Effective May 5, 2023

This Privacy Policy for Fisker Connected Cars (“Policy”) describes how Fisker group companies (“Fisker” or “we”) collect, use, and share personal information, whether received directly from users (“User” or “you”), through our websites, mobile applications, or other methods, when you use features of a vehicle of a Fisker brand which utilizes an internet connection (“Fisker Connected Car”). Sharing excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties.

This Policy also describes your rights and choices regarding our use and sharing of your information, including how you can access and update such information and that you may have the right to request that we stop processing your personal information.

The Policy applies to all Fisker Connected Car Users, whether you are a customer, driver or passenger of a Fisker Connected Car.

Responsible Fisker group company (controller):

The Fisker group company responsible for and in control of the processing of your personal data depends on your residency:

North America Region: Fisker Group Inc. 1888 Rosecrans Ave, Manhattan Beach, CA 90266.

EU Region including UK: Fisker GmbH: Am Ausbesserungswerk 8, in 80939, Munich Germany

1. Information we Collect

As described below, Fisker collects information that you provide to us, information that is automatically collected while you use the Fisker Connected Cars, and, in some cases, information from other sources such as service partners and third-parties.

A. Information we collect from your Fisker Connected Car to provide the Fisker Connected Car services to you

Fisker collects information from your Fisker Connected Car when you accept to use “Fisker Connected Car and Location Features” to provide such services you requested. This includes the following information:

• Fisker User Profile such as your account registration information and password.

• Network activity and device details such as IP address, device type, operating system, URLs are automatically collected when connecting to the internet.

• Vehicle information such as make & model of the vehicle, configuration, and VIN (vehicle identification number) to identify your vehicle and offer applicable services.

• Telemetry data about vehicle components and parts, including their status and performance, to provide vehicle support, repair and maintenance including remote vehicle diagnostics.

• Diagnostic data about your vehicle such as VIN, hardware model and part numbers, odometer, tire pressure, fuel and fluid levels, battery and lock status, trouble codes, warning indicators and alerts to diagnose, troubleshoot and fix vehicle issues in case of unexpected software, connectivity or component errors or maintenance issues between the normal wear and tear from driving your vehicle.

• Charging data about your vehicle such as location of the charging station, state of charge (SOC), Time -To-Complete Charge (TTC), Battery State of Health (SOH) to inform you about an ongoing charging process.

• Infotainment data about your vehicle connectivity with smart technologies such as sensors, telematic devices, heating and air conditioning controls, GPS, access to the internet, camera, smart phones to offer you the vehicle’s connected infotainment system which provides a fun, safe and productive driving experience.

• Service data such as the service location, date of service conducted, the issues – fixed /repairs performed, parts ordered and replaced, to inform you about your options when a repair or maintenance service is required.

You may prevent certain types of automatic data collection by navigating to privacy settings on your HMI screen of your vehicle and using the controls.

1. Your consent to us collecting information from your Fisker Connected Car for analytics purposes.

The legal basis for the above processing is performing our Fisker Connected Car services.This Policy should be read in conjunction with our Terms of Use.

When you accept to use the “Fisker Connected Car and Location Features” you also consent to us accessing, storing, collecting and processing the above data on your Fisker Connected Car for the purposes of

• analysing the above telemetry, diagnostics, charging and infotainment data to identify possible improvements in the interest of public safety and public interest.

• You can withdraw your consent at any time, e.g., by navigating to privacy settings on your HMI screen on your vehicle using controls. The withdrawal of your consent does not affect the lawfulness of the processing carried out based on the consent before its withdrawal.

When you are asked to provide personal information, you may decline. Note, however, that if you decline to provide necessary information or withdraw your consent, you may not be able to experience some or all of the connected car features that comes with your vehicle or features that you may have subscribed.

C. Other Purposes for which we may process your personal information

In addition to the above purposes, we may use your collected personal information for the following purposes as necessary for compliance with a legal obligation (including compliance with regulator or court orders) to which we are subject and as necessary for the purposes of our legitimate interests, except where such interests are overridden by your interests or fundamental rights and freedoms. Our legitimate interests may include processing:

• To comply with our internal compliance procedures;

• To protect the confidentiality or security of information;

• For fraud prevention, loss prevention, and other crime prevention purposes;

• To assist in the investigation of suspected illegal or wrongful activity, and to protect and defend our rights and property, or the rights or safety of third-parties; and/or

• To enforce our agreements with you or agreements with third-parties.

