Privacy Notice – Volvo ID

Effective from: 2021-07-05

Published at: 2021-05-31

This document describes how Volvo Cars (as defined below) processes your personal data or personal information (collectively referred to herein as "personal data") when you create and use your Volvo ID to get access to services within the Volvo Cars digital ecosystem (hereinafter "Volvo ID").

You can find the following information below:

1. Who we are

The entity responsible for the processing of personal data in relation to the creation and use of your Volvo ID is Volvo Car Corporation, having its registered office at Assar Gabrielssons Väg, SE-405 31, Gothenburg, Sweden, company registration number 556074-3089, hereinafter referred to as "Volvo Cars," "we," or "us."

2. What personal data we collect and why

The creation and use of your Volvo ID, to get access to services within the Volvo Cars digital ecosystem involves the processing of the following categories of personal data:

We collect your personal identifiers from you (such as first and last name, phone number, preferred language, country, e-mail address, and password) to create an account with us, to provide you with access to the Volvo Cars Services that require a Volvo ID, and to communicate with you regarding your Volvo ID. For the purpose of GDPR, the legal basis of this data processing is the performance of the contract you have entered into with Volvo Cars ((Art. 6.1.b) GDPR).

To provide an overview of your Volvo ID and its connected services on the Volvo ID Portal, we process your personal identifiers (Volvo ID and VIN) and commercial information (vehicle information and services connected to your Volvo ID). For the purpose of GDPR, the legal basis for this processing is a legitimate interest ((Art. 6.1.f) GDPR) to profile all cars and services that are associated with your Volvo ID.

We use your Volvo ID in order to uniquely identify you within the Volvo Cars App. To see how we use and share your information in connection with the Volvo Cars App, see Volvo Cars App Privacy Notice.

We also process the personal identifiers you provide when you created the account (see above) for troubleshooting purposes, in connection with the creation or use of your Volvo ID, and to improve the reliability of our product. For the purpose of GDPR, the legal basis for this is our legitimate interest ((Art. 6.1.f) GDPR) to secure a stable and reliable product for you.

3. How long we keep your data

We will keep your personal data as long as you have a registered Volvo ID. If you delete your Volvo ID (which you can do through the Volvo ID Portal), the Volvo ID, together with associated data, will be deleted thirty (30) days after your deletion request.

4. Who we share your personal data with

We share personal data with third-party processors that support us in providing the Volvo ID and carrying out the purposes above.

Our categories of processors that support us in delivering the Volvo ID are:

account creation and authentication service provider;
data hosting;
distribution of emails and SMS; and
troubleshooting service provider.

They are limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with each data processing agreement in place. In some of these situations, the use of the processors involves limited transfers of personal data outside of the European Union or Canada. We have taken precautions that such transfers are limited to the minimum necessary.

In the preceding 12 months, for business purposes we have shared:

Your personal identifiers and commercial information with our service providers to provide the Volvo ID services, including our data host, troubleshooting provider, and account-creation and authentication provider.
Your personal identifiers and commercial information for research and development purposes to better understand how to improve our products and services.
Your personal identifiers and commercial information with our troubleshooting vendor to identify and repair errors, and to maintain and improve the Volvo ID services.

Volvo Cars does not sell your personal data collected as part of the Volvo ID services.

We reserve the right to transfer any personal data we have in the event of bankruptcy, or if we or any part of our business merges with or is acquired by a third party, or if any such transaction is proposed.

We may also disclose personal data to third parties if we have reason to believe that disclosing such information is necessary to: (i) conduct investigations of possible breaches of law; (ii) identify, contact, or bring legal action against someone who may be violating an agreement they have with us; or (iii) to protect our rights, safety or property.

Finally, we may also share your personal data to comply with applicable laws and regulations, such as to respond to a subpoena, search warrant, or other lawful request for information.

5. Your rights in relation to the data processing we perform

5.1. Your rights under GDPR

As a data subject, you have specific legal rights granted by the General Data Protection Regulation relating to the personal data we process about you. These are briefly explained below, and you can exercise them by filling out the dedicated form indicated below.

