DIGITAL RETAIL SERVICE PRIVACY NOTICE
EFFECTIVE DATE: July 8, 2021
This Service Privacy Notice describes the privacy practices of Volvo Cars Canada LLC (referred to as “Volvo Cars Canada”, “we”, “our”, or “us”) with respect to processing related to our Digital Retail Service (“Service”), which allows you to obtain an estimate of the trade-in value of your vehicle, build a vehicle model, make a deposit for a vehicle, and apply for credit, among other things. We respect individual privacy and we appreciate the trust you place in us when you give Volvo Cars Canada your personal information. In this context, “personal information” is defined as any factual or subjective information, recorded or not, about an identifiable individual.
You can find below:
- How we obtain your meaningful consent;
- What personal information we collect;
- How we share your personal information;
- How we address the security, storage, and retention of personal information;
- How we address international transfers of personal information;
- Your privacy rights and choices;
- Links to external websites;
- How we make changes to our Privacy Notice; and
- How you can contact us.
YOUR MEANINGFUL CONSENT
We hope this Service Privacy Notice gives you enough transparency so you can make an informed decision before giving us your personal information. We will never take your consent for granted and your consent is voluntary and can be always revoked, subject to limitations as permitted under the applicable laws. If you withdraw consent that is necessary for the Services, we may not be able to provide you with those Services.
We collect your personal information through web forms that you submit at different points throughout the Service, such as when you ask to ‘Save for Later’ a model or deal you have built using the Service, request a valuation of your trade-in vehicle, book an appointment, submit information for the credit application process, and other forms available on the Service. By using our Digital Retail Service, you give Volvo Cars Canada, our affiliates, and authorized retail partners your meaningful consent to process your personal information for the purposes for which you provide it, and as described in this Privacy Notice.
INFORMATION WE COLLECT AND WHY
The Digital Retail Service gives our customers the ability to complete some of the steps required or often taken to commence the purchase a Volvo car in an online, digital format. When you use our Service, we will collect personal information from you and use your information for the legitimate business purposes described in this Privacy Notice.
HOW WE SHARE YOUR PERSONAL INFORMATION
We have shared your personal information for a business purpose:
- Identifiers and Commercial Information with your authorized Volvo retailer to process the purchase or lease of your vehicle and, if you will trade-in your current vehicle, allow the retailer to give you an estimated appraisal value and update your new vehicle’s payment information.
- Identifiers and Financial Information with your financial institution, authorized Volvo retailer, and adjudicating partners to process your credit application and give you credit adjudicating for the lease or finance of your vehicle from the retailer.
- Identifiers and Financial Information with our credit card processor (Stripe) to process your deposit and, on your behalf, submit your deposit to your authorized Volvo retailer.
We may also share the personal information collected from the Digital Retail Service in the following circumstances:
- As a result of a change in our corporate structure: in the event that we enter into, or intend to enter into, a transaction that alters the structure of our business, such as a reorganization, merger, acquisition, sale, joint venture, assignment, consolidation, transfer, change of control, or other disposition of all or any part of our business, assets, or stock, we would share any personal information collected about you with third parties, including the buyer or target (and their agents and advisors) for the purpose of facilitating and completing the transaction. We will share personal information with third parties if we undergo bankruptcy or liquidation, in the course of such proceedings.
- To prevent harm: we will share personal information if we believe it is necessary to detect, investigate, prevent, or act against illegal activities, fraud, or situation(s) involving potential threats to the rights, property, or personal safety of any person.
- For legal purposes: we will share personal information where we are legally required to do so such as in response to court orders, law enforcement, or legal process, including for national security purposes; to establish, protect, or exercise our legal rights, as required to enforce our terms of service or other contracts; to defend against legal claims or demands; or to comply with the requirements of any applicable law.
- With your consent: apart from the reasons identified above, we may ask for your permission to share your personal information for a specific purpose for which we do not already have your consent.
INFORMATION SECURITY, STORAGE, AND RETENTION
To help protect your personal information from loss, theft, and unauthorized access, use, or disclosure, we have implemented technical, administrative, and physical security measures including 256-bit encryption, access controls, and secure development processes. Unfortunately, no method of transmission over the Internet, or method of electronic storage, is 100% secure or impenetrable. We cannot ensure or warrant the security of any information you provide to us.
