VOLVO ID PRIVACY NOTICE

Effective Date: June 1, 2021

This document describes how Volvo Cars (as defined below processes your personal data or personal information (collectively referred to in this document as "personal data") when you create and use your Volvo ID to get access to services within the Volvo Cars digital ecosystem (hereinafter "Volvo ID").

You can find below:

  1. Who we are;
  2. What personal data we process and why;
  3. How long we keep your data;
  4. Who we share your personal data with;
  5. What rights you have in relation to the data processing we perform;
  6. Children’s privacy;
  7. Information security;
  8. "Do No Track";
  9. Contact information; and
  10. Changes to our Privacy Notice.

1. Who We Are

The entity responsible for the processing of personal data in relation to the creation and use of your Volvo ID is Volvo Car Corporation, having its registered office at Assar Gabrielssons Väg, SE-405 31, Gothenburg, Sweden, company registration number 556074-3089, hereinafter referred to as "Volvo Cars", "we", or "us".

2. What Personal Data We Collect and Why

The creation and use of your Volvo ID, to get access to services withing the Volvo Cars digital ecosystem, involves the processing of the following categories of personal data:

We collect from you your personal identifiers (such as first and last name, phone number, preferred language, country, E-mail address and password) to create an account with us, provide you with access to the Volvo Cars Services that require a Volvo ID and to communicate with you regarding your Volvo ID. For the purpose of GDPR, the legal basis of this data processing is performance of the contract you have enter into with Volvo Cars ((Art. 6.1.b) GDPR).

To provide an overview of your Volvo ID and its connected services on the Volvo ID Portal, we process your personal identifiers (Volvo ID and VIN) and commercial information (, vehicle information and services connected to your Volvo ID). For the purpose of GDPR, the legal basis for this processing is the legitimate interest ((Art. 6.1.f) GDPR) to outline all cars and services that are associated with your Volvo ID.

We use your Volvo ID in order to uniquely identify you within the Volvo Cars App. To see how we use and share your information in connection with the Volvo Cars App see https://www.volvocars.com/us/legal-policies/privacy/volvo-cars-app-privacy-notice/. We also process the personal identifiers you provide when you created the account (see above) for troubleshooting purposes, in connection with the creation or use of your Volvo ID and to improve the reliability of our product. For the purpose of GDPR, the legal basis for this is our legitimate interest ((Art. 6.1.f) GDPR) to secure a stable and reliable product to you.

3. How Long We Keep Your Data

We will keep your personal data as long as you have a registered Volvo ID. If you delete your Volvo ID (which you can do through the Volvo ID Portal) the Volvo ID together with associated data will be deleted thirty (30) days after your deletion request.

4. Who We Share Your Personal Data With

With Service Providers:

We share personal data with third party processors that support us in providing the Volvo ID and carrying out the purposes above.

Our categories of processors supporting in delivering the Volvo ID are:

  • account creation and authentication service provider;
  • data hosting
  • distribution of e-mails and SMS
  • troubleshooting service provider

They are limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with each data processing agreement in place. In some of these situations the use of the processors involves limited transfers of personal data outside of the European Union. We have taken precautions that such transfers are limited to the minimum necessary.

For prevention of harm, in reorganization or for legal purposes:

General sharing

We may share the personal data collected from the Volvo Cars App in the following circumstances:

  • As a result of a change in our corporate structure: in the event that we enter into, or intend to enter into, a transaction that alters the structure of our business, such as a reorganization, merger, acquisition, sale, joint venture, assignment, consolidation, transfer, change of control, or other disposition of all or any part of our business, assets, or stock, we would share any personal data collected about you with third parties, including the buyer or target (and their agents and advisors) for the purpose of facilitating and completing the transaction. We will share personal data with third parties if we undergo bankruptcy or liquidation, in the course of such proceedings.
  • To prevent harm: we will share personal data if we believe it is necessary to detect, investigate, prevent, or act against illegal activities, fraud, or situation(s) involving potential threats to the rights, property, or personal safety of any person.
  • For legal purposes: we will share personal data where we are legally required to do so such as in response to court orders, law enforcement, or legal process, including for national security purposes; to establish, protect, or exercise our legal rights, as required to enforce our terms of service or other contracts; to defend against legal claims or demands; or to comply with the requirements of any applicable law

In the preceding 12 months:

In the preceding 12 months, we have shared, for a business purpose:

  • your personal identifiers and commercial information with our service providers to provide the Volvo ID services, including our, data host, troubleshooting provider, and account creation and authentication provider.
  • Your personal identifiers and commercial information for research and development purposes to better understand how to improve our products and services.
  • Your personal identifiers and commercial information with our troubleshooting vendor to identify and repair errors, and to maintain and improve the Volvo ID services.

