Customer Privacy Policy

Effective from: 2021-10-11

Published at: 2021-10-11

1. General provisions

1.1. This Policy for the Processing of Clients’ Personal Data and the Terms and Conditions for Consent to the Processing of Clients’ Personal Data (the ‘Policy and Terms and Conditions’) in accordance with the provisions of Federal Law No. 152-FZ ‘On personal data’ dated 27 July 2006 determine the procedure and terms and conditions for the personal data operator, LLC Volvo Cars (building 5, 39 Leningradskaya Street, Khimki, Moscow Region, 141402 Russia) (the ‘Company’), to process personal data of clients (individuals and their representatives), the purposes and procedure for organising the processing of their personal data as well as the requirements for protecting such personal data and conditions for the client to provide his/her consent to the processing of personal data.

1.2. The Company publishes this Policy and the Terms and Conditions on the website https://www.volvocars.com/ru/legal/privacy. The Company provides a link to this Policy and the Terms and Conditions in the personal data collection forms on the Company’s websites and includes it in car lease agreements. Moreover, VOLVO’s official dealers include a link to the Policy and the Terms and Conditions in car sale and purchase agreements concluded with clients and work orders for car repairs when personal data is transferred to the Company.

1.3. This Policy and the Terms and Conditions regulate the procedure for the Company to process personal data and do not regulate the procedure for VOLVO’s official dealers to process personal data; such official dealers are independent personal data operators and are independently liable for the processing of personal data.

2. Personal data subjects

2.1. This Policy and the Terms and Conditions apply to clients (individuals and their representatives).

2.2. In this Policy and the Terms and Conditions, the term “clients (individuals and their representatives)” means:

persons who have concluded a sale and purchase agreement for VOLVO cars,
persons who have concluded with the Company a lease agreement for VOLVO cars,
owners of VOLVO cars,
persons who are in possession of VOLVO cars,
persons who are allowed to drive cars,
persons interested in concluding an agreement on their own initiative (in particular, a sale and purchase agreement and a lease agreement for a car), test-driving a VOLVO car and otherwise communicating with the Company with respect to the Company’s goods, work and services,
persons who have posted an enquiry on the Company’s websites,
representatives acting further to an instruction of the client,
representatives acting on the client’s behalf pursuant to the law, a power of attorney or another document confirming the powers of such representative.

3. Purposes of personal data processing

3.1. The Company processes the personal data of clients for the following purposes:

to perform functions and assume powers and obligations imposed on the Company by Russian legislation and international treaties to which Russia is a party;
to conclude and perform sale and purchase agreements and lease agreements for VOLVO cars and other agreements with a client;
to conduct marketing, analytical and statistical research and surveys relating to the sale of VOLVO cars, the supply of maintenance and repair services, financial services under Volvo Car Financial Services programmes, roadside assistance services, including to conduct surveys to assess whether clients are satisfied with the services provided;
to supply services connected with the use of VOLVO cars (including warranty and after-sales services, as well as roadside assistance services);
to ensure that VOLVO cars are used safely and the safety of the life and health of owners and users of VOLVO cars, as well as to distribute information about product recall campaigns;
to give information about updates of and changes to the products and services of the Company and dealership centre, including amendments made to the terms and conditions and policies;
to give information about new products, services and events of the Company and dealership centre;
to assess and improve the Company’s offers and to exchange information with clients;
to promote the goods, work and services of the Company, its partners and dealership centre on the market, including by contacting clients directly via means of communication (via electronic communications networks by using telephone, facsimile and mobile radio-telephone communication, Internet, fax, SMS and mail);
to personalise proposals for clients as part of the promotion of goods, work and services of the Company, dealership centres and partners, to determine that a client is a regular customer and to increase satisfaction with the quality of services;
to administer and handle inquiries, complaints, claims and other requests as well as to defend the Company and clients in pre-trial and court proceedings;
to check whether there are grounds for a discount for a VOLVO car to be granted if the client participates in programmes to support the Company’s sales;
to check whether the client is reliable (including when a vehicle is leased under the Volvo Car Drive service);
to provide assistance with documenting car insurance.