D. Information from Other Sources

In addition to information which we collect directly from you and your Fisker Connected Car, we may obtain information from others for the above purposes, when you direct them to share information with us and in the following cases:

• Affiliates - We may share and receive personal information among Fisker and its affiliates for the purposes described in this Policy.

• Third-Party Vendors, Service Providers, or Suppliers - We may receive personal information from vendors or agents with whom we work together or that are working on our behalf for the purposes described in this Policy.

• Courts, regulatory agencies, and others - We may receive personal information from courts, regulatory agencies, or other organizations for legal compliance purposes, including but not limited to protect your safety or the safety of others, to protect Fisker’s or others’ rights, to investigate fraud, and/or to meet our tax reporting obligations.

• Combination of Information Sources - We may combine personal information you provide to us, information from your devices, information about you we receive from others, information we generate about you, or other sources.

We also collect information in a form that cannot reasonably be linked back to you. That information is not covered under this Policy.

2. How We May Disclose Information

We may share your personal information as described in this Privacy Policy, including to the following:

• Affiliates - We may disclose some or all of your personal information to our subsidiaries, joint ventures, and Fisker Group companies ( Fisker Group Inc, Fisker Canada Ltd., Fisker GmbH (Austria), Fisker GmbH (Germany), Fisker Denmark Aps, Fisker France SAS, Fisker Norway AS, Fisker Sweden AB, Fisker (GB) Ltd. And other companies under our common control, for the purposes described in this Policy.

• Pursuant to Legal Process - We may also disclose personal information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request for information we receive, or as otherwise pursuant to legal process.

• Protection of Rights and Interests - We may also use and disclose personal information to establish or exercise our legal rights, to enforce our agreements, to assert and defend against legal claims, or if we believe such disclosure is necessary to investigate, prevent, or take other action regarding actual or suspected illegal or fraudulent activities or potential threats to the physical safety or well-being of any person.

• Business Transactions - Subject to applicable law, we reserve the right to transfer some or all personal information in our possession to a successor organization in the event of a merger, acquisition, bankruptcy, or other sale or transfer of all or a portion of our assets. If any such transaction occurs, the purchaser will be entitled to use and disclose the personal information collected by us in the same manner that we can, and the purchaser will assume the rights and obligations regarding personal information as described in this Policy.

• Vendors - We employ other companies to perform functions both on our and your behalf, such as website monitoring and hosting, maintaining and securing the Fisker Connected Cars, sales and order fulfillment, product repairs and maintenance, customer service, credit card processing, IT services, online and offline advertising, analytics, sending and responding to electronic mail, and other functions necessary to support Fisker Connected Cars and the products, future product offerings, and services that we offer.

• Third-Parties - Where permitted by applicable law, or where you have agreed, we may share your name and email with select third-parties whose products or services we think you may be interested in.

• Rewards Program or Other Promotions - If you choose to participate in our Rewards Program or a promotion sponsored by Fisker, we may share your personal information with third-parties (including, without limitation, a co-sponsor) or the public in connection with the administration of such promotion, and as required by law or permitted by the Rewards Program or other promotion’s terms or official rules (such as on a winners list).

• De-identified Data - We may share de-identified information under applicable law.

3. Your Rights and Choices

You have a number of rights and choices with respect to how your information is used.

A. California Consumer Privacy Act (CCPA) Privacy Rights and Disclosures

California residents may have certain privacy rights under state law.

Right to Know - California residents have the right to know certain information about a business’s data practices in the preceding 12 months. In particular, you may have the right to request the following from us:

• The categories of personal information we have collected about you;

• The categories of sources from which the personal information was collected;

• The categories of personal information about you that we have disclosed;

• The categories of third-parties to whom the personal information was disclosed;

• The business or commercial purpose for collecting or selling personal information; and

• The specific pieces of personal information we have collected about you.

Right to Delete - If you are a California resident, you may request that we delete your personal information. Note that deletion requests are subject to certain limitations. For example, we may retain personal information as permitted by law, such as for tax or other record-keeping purposes, to maintain an active Account, and to process transactions and facilitate customer requests.

Right to Opt-Out of Sale - If you are a California resident, you may request that we not disclose your personal information to third parties. Please note that we may continue to share your personal information with our affiliates, service providers, and for essential purposes described above and other such circumstances. To the extent “sale” is interpreted under the CCPA to include advertising technology activities such as those disclosed in the cookies and analytics and advertising sections as a “sale,” we will comply with applicable law as to such activities. You may update your preferences through the cookie consent banner that may appear at the bottom of Fisker websites.

Right to Non-Discrimination - You have the right not to receive discriminatory treatment in terms of price or services for exercising of any your CCPA rights.

