Skip to main content

Privacy Policy

1. Highlights / Notice at Collection

Last Updated: [10/12/2026]

Nexteer Automotive Corporation, together with its subsidiaries and affiliates worldwide, collectively referred to as “Nexteer,” “we,” “us,” or “our,” respects your privacy and is committed to protecting personal information.

This Global Privacy Policy explains how Nexteer collects, uses, discloses, shares, sells, transfers, retains, deletes, and protects personal information when you visit or use our websites, including www.nexteer.com, interact with our online forms, communicate with us, apply for employment, engage with us as a customer, supplier, vendor, business partner, investor, candidate, website user, or other external stakeholder, or otherwise interact with services, portals, procurement platforms, communications, or digital properties that link to this Global Privacy Policy.

This Global Privacy Policy is intended to provide privacy disclosures for Nexteer’s key operating regions, including the United States, Europe, Mexico, Brazil, and the People’s Republic of China, unless a more specific country-specific, regional, workforce, supplier, procurement, platform, or activity-specific privacy notice applies.

Where Nexteer provides a separate privacy notice for a specific activity, country, region, workforce population, product, service, portal, supplier relationship, procurement process, or processing activity, that separate notice will apply to the extent it differs from this Global Privacy Policy. For example, supplier representatives in the EMEA region may receive or access a separate EMEA Privacy Notice for Suppliers, which provides additional information regarding the relevant controller, purposes and legal bases, procurement platforms, recipients, international transfers, retention periods, data subject rights, obligation to provide data, and local supervisory authority.

 
Important Highlights

Who is responsible for your personal information?

Nexteer Automotive Corporation and/or the relevant Nexteer entity that operates the website, communicates with you, enters into a business relationship with you, receives your job application, manages a supplier or procurement relationship with you, or otherwise determines the purposes and means of processing your personal information acts as the controller, business, operator, or responsible entity for your personal information, as applicable under relevant privacy laws.

Questions, requests, or complaints may be submitted to:

Global Information Security & Privacy Officer
Nexteer Automotive Corporation
Email: michael.bennett@nexteer.com

For certain EMEA supplier-related processing activities, local contact details may also be provided in the applicable EMEA Privacy Notice for Suppliers.

 

 

What personal information do we collect?

Nexteer may collect the following categories of personal information:

  1. identifiers;
  2. business contact information;
  3. professional or employment-related information;
  4. supplier, customer, vendor, and business partner information;
  5. procurement platform, supplier qualification, supplier certification, and supplier evaluation information;
  6. recruitment and candidate information;
  7. internet or other electronic network activity information;
  8. geolocation information, such as approximate location derived from IP address;
  9. communications information;
  10. financial and accounting information;
  11. investor relations information;
  12. account, portal, and authentication information;
  13. sensitive personal information where permitted or required by law;
  14. inferences derived from interactions with Nexteer websites, systems, platforms, or communications.

More information is provided in Section 4 — Collection of Personal Information.

 

Why do we collect and use personal information?

Nexteer collects and uses personal information for business and commercial purposes, including to:

  1. operate, maintain, secure, and improve our websites, portals, platforms, systems, and services;
  2. communicate with you and respond to inquiries;
  3. manage customer, supplier, vendor, investor, and business partner relationships;
  4. support procurement, supplier onboarding, supplier qualification, supplier evaluation, quality, logistics, finance, compliance, and related business activities;
  5. administer recruitment and candidate evaluation;
  6. comply with legal, regulatory, tax, accounting, audit, archival, and corporate governance obligations;
  7. prevent, detect, and investigate cybersecurity incidents, fraud, misuse, or unlawful activity;
  8. conduct analytics and improve website functionality;
  9. send newsletters, investor updates, technical materials, brochures, or marketing communications where permitted by law;
  10. evaluate or conduct corporate transactions;
  11. establish, exercise, or defend legal claims;
  12. protect Nexteer’s rights, property, personnel, systems, and operations.

Nexteer will not collect additional categories of personal information or use personal information for materially different, unrelated, or incompatible purposes without providing notice or obtaining consent where required by applicable law.

 

Is personal information disclosed, sold, or shared?

Nexteer may disclose personal information to:

  1. Nexteer affiliates and subsidiaries;
  2. service providers, processors, contractors, vendors, consultants, and professional advisers;
  3. IT service providers, procurement platform providers, hosting providers, accounting providers, legal providers, logistics providers, and courier providers;
  4. customers, suppliers, vendors, business partners, and commercial counterparties;
  5. courts, regulators, law enforcement, government authorities, public institutions, or other parties where required or permitted by law;
  6. parties involved in corporate transactions;
  7. other parties at your direction or with your consent.

Nexteer does not sell personal information for monetary consideration.

Certain uses of cookies, pixels, analytics tools, advertising technologies, or similar technologies may be considered a “sale,” “sharing,” or “targeted advertising” under certain U.S. state privacy laws if they involve disclosure of online identifiers, device information, or internet activity information to third parties for cross-context behavioral advertising or targeted advertising.

Where required by applicable law, Nexteer will provide a “Your Privacy Choices,” “Do Not Sell or Share My Personal Information,” or comparable opt-out mechanism. Nexteer will also honor legally recognized opt-out preference signals, including Global Privacy Control, where required by applicable law and technically feasible.

 

How long do we retain personal information?

Nexteer retains personal information only for as long as reasonably necessary and proportionate to achieve the purposes for which it was collected or processed, unless a longer retention period is required or permitted by law.

Nexteer determines retention periods based on the category of personal information, the purpose of processing, legal and regulatory requirements, contractual obligations, audit and compliance needs, security requirements, limitation periods, and Nexteer’s records retention schedules.

For supplier, procurement, and EMEA processing activities, additional or more specific retention periods may apply under a separate supplier privacy notice, procurement notice, or Nexteer records management procedure.

When personal information is no longer required, Nexteer will take reasonable steps to delete, destroy, anonymize, de-identify, aggregate, or otherwise securely dispose of the information in accordance with applicable law and Nexteer policies.

More information is provided in Section 11 — Data Retention and Disposal.

 

Are data transferred internationally?

