Article version 2020.266.0

Volvo Valet from Volvo Cars – Privacy Notice

Effective from:

Published at:

Volvo Valet is a service offered to Volvo Cars customers, which allows customers to schedule test drive and/or a service appointment directly through the Volvo Valet app or Volvo Cars App and have their vehicle picked up from their chosen location with the option to have a loaner delivered, or exchange your current leased vehicle for a new leased vehicle, or have a newly purchased vehicle delivered (hereinafter also “Volvo Valet”).

Last updated: September 22, 2020

Who we are

The data controller for all personal data collected and processed in relation to the Volvo Valet service is Volvo Car Norway AS, having its registered office at Postboks 540, 1327 Lysaker, Norway (hereinafter “Volvo Cars”), together with the Volvo retailer where you request the Volvo Valet service (hereinafter “Volvo retailer” or “retailer”).

Personal data collected and processing purposes

The use of the Volvo Valet service involves the processing of the following categories of personal data:

  1. Drivers performing the Volvo Valet service as well as customers using the service need to create an account. In this case we will process: first and last name, contact details (email, personal and work phone numbers), password (hashed). This is done in the course of our provision of the service to our customers, in order to identify the driver and the customer and ensure communication with them. We also require drivers to upload a photo of themselves to ensure that the customer can see the person that will greet them and take over their vehicle.
    1. If you are a customer of the Volvo Valet service, the legal basis of the data processing is performance of a contract to which you are a party ((Art. 6.1.b) GDPR).
    2. If you are a driver who creates an account with the app and provides Volvo Valet within the framework of the Birdseye mobile app, the legal basis of the data processing is performance of the app usage contract you have entered into with Volvo Cars ((Art. 6.1.b) GDPR). If you are a driver and provide services in the context of Volvo Valet as necessary to fulfil the employment contract that you have concluded with the respective Volvo retailer as your employer, the legal basis for data processing is to carry out the employment relationship. If you are a driver and either provide services in the context of Volvo Valet which are not necessary to fulfil the employment contract you have concluded with the respective Volvo dealer as your employer or if you are contracted by the respective dealer, the legal basis of the data processing is for the purposes of our legitimate interests ((Art. 6.1.f) GDPR). Our legitimate interest is that we want to enable the driver to provide the Volvo Valet service to the customer via the app. Our legitimate interest is also that we want to improve the contact between driver and customer with the uploaded photo of the driver.
  2. When a Volvo Valet service is performed, we track the location of the driver through their smartphone. This is done in order to calculate the estimated time for the service.
    1. The legal basis of the data processing is performance of the app usage contract you have entered into with Volvo Cars ((Art. 6.1.b) GDPR).
    2. If you are a driver and perform the Volvo Valet service as necessary to fulfil the employment contract that you have concluded with the respective Volvo dealer as your employer, the legal basis for data processing is to carry out the employment relationship. If you are a driver and either providing services in the context of Volvo Valet which are not necessary to fulfil the employment contract you have concluded with the respective Volvo dealer as your employer or if you are contracted by the respective dealer, the legal basis of the data processing is for the purposes of our legitimate interests ((Art. 6.1.f) GDPR). Our legitimate interest is that we want to calculate the arrival times of the driver. We also want to use it to organise which drivers can be assigned to which service.
  3. When a customer uses the Volvo Valet service, we collect more information about the customer:
    • Customer Pickup & Delivery Service History – in order to know which services have been completed;
    • Customer Driver's License – if the customer uses a loaner vehicle;
    • Customer Insurance Card - Needed if the customer uses a loaner vehicle;
    • Customer License Plate and VIN number - Needed to identify vehicle;
    • Pickup Address - Needed to provide the service;
    • Pickup Notes inserted by customer (if any);
    • Service Notes inserted by workshop (if any);
    • Vehicle interested in for test drive (if any);
    • Customer trade-in vehicle photos (if any);
    • Dropoff Address - Needed to provide the service;
    • Dropoff Notes inserted by customer (if any); and
    • IP address.
    The legal basis of the data processing is performance of a contract to which you are a party ((Art. 6. 1. b) GDPR).
  4. When we send customers push notifications with the status updates of the service through the Volvo Valet app, we use the following categories of data in order to keep track of notifications sent:
    • Unique Device Identifier;
    • Push notification token;
    • Push notification title (May contain the names of customers, drivers, vehicle make/model/color);
    • Push notification body (May contain the names of customers, drivers, vehicle make/model/color); and
    • IP address.
    1. If you are a customer of the Volvo Valet service, the legal basis of the data processing is performance of a contract to which you are a party ((Art. 6.1. b) GDPR).
    2. If you are a driver and a push notification was sent which contains your name as necessary to fulfil the employment contract that you have concluded with the respective Volvo dealer as your employer, the legal basis for data processing is to carry out the employment relationship. If you are a driver and a push notification was sent which contains your name and either this is not necessary to fulfil the employment contract you have concluded with the respective Volvo dealer as your employer or if you are contracted by the respective dealer, the legal basis of the data processing is for the purposes of our legitimate interests ((Art. 6.1.f) GDPR) to provide the customer with the most accurate information possible about the current status of the service.
  5. When feedback is left after performance of the service, we collect the names of the customer and of the driver, the rating and comments given by the customer. The legal basis of the data processing is for the purposes of our legitimate interests ((Art. 6.1.f) GDPR) to continuously improve our services for the customer. Furthermore, it is the customer's decision whether or not to give a feedback.
  6. The quality of our service is essential and, because liability issues may arise regarding alleged damages to the car, we keep photos of the vehicle, along with timestamps and location, in our interest to defend our (and our partners and drivers involved in the service) rights and interests. The legal basis of the data processing is for the purposes of our legitimate interest ((Art. 6.1.f) GDPR) that in case of damage we want to clarify as simply as possible whether the damage was caused by drivers during the performance of the service.
  7. When you send us an e-mail with the request for support in using Volvo Valet if you have any other questions in the context of our Volvo Valet offer. In the case of an existing customer relationship, the legal basis for data processing is performance of a contract to which you are a party ((Art. 6.1. b) GDPR). In the case of a general request without a customer relationship, the legal basis of the data processing is for the purposes of our legitimate interests ((Art. 6.1.f) GDPR) to offer you an easy way to contact us.
  8. When you use the Volvo Valet app, we use Google Analytics to better understand user behaviour and improve the usability of the app. We thus process your IP address, which is anonymised immediately after the collection.The legal basis for the data processing is legitimate interest ((Art. 6.1.f) GDPR).

