Volvo Cars App Privacy Notice

Effective from: 2024-09-23

Published at: 2024-09-23

This document describes how Volvo Cars (as defined below) collects, uses, holds, discloses and otherwise processes your personal information when you use the Volvo Cars mobile application (hereinafter “Volvo Cars App”), that keeps you connected to your Volvo vehicle. Your use of our services constitutes your agreement under New Zealand law to our privacy practices.

The Volvo Cars App has several functionalities, which entail different types of personal information processing, as we will explain below. Depending on your market and the type of subscription you have, these functionalities can be grouped as follows:

The Volvo Cars services – this includes the aspects mentioned under sections 2.1 (When you use the Volvo Cars App), 2.2 (The Volvo Cars remote vehicle services), 2.3 (Driving Journal), 2.4 (Charging), 2.5 (Car sharing with Guest functionality), 2.6 (App Analytics), 2.7 (Research and development), 2.8 (Your subscription for the Volvo Cars App) below.

We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. Whenever we make substantial changes to this notice, we will inform you of the changes. This privacy notice is current as of the date which appears at the top of the document.

You can find below:

1. Who is responsible for the processing of your personal information

The responsibility for the processing of your personal information in the Volvo Cars App belongs to Volvo Car Corporation, having its registered office at Assar Gabrielssons Väg, SE-405 31, Gothenburg, Sweden, company registration number 556074-3089, hereinafter referred to as “Volvo Cars”.

2. Personal data collected, why and for how long

As mentioned previously, Volvo Cars App comes with a number of different functions depending on your car model and your market – some of the functions described below might not be applicable for you.

2.1 When you use the Volvo Cars App

When you use the Volvo Cars App, we automatically collect data about your use of the Volvo Cars App in order to monitor its functioning and undertake troubleshooting measures when necessary. In order to do this, we use information such as device information (e.g., device manufacturer, app installation ID), general vehicle information (e.g., vehicle model and type, year, user country) and usage data (e.g., clicks, views and potential issues or errors). This processing is necessary for our legitimate interest to provide you with a secure and functioning Volvo Cars App. The information used for this purpose is retained for 30 days from collection.

2.2 The Volvo Cars remote vehicle services

We collect identifiers (such as your first and last name, phone number, Volvo ID (e-mail address), vehicle identification number – “VIN”, unique device identifier, and push notification token) and purchase history (ownership period, any subscription services in which you are enrolled, and the model and year of your vehicle and corresponding vehicle specifications).

We use this information to provide the Volvo Cars remote vehicle services, such as the ability to control your vehicle remotely (e.g. pre-climatisation, unlock/lock doors, remote start/stop of engine, current outside temperature, receive theft alarm notifications), viewing the status of your vehicle (e.g. fuel level, windshield washer fluid levels, brake fluid levels, door lock status, tyre pressure or maintenance warnings, battery status, or other vehicle status indicators).

We also use this information to send push notifications within the Volvo Cars App related to upcoming maintenance and service reminders for your vehicle. For hybrid and full electric cars, we store charging location to be able to offer a convenient way to schedule the charging. We collect your vehicle location information as well as, if you allow this, location of your mobile device, for you to use the map functionalities in the Volvo Cars App, and to show you your position relative to your Volvo on the map.

Wherever you are not asked specifically whether you agree to any data processing, the reason why we process this data is in order to perform our contract with you (Art. 6.1. (b) GDPR). However, if the New Zealand privacy law requires your consent, your use of the Volvo Cars App and services represents such consent.

If, through your mobile settings, you grant us access to your location data, calendars and contacts, we will process this personal information to supply an easy way for you to send location of a point of interest from your phoand collect your vehicle location information automatically through your vehicle telematicsne to the car based on your contact list, calendars events or search results. The legal basis for this processing is your consent (Art. 6.1.(a) GDPR).

When your Volvo Cars subscription comes to an end, the details linked with this service, including your personal information, will be deleted after ninety (90) days. Note that the Volvo Cars subscription follows the car, therefore if there is a change of ownership you as a seller are responsible to disconnect your car from the app and get your data deleted. This also applies for registered Primary driver in case of car lease. Follow this link for instructions.

2.3 Driving Journal

The Volvo Cars App allows you to choose to log your Driving Journal. This may be useful to you if, for example, you expense mileage. The Driving Journal must be activated by you, otherwise it stays inactive and the data is not collected.

If you do activate the Driving Journal, we collect your identifiers (such as first and last name, phone number, e-mail address, and VIN) and collect automatically through your vehicle telematics your vehicle location information (start and stop, or continuously depending on type of car as described below) to identify each trip including trip related information (time, distance, fuel and/or electricity consumption, electricity generation if hybrid) and mileage. For petrol and diesel cars, the Driving Journal only contains the start and finish positions of each driving cycle. However, if you have a hybrid/twin engine model, the Driving Journal also includes information about your routes.

We process this data based on your consent (Art. 6.1.(a) GDPR).

As a rule, the Driving Journal data is stored for 100 days. In special situations, such as cars benefiting from the Recharge Refund, the Driving Journal data is stored for 500 days.