Your personal information is stored on secured servers with restricted access. By giving us your meaningful consent to collect your personal information, you agree to the transfer and storage of your information on our and our service providers servers, including those
INTERNATIONAL DATA TRANSFERS
Personal information that we collect may be stored and processed in Canada or any other country in which we or our service providers maintain facilities, including in the United States and Sweden. Personal information processed and stored in another country may be subject to disclosure or access requests by the governments, courts or law enforcement or regulatory agencies in that country according to its laws. By providing us with personal information , you consent to any such transfer of information outside of your country.
PRIVACY RIGHTS AND CHOICES
Accessing and correcting your personal information:
You have a right to request access to your personal information and to request a correction to it if you believe it is inaccurate. If you would like to have access to the personal information we have about you, or if you would like to have it corrected, please contact us using the contact information below. In some cases, we may not be able to allow you to access certain personal information in certain circumstances, for example if it contains personal information of other persons, or for legal reasons. To help protect against fraudulent requests for access to your personal information , we may ask you for information to allow us to confirm that the person making the request is you or is authorized to access your information before granting access. You will need to provide us with sufficient information that allows us to reasonably verify that you are the person whose personal information we collected and describe your request in sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion correction requests with the information provided, we may ask you for additional pieces of information.
Right to withdraw consent:
Where you have given consent for the processing of your personal information, you may withdraw your consent with effect for the future. Please note that if you withdraw consent that in necessary for us to provide you with products or services, we may no longer be able to provide those products or services to you. You may withdraw any consent you have provided to our use of personal information to market to you without withdrawing consent needed to provide our goods and services. Your withdrawal of consent does not have retroactive effect, and there may be cases where we are permitted under the applicable law to process certain personal information without consent.
We have designated a Privacy Officer responsible for data privacy compliance and adherence to the fair information principles. At your request, our Privacy Officer can provide you with further information regarding our processing and protection of your personal information (see “Contact Information” below).
This website may contain links to other sites that Volvo Cars Canada does not own or control and is not responsible for. Please be aware that Volvo Cars Canada is not responsible for the privacy practices of such other sites. You should read the privacy statements of every website that you visit. This privacy statement applies solely to information collected by through the Digital Retail Services.
HOW WE MAKE CHANGES TO OUR PRIVACY NOTICE
This Privacy Notice is current as of the date which appears at the top of the document.
SCOPE AND PURPOSE
This policy is applicable to the Processing of customers' Personal Data at all companies included in the Volvo Car Group ("Volvo Cars" or "we"). The purpose of this policy is to provide our current, former and potential customers (jointly referred to as "customers" or "you") with a general understanding of:
- The circumstances under which we collect and process your Personal Data
- The types of Personal Data we collect
- The reasons for collecting your Personal Data
- How we handle your Personal Data
- Distribution of responsibility for the Processing of Personal Data between various legal entities at Volvo Cars, and
- Contact details for us so you can receive information about and claim your rights in relation to our processing of your Personal Data.
This policy is updated continuously to reflect the measures taken by Volvo Cars in relation to your Personal Data.
Volvo Car Corporation (a Swedish legal entity with corporate registration number 556074-3089) is the Data Controller for research and development of new and current vehicle models, and also for certain global services offered to customers. Furthermore, Volvo Car Corporation is Data Controller for handling Personal Data processed for monitoring the quality of the vehicles and any potential safety recalls as well as to meet regulatory requirements.
Each national sales company within Volvo Cars is generally responsible for marketing, sales and customer relations as well as market-specific services in its market. The national sales company is Data Controller for the Processing of Personal Data taking place for these purposes. In markets without a national sale company, an importer usually has the same responsibility as a national sale company. Therefore, the importer is the Data Controller in these instances. Volvo Cars contractually requires its dealers and repairers to comply with rules concerning data protection. Please note, that Volvo Cars and its authorized dealers and repairers are separate legal entities and that we are generally not responsible if such dealers and repairers do not follow applicable laws. If you have questions regarding your dealer's or repairer's use of your Personal Data, please contact the dealer or repairer directly.
PRINCIPLES OF DATA PROCESSING
The Processing of your Personal Data forms an important part of our provision of products and services to you. We appreciate the trust you place in us when providing us with your Personal Data, and consider your privacy an essential part of the services we offer. In order to safeguard your Personal Data while increasing the customer value and offering enhanced and safer driving experiences, we adhere to the following five general principles.
FREEDOM OF CHOICE
Your Personal Data belongs to you. We strive not to make any assumptions regarding your privacy preferences and aim to design our services so that you can choose whether or not to share your Personal Data with us.
