PRIVACY POLICY
XPENG takes privacy issues very seriously and we are fully committed to protecting your privacy. In this Privacy Notice we describe who we are, how and for which purposes and on what legal basis we process your personal data through XPENG website and APP, how you can exercise your privacy rights and all other information that may be relevant to you. A reference to "XPENG", "we", "us" is a reference to XPENG European Holding B.V. and its affiliates involved in the collection, use, sharing, or other processing of personal data.
We did our best to provide you with all information in a clear and readable format. However, if you have any questions about our use of your personal data after reading this Privacy Notice, you can of course always contact us through the contact details provided at the end of this Privacy Notice.
This Privacy Notice may be changed over time. The last modifications to this Privacy Notice have been made on 21/08/2026
1. WHEN DOES THIS PRIVACY NOTICE APPLY?
This Privacy Notice is applicable to the processing of personal data in relation to the use of XPENG APP and/or website, and your experiences at our direct-sale or authorized stores.This Privacy Notice does not apply to your activities or interactions at our local retail partners. For information on their data practices, we kindly recommend you to consult the privacy policies of the respective dealer or importer.
2. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?
This Privacy Notice applies to the processing of personal data where XPENG acts as a controller in the sense of applicable data protection laws. This Privacy Notice indicates what personal data are collected and used (processed) by XPENG and for what purpose, and to which persons or entities the data may be provided.For scenarios where this Privacy Notice does not apply, such as your interaction with our authorized retail partners, the respective third party can act as an independent controller, and we recommend you review their privacy policies to understand how they handle your data.
3. WHAT PERSONAL DATA DO WE COLLECT?
When we provide our services, we have a need to process personal data. We typically process the following personal data:- Your basic information: your first name, last name, ID number, preferred salutation, and contact information such as your address, zip code, city, region, country, phone number, email address.
- Your XPENG account information: your user ID, username, Google/Facebook account (if you use Google/Facebook account to sign in), phone number and email address associated with the account, password. Your phone's camera permission is required to enable you to scan the QR code on your vehicle display screen to log in XPENG vehicle account.
- Device information: device name, device type, OS version, screen resolutions, system language, device ID, MAC address, IP address, cookie ID, Bluetooth ID, device motion status (if you use XPENG APP polling through an Android device, the device motion status is verified in real-time in your device to ensure the effectiveness of the function), browser information and other information related to your device.
- Vehicle information: Vehicle Identification Number (VIN), vehicle model, registration number, vehicle conditions, Bluetooth ID, ICCID, other unique device identifiers.
- Vehicle telematics data: telematics data regarding the performance, usage, operation, and condition of your XPENG vehicle, including A/C and temperature, speed, status of doors, windows, and ports, charging and battery status, mileage, Bluetooth connectivity status.
- Location information: such as the location of your XPENG vehicle, and your location for finding the nearest stores or charging station, as well as locations you have saved on the APP. We may use third party map applications (such as Google Maps) to help you verify your location.
- Appointment or service history: including reservations, test drive appointments, vehicle repair history, warranty claims, service records, and any other information related to your service appointments or requests.
- Order information: your purchase information, order agreement, and other documents related to your delivery, such as government-issued ID.
- Communication and interactions information: such as customer service records, satisfaction surveys, customer feedback, your request details, and images you uploaded (if you choose to).
- Financial information: including payment method, bank card information payment status, amount, VAT number, invoice, information about financing, leasing or credit application.
- Insurance information: If you want us or our authorized dealers to provide insurance brokerage, we or our dealers will need to collect your name, your government-issued ID, contract information, vehicle identification number (VIN), and any other information related to your insurance to fulfill your request.
- Job application data: including employment and education information, date of birth, nationality, background check information, resume details, cover letters or work samples.
- Usage information: When you use our service, we ill automatically collect information about your interaction with it, including the pages and contents you view, the time you spend on them, and other usage patterns. This may include data collected through Cookies and other similar technologies.
- Analytics data: aggregated data regarding APP and website users' UI behaviour, usage and performance. We may use third party applications (such as Google Analytics) to realize this function.
