Overview
Customer Privacy PolicyVehicle Privacy NoticePrivacy Notice – Volvo Valet from Volvo CarsONLINE RESERVATION PRIVACY POLICYPrivacy Notice – Vehicle Data AnalyticsPrivacy Notice – Consumer surveysWebsite Privacy PolicyPrivacy Notice – Volvo Cars AppPrivacy Notice – Volvo IDTest Vehicle Privacy Notice

Article Version 2021.186.0

Privacy Notice – Volvo ID

Effective from: 2021-07-05
Published at: 2021-05-31

This document describes how Volvo Cars (as defined below) processes your personal data or personal information (collectively referred to herein as "personal data") when you create and use your Volvo ID to get access to services within the Volvo Cars digital ecosystem (hereinafter "Volvo ID").

1. Who we are

The entity responsible for the processing of personal data in relation to the creation and use of your Volvo ID is Volvo Car Corporation, having its registered office at Assar Gabrielssons Väg, SE-405 31, Gothenburg, Sweden, company registration number 556074-3089, hereinafter referred to as "Volvo Cars," "we," or "us."

2. What personal data we collect and why

The creation and use of your Volvo ID, to get access to services within the Volvo Cars digital ecosystem involves the processing of the following categories of personal data:

We collect your personal identifiers from you (such as first and last name, phone number, preferred language, country, e-mail address, and password) to create an account with us, to provide you with access to the Volvo Cars Services that require a Volvo ID, and to communicate with you regarding your Volvo ID. For the purpose of GDPR, the legal basis of this data processing is the performance of the contract you have entered into with Volvo Cars ((Art. 6.1.b) GDPR).

To provide an overview of your Volvo ID and its connected services on the Volvo ID Portal, we process your personal identifiers (Volvo ID and VIN) and commercial information (vehicle information and services connected to your Volvo ID). For the purpose of GDPR, the legal basis for this processing is a legitimate interest ((Art. 6.1.f) GDPR) to profile all cars and services that are associated with your Volvo ID.

We use your Volvo ID in order to uniquely identify you within the Volvo Cars App. To see how we use and share your information in connection with the Volvo Cars App, see Privacy Notice – Volvo Cars App.

We also process the personal identifiers you provide when you created the account (see above) for troubleshooting purposes, in connection with the creation or use of your Volvo ID, and to improve the reliability of our product. For the purpose of GDPR, the legal basis for this is our legitimate interest ((Art. 6.1.f) GDPR) to secure a stable and reliable product for you.

3. How long we keep your data

We will keep your personal data as long as you have a registered Volvo ID. If you delete your Volvo ID (which you can do through the Volvo ID Portal), the Volvo ID, together with associated data, will be deleted thirty (30) days after your deletion request.

4. Who we share your personal data with

With Service Provider:

We share personal data with third-party processors that support us in providing the Volvo ID and carrying out the purposes above.

Our categories of processors that support us in delivering the Volvo ID are:

  • account creation and authentication service provider;
  • data hosting;
  • distribution of emails and SMS; and
  • troubleshooting service provider.

They are limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with each data processing agreement in place. In some of these situations, the use of the processors involves limited transfers of personal data outside of the European Union. We have taken precautions that such transfers are limited to the minimum necessary.

For the prevention of harm, in reorganization, or for legal purposes:

General sharing

We may share the personal data collected from the Volvo Cars App in the following circumstances:

  • as a result of a change in our corporate structure: in the event that we enter into, or intend to enter into, a transaction that alters the structure of our business, such as a reorganization, merger, acquisition, sale, joint venture, assignment, consolidation, transfer, change of control, or other disposal of all or any part of our business, assets, or stock, we would share any personal data collected about you with third parties, including the buyer or target (and their agents and advisors), for the purpose of facilitating and completing the transaction. We would share personal data with third parties if we undergo bankruptcy or liquidation, in the course of such proceedings.
  • to prevent harm: we will share personal data if we believe it is necessary to detect, investigate, prevent, or act against illegal activities, fraud, or situation(s) involving potential threats to the rights, property, or personal safety of any person.
  • for legal purposes: we will share personal data where we are legally required to do so, such as in response to court orders, law enforcement, or legal process, including for national security purposes; to establish, protect, or exercise our legal rights, as required to enforce our terms of service or other contracts; to defend against legal claims or demands; or to comply with the requirements of any applicable law.