Yes. Nexteer is a global automotive company. Personal information may be transferred to, accessed from, stored in, or otherwise processed in countries other than the country in which it was collected, including the United States, Mexico, Brazil, Europe, the People’s Republic of China, and other jurisdictions where Nexteer, its affiliates, service providers, customers, suppliers, vendors, platform providers, hosting providers, or business partners operate.

Personal information may also be transferred outside the jurisdiction in which it was collected in connection with procurement, supplier management, supplier qualification, supplier evaluation, and the use of procurement or supplier-management platforms, including Intelex, where applicable. Such transfers may include transfers to jurisdictions where Nexteer, its affiliates, platform providers, hosting providers, or other service providers operate.

Where required by applicable law, Nexteer implements appropriate safeguards for cross-border transfers, which may include adequacy decisions, standard contractual clauses or other approved contractual safeguards, intra-group transfer arrangements, Data Privacy Framework mechanisms, where applicable and valid, transfer assessments, certifications, consent where required, standard contracts, government security assessments, or other lawful transfer mechanisms.

More information is provided in Section 12 — International and Cross-Border Transfers.

 

What risks should you know about?

Personal information transferred to or processed in another jurisdiction may be subject to the laws of that jurisdiction and may be accessible to courts, law enforcement, regulators, national security authorities, public institutions, or other government authorities in accordance with applicable law.

Nexteer uses reasonable administrative, technical, organizational, and physical safeguards designed to protect personal information. However, no method of transmission over the internet or electronic storage is completely secure, and absolute security cannot be guaranteed.

2. Scope

This Global Privacy Policy applies to personal information that Nexteer collects:

  1. through websites, portals, online forms, applications, and digital services that link to this Global Privacy Policy;
  2. through email, telephone, web forms, event registration, supplier communications, investor communications, and other business communications;
  3. in connection with recruitment, candidate screening, and employment application processes, unless a separate applicant or employee privacy notice applies;
  4. in connection with supplier relationships, procurement processes, supplier qualification, supplier certification, supplier evaluation, supplier communications, and procurement or supplier-management platforms;
  5. through cookies, analytics tools, log files, social media features, embedded content, and similar technologies used on our websites;
  6. from customers, suppliers, vendors, business partners, affiliates, service providers, public sources, or other third parties where permitted by applicable law.

This Global Privacy Policy does not apply to websites, platforms, applications, or services operated by third parties, even where they are linked from Nexteer websites. Third-party websites and services are governed by their own privacy notices.

Where Nexteer provides a separate privacy notice for a specific activity, country, region, workforce population, product, service, portal, supplier relationship, procurement process, or processing activity, that separate notice will apply to the extent it differs from this Global Privacy Policy.

3. Regional and Activity-Specific Privacy Notices

Because Nexteer operates globally, this Global Privacy Policy is intended to provide privacy disclosures for Nexteer’s key operating regions, including the United States, Mexico, Brazil, Europe, and the People’s Republic of China, unless a more specific country-specific, regional, workforce, supplier, procurement, platform, or activity-specific privacy notice applies.

Nexteer may provide supplemental privacy notices for individuals located in specific jurisdictions or involved in specific processing activities, including:

  1. residents of the United States;
  2. individuals located in Europe;
  3. individuals located in Mexico;
  4. individuals located in Brazil;
  5. individuals located in the People’s Republic of China;
  6. supplier representatives in the EMEA region;
  7. job applicants, employees, contractors, or workforce members;
  8. residents of countries or regions where local privacy or data protection laws require additional disclosures.

If a supplemental privacy notice applies to you, it should be read together with this Global Privacy Policy. In the event of a conflict between this Global Privacy Policy and a supplemental notice, the supplemental notice will govern with respect to the relevant jurisdiction, individual, processing activity, Nexteer entity, or business relationship, unless otherwise required by applicable law.

4. Collection of Personal Information

In the preceding twelve months, Nexteer may have collected the following categories of personal information. The table below describes the categories of personal information, examples, sources, business or commercial purposes, whether the category is disclosed, sold, or shared, and the applicable retention approach.