4. HOW DO WE USE YOUR PERSONAL DATA?
We use personal data to manage our service and meet your information requests, to understand the use of our XPENG APP and website use, and to make our products and services as effective as possible.To realize our product functions and services:
| Data Processing Purposes | Type of Personal Data | Legal Basis for Processing |
|---|---|---|
| To create and activate your XPENG account | 1. Your username, password, email, phone number, or Google/Facebook account relate to your XPENG account 2. Vehicle information | Performance of a contract with you |
| To fulfill and complete your orders, including reservations, orders and pre-orders, leasing, fleet sales, and other transactions entered with us | 1. Your basic information, including contact information 2. Order information 3. Financial information | Performance of a contract with you |
| To provide connected-vehicle service through XPENG APP | 1. VIN and User ID 2. Vehicle telematics data (such as mileage, battery, speed) 3. Bluetooth information (such as MAC address, Bluetooth ID, connectivity status) 4. Location data 5. Device motion status (if applicable) | Performance of a contract with you |
| Vehicle authorization (authorize others to remote control your XPENG vehicle via XPENG APP) | 1. User ID 2. VIN 3. Contact information of your authorized person 4. Virtual identification and authentication 5. Authorization status | Performance of a contract with you |
| To provide you with charging service | 1. Location data 2. Vehicle telematics data (such as battery and charging status) 3. Order information | Performance of a contract with you |
| To handle bills, invoices, and taxation | 1. Your basic information, including contact information 2. Order information 3. Financial information | 1. Performance of a contract with you 2. Necessary to comply with a legal obligation |
| To provide you with XPENG Trade-in service | 1. Your vehicle information, including VIN, vehicle model, registration number, vehicle conditions 2. Your contact information | Performance of a contract with you |
| To provide insurance or finance solutions for you (upon your request) | 1. Your basic information, including contact information 2. Insurance contract information 3. Financial information 4. Vehicle and device information | Necessary in order to take steps at your request prior to entering into a contract |
| To provide home charging station services （e.g., binding, managing, sharing, or accepting shared charging stations via the dedicated mobile app; Connecting to your charging station via Bluetooth for operational control.) | 1. UID associated with your XPENG account 2. Email address (encrypted for security) 3. Bluetooth access (due to Android system requirements, enabling Bluetooth also requires granting location permission for device discovery.) | Performance of a contract with you |
| To optimize the placement of our charging stations | 1. Name and location of charging station recommended to you or you searched or viewed 2. Anonymized location information | Necessary for our legitimate interest: to analyze and improve our charging service |
To communicate with you:
We will take reasonable and appropriate measures to protect your personal data from loss, misuse, unauthorized access, disclosure, alteration and destruction. However, please note that no security measures can be 100% secure and perfect, and in the unfortunate event that a personal data security incident occurs, we will report it promptly and take remedial measures in accordance with the requirements of the law and regulatory authorities.
If you sell or transfer your vehicle to another person, please inform us promptly so that we can determine whether additional steps are needed to be taken to avoid disclosing personal data from or about you to the purchaser or transferee of the vehicle.
With respect to personal data transferred outside the United Kingdom, we comply with applicable data protection laws providing adequate safeguards for the transfer of personal data to countries outside of the United Kingdom by relying on:
- UK adequacy decisions. These are regulations which recognize that a country, territory, sector or international organization provides an adequate level of protection. We may transfer your personal data where applicable UK adequacy regulations are in place.
- Appropriate safeguards. In the absence of applicable UK adequacy regulations, we rely on the UK International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission's standard contractual clauses, or another safeguard permitted under the UK GDPR to transfer your personal data to our affiliates, such as our headquarters in China, and/or other third parties.
As part of our global operations, your personal data is also processed by XPENG's affiliates located in China (such as Guangzhou Xiaopeng Motors Technology Co., Ltd. and its affiliates) insofar as necessary for the provision of services, such as IT system operations and maintenance, research and development, analytics, and technical support. This access is granted on a need-to-know basis only and under strict security controls and authorization. For transfers of personal data from the United Kingdom to our affiliates in China, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum, as applicable, supplemented with additional technical and organizational measures in relation to these transfers, such as:
- Encryption of data, in transit and in rest;
- Other measures in order to – where legally possible – limit access to personal data by the government or governmental authorities.
