Article version 2021.91.0

Privacy Notice – Online sales of a Volvo car

Effective from:

Published at:

Volvo Car UK Limited and Care by Volvo Car UK Limited are committed to protecting and respecting your privacy. This document describes how your personal data will be processed when you order or subscribe for a new or used Volvo car online through www.volvocars.com (hereinafter the “Order”).

You can find below:

  1. Who we are;
  2. What personal data we process, why and for how long;
  3. Who we share your personal data with;
  4. Information Security
  5. Your rights in relation to the data processing we perform;
  6. Contact information; and
  7. Changes to our Privacy Notice.

We process the personal data of individuals in the United Kingdom in accordance with the European data protection law as it is deemed to apply to the United Kingdom by the Data Protection Act 2018.

1. Who we are

The legal entity responsible for the processing of personal data in relation to the Order of a new car through Care by Volvo is Care by Volvo Car UK Limited (company registration no 11734379) a company registered in United Kingdom and with address Scandinavia House, Norreys Drive, Maidenhead, United Kingdom, SL6 4FL a legal entity within the Volvo Car Group.

The legal entity responsible for the processing of personal data in relation to the Order of a used Volvo Selekt car is Volvo Car UK Limited (company registration no 2281044) a company registered in United Kingdom and with address Scandinavia House, Norreys Drive, Maidenhead, United Kingdom, SL6 4FL a legal entity within the Volvo Car Group.

Care by Volvo Car UK Limited and Volvo Car UK Limited are hereinafter referre to as “we” “us” or “our”.

2. What personal data we process, why and for how long

We will process the personal data that you provide to us through the online platform, or we otherwise collect, in connection with your Order, as further described below.

1. When placing the Order

When you place your Order, we will process your:

  • date of birth
  • first and last name
  • address
  • contact details (email address and phone number).

This personal data is collected from you and will be processed in order to (i) verify your identity, (ii) perform a check against sanction lists (as further described in part 2 below), and (iii) communicate with you regarding your Order.

The legal basis for the processing of your personal data in connection to (i) verify your identity and (ii) to perform a check against sanction lists is our legitimate interest in order to know who we are selling a car to and comply with our legal obligations

The legal basis for the processing of your personal data in connection with (iii) communicate with you regarding your Order is to fulfill our contractual obligationsconclude a sales contract with you and comply with our legal obligations

How long do we keep your personal data

When you make your Order, you may be asked to pay a reservation fee or deposit. If you do not finalise the step where you pay the deposit or reservation fee your personal data mentioned above will be stored for thirty (30) days after you submitted the Order. We do this in order for you to be able to complete the Order and for us to assist you during this period.

Payment of deposit or reservation fee

If you choose to pay your deposit or reservation fee through credit card or debit card your personal data will be collected and processed by Stripe Payments Europe, Ltd (”Stripe”), a company incorporated under the laws of Ireland. Stripe will be the controller of such personal data collected through the credit or debit card payment and you can view their privacy policy here.

2. Performing a know your customer check against sanction lists

When you submit the Order, we will prior to accepting and confirming your Order perform a check against the sanctions list imposed by the UN, UK and US. We will in connection therewith process your:

  • date of birth
  • first and last name
  • address
  • a copy of valid driving licence or other valid ID in case required to finalise the check against the sanction lists.

The purpose of the processing is to perform a scanning against sanction lists imposed by the UN, UK and US to prevent fraud, money laundering and terrorist financine and to ascertain any potential customers that are Politically Exposed Persons The legal basis for this processing is our legitimate interest to know who we sell cars to and comply with the UK 2020 Money Laundering Regulations.

Where you have Ordered a new car from Care by Volvo Car UK Limited, the performance of the know your customer check against sanction lists will be done by Schufa Holding AG (“Schufa”), a company incorporated under the laws of Germany. For that reason, we will share the above mentioned personal data with Schufa. Schufa is the controller of such personal data and personal data collected through the screening process and you can view their privacy policy here.