Category and Sources of Information Examples Business or Commercial Purpose Do We Disclose, Sell, or Share This Data? Retention
Identifiers. We collect this information from you, your organization, customers, suppliers, business partners, Nexteer affiliates, service providers, websites, cookies, and log files. We may also generate identifiers internally. Name, company, job title, business email address, telephone number, postal address, country, IP address, online identifier, account ID. To enable use of our websites, portals, services, platforms, and communications; to communicate with you; to manage business relationships; to administer accounts; to understand website use; to protect security; to comply with legal obligations. We disclose this data to Nexteer affiliates, service providers, business partners, advisers, and authorities where required or permitted by law. We do not sell this data for monetary consideration. This data may be shared where certain cookies or advertising technologies constitute “sharing” under applicable U.S. state privacy laws. We retain this information for the length of time reasonably necessary to fulfill the purposes described in this Global Privacy Policy, unless a longer retention period is required or permitted by law.
Personal information described in Cal. Civ. Code § 1798.80(e). We collect this information from you, your organization, customers, suppliers, business partners, Nexteer affiliates, and service providers. Name, contact information, employment-related information, transaction-related information, signature, where applicable. To manage supplier, customer, vendor, and business partner relationships; to administer contracts; to support procurement, finance, quality, logistics, compliance, and recordkeeping; to communicate with you. We disclose this data to Nexteer affiliates, service providers, business partners, advisers, and authorities where required or permitted by law. We do not sell this data for monetary consideration. Sharing may occur only where applicable law treats certain technology disclosures as sharing. Retained as reasonably necessary for the disclosed purposes and for legal, tax, audit, compliance, and recordkeeping requirements.
Commercial information. We collect this information from customers, suppliers, vendors, business partners, your organization, Nexteer affiliates, and service providers. Supplier records, customer records, procurement data, transaction records, product or service inquiries, business relationship records, purchase orders, supplier communications. To manage business operations, procurement, logistics, finance, contracts, quality, warranty, compliance, and relationship management. We disclose this data to Nexteer affiliates, service providers, customers, suppliers, business partners, advisers, logistics providers, and authorities where required or permitted by law. We do not sell this data for monetary consideration. Retained for the duration of the business relationship and thereafter as required or permitted for contract, warranty, product quality, safety, tax, audit, compliance, dispute-resolution, and legal purposes.
Supplier, procurement, qualification, certification, and evaluation information. We collect this information from suppliers, supplier representatives, your organization, procurement platforms, Nexteer affiliates, service providers, and business records. Supplier onboarding data, supplier qualification data, supplier certification data, supplier evaluation data, procurement platform activity, submitted offers, executed orders, communications and files submitted through procurement systems, including Intelex, where applicable. To manage supplier onboarding, procurement processes, supplier qualification, supplier certification, supplier evaluation, order management, contract performance monitoring, supplier communications, quality processes, compliance, and supplier relationship management. We disclose this data to Nexteer affiliates, IT service providers, procurement platform providers including Intelex where applicable, hosting providers, accounting and legal providers, logistics and courier providers, customers or business partners where necessary, public institutions, and entities authorized by law. We do not sell this data. Retained for the duration of the relevant contract or supplier relationship and for the period necessary to establish, exercise, or defend claims; for periods required by tax, accounting, archival, and other legal obligations; and in accordance with Nexteer’s applicable records management procedures, including for procurement platforms and marketing-related processing.
Professional or employment-related information. We collect this information from you, recruiters, references, professional networking platforms, your organization, public sources, and service providers. Employer, job title, work history, qualifications, certifications, professional contact details, résumé or CV, references, interview notes. To evaluate candidates; administer recruitment; manage business communications; manage supplier, customer, and business partner relationships; comply with legal obligations. We disclose this data to Nexteer affiliates, recruiters, service providers, advisers, and authorities where required or permitted by law. We do not sell this data. Retained for the duration of the relevant recruitment or business relationship and thereafter as required or permitted for legal, audit, compliance, and recordkeeping purposes.
Education information. We collect this information from you, recruiters, educational institutions where applicable, references, and service providers. Education history, degrees, qualifications, certifications, training information. To evaluate candidates, verify qualifications, administer recruitment, and comply with legal obligations. We disclose this data to Nexteer affiliates, recruiters, service providers, advisers, and authorities where required or permitted by law. We do not sell this data. Retained for recruitment, verification, compliance, audit, and legal defense purposes as required or permitted by law.
Internet or other electronic network activity information. We collect this information automatically from your device, browser, cookies, analytics tools, websites, platforms, and log files. Browsing history, search history, pages viewed, links clicked, files downloaded, browser type, device data, referrer, session data, platform activity history, interaction with websites, portals, systems, or advertisements. To operate websites and platforms, provide functionality, administer technology, improve performance, conduct analytics, detect misuse, troubleshoot errors, prevent fraud, and protect security. We disclose this data to hosting, analytics, cybersecurity, IT, platform, and technology service providers. We do not sell this data for monetary consideration. This data may be shared if third-party cookies or similar technologies are used for cross-context behavioral advertising or targeted advertising. Retained for the period necessary for website or platform operation, analytics, cybersecurity, troubleshooting, fraud prevention, misuse detection, audit, and legal compliance. Unless a longer period is required for security, legal, audit, investigation, or misuse-prevention purposes, technical usage data including IP addresses will be retained in accordance with Nexteer’s information security and records retention procedures.
Geolocation data. We collect this information automatically from your device or systems, or from you where enabled. Approximate location derived from IP address; precise geolocation only where enabled or legally permitted. To support website functionality, analytics, security, fraud prevention, and operational purposes. We disclose this data to service providers where necessary. We do not sell this data for monetary consideration. Sharing may occur only where applicable law treats certain technology disclosures as sharing. Retained only as reasonably necessary for the disclosed purpose, unless a longer period is required or permitted by law.
Communications information. We collect this information from you and from communications systems, portals, and platforms. Contact form submissions, emails, inquiries, complaints, chat transcripts, support requests, feedback, supplier communications, procurement communications, files or documents submitted through systems. To respond to inquiries, provide support, manage business communications, maintain records, administer procurement and supplier relationships, and comply with legal obligations. We disclose this data to Nexteer affiliates, service providers, advisers, platform providers, and business counterparts where necessary. We do not sell this data. Retained for the period necessary to respond to the communication and maintain appropriate business, legal, compliance, procurement, and recordkeeping records.
Financial and accounting information. We collect this information from you, your organization, customers, suppliers, vendors, service providers, and business records. Invoicing data, payment and settlement information, banking data to the necessary extent, tax-related records. To administer contracts, process payments, conduct financial settlements, manage accounting, comply with tax and legal obligations, and maintain business records. We disclose this data to Nexteer affiliates, accounting providers, legal providers, banks, auditors, service providers, public institutions, and entities authorized by law. We do not sell this data. Retained for the period required or permitted by tax, accounting, audit, legal, contractual, and recordkeeping requirements. More specific retention periods may apply under local notices or records management procedures.
Investor relations information. We collect this information from you, investor relations platforms, event registration systems, and service providers. Investor inquiries, communication preferences, event registration information, contact details. To manage investor communications, corporate governance, securities law compliance, reporting, and recordkeeping. We disclose this data to Nexteer affiliates, service providers, advisers, and authorities where required or permitted by law. We do not sell this data. Retained as necessary for investor communications, securities law compliance, corporate governance, audit, and recordkeeping purposes.
Sensitive personal information. We collect this information from you, service providers, systems, or authorities where permitted or required by law. Government ID, work authorization information, disability accommodation information, account credentials, precise geolocation where applicable, or other information treated as sensitive under applicable law. To verify identity, administer recruitment, provide accommodations, maintain security, comply with law, protect rights and safety, and administer access to systems or platforms where applicable. We disclose this data only to service providers, advisers, authorities, or other recipients where necessary and legally permitted. We do not sell this data. Retained only as long as reasonably necessary for the specific disclosed purpose, unless a longer period is required or permitted by law.
Inferences. We may derive this information from website usage, analytics, communications, business interactions, supplier evaluations, or platform activity. Preferences, interests, business interaction patterns, website usage trends, supplier relationship indicators, platform usage trends. To improve websites, platforms, communications, user experience, analytics, supplier management, procurement operations, and business relationship management. We disclose this data to service providers where necessary. It may be shared if derived from technologies used for cross-context behavioral advertising or targeted advertising. Otherwise, we do not sell or share it. Retained as reasonably necessary for analytics, business improvement, procurement, supplier management, and compliance purposes.

