Mitsubishi Fuso Truck and Bus Corporation (hereinafter “MFTBC”) Privacy Statement

This California Supplement to the Privacy Statement supplements the information contained in MFTBC’s Privacy Statement above and applies solely to all visitors, users, and others who reside in the States of California (“consumers” or “you”). It also applies to the related online services (the “Services”) that we provide through our Websites (the “Sites”). This Privacy Policy applies solely to the Personal Information (as defined below in Section 1) collected from consumers or users who reside in the State of California (“users,” “consumers” or “you”). The California Consumer Privacy Act of 2018 (“CCPA”) and the California Privacy Rights Act of 2020 (“CPRA”) require certain notice(s) and may provide specific rights to consumers, which are detailed below. Any terms defined in the CCPA or CPRA have the same meaning as used in those statutes when used in this notice.
By using MFTBC’s Sites and/or the Services, and providing us with Personal Information you agree to the practices described in this Privacy Policy and the Cookie Policy referenced below and to the updates to these policies posted here from time to time. To make sure you stay informed of all changes, you should check these policies periodically. Updates will be referenced by the “Last Updated” date shown above.

Definition of Personal Information (CCPA and CPRA)
For purposes of this Privacy Policy, except where a different definition is noted, “Personal Information” means information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device.
Personal Information for purposes of this Privacy Policy does not include:

• Publicly available information from government records or news stories.
• De-identified or aggregated consumer information.
• Other information excluded from the CCPA’s scope, such as:
• Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
• Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

California “Shine the Light” Law/Your California Privacy Rights
California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits consumers who are California residents, to request and obtain from us once a year, free of charge, information about the categories of personal information (as defined in the Shine the Light law), if any, that we disclosed in the preceding calendar year to third parties for those third parties’ direct marketing purposes. Our disclosure requirements apply only if we share our consumers’ personal information with third parties for them to directly market their own products to those consumers, instead of assisting us with our own business. If you are a California resident and would like to make such a request, contact us using the contact information provided below.

Information MFTBC Collects
As more fully explained in the Privacy Statement above, MFTBC’s Sites collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“ Personal Information”). Collection of information in this context includes information that users may voluntarily provide to MFTBC by directly contacting MFTBC using the contact information provided on the Sites. In particular, MFTBC’s Sites may collect the following categories of Personal Information from its users:

Category A: Identifiers
Examples: A real name, Internet Protocol address, email address, or other similar identifiers.

Collected: YES

Category B: Personal information categories listed in the California Customer
Records statute (Cal. Civ. Code § 1798.80(e)).
Examples: A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some Personal Information included in this category may overlap with other categories.

Collected: YES

Examples: Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

Collected: NO

In response to a verified consumer request for categories of information collected, we will investigate and provide an individualized response to the consumer, and will not merely refer the consumer to our general practices outlined in this Privacy Policy unless our response would be the same for all consumers and this Privacy Policy discloses all the information that is otherwise required for the response to such a consumer request.
MFTBC collects the categories of Personal Information listed above from the following types of sources:

• Directly from you. For example, from information emailed to us using the contact information displayed on the Sites.
• Indirectly from you. For example from observing your actions on MFTBC’s Sites, or your interactions with advertisers.
• From third parties. For example, third party social networking providers and advertising companies, our affiliates and service providers who provide services or information to us. If you do not want us to collect information from social networks, you should review and adjust your privacy settings on those networks as desired before linking or connecting them to our Sites or Services.
• From publicly available sources. For example, online database searches.

Use of Personal Information
MFTBC may use, or disclose the Personal Information it collects for one or more of the following business purposes:

• To fulfill or meet the reason your information was provided to MFTBC. For example, if you email us and share your name and contact information to request more information about our products, MFTBC may send such Personal Information to third party vendors with which it contracts, who may at their sole discretion use that Personal Information to respond to your inquiry.
• To provide you with support and to respond to your inquiries concerning the operation of the website, including to investigate and address your concerns and monitor and improve MFTBC’s responses.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your Personal Information or as otherwise set forth in the CCPA.
• MFTBC will not collect additional categories of Personal Information or use the Personal Information MFTBC has collected for materially different, unrelated, or incompatible purposes without providing you notice. Such notice may be provided by changes to this privacy statement.