Volvo Cars does not sell your personal data collected as part of the Volvo ID services.

5. Your Rights in Relation to the Processing of Personal Data

5.1 Your Rights Under GDPR

As a data subject you have specific legal rights granted by the General Data Protection Regulation (GDPR) relating to the personal data we process about you. These are briefly explained below, and you can exercise them by filling out the dedicated form indicated below.

  1. Right to withdraw consent: Where you have given consent for the processing of your personal data, you may withdraw your consent at any moment with effect for the future.
  2. Right to access your personal data: You may ask from us information regarding personal data that we hold about you. We will provide you with a copy of your personal data upon request. If you request further copies of your personal data, then we can charge you with a reasonable fee that we base on the administrative costs. You have the right to the information about our safeguards for the transfer of your personal data to a country that is outside the EU and the European Economic Area (EEA) if you request that we confirm whether or not we process your personal data, and we transfer your personal data to a country that is outside the EU and the EEA.
  3. Right to rectification: You may obtain from us rectification of incorrect or incomplete personal data concerning you. We make reasonable efforts to keep personal data in our possession or control which are used on an ongoing basis, accurate, complete, current, and relevant, based on the most recent information available to us.
  4. Right to restriction: You may obtain from us restriction of processing of your personal data, if:
    1. you contest the accuracy of your persona data, for the period we need to verify the accuracy;
    2. the processing is unlawful, and you request the restriction of processing rather than erasure of your personal data;
    3. the processing is unlawful, and you request the restriction of processing rather than erasure of your personal data;
    4. we no longer need your personal data for the processing purpose, but you require them for the establishment, exercise, or defense of legal claims; or
    5. you object to the processing while we verify whether our legitimate grounds override yours.
  5. Right to portability: You have the right to receive your personal data that you have provided to us, and, where technically feasible, request that we transmit your personal data (that you have provided to us) to another organization, if:
    1. we process your personal data by automated means;
    2. we base the processing of your personal data on your consent, or our processing of your personal data is necessary for the execution or performance of a contract to which you are a party;
    3. your personal data is provided to us by you; or
    4. your right to portability does not adversely affect the rights and the freedoms of other persons.

    You have the right to receive your personal data in a structured, commonly used and machine-readable format. Your right to receive your personal data must not adversely affect the rights and the freedoms of other persons. Your right to have your personal data transmitted from us to another organization is a right you have if such transmission is technically feasible.

  6. Right to erasure: You have the right to request that we delete the personal data we process about you. We must comply with this request if we process your personal data, unless processing is necessary:
    1. for exercising the right of freedom of expression and information;
    2. for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject;
    3. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or
    4. for the establishment, exercise, or defense of legal claims.
  7. Right to object:You may object – at any time – to the processing of your personal data due to your particular situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing or for the establishment, exercise, or defense of legal claims. If you object to the processing, please specify whether you also wish the erasure of your personal data, otherwise we will only restrict it.

    You also have the right to object at any time, regardless of any reason, to the processing of your personal data for direct marketing (which includes profiling to the extent that it is related to such direct marketing), if such processing was based on our legitimate interest. If the marketing was based on your consent, you can withdraw consent (see above).

  8. Right to lodge a complaint: You can lodge a complaint to your local data protection supervisory authority or with any other data protection authority in the EU. However, we will appreciate if you first contact us to try and solve your problem – you can find our contact details below.
  9. You can exercise your rights in relation to us by filling out this form, which will help us to deal with your request properly. The online form contains the information that we need to verify your identity and review your request. For requests submitted by telephone or email, you will need to provide us with sufficient information that allows us to reasonably verify that you are the person whose personal data we collected and describe your request in sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information.