You can at any time deactivate the Driving Journal, and in this case the data will stop being collected. This does not however automatically trigger the deletion of the previously collected information.

2.4 Charging

2.4.1 Public charging

2.4.2 Plug & Charge

Plug & Charge allows you to charge at a public charger without using an app, RFID or card. Compatible charging stations can identify your vehicle and verify your charging contract without any manual input, which means that you can start charging by just plugging in the cable.

When you use Plug & Charge, we process the following personal data:

VIN;
PCID (Provisioning Certificate ID); and
Contract certificate.

The processing of your personal data in relation to Plug & Charge is necessary for the performance of our agreement with you.

We will retain the aforementioned data until the contract certificate is removed from the vehicle.

2.5 Car sharing with Guest functionality

When using the car sharing with Guest functionality available through the Volvo Cars App, Volvo Cars processes the following personal information:

Your and your Guest’s Volvo ID – for identification and to make it possible to save your individual settings separately.
Your and your Guest’s mobile phone number – to send invitations to Guests through SMS.
Car model, model year, car color, license plate and location of the car to make it easier for the Guest to find the car.
Car door lock status - to open and lock the car and make sure that the car is locked after use.
Driving Journal data (if enabled) of Guest trips are available for both the Guest and the Primary driver, all driving journal data for the car is only available for the Primary driver.

Under GDPR, the legal basis for the processing of your data is your contract with us (Art. 6.1. (b) GDPR), while the legal basis for the processing of the guest’s personal data is our legitimate interest (Art. 6.1. (f) GDPR) to give you the benefit of the car sharing functionality. Under New Zealand law, your and your guest’s use of the service represents consent.

We will retain this personal information until 1) the Guest is removed by the Primary driver, 2) according to Driver Journal retention rules or 3) until the subscription comes to an end, whichever comes first.

2.6 App Analytics

We measure how our app is being used in order to better understand user behaviour and improve the usability and reliability of the app, as well as to gain insights into how the services are used and improve your experience of these services. We do this by using Google Analytics (in restricted mode), and we process your device ID, device IP address (pseudonymised immediately after collection), Volvo ID and vehicle connection status.

The legal basis for this data processing is our legitimate interest ((Art. 6.1.f) GDPR) to improve the usage and experience of our our app and our services.

This data will be stored for fourteen (14) months from collection.

2.7 Research and development

For research and development purposes to better understand how to improve our products and services and which new ones to develop, we use a data-driven approach and leverage vehicle (such as VIN), product (such as Volvo Cars App usage), customer (such as Volvo ID) and sales data (such as selling or servicing retailer) to inform the direction of the development of our products and services. The processing spans a wide range of analytics, modelling and research performed by our analysts and data scientists.

The legal basis for this processing is our legitimate interest ((Art. 6.1.f) GDPR). Where possible, we restrict analyses to anonymised or pseudonymised data. The processing does not include any automated decision concerning you.

We retain this data for ten (10) years.

2.8 Your subscription for the Volvo Cars App

If you have a subscription for the Volvo Cars remote vehicle services, you will get the opportunity to renew this service in the Volvo Cars App. When you do this, as well as to manage your subscription, we process your identifiers (such as first and last name, phone number, e-mail address, VIN) and your purchase status and history. The purpose of our processing is to administer and monitor your purchase (from purchase to delivery) including any necessary contacts with authorities for official reporting, administration of your request for related services, follow up on the delivery, and to communicate updates related to the services that you have purchased. We use a third-party payment provider to process your payments, and that is a separate processing of your personal information by them; you can read more about the privacy practices of our payment processor in section 3 below.

Under GDPR, the legal basis for our processing of your personal data is that this processing is necessary for the performance of our contract (Art. 6.1. (b) GDPR) with you.

We will retain your personal information for ninety (90) days after your Volvo Cars subscription has expired, in order to enable continuation of the service if you choose to resubscribe. In addition, we will archive the data relating to your purchase so long as required under our obligations to comply with accounting and financial reporting legislation (Art. 6.1. (c) GDPR).

3. How your personal information is shared

The processing mentioned above by Volvo Car Corporation involves processing of your personal information including with the following categories of third parties, on a need-to-know basis:

Sharing with agencies that support us (processors)

Our categories of agencies supporting delivering the Volvo Cars App are:

cloud connectivity service provider;
data hosting;
push notifications;
distribution of emails;
chat functionality and customer care handling;
selected Volvo Car retailers for digital service booking and Volvo Valet; and
subscription invoice handling provider.

They are limited by contract in their ability to use your personal information for any purpose other than to provide services for us in compliance with each data processing agreement in place.

Sharing with other members of the Volvo Car Group

Personal information mentioned under sections 2.7 and 2.8 above is shared with our importer in the country where the information originates from, for the following purposes:

assessing retailer performance;
assessing subscription extentions and reactivations.

Collection by other third parties (separate controllers)

We process payments through third parties that collect payment data directly from you and do not share it with us:

Stripe Inc. (provider of payment service, billing, invoicing and subscription administration). You can view their privacy policy at https://stripe.com/en-se/privacy.