In the preceding 12 months:

In the preceding 12 months, for business purposes we have shared:

  • your personal identifiers and commercial information with our service providers to provide the Volvo ID services, including our data host, troubleshooting provider, and account creation and authentication provider.
  • Your personal identifiers and commercial information for research and development purposes to better understand how to improve our products and services.
  • Your personal identifiers and commercial information with our troubleshooting vendor to identify and repair errors, and to maintain and improve the Volvo ID services.

Volvo Cars does not sell your personal data collected as part of the Volvo ID services.

5. Your rights in relation to the data processing we perform

5.1. Your rights under GDPR

As a data subject, you have specific legal rights granted by the General Data Protection Regulation relating to the personal data we process about you. These are briefly explained below, and you can exercise them by filling out the dedicated form indicated below.

  1. Right to withdraw consent: Where you have given consent for the processing of your personal data, you may withdraw your consent at any moment with effect for the future.
  2. Right to access your personal data: You may ask us for information regarding personal data that we hold about you. We will provide you with a copy of your personal data upon request. If you request further copies of your personal data, then we can charge you a reasonable fee that we base on administrative costs. You have the right to information about our safeguards for the transfer of your personal data to a country that is outside the EU and the EEA if you request that we confirm whether or not we process your personal data and we transfer your personal data to a country that is outside the EU and the EEA.
  3. Right to rectification: You may obtain our rectification of incorrect or incomplete personal data concerning you. We make reasonable efforts to keep personal data in our possession or control which are used on an ongoing basis, accurate, complete, current and relevant, based on the most recent information available to us.
  4. Right to restriction: You may obtain our restriction of the processing of your personal data, if:
    1. the processing is unlawful and you request the restriction of processing rather than erasure of your personal data,
    2. we no longer need your personal data for the processing purpose but you require them for the establishment, exercise, or defense of legal claims, or
    3. you object to their processing while we verify whether our legitimate interests override yours.
  5. Right to portability: You have the right to receive your personal data that you have provided to us and, where technically feasible, to request that we transmit your personal data (that you have provided to us) to another organization, if:
    1. we process your personal data by automated means;
    2. we base the processing of your personal data on your consent or our processing of your personal data is necessary for the execution or performance of a contract to which you are a party;
    3. your personal data are provided to us by you; and
    4. your right to portability does not adversely affect the rights and the freedoms of other persons.
    You have the right to receive your personal data in a structured, commonly used and machine-readable format. Your right to receive your personal data must not adversely affect the rights and the freedoms of other persons. Your hold the right to have your personal data transmitted from us to another organization if such transmission is technically feasible.
  6. Right to erasure: You have the right to request that we delete the personal data we process about you. We must comply with this request if we process your personal data, unless processing is necessary:
    1. for exercising the right of freedom of expression and information;
    2. for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject;
    3. for archival purposes in the public interest, for scientific or historical research purposes, or for statistical purposes; or
    4. for the establishment, exercise, or defense of legal claims.
  7. Right to object: You may object to the processing of your personal data at any time due to your particular situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing, or for the establishment, exercise, or defense of legal claims. If you object to the processing, please specify whether you also request the erasure of your personal data; otherwise we will only restrict it.
    • You also have the right to object at any time, regardless of the reason, to the processing of your personal data for direct marketing (which includes profiling to the extent that it is related to such direct marketing), if such processing was based on our legitimate interest. If the marketing was based on your consent, you can withdraw consent (see above).
  8. Right to lodge a complaint: You can lodge a complaint to your local data protection supervisory authority or with any other data protection authority in the EU. However, we would appreciate it if you first contact us to try and solve your problem – you can find our contact details below.

You can exercise your rights in relation to us by filling out this form (first, choose your country or region, then open and fill out the online form), which will help us to deal with your request properly. The online form contains the information that we need to verify your identity and review your request. For requests submitted by telephone or email, you will need to provide us with sufficient information that allows us to reasonably verify that you are the person whose personal data we collected and describe your request in sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information.

5.2. Your rights under California Law

Under California law, consumers residing in California have certain rights with respect to the personal data about them that we collect and sell. These rights include: to access or delete the personal data that we have collected about them, to opt out of the sale of their personal data by us to a third party, and not to be discriminated against for exercising these rights.