Where you have purchased a used Volvo Selekt car from Volvo Car UK Limited, the performance of the know your customer check against sanction lists will be done by Veriphy Limited (company registration no 5066478), a company incorporated under the laws of England . For that reason, we will share the above mentioned personal data with Veriphy. Veriphy is the controller of such personal data and personal data collected through the screening process and you can view their privacy policy here.

How long do we keep your personal data

If we do not accept your Order we will store your personal data described above for twentyfour (24) months after we have declined your Order to be able to detect fraud attempts.

3. When your Order has been confirmed

When you Order has been confirmed by us we will process your:

  • date of birth
  • first and last name
  • contact details (address, email address and phone number)
  • Volvo ID
  • Volvo customer number
  • vehicle identification number (VIN) and registration number of the car
  • bank account details, if you have provided them to us in relation to a withdrawal of your contract and/or return of your car.

The purpose of the processing is to be able to (i) administer your Order, (ii) provide payment instructions, (iii) communicate regarding delivery of the car and to administrate the handover of the car (iv) administrate the registration of the car in the national vehicle register, and (v) recognise you as a recurrent customer and thus enhance your user/Volvo experience. The legal basis for this processing is to fulfill the Order/sales contract with you.

We will also process the aforementioned personal data to be able to communicate with you regarding potential car recalls. The legal basis for such processing is to comply with a legal obligation.

We will share your personal data with the following processors, which are limited by contract in their ability to use your personal data for any purpose other than to provide services to us in compliance with each respective data processing agreement in place:

  • Volvo Car UK Limited (and its sub processors) – financial services such as invoicing and refunds
  • Care by Volvo Car AB (and its sub processors) – services in relation to administration of the Order
  • Strive Group Limited trading as Volvo Cars Selekt Direct (and its sub processors) – services in relation to administration of the Order of your used Volvo Selekt car and sales support
  • Volvo Car Financial Services UK Limited (and its sub-processors)- provision of finance products
  • Appointed authorised Volvo retailer(s) (and its sub processors) – for (i) communication and administration of the handover of the car (ii) registration of the car in the national vehicle register, and (iii) administration in relation to a withdrawal of contract.

Personal data (such as first and last name, contact details and VIN of the car) will also be shared with the Driver and Vehicle Licensing Agencyto register the car in the national vehicle register. Driver and Vehicle Licensing Agency is the controller of such personal data and you can view their privacy policy here.

How long do we keep your personal data

Your personal data connected to your acquisition of the car will be kept for five (5) years from the date you cease to be a registered owner or driver of a Volvo car, assuming this date becomes known to us, unless we are legally obliged to keep the data for a longer period of time.

4. If you place an Order as a business customer

If you place an Order on behalf of a legal entity, we will process your:

  • date of birth
  • first and last name
  • contact details (email address and phone number, home address).

This personal data is collected from you when placing the Order on behalf of the legal entity and will be processed in order to (i) verify you as an authorized person to sign on behalf of the legal entity, (ii) administer your Order, (iii) provide payment instructions, and (iv) communicate regarding delivery of the car and to administrate the handover of the car. The legal basis for this processing is to conclude and fulfill the Order/sales contract with you.

We will also process the aforementioned personal data to be able to communicate with you regarding potential car recalls. The legal basis for such processing is to comply with a legal obligation.

We will share your personal data with the following processors, which are limited by contract in their ability to use your personal data for any purpose other than to provide services to us in compliance with each respective data processing agreement in place:

  • Volvo Car UK Limited (and its sub processors) – financial services such as invoicing and refunds
  • Appointed authorised Volvo retailer(s) (and its sub processors) – for (i) communication and administration of the handover of the car (ii) registration of the car in the national vehicle register, and (iii) activation of the car insurance (if applicable).

How long do we keep your personal data

The personal data connected to your acquisition of the car will be kept for five (5) years from the date you cease to be a registered driver of a Volvo car, assuming this date becomes known to us, unless we are legally obliged to keep the data for a longer period of time.

5. Provision of services under Volvo service programme

If you choose to purchase a Volvo service programme or your car comes with a Volvo service programme, we will in connection therewith process your:

  • date of birth
  • first and last name
  • contact details (address, email address and phone number)
  • Volvo ID
  • Volvo customer number
  • vehicle identification number (VIN) and registration number of the car
  • service status of components in the car (this kind of data is related to the car VIN and may therefore be connected to you).