Right to withdraw consent: Where you have given consent for the processing of your personal data, you may withdraw your consent at any moment with effect for the future.
Right to access your personal data: You may ask us for information regarding personal data that we hold about you. We will provide you with a copy of your personal data upon request. If you request further copies of your personal data, then we can charge you a reasonable fee that we base on administrative costs. You have the right to information about our safeguards for the transfer of your personal data to a country that is outside the EU and the EEA if you request that we confirm whether or not we process your personal data and we transfer your personal data to a country that is outside the EU and the EEA.
Right to rectification: You may obtain our rectification of incorrect or incomplete personal data concerning you. We make reasonable efforts to keep personal data in our possession or control which are used on an ongoing basis, accurate, complete, current and relevant, based on the most recent information available to us.
Right to restriction: You may obtain our restriction of the processing of your personal data, if:
1. you contest the accuracy of your personal data, for the period we need to verify the accuracy,
2. the processing is unlawful and you request the restriction of processing rather than erasure of your personal data,
3. we no longer need your personal data for the processing purpose but you require them for the establishment, exercise, or defense of legal claims, or
4. you object to their processing while we verify whether our legitimate interests override yours.
Right to portability: You have the right to receive your personal data that you have provided to us and, where technically feasible, to request that we transmit your personal data (that you have provided to us) to another organization, if:
1. we process your personal data by automated means;
2. we base the processing of your personal data on your consent or our processing of your personal data is necessary for the execution or performance of a contract to which you are a party;
3. your personal data are provided to us by you; and
4. your right to portability does not adversely affect the rights and the freedoms of other persons.
You have the right to receive your personal data in a structured, commonly used and machine-readable format. Your right to receive your personal data must not adversely affect the rights and the freedoms of other persons. Your hold the right to have your personal data transmitted from us to another organization if such transmission is technically feasible.
Right to erasure: You have the right to request that we delete the personal data we process about you. We must comply with this request if we process your personal data, unless processing is necessary:
1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject;
3. for archival purposes in the public interest, for scientific or historical research purposes, or for statistical purposes; or
4. for the establishment, exercise, or defense of legal claims.
Right to object: You may object to the processing of your personal data at any time due to your particular situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing, or for the establishment, exercise, or defense of legal claims. If you object to the processing, please specify whether you also request the erasure of your personal data; otherwise we will only restrict it. You also have the right to object at any time, regardless of the reason, to the processing of your personal data for direct marketing (which includes profiling to the extent that it is related to such direct marketing), if such processing was based on our legitimate interest. If the marketing was based on your consent, you can withdraw consent (see above).
Right to lodge a complaint: You can lodge a complaint to your local data protection supervisory authority or with any other data protection authority in the EU. However, we would appreciate it if you first contact us to try and solve your problem – you can find our contact details below.

You can exercise your rights in relation to us by filling out this form, which will help us to deal with your request properly. The online form contains the information that we need to verify your identity and review your request. For requests submitted by telephone or email, you will need to provide us with sufficient information that allows us to reasonably verify that you are the person whose personal data we collected and describe your request in sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information.

5.2. Rights and Additional Information for Canadian Residents

Accessing and Correcting Your Personal Information

For residents of Canada, you have a right to request access to your personal information and to request a correction to it if you believe it is inaccurate. If you would like to have access to the personal information we have about you, or if you would like to have it corrected, please submit a request through our online form here, via email at vcuscare@volvocars.com, or by calling us at 1(800) 550-565. In some cases, we may not be able to allow you to access certain personal information in certain circumstances, for example if it contains personal information of other persons, or for legal reasons.

To help protect against fraudulent requests for access to your personal information, before granting access we may ask you for information to allow us to confirm that the person making the request is you or is authorized to access your information. You will need to provide us with sufficient information that allows us to reasonably verify that you are the person whose personal information we collected, and you must describe your request in sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and correction requests using the information provided, we may ask you for additional pieces of information.

Right to withdraw consent

For the purposes of Canadian law, when you create your Volvo ID, you consent to the processing of personal information we describe in this Privacy Notice. If you have given consent for the processing of your personal information, you may withdraw your consent with effect for the future. Please note that if you withdraw consent that is necessary for us to provide you with products or services, we may no longer be able to provide those products or services to you. Your withdrawal of consent does not have retroactive effect, and there may be cases where, under the applicable law, we are permitted to process certain personal information without consent.

Security

In order to help prevent unauthorized access to or disclosure of personal information, we have put in place physical, electronic, and organizational procedures to help safeguard and secure the personal information we collect.

Personal information may be accessed by persons within our organization or by our third-party service providers who require such access to carry out the purposes described in this Privacy Notice, or are otherwise permitted or required to by applicable law. Personal information we collect is managed from our offices in Richmond Hill, Ontario.

Even though we have taken steps to help protect the personal information in our control, you should know that we cannot fully eliminate security risks associated with personal information. No security measures can provide absolute protection. We cannot ensure or warrant the security of any information you provide to us.

International Data Transfers

Personal information that we collect may be stored and processed in Canada or any other country in which we or our service providers maintain facilities, including in the United States and the European Union. Personal information processed and stored in another country may be subject to disclosure or access requests by the governments, courts, or law enforcement or regulatory agencies in that country according to its laws.

By providing us with personal data, you consent to any such transfer of information outside of your country.

6. Contact information

In order to exercise your rights, please see section 5 above. If you have any other questions regarding the subject matter of personal data protection, you can contact us at the following contact details:

Volvo Car Corporation

Mailing address: Assar Gabrielssons väg, SE-405 31, Gothenburg, Sweden

Email address: globdpo@volvocars.com

7. Changes to our Privacy Notice

We reserve the right to modify our privacy practices and update and make changes to this privacy notice at any time and at our discretion. Whenever we make substantial changes to this notice, and in particular when this notice underlies your consent, we will inform you of the changes and acquire your consent where required by law. This privacy notice is current as of the date which appears at the top of the document.