3.2. Personal data may be processed for other purposes if required in order to ensure statutory compliance.

4. The volume and content of personal data that is processed

4.1. Personal data that is processed includes all information that is collected and processed during interaction with clients and with third parties with respect to such interaction, including by using data collection forms, questionnaires (which include those on the websites) and websites (including https://www.volvocars.com/ru, https://www.privilegeclub.ru/, https://volvocardrive.ru/, volvoselekt.ru, cars.volvocars.ru/new) (the ‘Sites’) and that clients directly provide to the Company, including by using data collection forms, questionnaires and Sites (including by uploading individual files or by filling out the relevant fields on the Sites), and information that is obtained under agreements concluded or to be concluded, including when the Company offers goods and provides services, as well as information received from third parties.

4.2. The volume of clients’ personal data is determined according to the need to achieve specific goals relating to the processing of such data.

4.3. The Company processes only such volume of personal data as is necessary for achieving the specific purposes of the processing in relationships with the client in question, and such volume depends on the role of the client (as described in clause 2.2 of this Policy and the Terms and Conditions). Below is a complete list of the personal data the Company processes with respect to clients:

surname, name and patronymic;
sex;
day, month and year of birth, and age;
place of birth;
type, series and number of the identity document, the name of the issuing authority and date when it was issued;
information on the driver’s license;
residential address (address of registration and actual address);
contact details (including telephone numbers and email addresses);
marital status and family members;
information about employment activities (including data on the current place of work);
demographic information (including hobbies and the sector of employment);
information about a transportation vehicle (including its type, vehicle identification number (VIN), registration data of the car, its mark, model, colour, cost, date of purchase, service history and licence plate number);
data relating to products and services that have been purchased and used (including the client’s choices, purchase history, VolvoID and Volvo Cars);
financial data (including data on payments for the Company’s goods and services, methods of and terms and conditions for the purchase of and payment for goods and services, and data on the preferred bank);
data received during surveys and marketing research;
data based on the client’s requests and inquiries;
data provided to confirm the right to discounts under the Company’s sales support programmes;
information about fines that have been imposed;
photos and video materials;
the location of a car determined by means of a security tracking device;
information from the bank’s opinion following a check for solvency (credit score);
technical data on the usage of a car (including safety information, the state of the system functionality, driving data, location data and environmental data).

4.4. The Company’s sources of personal data are personal data subjects themselves and third parties (the cases when personal data is obtained from third parties are described in particular in sections 11, 12, 13 and 14 of this Policy and the Terms and Conditions).

5. The general procedure and conditions for processing personal data

5.1. Personal data is processed by using and/or without using automated means by collecting, recording, systematising, accumulating, storing, updating (renewing or modifying), extracting, using, transferring (providing or accessing to), blocking, deleting and destroying the personal data.

5.2. The legal grounds for processing clients’ personal data are as follows:

the client’s consent to the processing of his/her personal data, including in accordance with this Policy and the Terms and Conditions;
the fact that personal data needs to be processed to achieve the goals provided for by an international treaty of the Russian Federation or a law, and that the functions, powers and obligations imposed on or granted to the Company by Russian legislation need to be exercised and performed;
the client’s participation in court proceedings;
performing an agreement to which the client is a party or a beneficiary or a guarantor, as well as concluding an agreement initiated by the client or an agreement under which the client will be a beneficiary or a guarantor;
the need for the rights and lawful interests of the Company or third parties to be exercised, or if the processing is necessary for socially valuable purposes to be achieved, provided that this does not infringe rights and liberties of the client;
the need for personal data to be processed to protect the life, health and other vital interests of the client, provided that it is impossible to obtain the personal data subject’s consent.