Retention times

The following retention times are applicable for our processing of personal data mentioned above:

  1. Data about drivers (all categories of data except 4. – IP address, 6. and 8.): 1 year from last activity in the service;
  2. Data about customers (all categories of data except 4. – IP address, 6. and 8.): 3 years;
  3. Quality and liability data (data from category 6.): 3 years from the service, unless disputes arise in which case the period is extended with the time required to finalise the dispute;
  4. IP address from category 4.: 3 months; and
  5. Google Analytics Data (data from category 8): 14 months.

In addition, the Volvo dealer providing the service is subject to various retention and documentation obligations and may also be required by law to disclose personal data to authorities ((Art. 6 Para. 1 Sen. 1 lit. c) GDPR). This information can be found in the privacy policy of the dealer.

Recipients of your personal data

Processing by other members of the Volvo Car Group

Your personal data is processed by Volvo Car Corporation, Assar Gabrielssons Väg, SE-405 31 Gothenburg, Sweden. Furthermore, your personal data is processed by our data processor Volvo Car Technology USA LLC, who supports us in the field of introducing and training the respective Dealer and in case of its IT problems in the context of Volvo Valet. When we use our data processor in the context described, personal data will be transferred to the USA, on the basis of the standard contractual clauses approved by the EU Commission in accordance with Art. 46 Para. 2 lit. d) GDPR. A copy of the standard contractual clauses used can be found in various languages on the homepage of the EU Commission at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32010D0087.