5. Sources of Personal Information

Nexteer collects personal information from the following categories of sources.

5.1 Directly from You

For example, Nexteer may collect personal information when you access or use our websites, complete a form, contact us, request information, submit an inquiry, apply for employment, communicate with customer support, register for an event, subscribe to communications, submit supplier information, use a procurement platform, upload documentation, or otherwise interact with Nexteer, its personnel, representatives, suppliers, vendors, consultants, or service providers.

5.2 Indirectly from You

For example, Nexteer may collect information from observing your use of Nexteer websites, portals, platforms, or services, including the website from which you visit Nexteer, pages viewed, files downloaded, individual links clicked, search words or search phrases, duration of visit, browser used, device data, IP address, operating system, platform activity history, and other relevant website, portal, or system usage information.

5.3 From Third Parties

Nexteer may collect information from customers, suppliers, vendors, business partners, Nexteer affiliates, recruiters, references, professional networking platforms, background screening providers, analytics providers, cybersecurity providers, procurement platform providers, logistics providers, public sources, and government or regulatory authorities where permitted by law.

6. Disclosure, Sale, and Sharing of Personal Information

Nexteer may use, store, compile, analyze, disclose, and share personal information with third parties for the purposes described in this Global Privacy Policy.

Nexteer may disclose personal information to:

  1. Nexteer affiliates and subsidiaries, including entities located in the United States, Mexico, Brazil, Europe, the People’s Republic of China, and other countries, to support shared services, global operations, IT, security, compliance, recruitment, finance, legal, quality, engineering, procurement, supplier management, and business administration;
  2. service providers, processors, contractors, vendors, consultants, suppliers, licensors, marketing partners, analytics providers, hosting providers, cybersecurity providers, recruitment providers, procurement platform providers, delivery companies, and other entities performing work on Nexteer’s behalf;
  3. IT service providers, including procurement platform providers such as Intelex where applicable, hosting providers, and information systems providers;
  4. accounting and legal service providers;
  5. logistics and courier service providers;
  6. customers, suppliers, vendors, business partners, and commercial counterparties where necessary for business operations, procurement, logistics, quality, compliance, contracts, or relationship management;
  7. professional advisers, including lawyers, auditors, insurers, consultants, and financial advisers;
  8. relevant authorities, public institutions, courts, regulators, law enforcement, or other parties where Nexteer determines disclosure is required, necessary, or appropriate in connection with applicable law, regulation, court order, legal process, investigation, or legal claim;
  9. parties involved in a merger, acquisition, financing, restructuring, sale of assets, divestiture, or similar corporate transaction;
  10. other parties where you direct Nexteer to disclose the information or provide consent.

Sale or Sharing of Personal Information

In the preceding twelve months, Nexteer has not sold personal information for monetary consideration.

7. Supplier, Procurement, and Platform Processing

Where applicable, Nexteer may process supplier, procurement, and business partner personal information for the following purposes:

  1. performance of contracts and procurement processes;
  2. conducting business correspondence;
  3. concluding, administering, and performing contracts;
  4. financial settlements, invoicing, payments, and accounting;
  5. handling orders, deliveries, logistics, and supply-chain communications;
  6. use of procurement or supplier-management platforms, including Intelex where applicable;
  7. order management and contract performance monitoring;
  8. supplier management, supplier evaluation, supplier qualification, and supplier certification;
  9. compliance with legal, tax, accounting, archival, audit, and regulatory obligations;
  10. marketing and development of business cooperation, where permitted by law;
  11. establishment, exercise, or defense of legal claims;
  12. protection of Nexteer’s rights and interests.

Where GDPR or similar laws apply, the legal bases may include performance of a contract, compliance with legal obligations, and Nexteer’s legitimate interests in conducting business activities, managing procurement processes, maintaining business relationships, improving procurement operations, ensuring transparency and centralization of supplier management, and protecting Nexteer’s rights and interests.

Providing certain personal information may be necessary to enter into or perform a contract, use procurement platforms, complete supplier qualification, administer supplier certification, process orders, conduct financial settlements, or comply with legal obligations. Failure to provide required information may prevent Nexteer from entering into or performing a contract, providing access to procurement platforms, completing supplier qualification or certification, or conducting business cooperation.

Individuals whose personal information is processed in connection with supplier relationships, procurement processes, or procurement platforms in Europe or the EMEA region may also receive or access a separate supplier privacy notice from the relevant Nexteer entity. That notice may provide additional information regarding the relevant controller, legal bases, categories of data, use of procurement platforms such as Intelex, recipients, retention periods, cross-border transfers, data subject rights, obligation to provide data, and local supervisory authority.

8. Cookies, Analytics, and Similar Technologies

Nexteer websites may use cookies, pixels, tags, scripts, analytics tools, log files, web beacons, and similar technologies to operate the websites, remember preferences, understand website usage, improve performance, support security, and, where applicable, deliver or measure content.

Cookies are small text files stored on your device by your browser. Cookies may allow Nexteer to recognize your device, remember your preferences, maintain sessions, support login functionality, improve website performance, and understand how users interact with Nexteer websites.

8.1 Strictly Necessary Cookies

Strictly necessary cookies are required for the operation of Nexteer websites and cannot generally be disabled through our systems. These cookies may be used to enable secure areas of the website, maintain sessions, remember privacy preferences, prevent fraud, support load balancing, and ensure that requested website content loads properly.

8.2 Functional Cookies

Functional cookies allow Nexteer websites to remember choices you make, such as language preference, region, device type, or other user preferences. If you disable these cookies, some website functions may not operate properly or may not be tailored to your preferences.

8.3 Analytics Cookies

Analytics cookies help Nexteer understand how visitors use our websites, including which pages are visited, how long users remain on the website, which features are used, and whether errors occur. This information helps Nexteer improve website functionality, performance, and user experience.

8.4 Advertising and Audience Cookies

Advertising and audience cookies may be used to measure campaigns, understand interests, or display relevant content. These cookies may be placed by Nexteer or by third-party advertising or media partners.

