Privacy Notice – Volvo Cars App
This document describes how Volvo Cars (as defined below), and sometimes other entities, processes your personal data when you use the Volvo Cars mobile application (hereinafter “Volvo Cars App”), that keeps you connected to your Volvo vehicle.
The Volvo Cars app has several functionalities, which entail different types of personal data processing, as we will explain below. Depending on your market and the type of subscription you have, these functionalities can be grouped as follows:
- The Volvo Cars services – this includes the aspects mentioned under sections 2.1. (Your subscription), 2.2. (The Volvo Cars remote vehicle services), 2.3. (Driving Journal), 2.6. (Public car charging), 2.7. (When you get in touch with us), 2.8. (Marketing communications and surveys), 2.9. (App analytics), 2.10. (Research and development) below.
- Value added services, provided in collaboration with retailers – such as Digital service booking (section 2.4.) and Pick-up & Delivery Service (section 2.5.).
You can find below:
1. Who is responsible for the processing of your personal data
The responsibility for the processing of your personal data in the Volvo Cars App is divided according to below:
- The entity responsible for the main processing of personal data in relation to Your subscription, The Volvo Cars remote vehicle services, Driving Journal, App Analytics, as well as Research and Development, is Volvo Car Corporation, having its registered office at Assar Gabrielssons Väg, SE-405 31, Gothenburg, Sweden, company registration number 556074-3089, hereinafter referred to as “Volvo Cars”.
- The entities responsible for the processing of personal data when you get in touch with us as well as for Marketing communications are, jointly:
- Volvo Car Corporation, and
- Volvo Car Belgium NV, company registration number 0420.383.548, having its registered office at John Kennedylaan 25, 9000 Gand, Belgium, hereinafter referred to as “National Sales Company”.
- The retailer services booked through the Volvo Cars App (Digital service booking and Pick-up & Delivery Service), are jointly performed as joint controllers by Volvo Cars, the National Sales Company, and the Volvo Cars retailer where you request the retailer service (hereinafter “Volvo retailer” or “retailer”).
2. Personal data collected, why and for how long
As mentioned previously, Volvo Cars App comes with several different functions depending on your car model and your market – some of the functions described below might not be applicable for you.
2.1. Your subscription
If you have a subscription for the Volvo Cars remote vehicle services or other Volvo connected services, you may get the opportunity to renew this service in the Volvo Cars App.
When signing up for or extending an existing subscription, and for us to manage your subscription, we process your identifiers (such as first and last name, phone number, e-mail address, VIN) and your purchase status and history. The purpose of our processing is to administer and monitor your purchase (from purchase to delivery) including any necessary contacts with authorities for official reporting, administration of your request for related services, follow up on the delivery, and to communicate updates related to the services that you have purchased. We use a third-party payment provider to process your payments, and that is a separate processing of your personal data by them; you can read more about the privacy practices of our payment processor in section 3 below.
The legal basis for our processing of your personal data in relation to subscriptions is that this processing is necessary for the performance of our contract with you (Art. 6.1. (b) GDPR).
We will retain your personal data for ninety (90) days after your last subscription has expired in order to enable continuation of the service if you choose to resubscribe or for you to access invoices or receipts. In addition, we will archive the data relating to your purchase for ten (10) years in order to comply with accounting and financial reporting legislation – this is a legal obligation (Art. 6.1. (c) GDPR).
2.2. The Volvo Cars remote vehicle services
We collect identifiers (such as your first and last name, phone number, Volvo ID (e-mail address), vehicle identification number - “VIN”, unique device identifier, and push notification token) and purchase history (ownership period, any subscription services in which you are enrolled, and the model and year of your vehicle and corresponding vehicle specifications).
We use this information to provide the Volvo Cars remote vehicle services, such as the ability to control your vehicle remotely (e.g. pre-climatisation, unlock/lock doors, remote start/stop of engine, current outside temperature, receive theft alarm notifications), viewing the status of your vehicle (e.g. fuel level, windshield washer fluid levels, brake fluid levels, door lock status, tire pressure or maintenance warnings, battery status, or other vehicle status indicators).
We also use this information to send push notifications within the Volvo Cars App related to upcoming maintenance and service reminders for your vehicle. For hybrid and full electric cars, we store charging location to be able to offer a convenient way to schedule the charging. We collect your vehicle location information as well as, if you allow this, location of your mobile device, for you to use the map functionalities in the Volvo Cars App, and to show you your position relative to your Volvo on the map.
Wherever you are not asked specifically whether you agree to any data processing, the reason why we process this data is in order to perform our contract with you (Art. 6.1. (b) GDPR).