BALANCE OF INTERESTS
Where the Processing of your Personal Data is necessary for the pursuit of a legitimate interest, and where this interest outweighs the need to protect your privacy, we may process certain Personal Data without obtaining your express consent if so permitted by law. In certain other situations, we may also process your Personal Data without your consent if so required in accordance with applicable law. For more information, see the "Consent" section below. Where your Personal Data is processed for the public interest, we base that on the potential benefits to (including the safety of) our customers and the general public.
Volvo Cars will only process its customers' Personal Data if it is adequate, relevant and necessary in relation to the purpose for which it has been gathered. We aim to anonymize your Personal Data when a function or Service can be achieved with anonymized data. If we combine anonymized or non-Personal Data with your Personal Data, it will be treated as Personal Data for as long as it remains combined.
TRANSPARENCY AND SECURITY
Volvo Cars believes in being transparent about which Personal Data we process and for which purposes. To us it is also vital to protect your Personal Data since one of Volvo Cars' core values is to protect what is important to you. On request, Volvo Cars will provide customers with further information regarding our Processing and protection of your Personal Data.
It is Volvo Cars' policy to comply with the applicable laws, rules and regulations governing privacy and data protection in each and every country where we operate. Where necessary, we will adjust our Processing of your Personal Data as described in this policy to ensure legal compliance.
The Personal Data that Volvo Cars collects about you and the vehicle will be used:
- To provide you with products and services, including to verify your eligibility for certain purchases and services as well as to offer you enhanced offers and experiences;
- To inform you of updates to, or changes in, our products and services, including but not limited to changes to our terms and conditions and policies;
- To inform you of new products, services and events;
- To provide vehicle support and services (warranty service, recall information, etc.);
- For product development purposes: for example, to improve vehicle performance, quality and safety;
- To evaluate and improve our offerings to and communication with customers;
- To comply with legal requirements or requests from lawful authorities;
- To inform you about our products and services and identify those that may be of interest to you;
- To carry out market research; and
- For purposes of analysis and customer profiling (online and social included) done by ourselves and our chosen providers.
Volvo Cars uses the following definitions:
- "Data Controller" means a natural or legal person, public authority, institution or any other body which alone or jointly with others determines the purposes and means of the Processing of Personal Data.
- "Data Processor" means a natural or legal person, public authority, institution or any other body which processes Personal Data on behalf of the Data Controller.
- "Personal Data" means all information relating to an identified or identifiable physical person ("registered"). An identifiable physical person is a person who can be identified, directly or indirectly.
- "Processing" means any operation or set of operations which is performed upon Personal Data or sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, limitation, erasure or destruction.
- "Sensitive Personal Data" as Personal Data that is likely to cause harm or particular concern to the data subject if disclosed. Examples of such data are: Specific Personal Data categories (as defined below), credit card number and other financial information about the registered person, personal ID number and location details.
- "Special Categories of Data" means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the Processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation.
You may provide us with information about you or your vehicle when utilizing Volvo Cars' services in or outside a vehicle or in other contacts with Volvo Cars, for example through our websites or customer centers (in this context, please note that phone calls may be recorded, with your consent, for quality assurance purposes). We may also obtain such data from our authorized dealers and repairers and other Third Parties. Such data ("customer-provided Personal Data") may include:
- Your contact information (name, address, telephone number, email address, etc.);
- Demographic information (age, marital status, household composition, etc.);
- Vehicle information (vehicle identification number [VIN], model, date of purchase, service history, etc.);
- Location data generated by your activities (navigation assistance, search queries, location sharing, etc.); and
- Data pertaining to your purchase and use of our products and services (customer preferences and settings, purchase history, Volvo ID, etc.).
Your vehicle will also automatically collect data relating to the vehicle and its surroundings, primarily of a technical nature and not directly related to you as a person. Such data ("Vehicle-Recorded Data") is typically connected to the vehicle identification number (VIN) of the vehicle and may therefore be traceable to you. Vehicle-Recorded Data may include:
- Safety information (whether airbags or belt tensioners have been triggered, whether the doors and windows are locked or open, etc.);
- System functionality status (of the engine, throttle, steering, and brakes, etc.);
- Driving data (vehicle speed, brake and accelerator pedal use, steering wheel movement, etc.);
- Location data (the position of the vehicle in case of an accident, etc.); and
- Surroundings data (temperature outside the vehicle, images, etc.).
- Information about certain Vehicle-Recorded Data is also included in the Owner's Manual.