Sharing Personal Information/ Disclosures of Personal Information for a Business or Commercial Purpose
MFTBC may disclose your Personal Information to a third party for “business” or “commercial” purposes (as defined under the CCPA). When MFTBC discloses Personal Information for a business or commercial purpose, MFTBC enters a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not use it for any purpose except performing the contract.

MFTBC also may use or disclose Personal Information it collects for additional business or commercial purposes, which may include the following examples. The examples provided are illustrative and not intended to be exhaustive.

• Auditing Interactions with Consumers. For example: monitoring traffic to our Sites, counting ad impressions, and auditing legal and regulatory compliance.
• Security. For example, maintaining the safety, security, and integrity of our Sites, products and Services, databases and other technology assets and our business, including preventing fraud, detecting security breaches and prosecuting violators, and responding to law enforcement requests or court orders and to comply with any applicable laws and regulations.
• Debugging/Repair. For example, identifying and repairing errors in the functionality of our Sites.
• Certain Short-term Uses. For example, ad customization that does not involve or contribute to profiling.
• Performing Services. For example, creating, maintaining, customizing and securing your account with us, hosting our Sites, managing databases, performing analyses, and marketing services.
• Internal Research for Tech Development. For example, testing, research, analysis, and product development, including to develop and improve our Sites, products, and Services.
• Quality and Safety Maintenance and Verification. For example, improving, upgrading or enhancing our products or Services, and verifying the quality or safety of our Services.
• Our affiliates. For example, to perform Services.
• Service providers: For example, contractors, agents or sponsors who help us manage or provide our products and Services by, for example: developing or supporting products and features; sending email messages on our behalf; auditing; processing data or statistics; and serving, customizing or delivering products, Services or marketing. These third party service providers are required to protect Personal Information entrusted to them and not use it for any other purpose than the specific service they are providing on our behalf.
• Advertisers, advertising technology companies. For example, to perform analytics companies.
• Government regulators. For example, to comply with government laws and requirements.
• Our legal advisors and parties involved in a legal process. For example, to prosecute or defend legal actions or comply with laws.
• To an entity involved in the sale of our business. For example, in the event of a sale of all or part of MFTBC’s business.
• Third parties to whom you or your agents authorize us to disclose your Personal Information. For example, to provide products or Services.
• Other Commercial Purposes. Examples include: (i) purposes as described to you when collecting your Personal Information: (ii) if you sign up for text messaging, cookies or other tracking devices may be used to personalize your experience: and (iii) to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, in which Personal Information we hold is among the assets transferred.

If we decide to collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes we will update this Privacy Policy.

In response to a verified consumer request to know what Personal Information was collected or sold, MFTBC will investigate and provide an individualized response to the consumer, which will include the business or commercial purpose for collecting and/or sharing that information. MFTBC will not merely refer the consumer to our general practices outlined in this Privacy Policy unless our response would be the same for all consumers and this Privacy Policy discloses all the information that is otherwise required for the response to such a consumer request.

MFTBC does not sell your Personal Information to third parties or receive benefits from third parties for sharing Personal Information.

Your Rights and Choices
The CCPA provides consumers (California residents) with specific rights regarding their Personal Information. This section describes your CCPA rights and explains how to exercise those rights.

Access to Specific Information and Data Portability Rights
You have the right to request that MFTBC disclose certain information to you about its collection and use of your Personal Information over the past 12 months. Once MFTBC receives and confirms your verifiable consumer request, MFTBC will disclose to you:

• The categories of Personal Information MFTBC collected about you.
• The categories of sources for the Personal Information MFTBC collected about you.
• MFTBC’s business or commercial purpose for collecting Personal Information.
• The categories of third parties with whom MFTBC shares Personal Information.
• The specific pieces of Personal Information MFTBC collected about you (also called a data portability request).
• If MFTBC disclosed your Personal Information for a business purpose, MFTBC will also disclose:
• For disclosures for a business or commercial purpose: a list identifying the Personal Information categories that each category of recipient obtained.