6. The client’s consent and applicable clauses

6.1. The client of his/her own free will and volition and on his/her own behalf provides his/her personal data to the Company.

6.2. The client provides his/her consent to the processing of his/her personal data on the terms and conditions set out in this Policy and the Terms and Conditions by filling out data collection forms and questionnaires, by providing his/her personal data under agreements concluded or to be concluded with the Company, including when the Company offers goods and provides services, by logging in and uploading information to the Sites and carrying out other activities relating to the provision of personal data.

6.3. If the client provides to the Company personal data of third parties, which includes entering data into the forms provided for on the Sites (for instance, entering data concerning a different driver under the Volvo Car Drive service), and uploads files with their personal data or otherwise communicates such data to the Company (for instance, provides data on his/her family member to obtain a discount under the sales support programme), including on paper, the client warrants that such third parties have provided their consent to the processing of their personal data in accordance with the procedure and on the terms and conditions set out in this Policy and the Terms and Conditions. The client shall notify such third parties that their personal data has been transferred to the Company for the relevant purpose to be achieved of the processing of the personal data.

6.4. In the contact information settings on the Sites and when concluding a sales and purchase agreement for a car, when signing a work order in the event that a car is getting after-sales services and when sending an inquiry to the Company via the Sites, the client provides his/her consent to receiving promotional messages from the Company in the form of emails (including to the email address the client has specified), SMS and other types of messages via electronic communications networks, including by using telephone, mobile radio-telephone communication, data transmission networks (including to the mobile phone number specified by the client), push notifications, by using social networks and other sites on the Internet, concerning any events, news, discounts, activities and other possible information of the Company, as well as his/her consent to participating in advertising, marketing and other events aimed at promoting the goods and services of the Company and its partners The client may revoke his/her consent to receiving promotional messages from the Company by clicking the relevant button to refuse having the messages sent, or by sending a relevant notification to the Company (in writing or via telephone) or to a dealership centre (in writing).

6.5. If the client and/or other personal data subjects do not intend to provide their personal data to the Company in accordance with this Policy and the Terms and Conditions, in particular if they do not agree with this Policy and the Terms and Conditions, this may hinder or make impossible the exercise of mutual rights and obligations of the client (or third parties) and the Company, and may make it impossible for the Company to provide goods and services.

6.6. By accepting this Policy and the Terms and Conditions, the client agrees that the Company may obtain his/her personal data from third parties and process such data for the purposes specified in this Policy and the Terms and Conditions. This Policy and the Terms and Conditions provide for cases when the Company may obtain personal data from third parties (in particular, in sections 11, 12, 13 and 14). The data subject confirms that he/she has been notified that personal data may be obtained from third parties, in particular by acquainting himself/herself with this Policy and the Terms and Conditions.

7. Transferring personal data to third parties

7.1. The Company may engage third parties to process personal data, transfer personal data to third parties or instruct third parties to process personal data if this is required for the purposes of the processing of such data in accordance with this Policy and the Terms and Conditions, as well as in the cases for which current legislation provides. In particular, the Company may transfer clients’ personal data to the following persons (groups of persons):

in the volume necessary for achieving the purposes of processing for which this Policy and the Terms and Conditions provide:
- to dealership centres and leasing companies,
- to affiliated companies of the Volvo Car Group (in particular, the parent company Volvo Personvagnar AB (Volvo Car Corporation), Assar Gabrielssons Väg, SE-405 31, Gothenburg, Sweden) (‘Volvo Car Group’),
- to companies providing server facilities and companies servicing and maintaining the Company’s information systems,
- to companies providing services to process incoming and outgoing messages (calls), i.e. contact centres,
- to companies administering the loyalty programme,
- to car service stations,
- to marketing and advertising agencies, marketing research agencies and event planning agencies,
- to banking institutions and insurance companies,
- to roadside assistance providers and suppliers of vehicle monitoring services equipped with the Volvo Cars system (previously known as Volvo on Call),
- to companies providing courier services and delivery services (including companies providing concierge services and ‘pick-up &amp; delivery’),
- to expert organisations carrying out an inspection of vehicles and checking the conditions in which such vehicles are used and performing an expert examination of transportation vehicles as well as the assembly, repairs and/or dismantling of spare parts,
- to audit and consulting companies and law firms, and
- to other organisations with which the Company cooperates if personal data needs to be transferred for the purpose(s) of the processing;
in cases for which current legislation provides, to state authorities and local government bodies authorised to obtain information containing personal data, in a volume that is necessary for them to perform their functions.