Exercising Your Rights - If you are a California resident and the CCPA applies to you, you can submit a consumer request by emailing us at privacy@fiskerinc.com. In your request, please specify the type of request you are making, and provide your name and email. We will verify your request by contacting you via email and respond substantively within the timeframe permitted by law.

California residents may designate an authorized agent to submit requests on your behalf. We will require written proof of the agent’s permission to do so and verify your identity directly with you. Please provide written proof via email to privacy@fiskerinc.com.

Shine the Light - California Civil Code Section 1798.83 permits California residents to request information regarding the disclosure of your personal information by Fisker to third-parties for the third-parties direct marketing purposes. For these entities, this privacy policy applies only to their activities within the State of California. To make such a request, please contact us through our online form or by email at privacy@fiskerinc.com and specify you are making a “California Shine the Light” request.

B . General Data Protection Regulation (GDPR) Disclosure

Individuals in the United Kingdom (“UK”) and European Economic Area (“EEA”) and certain other jurisdictions may have certain rights under applicable law, including the GDPR, which include the right to request confirmation from us about whether or not we are processing your personal information. Where we are processing your personal information, subject to applicable law, you also have the right to:

• Request access to, modification or rectification, or deletion. You have the right to request access to, a copy of, modification of, or deletion of your personal information we maintain.

• Request restriction of processing. You have the right to request that we restrict the processing of your personal information in certain circumstances, such as where you believe that the personal information we hold about you is inaccurate or our processing is unlawful.

• Object to processing. In certain circumstances, you may have the right to request that we stop processing your personal information.

• Data portability. In certain circumstances, you may have the right to receive the personal information concerning you or to request that we transmit your personal information to another data controller.

• Withdraw Consent. Where consent is the basis of processing and provided that we are not required by applicable law or professional standards to retain such information, you may at any time withdraw consent. The withdrawal of your consent does not affect the lawfulness of the processing carried out based on the consent before its withdrawal.

• Lodge a Complaint. You have the right to lodge a complaint with a supervisory authority (in particular in the EU Member State of your habitual residence, place of work or alleged infringement) if you believe we have not complied with applicable data protection laws. The Bavarian data protection authority (Bayerisches Landesamt für Datenschutzaufsicht) is responsible for complaints against Fisker GmbH.

To exercise your rights under GDPR, contact us at privacy@fiskerinc.com. As permitted or required by law, certain data elements may not be subject to access, copy, modification, portability, restriction, and/or deletion. We will respond to reasonable requests as soon as practicable and as required by law. To protect privacy and security, we may take steps to verify an individual’s identity before responding to his or her request.

5. Privacy of Children

Fisker Connected Cars are intended for persons age 18 and older. We do not knowingly collect personal information from minors under 18 years of age. We will delete any personal information later determined to be collected from such individuals.

6. Cross-Border Data Transfers

Our products and services are controlled and operated from the United States. Information from or about you or your use of our products or services may be stored and processed in countries (including the US, Germany, Canada, Denmark, Sweden, UK, Norway, Austria and France),where we have facilities or in which we engage service providers. Those countries may not have the same data protection laws as the country in which you initially provided that information. When we transfer information from or about you or your use of our products or services to other countries, we will protect it as described in this Privacy Policy.

If you are located in the EEA, UK, or Switzerland, we comply with applicable legal requirements for the transfer of personal information to countries outside of the EEA, the UK, or Switzerland. In particular, Fisker has entered into Standard Contractual Clauses issued by the European Commission where appropriate. You may request a copy of such Standard Contractual Clauses by contacting us.

7. Data Security

We endeavour to maintain reasonable administrative, technical, and physical safeguards designed to protect the personal information we maintain against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use. However, we cannot ensure the security of any information you transmit to us, or guarantee that this information will not be accessed, disclosed, altered, or destroyed. We will make any legally required disclosures in the event of any compromise of personal information.

8. Data Retention

We will retain your personal information for as long as you maintain an account or have a contractual relationship with us, and vehicle data until the life cycle of the Vehicle or for as long as necessary to provide the products, future product offerings, or services, or for such longer period as may be required or permitted by applicable law. We will also retain personal information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

9. Modifications to This Policy

We reserve the right to modify this Policy at our discretion, and changes will be effective when we post the revised Policy. Use of the Fisker Connected Cars after posting will be understood as consent to the updated Policy, to the extent permitted by law.

10. Contact Information

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us at privacy@fiskerinc.comor under the postal addresses provided for our Fisker group companies above.