We are particularly careful and apply additional measures if and when collecting and Processing Sensitive Personal Data, as required by applicable law. For the avoidance of doubt, note that applicable law may require other kind of data to also be treated as Sensitive Personal Data.
Where reasonably practical or as required by applicable law, we will, in collecting or recording your Personal Data, provide you with (i) specific information as to the purposes of the Processing of your Personal Data, (ii) the identity of the Data Controller, (iii) the identities of any Third Parties to whom the data may be disclosed, and (iv) other information that may be necessary to ensure that you are able to safeguard your rights. The above information may, for example, be provided when you purchase a vehicle, in the vehicle's infotainment system, in mobile applications developed by Volvo Cars, at www.volvocars.com or otherwise in an agreement which you enter into with Volvo Cars.
Where reasonably practical or as required by applicable law, we will obtain your consent prior to collecting or using your Personal Data. The request for your consent will be clear and specific and will provide you with a reasonable basis with which to make your decision. We will never take your consent for granted. Instead, we will make sure that you can actively consent in a clear and transparent manner. Your consent is voluntary and can always be revoked, for example by terminating a particular Service or contacting Volvo Cars at the address indicated in the "Information and Access" section below. If you do not give your consent, it may not be possible to use services or parts of services.
COLLECTION AND PROCESSING OF PERSONAL DATA WITHOUT CONSENT
The collection and use of Vehicle-Recorded Data may be necessary in order for (i) technicians to diagnose and correct faults in vehicles during the service and maintenance of vehicles, (ii) Volvo Cars product development, for example enhancements of the vehicles' quality and safety features, (iii) managing Volvo Cars' warranty commitments and (iv) fulfillment of legal requirements. When collecting or using Vehicle-Recorded Data for these purposes, and for similar legitimate interests pursued by Volvo Cars, we will generally not seek your consent unless this is deemed necessary in the individual case or required by applicable law.
You may access applications and other services linked with the vehicle but provided by a Third Party, which may, for example, require transmission of location data and other Vehicle-Recorded Data to this Third Party. Volvo Cars is not responsible for the collection or use of Personal Data in applications or services provided by a Third Party, and recommends that you carefully review applicable terms for (and any integrity policy related to) such applications or services before you use them. If you have questions concerning a certain Third-Party use of your Personal Data, please contact the Third Party directly.
Volvo Cars may transfer your Personal Data to recipients in countries outside of the European Economic Area which may have differing data protection laws. This includes countries which the EU Commission does not consider to have an adequate level of protection for personal data. If this occurs Volvo Cars will ensure there is are legal grounds for the transfer in accordance with applicable data protection legislation. You will also be informed about the legal grounds, what safeguards were implemented, and where you can obtain a copy of these safeguards.
For most Processing acts, you are able to terminate our use of your Personal Data by updating your preferences, terminating a particular Service, revoking your consent to the Processing by contacting Volvo Cars at the address indicated in the "Information and Access" section below or as otherwise instructed by us. However, and unless otherwise provided in applicable law, you may generally not opt out of the Processing of your Personal Data:
In relation to certain acts of collection and further Processing of your Vehicle-Recorded Data relating to safety, quality, and product improvement;
When we perform such Processing in order to send you important notices, such as changes to our terms and conditions and policies or in case of product recalls; and
When we perform it in order to comply with our legal obligations.
We will only retain your Personal Data for as long as it is necessary to fulfill the purposes outlined in this policy or the purposes of which you have otherwise been informed. This means that when you have consented to our Processing of your Personal Data, we will retain the data for as long as the customer relationship lasts (and, where applicable, until the expiration of the warranty period) or until you withdraw your consent. If you have revoked your consent, we may nevertheless retain certain Personal Data for the period required in order for us to meet our legal obligations and defend ourselves in legal disputes. If we have not received your consent for Processing, the data will only be retained to the extent we are permitted to do so by law.
When we process your Personal Data, we strive to ensure that it is correct and up to date. We attempt to delete or correct Personal Data that is incorrect or incomplete. For more information regarding your right to ensure the accuracy of your Personal Data held by us, please see the "Information and Access" section below.