7.2. The Company does nor disseminate (disclose) clients’ personal data to the public at large.

8. Timeframes for the storage of and the procedure for destroying (deleting) personal data

8.1. The timeframes for processing personal data are determined in line with the purpose for which such data has been collected.

8.2. Personal data should be stored in a form that allows the personal data subject to be identified, but for no longer than is required in accordance with the purposes of the processing unless another timeframe is set by Russian legislation or a contract to or under which the client is a party, beneficiary or a guarantor.

8.3. The storage timeframes for a data subject's personal data are determined in particular by Order No. 558 of the Russian Ministry of Culture ‘On adopting the List of standard management archive documents that are formed as state authorities, local authorities and companies carry out their activity, and the timeframes for storing such documents’ dated 25 August 2010, Order No. 236 of the Federal Archive Agency (known in Russia by the acronym ‘Rosarchive’) ‘On adopting the List of standard management archive documents that are formed as state authorities, local authorities and companies carry out their activity, and the timeframes for storing such documents” dated 20 December 2019, and other statutory requirements and regulatory documents.

8.4. Personal data of clients processed further to requests by them will be stored in accordance with the conditions of such requests for services, information and marketing communications or within 12 (twelve) months from the date when a service was provided to the client or from the time when the client unsubscribed from receiving advertising communications.

8.5. Personal data of clients is stored when such data is processed in order to: (i) promote goods, work and services of the Company, its partners and a dealership centre on the market, including by contacting clients directly via means of communication, (ii) conduct marketing, analytical and statistical research and surveys relating to the sale of VOLVO cars, (iii) give information about new products, services and events of the Company and a dealership centre, (iv) personalise proposals for clients as part of the promotion of goods, work and services of the Company, dealership centres and the Company’s partners, and to determine that a client is a regular customer and increase satisfaction with the quality of services:

for the period of joint activities (interaction) with the Company at the client’s initiative; and if the client does not communicate with the Company, his/her personal data for the relevant purpose is stored for a year from the last communication and is subsequently deleted (if the Company has no right to continue the processing of such personal data that does not require consent to be processed),
until the consent to the processing of personal data for the relevant purpose is revoked, after which the Company deletes the personal data (if the Company has no right to continue the processing of such personal data that do not require a consent to be processed).

8.6. Personal data of clients processed as part of the Volvo Car Drive service is stored:

for 3 (three) years from the date when the Company or the client refused to conclude a lease agreement for a vehicle,
throughout the term of a lease agreement for a vehicle, and within 3 (three) years from the date of termination of such agreement.

8.7. Personal data of clients that is processed in the event of clients’ requests via a chat in the Company's application or via a chat on the Company’s Sites with respect to which the Company will be the operator of personal data should be stored for 12 (twelve) months from the time when the client’s request is received. If the client took part in a survey of the Company in connection with a request via a chat, the Company will store personal data for 6 (six) months after such request.