Where required by applicable law, Nexteer will request consent before using advertising or audience cookies. Certain disclosures of online identifiers, device information, or internet activity information through advertising or audience cookies may be considered a “sale,” “sharing,” or “targeted advertising” under certain U.S. state privacy laws.

8.5 Cookie Choices

You may control cookies through your browser settings and, where available, through Nexteer’s cookie preference tool. If you disable or refuse cookies, some parts of Nexteer websites may not function properly.

Cookies and similar technologies that are not technically required may be managed through the “Your Privacy Choices” link or cookie preference tool where available.

9. Third-Party Web Analytics Tools

Nexteer may use third-party web analytics tools to analyze website usage, traffic, performance, user engagement, recruitment activity, procurement platform activity where applicable, or related website and platform services.

These tools may use cookies, pixels, scripts, or similar technologies to collect information such as pages visited, referrer URL, browser configuration, operating system, device information, internet service provider (ISP),  job-posting views, or application events, platform interaction events, and other interaction data.

Nexteer uses information gathered by analytics tools to generate reports, improve websites and services, troubleshoot issues, assess recruitment, marketing, procurement, or platform effectiveness, and perform other website-related or platform-related services.

Specific third-party analytics, advertising, or technology providers may be identified in a cookie banner, cookie preference tool, supplemental notice, or other notice made available on the relevant Nexteer website.

10. Social Plugins and Embedded Third-Party Content

Nexteer websites may include links, buttons, plugins, embedded media, maps, videos, or other features from social media networks and third-party content providers, such as LinkedIn, YouTube, X, Facebook, Instagram, Google Maps, or similar services.

If you visit a Nexteer page that contains a social media plugin or embedded third-party content, your browser may establish a connection to the relevant third-party server. The third party may receive information that your device accessed the relevant Nexteer page. If you interact with a plugin, click a social media button, play embedded media, use an interactive map, or otherwise activate third-party content, data may be transmitted to the relevant third party.

If you are logged into a third-party account when interacting with embedded content or plugins, the third party may associate your interaction with your account.

Nexteer does not control how third-party platforms collect, use, or disclose personal information. Their processing is governed by their own privacy notices.

11. Data Retention and Disposal

Nexteer retains personal information only for as long as reasonably necessary and proportionate to achieve the purposes for which it was collected or processed, unless a longer retention period is required or permitted by law.

Retention periods vary depending on the category of personal information, the context in which it was collected, the purposes of processing, applicable legal requirements, and Nexteer’s internal records retention schedules.

11.1 Retention Criteria

When determining how long to retain personal information, Nexteer considers:

  1. the purpose for which the information was collected and processed;
  2. the nature, volume, and sensitivity of the information;
  3. applicable legal, regulatory, tax, accounting, employment, product liability, safety, quality, audit, archival, and reporting requirements;
  4. contractual obligations with customers, suppliers, employees, applicants, vendors, and business partners;
  5. applicable limitation periods for legal claims;
  6. operational, cybersecurity, and business continuity needs;
  7. whether the information is necessary to protect Nexteer’s rights, property, safety, systems, or personnel;
  8. whether the information is subject to a legal hold, audit, investigation, litigation, regulatory request, or dispute;
  9. whether the information can be deleted, anonymized, de-identified, or aggregated.

11.2 Storage of Personal Information

Nexteer may store personal information in physical and electronic form, including in servers, databases, business systems, secure file repositories, archives, access-controlled physical locations, and records maintained by authorized departments or approved service providers.

Personal information may be stored by Nexteer group companies or by service providers acting on Nexteer’s behalf in jurisdictions where Nexteer or its service providers operate, subject to applicable contractual, legal, privacy, and security requirements.

11.3 Retention by Category

The retention column in the Collection of Personal Information table above describes Nexteer’s general retention approach by category of personal information. Unless a longer retention period is required or permitted by law, Nexteer retains personal information for no longer than reasonably necessary for the purposes described in this Global Privacy Policy.

For supplier and procurement-related personal information, retention periods may include:

  1. the duration of the relevant contract or business relationship;
  2. the period necessary to establish, exercise, or defend claims;
  3. periods required by tax, accounting, archival, audit, and other legal obligations;
  4. periods established in Nexteer’s applicable records management procedures, including for procurement platforms, supplier-management platforms, and marketing-related processing;
  5. periods specified in applicable regional or activity-specific notices, such as an EMEA Privacy Notice for Suppliers.

11.4 Secure Disposal, Deletion, Anonymization, and De-Identification

When personal information is no longer required, Nexteer will take reasonable steps to securely delete, destroy, anonymize, de-identify, aggregate, or otherwise dispose of the information in accordance with applicable law, Nexteer policies, records retention schedules, and technical feasibility.

Secure disposal methods may include deletion from active systems, removal from applications, deactivation or deletion of accounts, de-identification or anonymization, secure destruction of physical records, overwriting or deletion of electronic media, return or destruction by service providers, or other reasonable technical and organizational measures appropriate to the nature of the information.

Where permitted by applicable law, Nexteer may retain anonymized, de-identified, or aggregated information for business, operational, analytics, security, research, reporting, product improvement, and compliance purposes, provided such information is not used to identify an individual except as permitted by applicable law.

Personal information may persist for a limited period in backup, archival, disaster-recovery, legal-hold, audit, investigation, or security systems until it is deleted or overwritten in accordance with applicable retention and system lifecycle procedures.

11.5 Account, Portal, and Platform Confirmation and Deletion

Where Nexteer provides user accounts, portals, procurement platforms, or registered access to online services, Nexteer may periodically request users to confirm or update their account information. If a user does not confirm or update account information within the applicable period, Nexteer may deactivate the account.

Unless a longer retention period is required or permitted by law, contract, audit, security, investigation, dispute-resolution, supplier-management, procurement, or compliance requirements, Nexteer will delete or anonymize deactivated account information after a reasonable period in accordance with Nexteer’s records retention schedules and applicable law.

12. International and Cross-Border Transfers

Nexteer is a global automotive company. As a result, personal information may be transferred to, accessed from, stored in, or otherwise processed in countries other than the country in which it was collected, including the United States, Mexico, Brazil, Europe, the People’s Republic of China, and other jurisdictions where Nexteer, its affiliates, subsidiaries, service providers, customers, suppliers, vendors, platform providers, hosting providers, or business partners operate.