Deletion Request Rights
You have the right to request that MFTBC delete any of your Personal Information that MFTBC has collected and retained, subject to certain exceptions. Once MFTBC receives and confirms your verifiable consumer request, MFTBC will delete (and direct our service providers to delete) your Personal Information from its records, unless an exception applies.

MFTBC may deny your deletion request if retaining the information is necessary for MFTBC or its service provider(s) to:

• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with MFTBC.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Exercising Access, Data Portability, and Deletion Rights
To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by sending us a message to MFTBC_datacompliance@DaimlerTruck.com. You may only make a verifiable consumer request for access or data portability twice within a 12-month period.

The verifiable consumer request must provide sufficient information that allows MFTBC to reasonably verify you are the person about whom MFTBC collected Personal Information or an authorized representative. This means that in making a request you may be required to: provide your email and phone number, customer information, or other information needed to verify your identity depending on the sensitivity of the Personal Information that is the subject of the request.

MFTBC cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. If MFTBC is unable to verify your identity, we reserve the right to deny the request. Making a verifiable consumer request does not require you to create an account with MFTBC. MFTBC will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

If you choose to use an authorized agent to submit a request to know or a request to delete your information, MFTBC may require that you: (1) provide the authorized agent written permission to do so; and (2) verify your own identity directly with MFTBC. MFTBC will not require these steps if we have received proof that you have provided the authorized agent with a power of attorney pursuant to California Probate Code sections 4000 to 4465. MFTBC may deny a request from an agent that does not submit proof that they have been authorized by you to act on your behalf. MFTBC may also deny a request from an agent that does not meet the requirements for authorized agents under the CCPA.

Once MFTBC has verified your identity (and your authorized agent, as applicable), MFTBC will respond to your request as appropriate. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. If we are unable to complete your request in whole or in part, we will let you know why.

Response time and format
MFTBC makes reasonable efforts to respond to a verifiable consumer request within forty-five (45) days of its receipt. If MFTBC requires more time (up to ninety (90) days), MFTBC will inform you of the reason and extension period in writing. MFTBC will deliver its written response by mail or electronically, at your option. Any disclosures MFTBC provides will only cover the 12-month period preceding the verifiable consumer request’s receipt. MFTBC’s response will also explain the reasons MFTBC cannot comply with a request, if applicable. For data portability requests, MFTBC will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance, specifically by electronic mail communication.

If MFTBC determines that the request warrants a fee, MFTBC will tell you why it made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

• MFTBC will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, MFTBC will not:
• To the extent that any goods or services are provided by MFTBC, deny you goods or services unless the deletion of your Personal Information prevents MFTBC from providing such goods or performing such services.
• Charge you different prices or rates for services, including through granting discounts or other benefits, or imposing penalties.
• To the extent that any goods or services are provided by MFTBC, provide you a different level or quality of goods or services unless the deletion of your Personal Information prevents MFTBC from providing you with the same level or quality of goods or services as it does for customers whose Personal Information has not been deleted.
• To the extent that any goods or services are provided by MFTBC, suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services, unless the deletion of your Personal Information would prevent MFTBC from providing you with the same level or quality of goods or services as it does for customers whose Personal Information has not been deleted.

Changes to MFTBC’s California Privacy Notice
MFTBC reserves the right to amend this privacy notice at its discretion and at any time. When MFTBC makes changes to this privacy notice, it will post the updated notice on MFTBC’s Sites and update the notice’s effective date. Your continued use of MFTBC’s Sites following the posting of changes constitutes your acceptance of such changes.

Contact Information
If you have any questions or comments about this Privacy Statement, the ways in which MFTBC collects and uses your information, your choices and rights regarding such use, or wish to exercise your rights under California law, please contact MFTBC.

Data Compliance Officer
Mitsubishi Fuso Truck and Bus Corporation
10 Ohkura-cho, Nakahara-ku, Kawasaki-shi, Kanagawa
211-8522 Japan
Email: MFTBC_datacompliance@DaimlerTruck.com