Privacy Notice – Pick-up & Delivery Service from Volvo Cars

Effective from: 2020-05-21

Published at: 2020-05-21

This Privacy Notice outlines the processing of personal information for compliance with the Protection of Personal Information Act is South Africa.

Pick-up & Delivery Service is a service offered to Volvo Cars customers or customers of an entity in the Partner Group, which allows customers to schedule test drive and/or a service appointment directly through the Pick-up & Delivery Service app and have their vehicle picked up from their chosen location with the option to have a loaner, only if available, delivered or exchange your current leased vehicle for a new leased vehicle (hereinafter also the “Pick-up & Delivery Service”).

Who we are

The data controller for all personal data collected and processed in relation to the Pick-up & Delivery Service is Volvo Car South Africa, having its registered office at 71 Regency Drive, Route 21 Corporate Park, Irene (hereinafter “Volvo Cars”), together with the Volvo dealer where you request the Pick-up & Delivery Service (hereinafter “Volvo dealer” or “dealer”).

Personal data collected and processing purposes

POPIA: Chapter 3, article 13.

The use of the Pick-up & Delivery Service involves the processing of the following categories of personal data:

Drivers performing the Pick-up & Delivery Service as well as customers using the service need to create an account. In this case we will process: first and last name, contact details (email, personal and work phone numbers), password (hashed). This is done in the course of our provision of the service to our customers, in order to identify the driver and the customer and ensure communication with them. We also require drivers to upload a photo of themselves to ensure that the customer can see the person that will greet them and take over their vehicle.
1. If you are a customer of the Pick-up & Delivery Service, the legal basis of the data processing is performance of a contract to which you are a party.
2. If you are a driver who creates an account with the app and provides Pick-up & Delivery Service within the framework of the app, the legal basis of the data processing is performance of the app usage contract you have entered into with Volvo Cars. If you are a driver and provide services in the context of Pick-up & Delivery Service as necessary to fulfil the employment contract that you have concluded with the respective Volvo dealer as your employer, the legal basis for data processing is to carry out the employment relationship. If you are a driver and either provide services in the context of Pick-up & Delivery Service which are not necessary to fulfil the employment contract you have concluded with the respective Volvo dealer as your employer or if you are contracted by the respective dealer, the legal basis of the data processing is for the purposes of our legitimate interests. Our legitimate interest is that we want to enable the driver to provide the Pick-up & Delivery Service to the customer via the app. Our legitimate interest is also that we want to improve the contact between driver and customer with the uploaded photo of the driver.
When a Pick-up & Delivery Service is performed, we track the location of the driver through their smartphone. This is done in order to calculate the estimated time for the service.
1. The legal basis of the data processing is performance of the app usage contract you have entered into with Volvo Cars.
2. If you are a driver and perform the Pick-up & Delivery Service as necessary to fulfil the employment contract that you have concluded with the respective Volvo dealer as your employer, the legal basis for data processing is to carry out the employment relationship. If you are a driver and either providing services in the context of Pick-up & Delivery Service which are not necessary to fulfil the employment contract you have concluded with the respective Volvo dealer as your employer or if you are contracted by the respective dealer, the legal basis of the data processing is for the purposes of our legitimate interests. Our legitimate interest is that we want to calculate the arrival times of the driver. We also want to use it to organise which drivers can be assigned to which service.
When a customer uses the Pick-up & Delivery Service, we collect more information about the customer:
- Customer Pickup & Delivery Service History – in order to know which services have been completed;
- Customer Driver's License – if the customer uses a loaner vehicle;
- Customer Insurance Card - Needed if the customer uses a loaner vehicle;
- Customer License Plate and VIN number - Needed to identify vehicle;
- Pickup Address - Needed to provide the service;
- Pickup Notes inserted by customer (if any);
- Service Notes inserted by workshop (if any);
- Vehicle interested in for test drive (if any);
- Customer trade-in vehicle photos (if any);
- Dropoff Address - Needed to provide the service;
- Dropoff Notes inserted by customer (if any); and
- IP address.
The legal basis of the data processing is performance of a contract to which you are a party.
When we send customers push notifications with the status updates of the service through the Pick-up & Delivery Service app, we use the following categories of data in order to keep track of notifications sent:
- Unique Device Identifier;
- Push notification token;
- Push notification title (May contain the names of customers, drivers, vehicle make/model/colour);
- Push notification body (May contain the names of customers, drivers, vehicle make/model/colour); and
- IP address.
1. If you are a customer of the Pick-up & Delivery Service, the legal basis of the data processing is performance of a contract to which you are a party.
2. If you are a driver and a push notification was sent which contains your name as necessary to fulfil the employment contract that you have concluded with the respective Volvo dealer as your employer, the legal basis for data processing is to carry out the employment relationship. If you are a driver and a push notification was sent which contains your name and either this is not necessary to fulfil the employment contract you have concluded with the respective Volvo dealer as your employer or if you are contracted by the respective dealer, the legal basis of the data processing is for the purposes of our legitimate interests to provide the customer with the most accurate information possible about the current status of the service.
When feedback is left after performance of the service, we collect the names of the customer and of the driver, the rating and comments given by the customer. The legal basis of the data processing is for the purposes of our legitimate interests to continuously improve our services for the customer. Furthermore, it is the customer's decision whether to give a feedback.
The quality of our service is essential and, because liability issues may arise regarding alleged damages to the car, we keep photos of the vehicle, along with timestamps and location, in our interest to defend our (and our partners and drivers involved in the service) rights and interests. The legal basis of the data processing is for the purposes of our legitimate interest that in case of damage we want to clarify as simply as possible whether the damage was caused by drivers during the performance of the service.
When you send us an e-mail with the request for support in using the Pick-up & Delivery Service app or if you have any other questions in the context of our Pick-up & Delivery Service offer. In the case of an existing customer relationship, the legal basis for data processing is performance of a contract to which you are a party. In the case of a general request without a customer relationship, the legal basis of the data processing is for the purposes of our legitimate interests to offer you an easy way to contact us.
When you use the Pick-up & Delivery Service app, we use Google Analytics to better understand user behaviour and improve the usability of the app. We thus process your IP address, which is anonymised immediately after the collection. The legal basis for the data processing is your consent POPIA (SA).