8.8. Personal data that is being processed should be destroyed if one of the below circumstances occurs:

the purposes of the processing of the personal data have been achieved, when this is a ground for terminating the processing of personal data;
the purposes of the processing no longer need to be achieved (in particular, when the Company terminates its activity);
the timeframe for storing the documents established by Russian legislation has terminated;
the client has revoked his/her consent to the processing of personal data if the Company has no other grounds for the processing of personal data;
unlawful processing of personal data has been identified and there is no way to ensure that the personal data is processed lawfully;
it has been identified that personal data has been processed that was obtained in an unlawful manner or that is not necessary for the claimed purpose of processing the personal data;
a state body authorised to protect the rights of personal data subjects has so requested in a lawful manner;
in other cases for which Russian legislation provides.

8.9. Personal data is destroyed within a timeframe that does not exceed 30 (thirty) days from the date when a ground emerged for the destruction of the personal data that is being processed unless Russian legislation provides for other timeframes.

8.10. Personal data is destroyed in a way that rules out further processing of such personal data and a possibility of such data being restored, by using software tools guaranteeing that the data is deleted and tools of the relevant information system or operating system.

8.11. If required, the Company notifies the client and/or a body authorised to protect the rights of personal data subjects that the personal data has been destroyed.

9. Security of personal data

9.1. When processing personal data the Company takes organisational and technical measures that are necessary and sufficient for ensuring the security of the personal data in the event of accidental and unauthorised access, destruction, alteration, access to such data being blocked and other unauthorised activities.

9.2. A list of measures to protect and ensure security of personal data is determined in the Policy for the Processing and Protection of Personal Data posted here.

10. Rights and obligations of the client

10.1. By accepting this Policy and the Terms and Conditions the client confirms that he/she knows his/her rights and obligations set out in Federal Law No. 152-FZ ‘On personal data’ dated 27 July 2006, in particular the right to access his/her personal data and to revoke his/her consent.

10.2. The client may revoke his/her consent to the processing of personal data by using the Sites and feedback forms as well as by sending a written application via registered mail to the Company’s postal address or an email to: volvocustomer@volvocars.com. If the client specifies incorrect data, the Company will be entitled to continue processing the client’s personal data.

10.3. As a personal data subject the client has the right:

to file inquiries about the processing of his/her personal data;
to demand that his/her personal data should be adjusted, blocked or destroyed if such personal data is incomplete, obsolete, inaccurate, was received unlawfully or is not necessary for the declared purpose of processing; and to take any measures provided for by legislation to protect his/her rights;
to demand the list of his/her personal data that the Company is processing and the source of such data;
to be advised of the timeframes for which his/her personal data is processed, including storage timeframes;
to demand that all persons to whom incorrect or incomplete personal data was previously provided should be notified to that effect, such notification specifying all exclusions, adjustments and additions made to the data;
to appeal to a body authorised to protect the rights of personal data subjects or a court against unlawful acts or omissions committed when his/her personal data was being processed;
to protect his/her rights and lawful interests, including having recourse to the court to seek compensation for losses and/or for moral harm.

10.4. As a personal data subject the client is obliged:

to provide the Company with accurate personal data;
to inform the Company of any changes and additions to his/her personal data in a timely manner.

10.5. By accepting this Policy and the Terms and Conditions the client hereby confirms that the personal data he/she has provided is accurate. The Company proceeds on the assumption that the client submits accurate and sufficient personal data and keeps such data up-to-date.

11. Processing personal data as part of information exchange with specialised online platforms for the purchase and sale of cars and for calculating the cost of body repair

11.1. The Company may exchange specific information (in particular, VINs and, with respect to online platforms for calculating the cost of body repair, also other data concerning the cost of the repair) that does not include personal data with specialised online platforms for the purchase and sale of cars and for calculating the cost of body repair. No information identifying clients (for instance, surnames, names, patronymics, contact details, etc.) will be transferred.

11.2. When obtaining VINs the Company may combine them with the information that is already at the Company's disposal.

11.3. The Company will use the data resulting from such combination as specified above for the following purposes:

to conduct marketing, analytical and statistical research;
to give information about new products, services and events of the Company and dealership centre;
to promote the goods, work and services of the Company, its partners and a dealership centre on the market, including by contacting clients directly via means of communication (via electronic communications networks by using telephone, facsimile and mobile radio-telephone communication, Internet, fax, SMS and mail);
to personalise proposals for clients as part of the promotion of goods, work and services of the Company, dealership centres and partners, and to determine that client is a regular customer and to increase satisfaction with the quality of services.