Processing by other parties

We will share your personal data with the following categories of third parties, on a need-to-know basis:

  • Amazon Web Services Ireland Limited and its subprocessors (European Union) – Data Hosting
  • Google Ireland Limited together with its subprocessors (see list of datacentres at https://www.google.com/about/datacenters/inside/locations/index.html; data transfer also to Google LLC, United States of America, under the Standard Contractual Clauses) –– Google Analytics is used to track events inside of the Volvo Valet apps such as clicks, location, page views, etc. This allows us to optimize the product and carry out Volvo Valet. The following information is tracked in Google Analytics:
    • · Data Visualization – Tools to create charts, graphs, and other visualizations of data for analysing and improving the Volvo Valet service.
    To view how Google uses data when you use the Volvo Valet app, please click here www.google.com/policies/privacy/partners/.
  • Branch Metrics Inc (United States of America, under the Standard Contractual Clauses) – Push Notifications.
  • Twilio Inc. and its subprocessors (United States of America, under Twilio’s binding corporate rules and the Standard Contractual Clauses) – SMS Communication
  • Slack (United States of America, under the Standard Contractual Clauses) – An internal communication tool used by Volvo Cars Technology USA LLC. Your data may be shared between our employees on this tool as a result of investigating a bug or issue.

All of such third parties act as our processors and are limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with each data processing agreement in place.

Your rights in relation to the data processing we perform

As a data subject you have specific legal rights granted by the General Data Protection Regulation relating to the personal data we process about you:

  1. Right to withdraw consent: Where you have given consent for the processing of your personal data, you may withdraw your consent at any moment with effect for the future.
  2. Right to access your personal data: You may ask from us information regarding personal data that we hold about you. We will provide you with a copy of your personal data upon request. If you request further copies of your personal data, then we can charge you with a reasonable fee that we base on the administrative costs. You have the right to the information about our safeguards for the transfer of your personal data to a country that is outside the EU and the EEA if you request that we confirm whether or not we process your personal data, and we transfer your personal data to a country that is outside the EU and the EEA.
  3. Right to rectification: You may obtain from us rectification of incorrect or incomplete personal data concerning you. We make reasonable efforts to keep personal data in our possession or control which are used on an ongoing basis, accurate, complete, current and relevant, based on the most recent information available to us.
  4. Right to restriction: You may obtain from us restriction of processing of your personal data, if
    1. you contest the accuracy of your personal data, for the period we need to verify the accuracy,
    2. the processing is unlawful and you request the restriction of processing rather than erasure of your personal data,
    3. we do no longer need your personal data for the processing purpose but you require them for the establishment, exercise or defense of legal claims, or
    4. you object to the processing while we verify whether our legitimate grounds override yours.
  5. Right to portability: You have the right to receive your personal data that you have provided to us, and, where technically feasible, request that we transmit your personal data (that you have provided to us) to another organization, if:
    1. we process your personal data by automated means;
    2. we base the processing of your personal data on your consent, or our processing of your personal data are necessary for the execution or performance of a contract to which you are a party;
    3. your personal data are provided to us by you; and
    4. your right to portability does not adversely affect the rights and the freedoms of other persons.
    You have the right to receive your personal data in a structured, commonly used and machine-readable format. Your right to receive your personal data must not adversely affect the rights and the freedoms of other persons. Your right to have your personal data transmitted from us to another organization is a right you have if such transmission is technically feasible.
  6. Right to erasure: You have the right to request that we delete the personal data we process about you. We must comply with this request if we process your personal data, unless processing is necessary:
    1. for exercising the right of freedom of expression and information;
    2. for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject;
    3. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or
    4. for the establishment, exercise or defense of legal claims.
  7. Right to object: You may object – at any time – to the processing of your personal data due to your particular situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing or for the establishment, exercise or defense of legal claims. If you object to the processing, please specify whether you also wish the erasure of your personal data, otherwise we will only restrict it.You may object – at any time - to the processing of your personal data for direct marketing purposes.
  8. Right to lodge a complaint: You can lodge a complaint to your local data protection supervisory authority or with any other data protection authority in the EU. However, we will appreciate if you first contact us to try and solve your problem.

You can exercise your rights in relation to us by filling out this form.

Contact Information

In order to exercise your rights, please use the applicable web form mentioned above. If you have any other questions regarding the subject matter of personal data protection, you can contact us at the following contact details:

E-mail address: globdpo@volvocars.com

Changes to our Privacy Notice

We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. For this reason, we encourage you to refer to this privacy notice on an ongoing basis. This privacy notice is current as of the date which appears at the top of the document. We will treat your personal data in a manner consistent with the privacy notice under which they were collected, unless we have your consent to treat them differently.