Privacy Policy

SUPPLEMENTAL PRIVACY NOTICE - ELECTRICITY REFUND PAYOUT THROUGH VOLVO CARS APP

Last Updated: May 5, 2021

This document describes how Volvo Cars (as defined below) processes your personal data when you claim a refund through Volvo Cars App for your electricity costs in connection with the use of your Volvo vehicle (hereinafter “Electricity Refund”). This document should be read as a supplement to the existing Volvo Cars App Privacy Notice.

You can find below:

1. Who we are;
2. What personal data we collect and why;
3. How long we keep your data;
4. Who we share your personal data with;
5. What rights you have in relation to the data processing we perform;
6. How we address children’s privacy;
7. How we address information security;
8. How to contact us; and
9. How we make changes to our Privacy Notice.

1. Who We Are

The entity responsible for the processing of personal data in relation to the Electricity Refund is Volvo Car Corporation, having its registered office at Assar Gabrielssons Väg, SE-405 31, Gothenburg, Sweden, company registration number 556074-3089, hereinafter referred to as “Volvo Cars”, “we”, or “us”. For the purposes of GDPR, Volvo Car Corporation is a data controller for these purposes. Volvo Car USA LLC is hereinafter referred to as “National Sales Company”.

For the purposes of the California Consumer Privacy Act (CCPA) and as pertaining to information of US residents, Volvo Cars facilitates the collection of information for the benefit of Volvo Car USA LLC, having its registered office at 1800 Volvo Place, Mahwah, NJ, 07430, USA, and privacy policy at https://www.volvocars.com/us/legal-policies/privacy/general-privacy-statement/.

2. What Personal Data We Collect and Why

To claim your Electricity Refund, you need to be the registered owner of the subscription. When you claim the refund through your Volvo Cars App, the following categories of personal data will be processed:

1. To verify that the Electricity Refund offer is due or you to claim, we will process your Volvo ID and your Vehicle Identification Number (VIN). We do this based on the contract you signed to participate in the Electricity Refund campaign (Art. 6.1. b) GDPR).
2. For our National Sales Company to perform the Electricity Refund we need your personal identifiers, such as your full name and mailing address, and financial information, such as your bank account, routing number, and name of your banking institution. We use this information to perform a transfer of your Electricity Refund into your bank account. If you do not provide your financial information into the Volvo Cars App, for you to receive your Electricity Refund, we will send you a personal check to your mailing address.
3. For our legal obligation to comply with accounting rules and financial reporting legislation we will store your bank account information (bank account number and full name) and timestamp related to your Electricity Refund in our records.

3. How Long We Keep Your Data

The following retention times are applicable for our processing of personal data mentioned above:

1. Personal and Car Identifiers: 500 days from when you accepted the offer.

4. Who We Share Your Personal Data With

With Service Providers:

We will share your personal data with the following categories of third parties, on a need-to-know basis:

• Our processor supporting our activity in general, such as providers of IT solutions; and
• Our banking institution partner who facilitates the payment of your Electricity Refund.

Our categories of processors supporting delivering the Electricity Refund, which are limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with each data processing agreement in place. In some of these situations the use of the processors involves limited transfers of personal data outside of the European Union (EU). We have taken precautions that such transfers are limited to the minimum necessary.

For prevention of harm, in reorganization or for legal purposes:

General Sharing:

We may share the personal data collected from the Volvo Cars App in the following circumstances:

• As a result of a change in our corporate structure: n the event that we enter into, or intend to enter into, a transaction that alters the structure of our business, such as a reorganization, merger, acquisition, sale, joint venture, assignment, consolidation, transfer, change of control, or other disposition of all or any part of our business, assets, or stock, we would share any personal data collected about you with third parties, including the buyer or target (and their agents and advisors) for the purpose of facilitating and completing the transaction. We will share personal data with third parties if we undergo bankruptcy or liquidation, in the course of such proceedings.
• To prevent harm: We will share personal data if we believe it is necessary to detect, investigate, prevent, or act against illegal activities, fraud, or situation(s) involving potential threats to the rights, property, or personal safety of any person.
• For legal purposes: We will share personal data where we are legally required to do so such as in response to court orders, law enforcement, or legal process, including for national security purposes; to establish, protect, or exercise our legal rights, as required to enforce our terms of service or other contracts; to defend against legal claims or demands; or to comply with the requirements of any applicable law.