Personal information collected outside the United States may be transferred to, accessed from, stored in, or otherwise processed in the United States.

These countries may have privacy and data protection laws that differ from the laws of your jurisdiction. Personal information may also be accessible to courts, law enforcement, regulators, national security authorities, public institutions, or other government authorities in accordance with applicable law.

12.1 Transfers Within the Nexteer Group

Personal information may be transferred among Nexteer group companies for the purposes described in this Global Privacy Policy, including global business administration, centralized customer or supplier relationship management, procurement management, information security, IT support, recruitment, finance, legal, compliance, audit, quality, engineering, manufacturing support, corporate governance, and internal administrative purposes.

Where Nexteer maintains centralized systems, databases, portals, procurement platforms, or shared-service functions, personal information may be accessed by authorized Nexteer personnel in multiple jurisdictions on a need-to-know basis and subject to appropriate access controls, confidentiality obligations, and security measures.

12.2 Transfers to Service Providers and Third Parties

Nexteer may transfer personal information to service providers, processors, contractors, vendors, professional advisers, platform providers, hosting providers, and other third parties located outside your jurisdiction where necessary for the purposes described in this Global Privacy Policy.

For supplier and procurement-related processing, personal information may be transferred outside Europe or another jurisdiction of collection in connection with the use of procurement or supplier-management platforms, including Intelex where applicable, and services provided by subcontractors or service providers located outside the relevant jurisdiction.

Nexteer requires service providers and processors to process personal information only on behalf of Nexteer, in accordance with Nexteer’s instructions, and subject to appropriate contractual, privacy, confidentiality, and security obligations.

Where personal information is transferred to subcontractors or sub-processors, Nexteer requires appropriate safeguards designed to ensure a level of protection consistent with applicable law and Nexteer’s privacy and information-security requirements.

12.3 Transfer Safeguards

Where required by applicable law, Nexteer implements appropriate safeguards for cross-border transfers of personal information. Nexteer may rely on one or more of the following safeguards or transfer mechanisms:

  1. adequacy decisions or adequacy regulations issued by competent authorities;
  2. standard contractual clauses or other approved contractual safeguards;
  3. intra-group data transfer agreements, corporate policies, and privacy principles;
  4. contractual obligations requiring appropriate security and confidentiality protections;
  5. explicit consent, where permitted or required by law;
  6. transfers necessary for performance of a contract or pre-contractual measures;
  7. transfers necessary for important public interest reasons;
  8. transfers necessary to establish, exercise, or defend legal claims;
  9. data transfer impact assessments, personal information protection impact assessments, certifications, government security assessments, standard contracts, or similar mechanisms where required by applicable local law;
  10. other lawful transfer mechanisms permitted by applicable privacy and data protection laws.

Where required by applicable law, individuals may request further information about the safeguards used for cross-border transfers by contacting Nexteer using the details in this Global Privacy Policy or in the applicable supplemental notice.

12.4 Data Privacy Framework

Where Nexteer relies on the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, or the Swiss-U.S. Data Privacy Framework for transfers of personal information to the United States, Nexteer will comply with the applicable Data Privacy Framework Principles regarding the collection, use, and retention of personal information covered by the applicable framework.

If there is any conflict between this Global Privacy Policy and the applicable Data Privacy Framework Principles for personal information covered by the Data Privacy Framework, the applicable Data Privacy Framework Principles will govern.

Nexteer may remain responsible for onward transfers of personal information to third parties acting as agents on its behalf, as required by the applicable Data Privacy Framework Principles.

Individuals may contact Nexteer using the contact details in this Global Privacy Policy with questions or complaints concerning Data Privacy Framework-covered personal information.

13. Security

Nexteer implements reasonable administrative, technical, organizational, personnel-related, and physical safeguards designed to protect personal information against accidental, unlawful, or unauthorized loss, access, misuse, alteration, disclosure, destruction, or damage.

These safeguards may include access controls, network security measures, monitoring, encryption or pseudonymization where appropriate, confidentiality obligations, vendor security reviews, incident response procedures, vulnerability management, regular backups, IT systems security monitoring, business continuity procedures, and employee training.

Where personal information is submitted through Nexteer websites, portals, or platforms, Nexteer uses reasonable technical safeguards designed to protect information during transmission, such as encryption or secure transmission protocols where appropriate.

Where Nexteer engages third-party service providers or processors, Nexteer requires appropriate contractual safeguards designed to ensure that such parties protect personal information, process it only for authorized purposes, and comply with applicable privacy and information-security requirements.

No method of transmission over the internet or method of electronic storage is completely secure. Accordingly, Nexteer cannot guarantee absolute security of personal information.

14. Children’s Privacy

Nexteer websites and services are intended for business and general corporate audiences and are not directed to children under 13 years of age or any higher age threshold applicable under local law.

Nexteer does not knowingly collect personal information from children through its general websites. If Nexteer learns that it has collected personal information from a child without appropriate consent or other lawful basis, Nexteer will take reasonable steps to delete, anonymize, or otherwise dispose of that information as required by applicable law.

Nexteer does not knowingly sell or share personal information of consumers under 16 years of age.

15. De-Identified, Aggregated, and Anonymized Information

Nexteer may use de-identified, aggregated, or anonymized information for business, operational, analytics, research, reporting, cybersecurity, product improvement, supplier management, procurement improvement, and compliance purposes.

Where Nexteer maintains de-identified information, Nexteer will maintain and use the information in de-identified form and will not attempt to re-identify the information except as permitted by applicable law, including to test whether de-identification processes comply with applicable requirements.

Where information has been anonymized so that it no longer relates to an identified or identifiable individual, such information may no longer be considered personal information under applicable law.

16. Privacy Rights — United States

State-specific privacy laws within the United States may provide consumers with certain rights regarding personal information that businesses collect, use, disclose, sell, share, or otherwise process.

