Privacy Notice – Digital Service Booking
This document describes how Volvo Cars (as defined below) processes your personal data when you book your service appointment online or through the Volvo Cars App (hereinafter “Digital service booking”).
You can find below:
1. Who we are
The entity responsible for the processing of personal data in relation to the Digital Service booking is Volvo Car Corporation, a Swedish legal entity with company registration number 556074-3089 with address Assar Gabrielssons Väg, SE-405 31, Gothenburg, Sweden, hereinafter referred to as “Volvo Cars”, “we”, “our” and “us”, will as controller process your personal data as described below.
2. What personal data we collect and why
The use of the Digital Service booking through the Volvo Cars App or the booking pages at volvocars.com involves the processing of the following categories of personal data:
- Contact information such as name, email address, telephone number – these will be processed and distributed to the party executing the service such as service/repair workshop, body paint workshop, car reconditioning specialists and car logistics services. This information will be used to contact you in matters regarding the service booked or as direct consequences of using the service such as sending confirmations and notifications. We process this data as necessary in order to perform the booking you request (in other words, our legal basis for this processing is your contract with us).
- Car related information such as vehicle identity, license plate, diagnostic trouble codes, warnings, milage, fluid levels, as well as your own description of the purpose of the booking (if any) will be processed and distributed to the party executing the service such as service/repair workshop, body paint workshop, car reconditioning specialists and car logistics services. This information will be used to assess the needed service. The legal basis for this processing is your contract with us for the service booking.
- Booking details (Time and location of requested appointment, used contact channel, booking status, booking content) may be stored in system logs for solving errors that might occur in the system. The booking details will also be processed for analysis and evaluation of the service. The legal basis for the data processing is our legitimate interest in performing these activities.
- When you use the digital service booking we use Google Analytics (in restricted mode) to better understand user behaviour and improve the usability. We thus process online identifiers, including cookie identifiers, internet protocol addresses and device identifiers; client identifiers. The legal basis for the data processing is our legitimate interest in measuring the usage and behaviour of our app.
3. How long we keep your data
The following retention times are applicable for our processing of personal data mentioned above:
- Contact data in matters regarding this service or as direct consequences of using the service: 2 years from last time using the service. Confirmation e-mails connected to the service, 61 days.
- Car related information regarding this service or as direct consequences of using the service: 2 years from last time using the service.
- Booking details in system logs: For statistics and development of the service pseudonymized information is stored 5 years.
- Google Analytics pseudonymized data used for analysis and development of the service: 14 months.
4. Who we share your personal data with
We will share your personal data with the following categories of third parties, on a need-to-know basis:
- Other members of the Volvo Car Group:
- Volvo Car Retail Solutions (Sweden), Providing calendar functionality
- Volvo Car Denmark A/S (Denmark) – analysis and development of the service
- Our processors supporting Digital Service booking, which are limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with each data processing agreement in place are:
- The selected Volvo Car retailer for the booking – Main provider of booked appointment
- Amazon Web Services Ireland Limited and its subprocessors (European Union) – Data Hosting
- Sendgrid, (United States of America, under the EU Standard Contractual Clauses)) – distribution of emails
5. Your rights in relation to the data processing we perform
You have specific legal rights granted by the General Data Protection Regulation relating to the personal data we process about you:
- Right to withdraw consent: Where you have given consent for the processing of your personal data, you may withdraw your consent at any moment with effect for the future.
- Right to access your personal data: You may ask from us information regarding personal data that we hold about you. We will provide you with a copy of your personal data upon request. If you request further copies of your personal data, then we can charge you with a reasonable fee that we base on the administrative costs. You have the right to the information about our safeguards for the transfer of your personal data to a country that is outside the EU and the EEA if you request that we confirm whether or not we process your personal data, and we transfer your personal data to a country that is outside the EU and the EEA.
- Right to rectification: If the information concerning you is not (or is no longer) correct, you can request its rectification. If your data is incomplete, you may request that it be completed.
- Right to restriction: You may obtain from us restriction of processing of your personal data, if:
- you contest the accuracy of your personal data, for the period we need to verify the accuracy,
- the processing is unlawful and you request the restriction of processing rather than erasure of your personal data,
- we do no longer need your personal data for the processing purpose but you require them for the establishment, exercise or defense of legal claims, or
- you object to the processing while we verify whether our legitimate grounds override yours.
- Right to portability: You have the right to receive (in a structured, commonly used and machine-readable format) your personal data that you have provided to us, and, where technically feasible, request that we transmit your personal data (that you have provided to us) to another organization, if:
- we process your personal data by automated means;
- we base the processing of your personal data on your consent, or our processing of your personal data is necessary for the execution or performance of a contract to which you are a party;
- your personal data are provided to us by you; and
- your right to portability does not adversely affect the rights and the freedoms of other persons.
- Right to erasure: You have the right to request that we delete the personal data we process about you. We must comply with this request if we process your personal data, unless the processing is necessary:
- to continue providing a service to you, such as an active subscription;
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject;
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or
- for the establishment, exercise or defense of legal claims.
- Right to object: You may object – at any time – to the processing of your personal data due to your particular situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing or for the establishment, exercise or defense of legal claims. If you object to the processing, please specify whether you also wish the erasure of your personal data, otherwise we will only restrict it. You also have the right to object at any time, regardless of any reason, to the processing of your personal data for direct marketing (which includes profiling to the extent that it is related to such direct marketing), if such processing was based on our legitimate interest. If the marketing was based on your consent, you can withdraw consent (see above).
- Right to lodge a complaint: You can lodge a complaint to your local data protection supervisory authority or with any other data protection authority in the EU. However, we will appreciate if you first contact us to try and solve your problem.
You can exercise your rights in relation to us by filling out this form.
6. Contact information
In order to exercise your rights, please use the applicable web form mentioned above. If you have any other questions regarding the subject matter of personal data protection, you can contact us at the following contact details:
Volvo Car Corporation
Post address: Assar Gabrielssons Väg, SE-405 31, Gothenburg, Sweden
E-mail address: email@example.com
7. Changes to our Privacy Notice
We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. For this reason, we encourage you to refer to this privacy notice on an ongoing basis. This privacy notice is current as of the date which appears at the top of the document. We will treat your personal data in a manner consistent with the privacy notice under which they were collected, unless we have your consent to treat them differently.