPR).
  
• Right to data portability: You have the right to receive the personal data you have provided us with in a structured, common, machine-readable format from us (Article 20 GDPR), provided said data has not already been deleted.
  
• Right to lodge a complaint with a supervisory authority: If you feel that we are violating the GDPR by processing personal data about you, you have the right to lodge a complaint with a supervisory authority, e.g. a data protection agency responsible for your place of residence, workplace or location where the alleged data protection violation occurred.
  
• Automated decision-making: As an applicant, you have the general right under Art. 22 GDPR to have the automated decision reviewed manually. You can also present your own opinion and contest the decision. 
  

If you wish to assert one of your rights or receive more information, please contact the controller or the joint controllers and/or the data protection officer.

You have the right, for reasons arising from your specific situation, to object at any time to the processing of personal data about you (Article 21 GDPR). We will no longer process your personal data unless we can prove compulsory, legitimate reasons for processing that outweigh your interests, rights and freedoms, or if the processing is required to assert, exercise or defend against legal claims.

If you wish to object to the processing of your personal data, please contact the joint controller and/or the data protection officer. In case of an objection, however, it is possible that we will no longer be able to provide the services agreed with you or not within the agreed scope.