If, through your mobile settings, you grant us access to your location data, calendars and contacts, we will process this data to supply an easy way for you to send location of a point of interest from your phone to the car based on your contact list, calendars events or search results. The legal basis for this processing is your consent (Art. 6.1.(a) GDPR).
When your Volvo Cars subscription comes to an end, the details linked with this service, including your personal information, will be deleted after ninety (90) days. Note that the Volvo Cars subscription follows the car, therefore if there is a change of ownership you as a seller are responsible to disconnect your car from the app and get your data deleted. This also applies for registered primary driver in case of car lease. Follow this link for instructions.
2.3. Driving Journal
The Driving Journal automatically log all your trips. This may be useful if, for example, you want to manage your mileage expenses. The Driving Journal must be activated by you, otherwise the data is not collected.
If you enable the Driving Journal, we will collect your identifiers such as first and last name, phone number and E-mail address, your vehicle’s VIN and its location as well as other trip related information such as your routes, time, distance, fuel and/or electric consumption and mileage. For petrol and diesel cars, the driving journal only contains the start and finish positions of each driving cycle. However, if you have a hybrid/twin engine model, the driving journal also includes information about your routes.
We process this data based on your consent (Art. 6.1.(a) GDPR).
As a rule, the Driving Journal’s data is stored for up to 400 days depending on car model.
You can disable the Driving Journal at any time, and by doing so the data will stop being collected. This does not however trigger the deletion of previously collected information.
2.4. Digital service booking
The Volvo Cars App makes it possible for you to book various services for your car with selected retailers. When you do this, the processing of personal data involved in this booking (as explained below) is performed jointly by Volvo Cars, the National Sales Company and the Volvo Cars retailer you select.
When you book a service through the Volvo Cars App, Volvo Cars collects:
- your identifiers (such as first and last name, phone number, e-mail address);
- depending on the service requested, car related information such as vehicle identity, license plate, diagnostic trouble codes, warnings, mileage, fluid levels, as well as your own description of the purpose of the booking (if any),
which will be distributed to the National Sales Company and the retailer executing the service you requested (which might be service/repair workshop, body paint workshop, car reconditioning specialists and car logistics services).
This information will be used to book the service, organise performance, contact you in matters regarding the service booked or as direct consequences of using the service such as sending confirmations and notifications. This data is processed in order to perform the booking you request (in other words, our legal basis for this processing is your contract with us (Art. 6.1. b) GDPR).
Booking details (time and location of requested appointment, used contact channel, booking status, booking content) will be stored in system logs for solving errors that might occur in the system. The booking details will also be processed for analysis and evaluation of the service. This processing is performed by Volvo Cars, and the legal basis for the data processing is our legitimate interest (Art. 6.1.f) GDPR) in performing these activities.
We will keep your service-related personal data up to two (2) years from last time using the service. In addition, we will archive pseudonymized booking details in system logs for five (5) years for statistics reasons.
When you use the digital service booking, Volvo Cars collected statistical data through Google Analytics (in restricted mode) to better understand user behaviour and improve the usability. We thus process online identifiers, including cookie identifiers, internet protocol addresses and device identifiers, client identifiers. The legal basis for the data processing is our legitimate interest (Art. 6.1.f) GDPR)) in measuring the usage and behaviour of our app. This data will be stored for fourteen (14) months from collection.
2.5. Pick-up & Delivery Service
The Volvo Cars App makes it possible for you to book the Pick-up & Delivery Service. When you do this, the processing of personal data involved in this booking (as explained below) is performed jointly by Volvo Cars, the National Sales Company and the Volvo Cars retailer performing the service.
If you use the Pick-up & Delivery Service, the following information is processed about you: your pickup & delivery service history – in order to know which services have been completed; driver's license and insurance details– if you use a loaner vehicle; license plate and VIN number - needed to identify vehicle; pickup and/or drop-off address - needed to provide the service; pickup and/or drop-off notes inserted by you (if any); IP address. When we send push notifications with the status updates of the service , we use the following categories of data in order to keep track of notifications sent: unique device identifier; push notification token; push notification title and body; IP address. This processing is based on performance of a contract to which you are a party ((Art. 6.1. b) GDPR).
If you leave feedback after performance of the service, we collect your name, the rating and comments given. The legal basis of the data processing is for the purposes of our legitimate interests ((Art. 6.1.f) GDPR) to continuously improve our services for the customer. Furthermore, it is the customer's decision whether to give feedback.