Depending on your state of residence and subject to applicable limitations and exceptions, you may have the following rights:

  1. Right to Access / Obtain: the right to request access to personal information collected about you, including information about categories of personal information, sources, purposes, disclosures, sale or sharing, and, where applicable, automated decision-making.
  2. Right to Data Portability: the right to receive personal information in a portable and readily usable format, where technically feasible.
  3. Right to Delete: the right to request deletion of personal information, subject to certain exceptions.
  4. Right to Correct: the right to request correction of inaccurate personal information.
  5. Right to Opt Out: the right to opt out of sale, sharing, targeted advertising, certain profiling, or certain automated decision-making where applicable.
  6. Right to Limit Sensitive Personal Information: the right to limit certain uses and disclosures of sensitive personal information where applicable.
  7. Right to Appeal: the right to appeal Nexteer’s decision regarding a privacy request where applicable.
  8. Right to Non-Discrimination: the right not to be discriminated against for exercising privacy rights.

Nexteer may still use aggregated, de-identified, or anonymized information that does not identify you. Nexteer may also retain and use personal information as necessary to comply with legal obligations, resolve disputes, enforce agreements, protect rights, maintain security, administer procurement or supplier records, or for other purposes permitted by applicable law.

17. Privacy Rights — Europe

If you are located in Europe, you may have rights under applicable privacy and data protection laws, including rights to:

  1. access personal information;
  2. rectify inaccurate or incomplete personal information;
  3. erase personal information;
  4. restrict processing;
  5. object to processing based on legitimate interests or direct marketing;
  6. receive personal information in a portable format;
  7. withdraw consent at any time where processing is based on consent;
  8. request information about applicable cross-border transfer safeguards;
  9. lodge a complaint with a competent supervisory authority.

Where the GDPR or similar European data protection laws apply, Nexteer processes personal information based on one or more of the following legal bases:

  1. consent;
  2. contractual necessity;
  3. legal obligation;
  4. legitimate interests;
  5. vital interests or public interest, where applicable.

Nexteer’s legitimate interests may include operating and securing our websites and systems, managing business relationships, responding to inquiries, conducting recruitment, preventing fraud, protecting legal rights, improving services, administering corporate compliance programs, managing internal administration, managing procurement processes, administering supplier relationships, improving procurement operations, and supporting global business operations.

Individuals whose personal information is processed in connection with supplier relationships, procurement processes, or procurement platforms in Europe or the EMEA region may also receive or access a separate supplier privacy notice from the relevant Nexteer entity. That notice may provide additional information regarding the relevant controller, legal bases, categories of data, use of procurement platforms such as Intelex, recipients, retention periods, cross-border transfers, data subject rights, obligation to provide data, and local supervisory authority.

18. Privacy Rights — Mexico

If you are located in Mexico, you may have rights under applicable Mexican privacy laws, subject to applicable conditions and limitations. These rights may include:

  1. the right to access your personal information;
  2. the right to rectify inaccurate or incomplete personal information;
  3. the right to cancel or request deletion of personal information where applicable;
  4. the right to object to certain processing of personal information;
  5. the right to withdraw consent where processing is based on consent;
  6. the right to limit the use or disclosure of personal information where applicable;
  7. the right to receive information about transfers of personal information where required by law.

These rights are commonly referred to as ARCO rights: access, rectification, cancellation, and opposition.

Where required by applicable Mexican law, Nexteer will provide additional information in a Mexico-specific privacy notice, including information on the relevant Nexteer entity, purposes of processing, transfers, rights, and mechanisms for exercising rights.

19. Privacy Rights — Brazil

If you are located in Brazil, you may have rights under the Brazilian General Data Protection Law, known as Lei Geral de Proteção de Dados Pessoais or LGPD, subject to applicable conditions and limitations. These rights may include:

  1. confirmation of whether Nexteer processes your personal information;
  2. access to personal information;
  3. correction of incomplete, inaccurate, or outdated personal information;
  4. anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed personal information;
  5. portability of personal information, where applicable;
  6. deletion of personal information processed based on consent, where applicable;
  7. information about public and private entities with which personal information has been shared;
  8. information about the possibility of refusing consent and the consequences of refusal;
  9. withdrawal of consent;
  10. the right to petition the Brazilian National Data Protection Authority or other competent authority where applicable.

Where required by applicable Brazilian law, Nexteer will provide additional information in a Brazil-specific privacy notice, including information on the relevant Nexteer entity, purposes of processing, legal bases, data sharing, international transfers, rights, and mechanisms for exercising rights.

20. Privacy Rights — People’s Republic of China

This section applies to individuals located in the People’s Republic of China, excluding for this purpose Hong Kong SAR, Macau SAR, and Taiwan, unless otherwise stated in an applicable local notice.

Where the Personal Information Protection Law of the People’s Republic of China and related implementing rules, standards, and guidance apply, Nexteer will process personal information in accordance with applicable PRC data protection requirements.

20.1 Personal Information We Process

Nexteer may process the categories of personal information described in this Global Privacy Policy, including identifiers, business contact information, professional information, recruitment information, communications information, website usage information, device information, cookie identifiers, supplier/customer information, procurement platform information, and other information you provide to us or that we collect in accordance with applicable law.

20.2 Sensitive Personal Information

Where required by PRC law, Nexteer will process sensitive personal information only for a specific purpose and where strictly necessary. Sensitive personal information may include, where applicable, precise location information, identity document information, biometric information, financial account information, health information, account credentials, or other information treated as sensitive under PRC law.

Where required, Nexteer will provide specific notice and obtain separate consent before processing sensitive personal information.

20.3 Sharing, Entrusted Processing, and Disclosure

Nexteer may share or provide personal information to Nexteer affiliates, service providers, processors, contractors, professional advisers, customers, suppliers, business partners, platform providers, hosting providers, and government or regulatory authorities where permitted or required by applicable law.

Where Nexteer entrusts a third party to process personal information on its behalf, Nexteer will require the entrusted party to process personal information in accordance with Nexteer’s instructions and applicable contractual, privacy, confidentiality, and security requirements.

Where required by PRC law, Nexteer will provide specific notice or obtain separate consent before sharing personal information with other personal information processors.

20.4 Cross-Border Transfers from the PRC

Personal information collected in the People’s Republic of China may be transferred to or accessed from countries or regions outside the PRC, including the United States, Mexico, Brazil, Europe, and other jurisdictions where Nexteer, its affiliates, platform providers, hosting providers, or service providers operate, where necessary for the purposes described in this Global Privacy Policy or a supplemental notice.