We have conducted a transfer risk assessment for China and will review it periodically to ensure that our safeguards remain effective.
If you want to request a copy of the safeguards applicable to your personal data, you may contact us according to the instructions in "How to Contact us" section below.
a) Share with XPENG' s affiliates: We may share information with XPENG's relevant affiliates. Your information may be shared within XPENG's affiliates only for explicit, and legitimate purposes, and the sharing is limited only to information required by services.
b) Share with our local dealers or importers: We may share certain personal data with our local dealers or importers to enable them to provide you with sales and after-sales services. Such sharing is limited to the information necessary for them to perform these services, and is governed by contractual agreements.
c) Share with our service providers or business partners: We may share your personal data with our service providers and business partners when it is required to provide services, for instance, customer service providers, roadside assistance providers, payment processors, leasing service partner, recruitment service provider, event/campaign organiser, analytics service provider, third parties you authorized, and other professional service providers. We will sign strict data processing agreements based on applicable data protection laws with third-party entities receiving your personal data, requiring them to take necessary security measures and properly handle your personal data.
d) Share with persons you've authorized: If you authorize someone else to use your vehicle or authorize someone else's account to be bound to your vehicle, your personal data may be accessed by third parties that you authorize, and you should exercise caution when making such authorizations.
e) Share with other third parties as required by law or otherwise: We may, in our sole discretion, transfer or disclose information, including information that does or does not identify you, to a third party when:
- It is required under a legal obligation to which XPENG is subject;
- It is required by government departments or the judiciary authorities for law enforcement purposes;
- It is required to handle emergencies;
- It is required to prevent or stop possible illegal, unethical practices;
- It is required to protect our products and services, and the personal and property safety of third parties or the public.
a) Electronic or text communications: If you no longer want to receive marketing-related communications, you may opt out of receiving them by clicking the unsubscribe button in the emails, or to adjust your preference on XPENG APP. Please note that we may still send you important safety messages/calls or product service issues even if you opt out of receiving marketing messages.
b) Data subject rights: You have the right, subject to applicable conditions and exemptions, to request access to and receive information about your certain data we maintain, to update and correct inaccuracies in that information, to restrict or delete the information, to object to or withdraw your authorization to use the information in a certain way. If you want to exercise the aforementioned rights, you may contact us according to the instructions in "How to Contact us" section below.
c) You can also lodge a complaint to the Information Commissioner's Office (ICO), the United Kingdom's data protection supervisory authority. However, we will appreciate if you first contact us to try and solve your problem - you can find our contact details below.
If you become aware that a child has provided us with personal data, please contact us as indicated in the "How to contact us" section below. We will take all reasonable measures to delete the information as soon as possible and to not use such information for any purpose, except where necessary to protect the safety of the child or others as required by law.
Or contact XPENG European Holding B.V. at Diemerhof 42, 1112 XN, Diemen, the Netherlands
| Data Processing Purposes | Type of Personal Data | Legal Basis for Processing |
|---|---|---|
| To fulfill requests or service appointments you make to us, including test drives, service and event appointments, partnership requests | 1. Your basic information, including contact information (note: we may contact you to confirm your booking or request) 2. Order information 3. Appointment or service history (such as appointment details, customer service history) | 1. Performance of a contract with you or necessary in order to take steps at your request prior to entering into a contract 2. Necessary for our legitimate interests: to administer customers inquiries and requests |
| To respond to any feedback, requests, questions, or complaints you may have regarding our products and services (in person, online, telephone, email, etc.) | 1. Your basic information, including contact information 2. Order information 3. Communication and interactions information, including your request details, and images/files you uploaded (if you choose to) | 1. Performance of a contract with you or necessary in order to take steps at your request prior to entering into a contract 2. Necessary for our legitimate interests: to administer customers inquiries and requests |
| Sign up for XPENG marketing communications | 1. Account information 2. Order information | 1. Where you have provided your consent |