The Volvo Cars App uses Google Maps to show your and your car’s location. You can view their privacy policy at https://policies.google.com/privacy.

In some of these situations provision of services by third parties involves limited transfers of personal information outside of New Zealand. We take precautions with such transfers to protect your personal information. We may also store your personal information overseas but will take steps to ensure its security.

We may also share your personal information in any way permitted byt eh Privacy Act 2020 or as authorised by you.

4. Your rights in relation to the personal information we hold about you

4.1 Your rights under GDPR

As a data subject you have specific legal rights granted by the General Data Protection Regulation relating to the personal data we process about you. These are briefly explained below, and you can exercise them by filling out the dedicated form indicated below.

Right to withdraw consent: Where you have given consent for the processing of your personal data, you may withdraw your consent at any moment with effect for the future.
Right to access your personal data: You may ask from us information regarding personal data that we hold about you. We will provide you with a copy of your personal data upon request. If you request further copies of your personal data, then we can charge you with a reasonable fee that we base on the administrative costs.
Right to rectification: You may obtain from us rectification of incorrect or incomplete personal data concerning you. We make reasonable efforts to keep personal data in our possession or control which are used on an ongoing basis, accurate, complete, current and relevant, based on the most recent information available to us.
Right to restriction: You may obtain from us restriction of processing of your personal data, if:
1. you contest the accuracy of your personal data, for the period we need to verify the accuracy,
2. the processing is unlawful and you request the restriction of processing rather than erasure of your personal data,
3. we do no longer need your personal data for the processing purpose but you require them for the establishment, exercise or defense of legal claims, or
4. you object to the processing while we verify whether our legitimate grounds override yours.
Right to portability: You have the right to receive your personal data that you have provided to us, and, where technically feasible, request that we transmit your personal data (that you have provided to us) to another organization, if:
1. we process your personal data by automated means;
2. we base the processing of your personal data on your consent, or our processing of your personal data are necessary for the execution or performance of a contract to which you are a party;
3. your personal data are provided to us by you; and
4. your right to portability does not adversely affect the rights and the freedoms of other persons.
You have the right to receive your personal data in a structured, commonly used and machine-readable format. Your right to receive your personal data must not adversely affect the rights and the freedoms of other persons. Your right to have your personal data transmitted from us to another organization is a right you have if such transmission is technically feasible.
Right to erasure: You have the right to request that we delete the personal data we process about you. We must comply with this request if we process your personal data, unless processing is necessary:
1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject;
3. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or
4. for the establishment, exercise or defense of legal claims.
Right to object: You may object – at any time – to the processing of your personal data due to your particular situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing or for the establishment, exercise or defense of legal claims. If you object to the processing, please specify whether you also wish the erasure of your personal data, otherwise we will only restrict it. You also have the right to object at any time, regardless of any reason, to the processing of your personal data for direct marketing (which includes profiling to the extent that it is related to such direct marketing), if such processing was based on our legitimate interest. If the marketing was based on your consent, you can withdraw consent (see above).
Right to lodge a complaint: You can lodge a complaint to your local data protection supervisory authority or with any other data protection authority in the EU. However, we will appreciate if you first contact us to try and solve your problem – you can find our contact details below.

You can exercise your rights in relation to us by filling out this form, which will help us to deal with your request properly. You will need to provide us with sufficient information that allows us to reasonably verify that you are the person whose personal data we collected and describe your request in sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information.

4.2 Your rights under the New Zealand Privacy Act

As an individual you have rights under the Act in relation to the personal information we hold about you. These are briefly explained below, and you can exercise them by filling out the dedicated form indicated below.

Right to access your personal information: You or your representative may ask from us information regarding personal information that we hold about you. We will confirm whether we hold any personal information about you and provide you with a copy of your personal information upon request (subject to certain reasons for refusal under the Act). We may charge you with a reasonable fee that we base on our administrative costs.
Right to request correction of your personal information: You or your representative may ask us to correct personal information held by us about you. We will make reasonable efforts in the circumstances to ensure that personal information held by us is accurate, up to date, complete and not misleading, based on the most recent information available to us. When requesting the correction of personal information or at any later time, you may ask us to attach a statement of correction to the information if we decide not to make the correction sought.
Right to lodge a complaint: You can lodge a complaint to the Privacy Commissioner orally or in writing – see https://privacy.org.nz/ for more information. However, we will appreciate if you first contact us to try and solve your problem – you can find our contact details below.

You may exercise these rights by using the form referred to in section 4.1 above.

5. Contact information

In order to exercise your rights, please see section 4 above. If you have any other questions regarding the subject matter of personal information protection, you can contact us at the following contact details:

Volvo Car Corporation

Post address: Assar Gabrielssons väg, SE-405 31, Gothenburg, Sweden

E-mail address: globdpo@volvocars.com

6. Changes to our Privacy Notice

We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. Whenever we make substantial changes to this notice, and in particular when this notice underlies your consent, we will inform you of the changes. This privacy notice is current as of the date which appears at the top of the document.