Data Controller
Data Controller: Elevare Insights Ltd (t/a XPENG Owners)
ICO Registration Number: ZC012981
Registered Office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ
Email: privacy@xpengowners.com
Definitions
In this policy, "we", "us" and "our" refers to Elevare Insights Ltd, trading as XPENG Owners. "You" refers to any individual whose personal data we process in connection with our community platforms and services.
1. Our Commitment
XPENG Owners respects your privacy. We collect and use personal data responsibly, transparently, and in line with the UK GDPR and the Data Protection Act 2018. This notice explains what we collect, why, how we use it, and the choices you have.
2. What We Collect
We may collect the following categories of information:
Name, email address, telephone number, postal address, town/city, region, demographics (e.g. age range, employment or ownership status — never health, ethnicity, or other sensitive data).
Posts, comments, poll responses, event participation, patterns derived from community interactions on our community platforms (as defined in Section 3, below), and other engagement data consistent with the purposes described in this policy.
Opinions about vehicles, ownership experience, purchase considerations, events and referrals.
Booking and order history, fulfilment information (including event tickets and digital delivery), billing or payment reference where payments are facilitated through our platforms.
Name, email, telephone, location, preferred dealership.
IP address, device type, browser information (where you interact with our websites or digital platforms).
3. Community Platforms
"Community platforms" means any online spaces operated or managed by us for engagement, discussion, commerce or insight generation. This includes, but is not limited to, our Facebook groups, social-media pages, portals, forums, and future digital channels.
4. How We Use Your Information
We use your data to:
- Create and manage your XPENG Owners community account.
- Apply automated analysis techniques to community engagement data to identify aggregated patterns, trends and insights.
- Analyse insight responses and community engagement (posts, comments, polls, events) to produce aggregated and anonymised insights for reporting purposes to authorised partners.
- Manage community-related commercial activity — including bookings, event ticketing, digital delivery and prize draws.
- Share contact details (with your explicit consent) with an authorised XPENG dealership for test-drive arrangements.
- Provide community updates, newsletters, and promotional content (where you have opted in).
- Maintain the security and integrity of our platforms and comply with legal obligations.
We do not sell your data and do not use automated decision-making with legal or similarly significant effects. Community engagement data may be analysed using automated techniques to identify aggregated patterns and trends.
5. Lawful Bases for Processing
As defined under UK GDPR Article 6:
| Social media community membership | Legitimate Interests (Art 6(1)(f)) |
| Community hub membership | Consent (Art 6(1)(a)) |
| Insight analysis & reporting | Legitimate Interests (Art 6(1)(f)) |
| Automated analysis & pattern recognition | Legitimate Interests (Art 6(1)(f)) |
| Bookings, event ticketing & digital delivery | Contract (Art 6(1)(b)) |
| Test-drive & partner referrals | Consent (Art 6(1)(a)) |
| Job applications (dealer roles) | Consent (Art 6(1)(a)) |
| Marketing communications | Consent (Art 6(1)(a)) |
| Legal or regulatory compliance | Legal Obligation (Art 6(1)(c)) |
6. Data Sharing & Third Parties
If you request a test drive, we share your name, telephone, email and location with an authorised XPENG dealership solely to arrange your appointment. We will also share a short summary of your interactions in the community. Telephone numbers are deleted within 48 hours of referral.
We use trusted third-party processors to support platform hosting, email delivery, event management, data storage, and analytical processing. All processors are required to handle data in line with UK GDPR and are located within the UK/EU or subject to appropriate safeguards.
Anonymised, aggregated data may be shared with authorised partners for insight and reporting purposes.
If you use our platform to apply for a role via a dealer job listing, we process your name, email address, phone number, CV, and covering letter solely to forward your application to the relevant dealer. We do not retain your CV or covering letter — these are transmitted directly to the dealer and not stored by us.
We do not transfer data outside the UK/EEA unless appropriate safeguards are in place.
7. Data Retention
| Test-drive telephone numbers | Deleted within 48 hours |
| Job application records (name, contact details, send status) | Until the role's closing date, then deleted |
| Insight & community engagement data | Up to 3 years |
| Bookings, event ticketing & digital delivery | 6 years (accounting) |
| Marketing preferences | Until unsubscribed or withdrawn |
8. Your Rights
You have the right to access, rectify, erase, restrict, port or object to processing, and to complain to the ICO at ico.org.uk.
Where processing is based on consent, you may withdraw that consent at any time — withdrawal does not affect the lawfulness of prior processing. Where processing is based on legitimate interests, you have the right to object, which we will consider against our legitimate grounds.
Requests can be sent to: privacy@xpengowners.com
9. International Operations
XPENG Owners is operated by Elevare Insights Ltd, registered in England & Wales, and our primary legal framework is UK GDPR. Where we operate in other jurisdictions, we align to applicable local privacy laws. These currently include:
- New Zealand Privacy Act 2020
- EU / EEA General Data Protection Regulation (GDPR) 2016/679
- Norway Personal Data Act (Personopplysningsloven) / EEA GDPR
- Sweden Data Protection Act (Dataskyddslagen) / EU GDPR
- Finland Data Protection Act (Tietosuojalaki) / EU GDPR
- Denmark Data Protection Act (Databeskyttelsesloven) / EU GDPR
- Australia Privacy Act 1988 (as amended by the Privacy and Other Legislation Amendment Act 2024)
- United Arab Emirates Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL)
- Israel Privacy Protection Law 5741-1981 and the Privacy Protection Regulations (Data Security) 5777-2017
- Thailand Personal Data Protection Act B.E. 2562 (PDPA 2019)
We operate in over 50 markets globally. Where local privacy legislation applies and we have significant operations in that jurisdiction, we align to those requirements, aligning through the UK GDPR framework. Not all jurisdictions we operate in are listed above. . If you are located in another juristiction and have questions on how we use data: privacy@xpengowners.com.
10. Security
All data is stored on secure, encrypted servers in the UK/EU with restricted access controls. Identifiable data is pseudonymised and separate from engagement and insight data to minimise privacy risk.
11. Children's Data
Our community is intended for adults (18+). We do not knowingly collect data from children.
12. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in law or services. New versions will include an updated "Last Updated" date. Where changes are material, we will notify community members through a transparency notice.
13. Contact Us
Elevare Insights Ltd
71–75 Shelton Street, Covent Garden, London WC2H 9JQ
United Kingdom
ICO Registration: ZC012981