Privacy Notice - Consumer surveys

This document describes how Volvo Cars (as defined below) utilises the personal data of users who participate in our consumer surveys (hereinafter "Consumer Survey").

It contains the following information:

1. Who we are;
2. What personal data we collect and why;
3. How long we keep your data;
4. Who we share your personal data with;
5. Your rights in relation to our data processing;
6. Contact information;
7. Changes to our Privacy Notice

1. Who we are

The organisation responsible for the processing of personal data in connection with our consumer surveys is Volvo Car Corporation, which has its registered office at Assar Gabrielssons Väg, 40531 Gothenburg, Sweden and is entered in the commercial register under number 556074-3089, hereinafter referred to as "Volvo Cars", "Volvo", "we" or "us".

2. What personal data we collect and why

When you interact with our Consumer Survey we process the following categories of data about you:

• Identifiers, such as name, email address, telephone number, title, age, gender, postcode and city of residence. The purpose of processing these data is to send out consumer surveys and assess consumer behaviour by segment. The basis for processing the data is our legitimate interest to improve the business objectives and customer satisfaction levels referred to in the survey responses.
• Data about your vehicle, such as vehicle type, vehicle identification number (VIN) and registration number. We process those data on the basis of our legitimate interest to assess field action and warranty performance.
• Type of contract, subscription number, relationship with the vehicle (start and end dates and type of contract/sale). The purpose of processing these data is to send out consumer surveys and assess consumer behaviour by segment in order to improve overall sales operations and customer satisfaction. The basis for processing these data is our legitimate interest to improve the business objectives and customer satisfaction levels referred to in the survey responses.
• Opening/click-through rates. We process these data in order to perform statistical analysis and reach measurement and to understand our consumers' interests. To enable this analysis, the email invitations contain so-called web beacons or tracking pixels that display single-pixel images that are also embedded in our website where we request your consent to deploy them. The basis for processing these data is our legitimate interest to understand the overall performance of the survey and interaction with it.

3. How long we keep your data

Responses to consumer surveys are kept for a maximum of five (5) years from the date of submission, after which they are anonymised.

In order to keep your responses secure, the invitation for feedback includes a personalised questionnaire accessible only to you. The survey website and our data storage facilities are provided with security measures to safeguard against the loss, misuse or alteration of the information under our control.

Only certain employees have access to the personal data you submit. These employees can only access your data for case handling, data analysis and quality control purposes. Under no circumstances will your information be downloaded for the purpose of sharing it with third parties.

4. Who we share your personal data with

We will share your personal data with the following categories of third party as necessary:

Our data processors, who support our overall business (e.g. IT solutions providers).

Our employees responsible for consumer surveys, whose use of your personal data will be contractually limited to the provision of services in accordance with each data processing agreement.

Your personal data will be disclosed by Volvo Cars to Grupo Los Tres Guatemala, S.A., which will process them. Volvo will transfer your personal data in accordance with local, state and federal law and all other applicable legislation.

5. Your rights in relation to our data processing

As data subject and owner, you have the legal rights in relation to the processing of your personal data set forth in the general regulation governing the law on protection of persons against processing of their personal data (Reglamentación General de la Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales). You can exercise these rights, which are briefly explained below, via the form indicated for that purpose.

1. Right to withdraw consent: You have the right to withdraw your consent to the processing of your personal data at any time and with future effect.

2. Right to access your personal data: You have the right to request information on the personal data we hold about you. If you exercise this right, you will receive a copy of your personal data. If you request additional copies of your data, you may be charged a reasonable fee to cover administrative costs. You have the right to receive information about our assurances regarding the transfer of your personal data to other countries should you request we process your personal data and transfer those data to such countries.

3. Right to rectification: You have the right to request rectification of inaccurate or incomplete personal data. We make reasonable efforts to ensure that the personal data we hold or process on an ongoing basis are accurate, complete, current and relevant, based on the most recent information available to us.

4. Right to restriction: You have the right to request restriction of processing of your personal data in the following cases:

1. if disputing the accuracy of your personal data, for as long as required to verify the accuracy of your data;
2. if the processing is unlawful and you request restriction of processing rather than deletion of your personal data;
3. if we no longer need to process your personal data but you request them for the purpose of establishing, exercising or defending legal claims;
4. if you oppose data processing while we verify whether our legitimate interests prevail over yours.

5. Right to portability: You have the right to receive the personal data submitted and, where technically possible, to request the transfer of those data to another organisation in the following cases:

1. if we process your personal data by automated means;
2. if we base the processing of your personal data on your consent, or if our processing of your personal data is necessary for the performance of a contract to which you are a party;
3. if the personal data have been provided by you.
4. Your right as data subject to portability does not adversely affect the rights and freedoms of others.

You have the right to receive your personal data in a structured, commonly used and machine-readable format. Your right to receive your personal data does not adversely affect the rights and freedoms of others. Your right to instruct us to transfer your personal data to another organisation is subject to such transfer being technically possible.

6. Right to erasure: You have the right to request the erasure of the personal data we process. If we process your personal data, we have a duty to comply with your request unless continued processing is necessary for the following purposes:

1. to exercise the right of freedom of expression and information;
2. to comply with applicable law in the European Union or a Member State;
3. to keep records for reasons of public interest or for scientific or historical research or statistical purposes;
4. to establish, exercise or defend legal claims.

7. Right to object: You have the right to object on personal grounds, and at any time, to the processing of your personal data, provided that such processing is based not on your consent but on our legitimate interests or those of third parties. In such case, we shall cease the processing of your personal data unless we can demonstrate both a compelling legitimate interest and an overriding interest for such processing, or for the purposes of establishing, exercising or defending legal claims. If you object to the processing, you must specify that you wish your personal data to be erased. If this is not specified, we will only restrict processing. You likewise have the right to object at any time and on any grounds to the processing of your personal data for direct marketing purposes (including profiling, to the extent that these profiles are related to such direct marketing), if the aforementioned processing is based on our legitimate interest. If such direct marketing is based on your consent, you have the right to withdraw that consent (see above).

8. Right to submit complaints: You have the right to submit complaints to the data protection supervisory authority or any equivalent authority in Guatemala. Notwithstanding, in such cases we ask you to contact us first, via the contact details below, to attempt to resolve the issue.

You may exercise your rights in relation to us by completing the respective form, via which we will duly handle your request. The online form contains the information we need to verify your identity and review your request. For requests submitted by telephone or email, you must provide sufficient information for us to confirm you are the person whose personal data we have collected. Please also formulate your request as precisely as possible to expedite assessment and handling. If the information you provide does not allow us to verify your identity, and therefore to handle your request to access and erase your data, we may request additional information.

You may exercise your rights in relation to all the parties mentioned in this notice.

6. Contact information

To exercise your rights, please use the web form in Section 5.

For any other matter related to the protection of personal data, please contact Grupo Los Tres Guatemala, S.A.:

Company: GRUPO LOS TRES GUATEMALA, S.A.

Address: Boulevard Liberación, 1-87 zona 9, Guatemala, Guatemala

Email: uagt@grupolostres.com

You can also contact the Volvo Car Corporation Data Protection Officer via the contact details below:

Company: Volvo Car Corporation

Postal address: Volvo Car Corporation, Assar Gabrielssons Väg, SE-405 31 Gothenburg, Sweden

7. Changes to our Privacy Notice

We reserve the right to change our privacy practices and to update and alter this privacy notice at our discretion and at any time. We therefore recommend you review this privacy notice at regular intervals. This privacy notice is effective as from the date at the top of the document. Your personal data will be processed in accordance with the privacy notice in force when they were collected unless you give your consent for them to be processed differently.