Privacy Policy

The data controller responsible for the processing of your personal data on this website is:

GUA B.V. Tolnasingel 6-8 2411 PV Bodegraven The Netherlands Chamber of Commerce (KvK): [registration number] VAT: NL[number]B01 Email: privacy@gua-intl.com Phone: +31 10 800 1508

GUA B.V. is the official distributor of Shelby American vehicles for Europe, the Middle East & Asia, and operates the Shelby Europe brand across these regions.

We collect personal data that you voluntarily provide to us and data that is automatically generated when you use our website.

Data you provide directly: • Full name, email address, phone number and country when submitting a contact or enquiry form • Vehicle interest, preferred model and message content • File attachments you choose to upload (e.g. vehicle registration documents) • Payment information when purchasing Team Shelby membership or merchandise (processed by Stripe — we do not store card details) • Newsletter subscription preferences

Data collected automatically: • IP address and approximate geolocation • Browser type, operating system and device type • Pages visited, time on page and referring URL • Cookie identifiers and session data (see Section 8)

We process your personal data on the following legal bases:

Contractual necessity (Art. 6(1)(b)): Processing required to fulfil an order, deliver a vehicle, process a membership, or respond to a pre-contractual enquiry. Legitimate interests (Art. 6(1)(f)): Improving our website, preventing fraud, sending relevant product updates to existing customers, and operating our dealer network. Consent (Art. 6(1)(a)): Sending marketing newsletters, placing non-essential cookies, and processing data for analytics purposes. You may withdraw consent at any time without affecting the lawfulness of prior processing. Legal obligation (Art. 6(1)(c)): Retaining financial records and complying with Dutch and EU law.

We use your personal data for the following purposes:

• Responding to vehicle enquiries, order requests and customer service messages • Processing and fulfilling orders for merchandise, membership and vehicle reservations • Sending transactional emails (order confirmations, shipping updates, warranty activations) • Sending marketing communications where you have opted in • Operating the Shelby Registry and verifying vehicle serial numbers • Improving website performance and user experience through analytics • Complying with legal and regulatory obligations • Fraud prevention and website security

We share your data only where necessary and under appropriate data processing agreements:

Stripe, Inc. — Payment processing for merchandise and membership purchases. Stripe is PCI-DSS Level 1 certified. Data may be transferred to the United States under Standard Contractual Clauses. GoDaddy Inc. — Website hosting and infrastructure. Data is processed within the EU/EEA where possible. Meta Platforms (Facebook) — If you interact with our Facebook page integration, Meta processes data under its own privacy policy. Authorised Dealers & Service Partners — Your enquiry data may be forwarded to the relevant authorised dealer in your country to fulfil your request. Dealers are contractually bound to process data only for the stated purpose. Shelby American, Inc. — Vehicle serial number verification and registry data shared with Shelby American for official registration purposes.

We do not sell, rent or trade your personal data to third parties for their own marketing purposes.

Some of our service providers are located outside the European Economic Area (EEA). Where we transfer personal data to countries that do not provide an equivalent level of data protection, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission • Adequacy decisions issued by the European Commission • Binding Corporate Rules where applicable

You may request a copy of the relevant safeguards by contacting privacy@gua-intl.com.

We retain personal data only for as long as necessary for the purposes described in this policy or as required by law:

Contact form submissions: 3 years from the date of submission Order and transaction records: 7 years (Dutch tax law requirement) Newsletter subscriptions: Until you unsubscribe Website analytics data: 26 months (aggregated after 14 months) Vehicle registry records: Indefinitely (as part of the official Shelby Registry) Cookie consent records: 1 year

We use cookies and similar technologies on this website. Cookies are small text files stored on your device.

Strictly necessary cookies: Required for the website to function (session management, security tokens, cookie consent preferences). These cannot be disabled. Analytics cookies: We use analytics tools to understand how visitors use our site (page views, session duration, traffic sources). These are only placed with your consent. Marketing cookies: If you interact with our social media integrations (e.g. Facebook), third-party cookies may be set. These are only activated with your consent. Functional cookies: Remember your language preference and other personalisation settings.

You can manage your cookie preferences at any time via the cookie banner on our website or by adjusting your browser settings. Withdrawing consent for non-essential cookies will not affect your ability to use the site.

As a data subject in the EU/EEA, you have the following rights:

Right of access (Art. 15): Request a copy of the personal data we hold about you. Right to rectification (Art. 16): Request correction of inaccurate or incomplete data. Right to erasure (Art. 17): Request deletion of your data where there is no compelling reason for its continued processing. Right to restriction (Art. 18): Request that we limit the processing of your data in certain circumstances. Right to data portability (Art. 20): Receive your data in a structured, machine-readable format. Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes. Right to withdraw consent (Art. 7(3)): Withdraw consent at any time where processing is based on consent. Right not to be subject to automated decision-making (Art. 22): We do not make solely automated decisions that produce legal or similarly significant effects.

To exercise any of these rights, please contact us at privacy@gua-intl.com. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or damage. These measures include:

• TLS/HTTPS encryption for all data in transit • Access controls and role-based permissions for staff • Regular security assessments and vulnerability scanning • Pseudonymisation and encryption of sensitive data at rest • Incident response procedures in compliance with GDPR Art. 33

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@gua-intl.com and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or via a prominent notice on our website.

We encourage you to review this policy periodically. Continued use of our website after changes are posted constitutes your acceptance of the updated policy.

For any questions, requests or concerns regarding this Privacy Policy or our data processing practices, please contact:

Privacy & Data Protection GUA B.V. Tolnasingel 6-8 2411 PV Bodegraven The Netherlands Email: privacy@gua-intl.com Phone: +31 10 800 1508

We aim to respond to all privacy-related enquiries within 5 business days.