12. Processing personal data as part of information exchange with the Company’s financial partners (including banks and insurance companies) and dealership centres

12.1. The Company may exchange specific information with its financial partners (including banks and insurance companies) and dealership centres, including among other data, financial data (including data on payments for the Company’s goods and services, the method of and terms and conditions for the purchase of and payment for the goods and services, and data on the preferred bank).

12.2. When obtaining such data the Company may combine it with the information that is already at the Company's disposal.

12.3. The Company will use the data resulting from such combination as specified above for the following purposes:

to conduct marketing, analytical and statistical research;
to give information about new products, services and events of the Company and dealership centre;
to promote the goods, work and services of the Company, its partners and a dealership centre on the market, including by contacting clients directly via means of communication (via electronic communications networks by using telephone, facsimile and mobile radio-telephone communication, Internet, fax, SMS and mail);
to personalise proposals for clients as part of the promotion of goods, work and services of the Company, dealership centres and partners, and to determine that client is a regular customer and to increase satisfaction with the quality of services.

13. Processing personal data as part of leasing a vehicle under the Volvo Car Drive service

13.1. The Company may exchange specific information with its financial partners (banks).

13.2. During such information exchange the Company may receive from its financial partner information from the bank’s opinion statement following a check on solvency (the credit score).

13.3. The Company will use the data from the bank’s opinion statement following a check on solvency (the credit score) for the purpose of concluding and performing a lease agreement for a VOLVO car between the client and the Company.

13.4. The Company may exchange specific information (which includes a car’s registration data and licence plate number and does not include personal data) with specialised service providers that provide information about fines that have been imposed. No information identifying clients (for instance, surnames, names, patronymics, contact details, etc.) will be transferred.

13.5. When obtaining information about fines that have been imposed the Company may combine it with information that is already at the Company's disposal.

13.6. The Company will use data resulting from such combination as specified above for the following purposes:

to conclude and perform a lease agreement between the client and the Company for a VOLVO car;
to check whether the client is reliable.

14. Processing personal data as part of handling claims of clients

14.1. In exceptional cases, when handling claims, the Company may obtain the following data from Volvo Car Group:

technical data concerning the usage of a car (including safety information, the state of the system functionality, driving data, location data and environmental data).

14.2. Technical data on the usage of a car (i.e. the data recorded by a car) includes:

safety information (which includes the information whether the airbag and belt tightener have been deployed, whether the doors and windows are open or closed, etc.);
information about the state of the system functionality (among other things, the state of the engine, throttle plate, steering system and brakes);
driving data (which includes the speed of a car, the usage of the brake and accelerator pedals, the movement of the steering wheel, etc.);
location data (which includes the position of a car in the event of an accident, etc.); and
environmental data (which includes outside temperature, images, etc.). Information about specific data recorded by a car is also included in the user manual.

14.3. The Company will use the above data in order to administer and handle inquiries, complaints, claims and other requests as well as to defend the Company and clients in pre-trial and court proceedings.

15. Processing personal data when the Company’s Sites are used

15.1. Personal data of clients using the Sites may be processed in accordance with the Policy for the Processing of Personal Data on Websites which is available on the website via the link.

16. Final provisions

16.1. Contact details for data subjects to file a request concerning the Company’s processing of personal data:

mailing address: building 5, 39 Leningradskaya Street, Khimki, Moscow Region, 141402 Russia,
email address: volvocustomer@volvocars.com.

16.2. The current versions of the Policy and the Terms and Conditions are available to any client on the Internet at the address: https://www.volvocars.com/ru/legal/privacy.