Where required by PRC law, Nexteer will satisfy applicable cross-border transfer requirements before transferring personal information outside the PRC. This may include conducting a personal information protection impact assessment, entering into standard contracts, obtaining certification, passing a government security assessment where required, providing required notices, and/or obtaining separate consent.

20.5 Rights Under PRC Law

Subject to applicable limitations, individuals in the PRC may have the right to:

  1. know and decide on the processing of their personal information;
  2. restrict or refuse processing of personal information;
  3. access and copy personal information;
  4. request correction or supplementation of inaccurate or incomplete personal information;
  5. request deletion of personal information;
  6. withdraw consent where processing is based on consent;
  7. request explanation of personal information processing rules;
  8. request transfer of personal information to another personal information processor where conditions under PRC law are met;
  9. exercise other rights provided under applicable PRC data protection laws.

PRC residents may exercise these rights by contacting Nexteer using the contact details in this Global Privacy Policy or any applicable local notice.

21. Privacy Rights — Other Countries or Regions

This section applies to individuals located in countries or regions other than the United States, Europe, Mexico, Brazil, or the People’s Republic of China, unless a more specific regional, country-specific, or activity-specific privacy notice applies.

Nexteer will process personal information in accordance with this Global Privacy Policy and applicable privacy and data protection laws in the jurisdiction relevant to the individual, the Nexteer entity, and the processing activity.

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, object to, withdraw consent to, or request portability of your personal information. You may also have the right to complain to a privacy or data protection authority.

Where personal information is transferred outside your jurisdiction, Nexteer will implement transfer mechanisms and safeguards required by applicable law. These may include adequacy decisions, standard contractual clauses, contractual safeguards, consent where required, transfer impact assessments, certifications, standard contracts, government security assessments, or other lawful mechanisms.

22. How to Exercise Your Rights

To exercise your privacy rights, submit a verifiable consumer request, access request, ARCO request, data subject request, or other applicable privacy request by contacting Nexteer at:

Global Information Security & Privacy Officer
Nexteer Automotive Corporation
Email: michael.bennett@nexteer.com

To assist Nexteer in processing your request, please provide sufficient information to allow Nexteer to verify your identity and locate relevant records. This may include:

  1. full name;
  2. email address;
  3. phone number;
  4. address, state, country, or region of residence;
  5. the nature of your relationship with Nexteer;
  6. information about your previous contact or touchpoint with Nexteer, such as website, product, service, job application, supplier relationship, procurement platform account, customer relationship, portal account, or business contact.

Nexteer can only respond to certain requests if it can verify your identity or authority to make the request.

Depending on your jurisdiction, you may request certain rights through an authorized agent or representative. When an authorized agent or representative submits a request, Nexteer may require proof of authorization and may require you to verify your identity directly with Nexteer, unless prohibited by applicable law.

For EMEA supplier-related privacy requests, individuals may also use the contact details provided in the applicable EMEA Privacy Notice for Suppliers.

23. Response Timing and Appeals

Nexteer will respond to privacy requests within the timeframe required by applicable law. For California residents, Nexteer will generally respond to verifiable consumer requests within 45 days of receipt, unless an extension is permitted by law.

If more time is needed, Nexteer will inform you of the reason and extension period in writing where required by applicable law.

If Nexteer cannot comply with a request, in whole or in part, Nexteer will provide a written response explaining the reasons where required by law.

Nexteer does not charge a fee to process or respond to a verified privacy request unless the request is excessive, repetitive, manifestly unfounded, or otherwise permitted by applicable law. If Nexteer determines that a fee is warranted, Nexteer will explain why and provide a cost estimate before completing the request.

If Nexteer denies your privacy request and applicable law provides a right to appeal, you may appeal the decision by contacting Nexteer using the same method used to submit the original request and including “Privacy Rights Appeal” in the subject line or request description. Nexteer will review and respond to appeals within the timeframe required by applicable law.

24. Filing a Complaint

You may file a complaint with the applicable state Attorney General’s office, privacy regulator, data protection authority, supervisory authority, consumer protection authority, or other regulatory agency where permitted by applicable law.

Before filing a complaint with a regulator, Nexteer encourages you to contact us using the contact information in this Global Privacy Policy or in the applicable supplemental notice so that we may review and attempt to resolve your concern

25. Links to Affiliated Sites

Nexteer websites may contain links to other Nexteer websites, portals, platforms, or digital properties. Your use of those affiliated websites, portals, platforms, or digital properties may be governed by separate privacy notices or terms applicable to those sites or services.

26. External Links

Nexteer websites may contain links to third-party websites or services operated by providers not affiliated with Nexteer. After you click a third-party link, Nexteer does not control the collection, storage, use, disclosure, or other processing of personal information by that third party.

This Global Privacy Policy does not apply to third-party websites or services. You should review the privacy notices of third-party websites or services for information about how they collect, use, disclose, and protect personal information.

27. Governing Law and Severability

This Global Privacy Policy will be interpreted in accordance with the privacy and data protection laws applicable to the relevant processing activity, jurisdiction, individual, and Nexteer entity involved.

If any provision of this Global Privacy Policy is held to be invalid, illegal, or unenforceable under applicable law, the remaining provisions will remain in effect to the fullest extent permitted by law.

Nothing in this Global Privacy Policy is intended to limit rights that cannot be limited under applicable privacy or data protection laws.

28. Changes to this Global Privacy Policy

Nexteer may update this Global Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, business operations, websites, platforms, or services. When Nexteer updates this Global Privacy Policy, Nexteer will revise the “Last Updated” date above.

If Nexteer makes material changes to this Global Privacy Policy or materially changes how Nexteer collects, uses, discloses, retains, transfers, sells, or shares personal information, Nexteer will provide notice as required by applicable law. This may include posting a prominent notice on Nexteer’s website, providing notice through relevant portals or communications, providing notice through supplier or procurement channels, or, where required, sending notice to individuals who previously provided consent or whose personal information is materially affected by the change.

Where required by law, Nexteer will obtain consent before applying material changes to processing activities that require consent.

Terms of Use

Privacy Policy

Contact Us

Locations

Careers