| Advertising and marketing purposes, including displaying online ads based on your online profile and analysing the effect of such online marketing campaigns. We may use cookies and similar technologies ("cookies") for this. Some cookies create unique identifiers and may collect data while you are using our websites or applications or other content, which help us to personalise content or advertisements. Read our Cookie Policy for more information about cookies | 1. Online identifiers 2. Device-related information 3. Cookies | Where you have provided your consent, to the extent that the processing is not permitted on a legitimate interest basis |
| To participate in surveys about your experience with our products and services | 1. Account information 2. Contact information 3. Survey or feedback details | Necessary for our legitimate interests: to understand, analyze and improve customer experience |
| Process job candidates' personal data to evaluate applications for employment | Job application data (including name, contact details, employment and education information, CV) | Necessary to take steps at your request prior to entering into a contract |
| Data Processing Purposes | Type of Personal Data | Legal Basis for Processing |
|---|---|---|
| To detect and defend against unauthorized access to data, and to enhance information security | 1. Device information 2. Network activity information | Necessary for our legitimate interests: to protect the confidentiality, integrity, and availability of IT systems |
| To upload crash logs for troubleshooting | 1. Account information 2. Relevant crash logs (may include user ID, device information, vehicle information and location information) | 1. Where you have provided your consent 2. Necessary for our legitimate interests: to ensure smooth user experience and service safety |
| To understand and analyze app and website UI behaviour and usage, so as to improve our services. We also use cookies like Google Analytics to collect usage data of our app and website; we only use this kind of analytics tools to understand usage and effectiveness of our online services. To know more about how Google Analytics process data, please see: https://policies.google.com/privacy?hl=en-US | 1. User ID 2. Device information 3. Usage information 4. Analytics data (aggregated data on UI behaviour, usage and analytics of app and website. Some of this data is shared with Google Analytics) | 1. Necessary for our legitimate interests: to understand, analyze and improve customer experience 2. Where you have provided your consent (website cookies) |
| Data Processing Purposes | Type of Personal Data | Legal Basis for Processing |
|---|---|---|
| To demonstrate compliance with regulatory requirements | 1. Contact information 2. Order information 3. Vehicle information | Necessary to comply with a legal obligation |
| To prevent thefts, and to ensure safety in Stores | Video images captured through CCTV | Necessary for our legitimate interests: to monitor the security of store assets and ensure Data Subjects' safety |
5. HOW DO WE STORE AND PROTECT YOUR PERSONAL DATA?
We retain the information we collect from or about you for the period necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by law. When the information is no longer necessary for these purposes, we delete it or keep it in a form that does not identify you. When determining this retention period, we take into account various criteria, including the type of services requested by or provided to you, the nature of our relationship with you, the impact on the services we provide to you if we delete some information from or about you, and retention periods required by law.We will take reasonable and appropriate measures to protect your personal data from loss, misuse, unauthorized access, disclosure, alteration and destruction. However, please note that no security measures can be 100% secure and perfect, and in the unfortunate event that a personal data security incident occurs, we will report it promptly and take remedial measures in accordance with the requirements of the law and regulatory authorities.
If you sell or transfer your vehicle to another person, please inform us promptly so that we can determine whether additional steps are needed to be taken to avoid disclosing personal data from or about you to the purchaser or transferee of the vehicle.
6. DATA CROSS-BORDER TRANSFER
We primarily store and process your personal data within the United Kingdom and the European Economic Area (EEA). As a globally operating company, we also share your personal data with third parties as described in "How do we share your information". These third parties can be located outside your country of residence and the European Economic Area (EEA). We comply with the applicable data protection laws relating to the transfers of personal from the EEA to third countries.With respect to personal data transferred outside the United Kingdom, we comply with applicable data protection laws providing adequate safeguards for the transfer of personal data to countries outside of the United Kingdom by relying on:
- UK adequacy decisions. These are regulations which recognize that a country, territory, sector or international organization provides an adequate level of protection. We may transfer your personal data where applicable UK adequacy regulations are in place.
- Appropriate safeguards. In the absence of applicable UK adequacy regulations, we rely on the UK International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission's standard contractual clauses, or another safeguard permitted under the UK GDPR to transfer your personal data to our affiliates, such as our headquarters in China, and/or other third parties.