Retention times

POPIA : Chapter 3, article 14.

The following retention times are applicable for our processing of personal data mentioned above:

Data about drivers (all categories of data except IP address): 1 year from last activity in the service;
Data about customers (all categories of data except IP address): 3 years;
Quality and liability data: 3 years from the service, unless disputes arise in which case the period is extended with the time required to finalise the dispute;
IP address: 3 months; and
Google Analytics Data 14 months.

In addition, the Volvo dealer providing the service is subject to various retention and documentation obligations and may also be required by law to disclose personal data to authorities (Art. 6 Para. 1 Sen. 1 lit. c) GDPR). This information can be found in the privacy policy of the dealer.

Recipients of your personal data

POPIA: Chapter 9, article 72.

Processing by other members of the Volvo Car Group

Your personal data is processed by Volvo Car Corporation, Assar Gabrielssons Väg, SE-405 31 Gothenburg, Sweden. Furthermore, your personal data is processed by our data processor Volvo Car Technology USA LLC, who supports us in the field of introducing and training the respective Dealer and in case of its IT problems in the context of Pick-up & Delivery Service. When we use our data processor in the context described, personal data will be transferred to the USA. The transfer of data, by an international company, will comply with POPIA: Chapter 9, Article 72 of the act.

Processing by other parties

We will share your personal data with the following categories of third parties, on a need-to-know basis:

Amazon Web Services Ireland Limited and its sub processors (European Union) – Data Hosting
Google Ireland Limited together with its subprocessors (see list of datacentres at https://www.google.com/about/datacenters/inside/locations/index.html; data transfer also to Google LLC, United States of America, under Standard Contractual Clauses) –– Google Analytics is used to track events inside of the Pick-up & Delivery Service apps such as clicks, location, page views, etc. This allows us to optimize the product and carry out Pick-up & Delivery Service. The following information is tracked in Google Analytics:
- Data Visualization – Tools to create charts, graphs, and other visualizations of data for analysing and improving the Pick-up & Delivery Service.
- Geolocation – Location data is used to locate pickup, drop-off and test drive locations for cars engaging in Pick-up & Delivery Service.
To view how Google uses data when you use the Pick-up & Delivery Service app, please click here https://www.google.com/policies/privacy/partners.
Branch Metrics Inc (United States of America, under Standard Contractual Clauses) – Push Notifications.
Twilio Inc. and its sub processors (United States of America, under Twilio’s binding corporate rules and the Standard Contractual Clauses) – SMS Communication.
Slack (United States of America, under Standard Contractual Clauses) – An internal communication tool used by Volvo Cars Technology USA LLC. Your data may be shared between our employees on this tool as a result of investigating a bug or issue.

All of such third parties act as our processors and are limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with each data processing agreement in place.

Your rights in relation to the data processing we perform

POPIA: Chapter 3, article 11.

As a data subject you have specific legal rights granted by the POPIA Regulation (SA citizens) relating to the personal data we process about you:

Right to withdraw consent: Where you have given consent for the processing of your personal data, you may withdraw your consent at any moment with effect for the future.
Right to access your personal data: You may ask from us information regarding personal data that we hold about you. We will provide you with a copy of your personal data upon request. If you request further copies of your personal data, then we can charge you with a reasonable fee that we base on the administrative costs. You have the right to the information about our safeguards for the transfer of your personal data to a country that is outside the EU and the EEA if you request that we confirm whether or not we process your personal data, and we transfer your personal data to a country that is outside the EU and the EEA.
Right to rectification: You may obtain from us rectification of incorrect or incomplete personal data concerning you. We make reasonable efforts to keep personal data in our possession or control which are used on an ongoing basis, accurate, complete, current and relevant, based on the most recent information available to us.
Right to restriction: You may obtain from us restriction of processing of your personal data, if
1. you contest the accuracy of your personal data, for the period we need to verify the accuracy,
2. the processing is unlawful, and you request the restriction of processing rather than erasure of your personal data,
3. we do no longer need your personal data for the processing purpose, but you require them for the establishment, exercise or defense of legal claims, or
4. you object to the processing while we verify whether our legitimate grounds override yours.
Right to portability: You have the right to receive your personal data that you have provided to us, and, where technically feasible, request that we transmit your personal data (that you have provided to us) to another organization, if:
1. we process your personal data by automated means;
2. we base the processing of your personal data on your consent, or our processing of your personal data are necessary for the execution or performance of a contract to which you are a party;
3. your personal data are provided to us by you; and
4. your right to portability does not adversely affect the rights and the freedoms of other persons.
You have the right to receive your personal data in a structured, commonly used and machine-readable format. Your right to receive your personal data must not adversely affect the rights and the freedoms of other persons. Your right to have your personal data transmitted from us to another organization is a right you have if such transmission is technically feasible.
Right to erasure: You have the right to request that we delete the personal data we process about you. We must comply with this request if we process your personal data, unless processing is necessary:
1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject;
3. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or
4. for the establishment, exercise or defense of legal claims.
Right to object: You may object – at any time – to the processing of your personal data due to your particular situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing or for the establishment, exercise or defense of legal claims. If you object to the processing, please specify whether you also wish the erasure of your personal data, otherwise we will only restrict it. You may object – at any time - to the processing of your personal data for direct marketing purposes.
Right to lodge a complaint: You can lodge a complaint to your local data protection supervisory authority or with any other data protection authority in SA. However, we will appreciate if you first contact us to try and solve your problem. You can exercise your rights in relation to us by filling out this form.

Contact information

In order to exercise your rights, please use the applicable web form mentioned above. If you have any other questions regarding the subject matter of personal data protection, you can contact us at the following contact details:

E-mail address: volvocrc@volvocars.com.

Changes to our Privacy Notice

We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. For this reason, we encourage you to refer to this privacy notice on an ongoing basis. This privacy notice is current as of the date which appears at the top of the document. We will treat your personal data in a manner consistent with the privacy notice under which they were collected, unless we have your consent to treat them differently.