  1. Right to access: You have the right to request what personal data we have collected, used, shared for a business purpose, and sold about you within the preceding 12 months. Once we receive your request and confirm your identity, we will disclose to you the information we have collected about you.
  2. Right to deletion: You have the right to request the deletion of your personal data that we collect about you, subject to certain exceptions. Once we receive your request and confirm your identity, we will delete (and direct our service providers to delete) your personal data from our records, unless an exception applies under applicable law.
  3. Right to opt out: You have the right to opt out of the sale of your personal data by us to third parties for monetary or other valuable consideration. Each of the individual Service Privacy Policies sets out whether or not we sell personal data as such action is defined under California law in connection with such service. In the event that we do sell your personal data, you may opt out. Across all of our digital properties, our collection and sharing of personal data through the use of certain cookies may be deemed a sale under the California Consumer Privacy Act. To exercise your right to opt out of the sharing of your personal data to advertising partners through cookies, please use our OneTrust Cookie Manager.
  4. Right to non-discrimination: You have the right to not receive discriminatory treatment if and when you exercise your rights to access, delete, or opt out. For example, this means we cannot deny goods or services to you or charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties, due to you having exercised your rights.

To exercise your right to access, correct, or delete your personal data, you may submit a request through our online form here, via email at vcuscare@volvocars.com, or by calling us at 1(800) 550-5658. You may only make a request for access twice within a 12-month period. To exercise your right to opt out of the sharing of your personal data to advertising partners, which may be a sale under the California Consumer Privacy Act, please use our OneTrust Cookie Manager.

If you are a resident of California, an authorized agent may make a verifiable consumer rights request related to your personal data. If you are an authorized agent making a request on behalf of a consumer, you must provide us with signed permission by the consumer that you are authorized to act on behalf of that consumer. If you are a legal entity, you must also provide us with documentation of your registration with the California Secretary of State. To submit such a request, please contact us via email at vcuscare@volvocars.com

The online form for access, correction, and deletion requests contains the information that we need to verify your identity and review your request. For requests submitted via telephone or e-mail, you must provide us with sufficient information that allows us to reasonably verify you are the person about whom we collected the personal data, and you must describe your request with sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information. We aim to respond to your request for access, correction, or deletion within the time required by applicable law. If we need more time to respond to your request, we will let you know of the reason and the extension period in writing.

6. Children's Privacy

Our products and services are not intended to be used by children. We do not knowingly solicit or collect any personal data about children under the age of sixteen (16) or knowingly allow children to order our products, communicate with us, or use any of our online services or mobile applications. If a child has provided us with personal data, a parent or guardian of that child may contact us to have that data deleted from our records. If you believe that we might have any data from a child under the age of sixteen (16), please tell us using the Contact Information listed below. We will take all reasonable steps to delete the child's data as soon as possible except where necessary to protect the safety of the child or others as required by law. We do not have actual knowledge that we sell personal data of minors under the age of sixteen (16) years.

7. Information Security

To protect your personal data from loss, theft, and unauthorized access, use, or disclosure, we have implemented technical, administrative, and physical security measures, including 256-bit encryption, access controls, and secure development processes. Unfortunately, no method of transmission over the Internet, or method of electronic storage, is 100% secure or impenetrable.

8. Do Not Track

We respond to Do Not Track (DNT) signals. DNT is a preference you can set on your web browser to inform websites that you do not want to be tracked. You can enable or disable DNT by visiting the preferences or settings page of your web browser. For more information, visit https://www.eff.org/issues/do-not-track

9. Contact information

In order to exercise your rights, please see section 5 above. If you have any other questions regarding the subject matter of personal data protection, you can contact us at the following contact details:

Volvo Car Corporation

Mailing address: Assar Gabrielssons väg, SE-405 31, Gothenburg, Sweden

Email address: globdpo@volvocars.com

10. Changes to our Privacy Notice

We reserve the right to modify our privacy practices and update and make changes to this privacy notice at any time and at our discretion. Whenever we make substantial changes to this notice, and in particular when this notice underlies your consent, we will inform you of the changes and acquire your consent where required by law. This privacy notice is current as of the date which appears at the top of the document.