The quality of our service is essential and because liability issues may arise regarding alleged damages to the car, we keep photos of the vehicle, along with timestamps and location, in our interest to defend our (and our partners and drivers involved in the service) rights and interests. The legal basis of the data processing is for the purposes of our legitimate interest ((Art. 6.1.f) GDPR) that in case of damage we want to clarify as simply as possible whether the damage was caused by drivers during the performance of the service.
We will retain your data related to the service up to three (3) years from last time using the service, unless disputes arise – in that case we keep the necessary data for as long as needed to defend our rights. In addition, we will archive pseudonymized booking details in system logs for five (5) years for statistics reasons.
2.6. Public car charging
The Volvo Cars app is integrated with a third party charging solution in order to make it easy for drivers to charge their electric cars. The third party charging solution is provided by Plugsurfing GmbH, a company registered in Germany, having its registered office in Weserstraße 175, 12045 Berlin, Germany with company registration number HRB 143142 B. The following data types are collected by us directly from you, and shared with PlugSurfing in order to deliver the service to you and to tend to any customer requests you may have (Art. 6.1.b GDPR):
- Volvo ID,
- Email address,
- Home address,
- Payment method/reference id,
- RFID charging key EVCO-ID,
- Your location – this is in order to help you find a charging station near you,
- Issue type/description,
- Any other info that might be relevant depending on issue type, e.g. credit card number, invoice number etc.
In order to measure the use of the public charging service (Art. 6.1.f) GDPR) we receive the following data from Plugsurfing:
- Plugsurfing user ID,
- Charging session ID,
- Charging session start time,
- Charging session duration,
- Charging session price,
- Energy added during charging session,
- Charging station connector type,
- Charge point operator name.
The data related to Public car charging will be retained as long as you are a Volvo Cars app user and for an extra period of three (3) years and fifteen (15) days.
2.7. When you get in touch with us
When you use the contact options in the Volvo Cars App, we will process your personal identifiers relevant for the channel you use (such as first and last name, phone number/E-mail address, VIN, unique device identifier, and push notification token) as well as any data you supply in connection with your enquiry. We do this under the legitimate interest to administer your request ((Art. 6.1.f) GDPR).
If your question concerns our public charging service powered by Plugsurfing we may additionally process the personal data mentioned in section 2.6. above.
The data related to your requests will be retained for thirty-six (36) months from the receipt of your enquiry.
2.8. Marketing communications and Surveys
Through the Volvo Cars App you can receive marketing communications related to the Volvo Cars products, if you have consented to this. To do this, we process your identifiers (such as first and last name, phone number, E-mail address), your vehicle specification (such as model, engine, VIN), Volvo ID data,device ID, and subscription information. The legal basis for this is your consent (Art. 6.1.(a) GDPR).
This data is processed for marketing purposes until you have withdrawn your consent. If you withdraw your consent, the processing of your data will be restricted to operating a suppression list in order to make sure you don’t unintentionally receive marketing communication.
Through your Volvo Cars app you can also receive surveys about our products and services. We process the same data as above, based on our legitimate interest to improve our services. This data is processed until you opt-out.
2.9. App Analytics
We measure how our app is being used in order to better understand user behaviour and improve the usability and reliability of the app, as well as to gain insights into how the services are used and improve your experience of these services. We do this by using Google Analytics (in restricted mode), and we process your device ID, device IP address (pseudonymised immediately after collection), Volvo ID and vehicle connection status.
The legal basis for this data processing is our legitimate interest ((Art. 6.1.f) GDPR) to improve the usage and experience of our app and our services.
This data will be stored for fourteen (14) months from collection.
2.10. Research and development
For research and development purposes to better understand how to improve our products and services and which new ones to develop, we use a data-driven approach and leverage vehicle (such as VIN), product (such as Volvo Cars App usage), customer (such as Volvo ID) and sales data (such as selling or servicing retailer) to inform the direction of the development of our products and services. The processing spans a wide range of analytics, modelling and research performed by our analysts and data scientists.
The legal basis for this processing is our legitimate interest ((Art. 6.1.f) GDPR). Where possible, we restrict analyses to anonymized or pseudonymized data. The processing does not include any automated decision concerning you.
We retain this data for ten (10) years.
3. How your personal data is shared
The processing mentioned above by Volvo Cars Corporation involves processing of your personal data with the following categories of third parties, on a need-to-know basis:
Our categories of processors supporting delivering the Volvo Cars App are:
- Cloud connectivity service provider;
- Data hosting;
- Push notifications;
- Distribution of emails;
- Chat functionality and customer care handling;
- Selected Volvo Car retailers for digital service booking and Pick-up & Delivery Service;
- Subscription invoice handling provider.