The purpose for the processing is (i) to be able to communicate with you on upcoming services and/or updates related to the services during the Volvo service programme and (ii) to be able to, in relation to service status of components in the car, assess the status of the car and, if and when needed, initiate maintenance procedures. We will also save the maintenance history of the car to be able to better plan the car’s future maintenance schedule. The legal basis for this processing is to fulfill the contract regarding the Volvo service programme.

We will share your personal data with the authorised Volvo repairer(s) (and its sub-processors) you choose for each occasion for the purpose of providing the service under the Volvo service programme. The chosen authorised Volvo repairer is limited by contract in their ability to use your personal data for any purpose other than to provide services to us in compliance with the data processing agreement in place.

How long do we keep your personal data

We will retain your personal data in connection with the Volvo service programme for four (4) years from the date the service to your car was provided or until the warranty related to your car has expired.

3. Who we share your personal data with

In addition to the processors mentioned under Section 2 above, we will share your personal data with the following third parties acting as our processors:

  • Volvo Car Corporation (and its sub-processors) – provision of services such as customer care and planning of car maintenance services, the web-page platform and IT-systems for business support and data storage
  • IT-suppliers (and their sub-processors) for provisions of general business support systems and data hosting, such as:
    • Salesforce UK Limited (and its sub-processors) – CRM system and data hosting
    • Adobe Systems Software Ireland Limited (and its sub-processors) – electronic signatures and data hosting
    • SAP Svenska AB (and its sub-processors) – ERP business system and data hosting
    • Fair Isaac Services Limited (and its sub-processors) – data hosting
  • Our legal advisors and similar professional consultants for the purpose of supporting, providing advice and representing us in relation to claims and/or court proceedings.
  • We may also disclose your personal data if required by law or upon request from governmental authorities.

We have entered into data processing agreement with each processor who is limited by contract in their ability to use your personal data for any purpose other than to provide services for us. Each processor has an obligation to keep the information confidential and only process the personal data in compliance with the data processing agreement in place.

Your personal data may be transferred outside the European Economic Area (including the United Kingdom), if so, such transfer will be based on the standard contractual clauses approved by the EU Commission or such other appropriate safeguard. The general text of the standard contractual clauses used can be found in various languages on the homepage of the EU Commission: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32010D0087.

Please contact us (in accordance with Section 6 below) if you have any questions in relation to the transfer of your personal data outside the European Economic Area (including the United Kingdom).

4. Information Security

To protect your personal information from loss, theft, and unauthorized access, use, or disclosure, we have implemented technical, administrative, and physical security measures including encryption, access controls, and secure development processes. We also pass on these standards to our external service providers. Unfortunately, no method of transmission over the Internet, or method of electronic storage, is 100% secure or impenetrable.

5. Your rights in relation to the personal data processing we perform

You have specific legal rights granted by the General Data Protection Regulation relating to the personal data we process about you. You can withdraw your consent or object to our processing of your data, access the data we hold about you, ask for rectification or restriction of your data, request to have your data ported to another entity, request that we delete your data, and finally you can file a complaint with the relevant data protection supervisory authority. In the UK this is the ICO.

Details about your rights – what they mean, when and how you can exercise them – can be found in our Customer Privacy Policy.

6. Contact information

In order to exercise your rights under Section 6 above, please use this web form. If you have any other questions regarding the subject matter of personal data protection, you can contact us at the following contact details:

Care by Volvo Car UK Limited

Post address: Scandinavia House, Norreys Drive, Maidenhead SL6 4FL

E-mail address: carebyvolvo-uk@volvocars.com

Volvo Car UK Limited

Post address: Scandinavia House, Norreys Drive, Maidenhead SL6 4FL

E-mail address: custcare@volvocars.com

7. Changes to our Privacy Notice

We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. For this reason, we encourage you to refer to this privacy notice and our Customer Privacy Policy on an ongoing basis. This privacy notice is current as of the date which appears at the bottom of the document. We will treat your personal data in a manner consistent with the privacy notice under which they were collected, unless we have your consent to treat them differently.