INFORMATION AND ACCESS
As stated in the "Notice" section above, we may provide you with specific information concerning our Processing of your Personal Data when collecting or recording such data. Once per year you have the right to request, and receive free of charge, information on (i) what Personal Data relating to you that we process, (ii) where the Personal Data is collected, (iii) the purpose of the Processing, and (iv) the recipients or recipient categories with which the Personal Data is shared. Requests for such information must be made in writing and be signed by you personally, and include information on the name, address and ideally the email address as well. You are also entitled to request that we correct, block or delete any incorrect information related to you. Requests should be sent to the legal entity indicated at the end of this document. Your requests will be dealt with in a prompt and proper manner. Requests to delete Personal Data will be subject to any applicable legal requirements. Where the applicable law allows for an administrative fee for complying with such a request, such a fee may be charged by Volvo Cars. In addition, you may be able to access an overview of certain customer-provided Personal Data held by Volvo Cars, and correct or update your information, by logging in to the Volvo Cars consumer portal account, or a similar Service offered in your local market.
Volvo Cars has taken technical and organizational measures in order to protect your Personal Data against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access and any other unlawful forms of Processing.
DISCLOSURES TO THIRD PARTIES
Volvo Cars may share your Personal Data:
- Among Volvo Cars units
- With Volvo Cars authorized dealers and repairers, for the purpose of distributing product and Service offers and other communications to you; and
- With other business partners for the purpose of distributing product and Service offers and other communications to you or for research and development purposes;
- In connection with the sale or transfer of a Volvo Cars entity or its assets;
- As required by law, for example in connection with a government inquiry, dispute or other legal process or request;
- When we, in good faith, believe that disclosure is necessary in order to protect our rights, for example in order to investigate potential violations of our terms and conditions or to detect, prevent or disclose fraud or other security issues;
- With other business partners or Third Parties where you have elected to receive a service from them and authorized them to request data from Volvo Cars;
- With our product and service providers who work on our behalf in connection with the above uses, such as wireless service providers, companies that host or operate our website, send communications, perform data analytics, credit card processors, or system providers necessary to process, store, or manage credit card or financial information; and
- With emergency services providers, such as law enforcement, roadside assistance providers, and ambulance providers, in order to deliver related services (for example, for Volvo On Call Emergency Support).
A Volvo Cars entity being the Data Controller of your Personal Data will, as a general rule, only disclose your Personal Data to a Third Party if it has received your consent to do so. However, if permitted by law, we may share your Personal Data without your consent, unless we consider your consent necessary in the individual case or your consent is required by law, in the following situations:
- Situations in which disclosure is required by law; and
- Situations in which disclosure is necessary for the purpose of a legitimate interest pursued by Volvo Cars (for example in order to protect our legal rights, as described above).
DATA PROCESSING ON OUR BEHALF
We restrict access to your Personal Data to Volvo Cars employees and providers who need to use the information in order to process it on our behalf, and who are contractually required to keep your Personal Data secure and confidential. We aim to choose the option for Data Processing services that best safeguards the integrity of your Personal Data toward any Third Party. Some of these processing activities may mean that your Personal data is transferred and otherwise processed in a another country. Such transfer will take place in accordance with the requirements that exist in your country.
We will not sell your Personal Data to or trade it with Third Parties unless we have your consent to do so. We will not share your Personal Data with Third Parties for their marketing purposes, unless we have received your consent for such disclosures. If you have provided such consent but wish to stop receiving marketing materials from a Third Party, please contact that Third Party directly. We may provide you with information regarding new products, services, events, or similar marketing activities. If you wish to unsubscribe from a particular e-mail newsletter or similar communication, please follow the instructions in the relevant communication. You may also use your Volvo Cars consumer portal account, or a similar Service offered in your local market, to opt out of specific types of communication from Volvo Cars and to change previously submitted preferences.
WEBSITES AND COOKIES
THIRD-PARTY SERVICES AND APPS
Our services are not intended for use by children. We do not knowingly solicit or collect any Personal Data about children under the age of 13 nor market to them. If a child has provided us with Personal Data, a parent or guardian of that child may contact us to have the information deleted from our records. If you believe that we might have any information from a child under age 13, please contact us. If we learn that we have inadvertently collected the personal information of a child under 13, or equivalent minimum age depending on jurisdiction, we will take steps to delete the information as soon as possible.
As a result of legal requirements, we have to monitor how our system works, including the vehicles we have produced. This means that we collect sample data from vehicles.
DATA PROTECTION REPRESENTATIVE
You can contact the Volvo Cars data protection representative via the following contact details:
17w26 - Support site - email adress to avoid SPAM
Volvo Car Corporation, Avd 50090, HB3S 405 31 Göteborg
Postal address: Volvo Cars Canada Limited, 9130 Leslie Street, Suite 101, Richmond Hill, Ontario, Canada L4B 0B9
Attention: Privacy Officer
You can also approach local data protection authorities.