They are limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with each data processing agreement in place. In some of these situations the use of the processors involves limited transfers of personal data outside of the European Union. We have taken precautions that such transfers are limited to the minimum necessary, and only involve data that cannot directly identify you and thus poses a very low risk in case of unauthorised disclosure.
Sharing with other members of the Volvo Car Group
Data mentioned under section 2.1 is shared with our national sales company and care by volvo entity in the country where the data originates from, for the following purposes:
- Assessing retailer performance;
- Customer care;
- Marketing segmentation;
- Assessing subscription extentions and reactivations.
Sharing with other third parties (separate controllers)
4. Your rights in relation to the processing of personal data
As a data subject you have specific legal rights granted by the General Data Protection Regulation relating to the personal data, we process about you. These are briefly explained below, and you can exercise them by filling out the dedicated form indicated below.
- Right to withdraw consent: Where you have given consent for the processing of your personal data, you may withdraw your consent at any moment with effect for the future.
- Right to access your personal data: You may ask from us information regarding personal data that we hold about you. We will provide you with a copy of your personal data upon request. If you request further copies of your personal data, then we can charge you with a reasonable fee that we base on the administrative costs. You have the right to the information about our safeguards for the transfer of your personal data to a country that is outside the EU and the EEA if you request that we confirm whether or not we process your personal data, and we transfer your personal data to a country that is outside the EU and the EEA.
- Right to rectification: You may obtain from us rectification of incorrect or incomplete personal data concerning you. We make reasonable efforts to keep personal data in our possession or control which are used on an ongoing basis, accurate, complete, current and relevant, based on the most recent information available to us.
- Right to restriction: You may obtain from us restriction of processing of your personal data, if:
- you contest the accuracy of your personal data, for the period we need to verify the accuracy,
- the processing is unlawful and you request the restriction of processing rather than erasure of your personal data,
- we do no longer need your personal data for the processing purpose but you require them for the establishment, exercise, or defence of legal claims, or
- you object to the processing while we verify whether our legitimate grounds override yours.
- Right to portability: You have the right to receive your personal data that you have provided to us, and, where technically feasible, request that we transmit your personal data (that you have provided to us) to another organization, if: You have the right to receive your personal data in a structured, commonly used and machine-readable format. Your right to receive your personal data must not adversely affect the rights and the freedoms of other persons. Your right to have your personal data transmitted from us to another organization is a right you have if such transmission is technically feasible.
- we process your personal data by automated means;
- we base the processing of your personal data on your consent, or our processing of your personal data are necessary for the execution or performance of a contract to which you are a party;
- your personal data are provided to us by you; and
- your right to portability does not adversely affect the rights and the freedoms of other persons.
- Right to erasure: You have the right to request that we delete the personal data we process about you. We must comply with this request if we process your personal data, unless processing is necessary:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject;
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or
- for the establishment, exercise, or defence of legal claims.
- Right to object: You may object – at any time – to the processing of your personal data due to your particular situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing or for the establishment, exercise or defence of legal claims. If you object to the processing, please specify whether you also wish the erasure of your personal data, otherwise we will only restrict it. You also have the right to object at any time, regardless of any reason, to the processing of your personal data for direct marketing (which includes profiling to the extent that it is related to such direct marketing), if such processing was based on our legitimate interest. If the marketing was based on your consent, you can withdraw consent (see above).
- Right to lodge a complaint: You can lodge a complaint to your local data protection supervisory authority or with any other data protection authority in the EU. However, we will appreciate if you first contact us to try and solve your problem – you can find our contact details below.
You can exercise your rights in relation to us by filling out this form, which will help us to deal with your request properly. The online form contains the information that we need to verify your identity and review your request. For requests submitted by telephone or email, you will need to provide us with sufficient information that allows us to reasonably verify that you are the person whose personal data we collected and describe your request in sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information.
You can exercise these rights in relation to all of the joint controllers mentioned in this notice.
5. Contact information
In order to exercise your rights, please see section 4 above. If you have any other questions regarding the subject matter of personal data protection, you can contact us at the following contact details:
Volvo Car Corporation
Postal address: Assar Gabrielssons väg, SE-405 31, Gothenburg, Sweden
E-Mail address: email@example.com
6. Changes to our Privacy Notice
We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. Whenever we make substantial changes to this notice, and in particular when this notice underlies your consent, we will inform you of the changes. This privacy notice is current as of the date which appears at the top of the document.