As part of our global operations, your personal data is also processed by XPENG's affiliates located in China (such as Guangzhou Xiaopeng Motors Technology Co., Ltd. and its affiliates) insofar as necessary for the provision of services, such as IT system operations and maintenance, research and development, analytics, and technical support. This access is granted on a need-to-know basis only and under strict security controls and authorization. For transfers of personal data from the United Kingdom to our affiliates in China, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum, as applicable, supplemented with additional technical and organizational measures in relation to these transfers, such as:
- Encryption of data, in transit and in rest;
- Other measures in order to – where legally possible – limit access to personal data by the government or governmental authorities.
We have conducted a transfer risk assessment for China and will review it periodically to ensure that our safeguards remain effective.
If you want to request a copy of the safeguards applicable to your personal data, you may contact us according to the instructions in "How to Contact us" section below.
7. HOW DO WE SHARE YOUR INFORMATION?
We will not sell your personal data to anyone at any time for any purpose. We will only share your personal data in the following ways:a) Share with XPENG' s affiliates: We may share information with XPENG's relevant affiliates. Your information may be shared within XPENG's affiliates only for explicit, and legitimate purposes, and the sharing is limited only to information required by services.
b) Share with our local dealers or importers: We may share certain personal data with our local dealers or importers to enable them to provide you with sales and after-sales services. Such sharing is limited to the information necessary for them to perform these services, and is governed by contractual agreements.
c) Share with our service providers or business partners: We may share your personal data with our service providers and business partners when it is required to provide services, for instance, customer service providers, roadside assistance providers, payment processors, leasing service partner, recruitment service provider, event/campaign organiser, analytics service provider, third parties you authorized, and other professional service providers. We will sign strict data processing agreements based on applicable data protection laws with third-party entities receiving your personal data, requiring them to take necessary security measures and properly handle your personal data.
d) Share with persons you've authorized: If you authorize someone else to use your vehicle or authorize someone else's account to be bound to your vehicle, your personal data may be accessed by third parties that you authorize, and you should exercise caution when making such authorizations.
e) Share with other third parties as required by law or otherwise: We may, in our sole discretion, transfer or disclose information, including information that does or does not identify you, to a third party when:
- It is required under a legal obligation to which XPENG is subject;
- It is required by government departments or the judiciary authorities for law enforcement purposes;
- It is required to handle emergencies;
- It is required to prevent or stop possible illegal, unethical practices;
- It is required to protect our products and services, and the personal and property safety of third parties or the public.
8. WHAT ARE YOUR RIGHTS IN RELATION TO THE DATA PROCESSING WE PERFORM?
As a data subject, you have specific legal rights granted by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection laws relating to the personal data we process about you. We enable you to access and control the data that we collect, use and share from or about you, or your use of services.a) Electronic or text communications: If you no longer want to receive marketing-related communications, you may opt out of receiving them by clicking the unsubscribe button in the emails, or to adjust your preference on XPENG APP. Please note that we may still send you important safety messages/calls or product service issues even if you opt out of receiving marketing messages.
b) Data subject rights: You have the right, subject to applicable conditions and exemptions, to request access to and receive information about your certain data we maintain, to update and correct inaccuracies in that information, to restrict or delete the information, to object to or withdraw your authorization to use the information in a certain way. If you want to exercise the aforementioned rights, you may contact us according to the instructions in "How to Contact us" section below.
c) You can also lodge a complaint to the Information Commissioner's Office (ICO), the United Kingdom's data protection supervisory authority. However, we will appreciate if you first contact us to try and solve your problem - you can find our contact details below.
9. PRIVACY OF CHILDREN
We do not knowingly collect or use any personal data from children (we define 'children' as minors younger than 16) without prior, verifiable consent which is given or authorized by the holder of parental responsibility over the child. We do not knowingly allow children to order our vehicles, communicate with us, or use any of our online services.If you become aware that a child has provided us with personal data, please contact us as indicated in the "How to contact us" section below. We will take all reasonable measures to delete the information as soon as possible and to not use such information for any purpose, except where necessary to protect the safety of the child or others as required by law.
10. HOW TO CONTACT US?
For questions or comments, or to submit a data subject request, please contact us by email: data-privacy@xiaopeng.com;Or contact XPENG European Holding B.V. at Diemerhof 42, 1112 XN, Diemen, the Netherlands