5.2 Your Rights Under California Law

Under California law, consumers residing in California have certain right with respect to the personal data about them that we collect and sell. These rights include:

  1. Right to access: You have the right to request what personal data we have collected, used, shared for a business purpose, and sold about you within the preceding 12 months. Once we receive your request and confirm your identity, we will disclose to you the information we have collected about you.
  2. Right to deletion: You have the right to request the deletion of your personal data that we collect about you, subject to certain exceptions. Once we receive your request and confirm your identity, we will delete (and direct our service providers to delete) your personal data from our records, unless an exception applies under applicable law.
  3. Right to opt-out: You have the right to opt-out of the sale of personal data by us to third parties for monetary or other valuable consideration. Each of the individual Service Privacy Policies sets out whether or not we sell personal data as such action is defined under California law in connection with such service. In the event we do sell your personal data, you may opt-out. Across all of our digital properties, our collection and sharing of personal data through the use of certain cookies may be deemed a sale under the CCPA. To exercise your right to opt-out of the sharing of your personal data to advertising partners through cookies, please use our OneTrust Cookie Manager.
  4. Right of non-discrimination: You have the right to not receive discriminatory treatment if and when you exercise your rights to access, delete, or opt-out. For example, this means we cannot deny you goods or services to you or change different prices or rates for goods and services, including through the use of discounts or other benefits or imposing penalties, due to you having exercised your rights.

To exercise your right to access, correct, or delete your personal data, you may submit a request through our online form here, via e-mail at vcuscare@volvocars.com, or by calling us at 1(800) 550-5658. You may only make a request for access twice within a 12-month period. To exercise your right to opt-out of the sharing of your personal data to advertising partners, which may be a sale under the CCPA, please use our OneTrust Cookie Manager.

If you are a resident of California, an authorized agent may make a verifiable consumer rights request related to your personal data. If you are an authorized agent making a request on behalf of a consumer, you must provide us with signed permission by the consumer that you are authorized to act on behalf of that consumer. If you are a legal entity, you must also provide us with documentation of your registration with the California Secretary of State. To submit such a request, please contact us via e-mail at vcuscare@volvocars.com.

The online form for access, correction, and deletion requests contains the information that we need to verify your identity and review your request. For requests submitted via telephone or e-mail, you must provide us with sufficient information that allows us to reasonably verify you are the person about whom we collected the personal data and describe your request with sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information. We aim to respond to your request for access, correction, or deletion within the time required by applicable law. If we need more time to respond to your request, we will let you know of the reason and the extension period in writing.

5.3 Your Rights Under Nevada Law

We do not sell personal data collected through our website for monetary consideration. Under Nevada law, you may opt-out of future sales of your personal data collected through our website for monetary consideration. If you want to opt-out of any potential future sales, please e-mail us at: vcuscare@volvocars.com with "Opt-Out of Future Sale of Personal Data" in the subject line and body of your message.

6. Children’s Privacy

Our products and services are not intended to be used by children. We do not knowingly solicit or collect any personal data about children under the age of sixteen (16) nor knowingly allow children to order our products, communicate with us, or use any of our online services or mobile applications. If a child has provided us with personal data, a parent or guardian of that child may contact us to have that data deleted from our records. If you believe that we might have any data from a child under the age of sixteen (16), please tell us using the Contact Information listed below. We will take all reasonable steps to delete the child’s data as soon as possible except where necessary to protect the safety of the child or others as required by law. We do not have actual knowledge that we sell personal data of minors under the age of sixteen (16) years.

7. Information Security

To protect your personal data from loss, theft, and unauthorized access, use, or disclosure, we have implemented technical, administrative, and physical security measures including, for certain data, 256-bit encryption, access controls, and secure development processes. Unfortunately, no method of transmission over the Internet, or method of electronic storage, is 100% secure or impenetrable.

8. Do Not Track

We respond to Do Not Track (DNT) signals. DNT is a preference you can set on your web browser to inform websites that you do not want to be tracked. You can enable or disable DNT by visiting the preferences or settings page of your web browser. For more information, visit: https://www.eff.org/issues/do-not-track.

9. Contact Information

In order to exercise your rights, please see section 5 above. If you have any other questions regarding the subject matter of personal data protection, you can contact us at the following contact details:

Volvo Car Corporation

Post address: Assar Gabrielssons väg, SE-405 31, Gothenburg, Sweden

E-mail address: globdpo@volvocars.com

10. How We Make Changes to Our Privacy Notice

We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. Whenever we make substantial changes to this notice, and in particular when this notice underlies your consent, we will inform you of the changes.

This privacy notice is current as of the date which appears at the top of the document.