In the preceding 12 months:

In the preceding 12 months, we have shared, for a business purpose:

• Your personal identifiers and financial information with our banking institution partner to process the payment of your Electricity Refund directly to your bank account or send you your Refund via personal check to your mailing address.

Sale of personal data

Volvo Cars does not sell your personal data collected as part of the Electricity Refund service.

5. Your Rights in Relation to the Data Processing We Perform

5.1 Your rights under GDPR

As a data subject you have specific legal rights granted by the General Data Protection Regulation (GDPR) relating to the personal data we process about you. These are briefly explained below, and you can exercise them by filling out the dedicated form indicated below.

1. Right to withdraw consent: Where you have given consent for the processing of your personal data, you may withdraw your consent at any moment with effect for the future.
2. Right to access your personal data: You may ask from us information regarding personal data that we hold about you. We will provide you with a copy of your personal data upon request. If you request further copies of your personal data, then we can charge you with a reasonable fee that we base on the administrative costs. You have the right to the information about our safeguards for the transfer of your personal data to a country that is outside the EU and the European Economic Area (EEA) if you request that we confirm whether or not we process your personal data, and we transfer your personal data to a country that is outside the EU and the EEA.
3. Right to rectification: You may obtain from us rectification of incorrect or incomplete personal data concerning you. We make reasonable efforts to keep personal data in our possession or control which are used on an ongoing basis, accurate, complete, current, and relevant, based on the most recent information available to us.
4. Right to restriction: You may obtain from us restriction of processing of your personal data, if:
   1. you contest the accuracy of your persona data, for the period we need to verify the accuracy;
   2. the processing is unlawful, and you request the restriction of processing rather than erasure of your personal data;
   3. the processing is unlawful, and you request the restriction of processing rather than erasure of your personal data;
   4. we no longer need your personal data for the processing purpose, but you require them for the establishment, exercise, or defense of legal claims; or
   5. you object to the processing while we verify whether our legitimate grounds override yours.
5. Right to portability: You have the right to receive your personal data that you have provided to us, and, where technically feasible, request that we transmit your personal data (that you have provided to us) to another organization, if:
   1. we process your personal data by automated means;
   2. we base the processing of your personal data on your consent, or our processing of your personal data is necessary for the execution or performance of a contract to which you are a party;
   3. your personal data is provided to us by you; or
   4. your right to portability does not adversely affect the rights and the freedoms of other persons.
   You have the right to receive your personal data in a structured, commonly used and machine-readable format. Your right to receive your personal data must not adversely affect the rights and the freedoms of other persons. Your right to have your personal data transmitted from us to another organization is a right you have if such transmission is technically feasible.
6. Right to erasure: You have the right to request that we delete the personal data we process about you. We must comply with this request if we process your personal data, unless processing is necessary:
   1. for exercising the right of freedom of expression and information;
   2. for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject;
   3. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or
   4. for the establishment, exercise, or defense of legal claims.
7. Right to object: You may object – at any time – to the processing of your personal data due to your particular situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing or for the establishment, exercise, or defense of legal claims. If you object to the processing, please specify whether you also wish the erasure of your personal data, otherwise we will only restrict it.

   You also have the right to object at any time, regardless of any reason, to the processing of your personal data for direct marketing (which includes profiling to the extent that it is related to such direct marketing), if such processing was based on our legitimate interest. If the marketing was based on your consent, you can withdraw consent (see above).

8. Right to lodge a complaint: You can lodge a complaint to your local data protection supervisory authority or with any other data protection authority in the EU. However, we will appreciate if you first contact us to try and solve your problem – you can find our contact details below.

You can exercise your rights in relation to us by filling out this form, which will help us to deal with your request properly. The online form contains the information that we need to verify your identity and review your request. For requests submitted by telephone or email, you will need to provide us with sufficient information that allows us to reasonably verify that you are the person whose personal data we collected and describe your request in sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information.

5.2 Your Rights Under California Law

Under California law, consumers residing in California have certain right with respect to the personal data about them that we collect and sell. These rights include:

1. Right to access: You have the right to request what personal data we have collected, used, shared for a business purpose, and sold about you within the preceding 12 months. Once we receive your request and confirm your identity, we will disclose to you the information we have collected about you.
2. Right to deletion: You have the right to request the deletion of your personal data that we collect about you, subject to certain exceptions. Once we receive your request and confirm your identity, we will delete (and direct our service providers to delete) your personal data from our records, unless an exception applies under applicable law.
3. Right to opt-out:You have the right to opt-out of the sale of personal data by us to third parties for monetary or other valuable consideration. Each of the individual Service Privacy Policies sets out whether or not we sell personal data as such action is defined under California law in connection with such service. In the event we do sell your personal data, you may opt-out. Across all of our digital properties, our collection and sharing of personal data through the use of certain cookies may be deemed a sale under the CCPA. To exercise your right to opt-out of the sharing of your personal data to advertising partners through cookies, please use our OneTrust Cookie Manager.
4. Right of non-discrimination: You have the right to not receive discriminatory treatment if and when you exercise your rights to access, delete, or opt-out.  For example, this means we cannot deny you goods or services to you or change different prices or rates for goods and services, including through the use of discounts or other benefits or imposing penalties, due to you having exercised your rights.

To exercise your right to access, correct, or delete your personal data, you may submit a request through our online form here, via e-mail at vcuscare@volvocars.com, or by calling us at 1(800) 550-5658. You may only make a request for access twice within a 12-month period. To exercise your right to opt-out of the sharing of your personal data to advertising partners, which may be a sale under the CCPA, please use our OneTrust Cookie Manager.

If you are a resident of California, an authorized agent may make a verifiable consumer rights request related to your personal data. If you are an authorized agent making a request on behalf of a consumer, you must provide us with signed permission by the consumer that you are authorized to act on behalf of that consumer. If you are a legal entity, you must also provide us with documentation of your registration with the California Secretary of State. To submit such a request, please contact us via e-mail at vcuscare@volvocars.com.

The online form for access, correction, and deletion requests contains the information that we need to verify your identity and review your request. For requests submitted via telephone or e-mail, you must provide us with sufficient information that allows us to reasonably verify you are the person about whom we collected the personal data and describe your request with sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information. We aim to respond to your request for access, correction, or deletion within the time required by applicable law. If we need more time to respond to your request, we will let you know of the reason and the extension period in writing.

5.3 Your Rights Under Nevada Law

We do not sell personal data collected through our website for monetary consideration. Under Nevada law, you may opt-out of future sales of your personal data collected through our website for monetary consideration. If you want to opt-out of any potential future sales, please e-mail us at: vcuscare@volvocars.com with “Opt-Out of Future Sale of Personal Data” in the subject line and body of your message.

6. Children’s Privacy

Our products and services are not intended to be used by children. We do not knowingly solicit or collect any personal data about children under the age of sixteen (16) nor knowingly allow children to order our products, communicate with us, or use any of our online services or mobile applications. If a child has provided us with personal data, a parent or guardian of that child may contact us to have that data deleted from our records. If you believe that we might have any data from a child under the age of sixteen (16), please tell us using the Contact Information listed below. We will take all reasonable steps to delete the child’s data as soon as possible except where necessary to protect the safety of the child or others as required by law. We do not have actual knowledge that we sell personal data of minors under the age of sixteen (16) years.

7. Information Security

To protect your personal data from loss, theft, and unauthorized access, use, or disclosure, we have implemented technical, administrative, and physical security measures including, for certain data, 256-bit encryption, access controls, and secure development processes. Unfortunately, no method of transmission over the Internet, or method of electronic storage, is 100% secure or impenetrable.

8. Contact Information

In order to exercise your rights, please see section 5 above. If you have any other questions regarding the subject matter of personal data protection, you can contact us at the following contact details:

Volvo Car Corporation

Post address: Assar Gabrielssons väg, SE-405 31, Gothenburg, Sweden

E-mail address: globdpo@volvocars.com

9. Changes to Our Privacy Notice

We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. Whenever we make substantial changes to this notice, and in particular when this notice underlies your consent, we will inform you of the changes.

This privacy notice is current as of the date which appears at the top of the document.