Privacy Notice – Consumer survey

Effective from: 2022-10-10

Published at: 2022-10-10

This document describes how Volvo Cars (as described below) handles your personal data when you participate in one of our consumer surveys (hereinafter "Consumer Survey").

Next you will find:

1. Who we are

The entities co-responsible for the processing of personal data in relation to the Consumer Surveys are Volvo Car Corporation, with registered office at Assar Gabrielssons Väg, 40531 Gothenburg, Sweden, with registration number 556074-3089, and Gildemeister Costa Rica, S.A. with address in San José, Escazú, San Rafael, hereinafter “Volvo Cars”, “we”, or “us”.

2. What personal data we collect and why

When you interact with our Consumer Survey, we process the following categories of data about you:

Identifiers such as name, email address, phone number, greeting type, age, gender, zip code, and city. We process this data to send the Consumer Survey and evaluate the performance of consumers by segmentation. The processing of the data is based on our legitimate interest to improve the commercial objective and the customer experience to which your response to the survey refers.
Your vehicle data, such as vehicle type, vehicle identification number (VIN), and license plate number. We process this data based on our legitimate interest to assess field action and warranty performance.
Contract type, subscription number, relationship with the vehicle (start and end date of the type of contract/sale). We process this data for the purpose of sending the Consumer Survey and evaluating the performance of consumers by segments, which allows us to improve overall business operations and the consumer experience. The processing of the data is based on our legitimate interest to improve the commercial objective and the customer experience to which your response to the survey relates.
Open/Click Rates We process this data for statistical analysis and reach measurement, and to understand the interests of our consumers. For this analysis, email invitations contain so-called web beacons or tracking pixels, which display single-pixel image files that are also embedded on our website, where we ask for your consent to display them. The processing of the data is based on our legitimate interest in understanding the general performance of the survey and the interaction with it.

3. How long we keep your data

Your responses to consumer surveys will be retained for up to five (5) years from the time you submit your responses, after which they will be anonymised.

In order to maintain the security of your answers, the invitation to provide feedback provides you with an individualized questionnaire that no one else can access. The survey website and our data storage facilities have security measures in place to protect the loss, misuse, and alteration of the information under our control.

Only certain employees have access to the personal information you provide us. They only have access for case management, data analysis and quality control.

4. Who we share your personal data with

We will share the personal data of the interested party with the following categories of third parties, to the extent necessary:

Our data processors who endorse our activity in general, such as IT solution providers.
Our managers of conducting Consumer Surveys, who are limited by contract regarding the use of the personal data of the interested party for any purpose other than to offer services in compliance with each data processing agreement in force:

Your personal data will be disclosed by Volvo Cars to, and processed by, Gildemeister Costa Rica, S.A. Volvo will transfer your personal data on the basis of the Standard Contractual Clauses of the European Commission and within the limitations established by Law 8968, Protection of the Person Against the Processing of Personal Data.

5. Your rights in relation to the data processing we perform

As the owner of the data, the interested party has specific legal rights, by virtue of the General Regulation of the Law for the Protection of the Person against the Treatment of their Personal Data, in relation to the treatment that is made of their personal data. These rights are briefly explained below, which you can exercise through the specific form below.

Right to withdraw consent: the interested party can withdraw their consent to the processing of their personal data at any time, with future effects.
Right to access your personal data: the interested party may request the information that we have about their personal data. If the interested party does so, we will provide them with a copy of their personal data. In the event of a request for additional copies of their data, we may charge them a reasonable fee for administrative costs. They have the right to obtain information about our guarantees in the transfer of their personal data to non-EU and EEA countries if they ask us to confirm if we process their personal data, and we transfer said data to those countries.
Right to rectification: the interested party may request the rectification of their incorrect or incomplete personal data. We use reasonable efforts to ensure that the personal data that we possess or control on an ongoing basis is accurate, complete, current and relevant, based on the most recent information available to us.
Right to restriction: The client may request that we restrict the processing of their personal data, in the following cases:
1. If you dispute the accuracy of your personal data, for the period we need to verify such accuracy.
2. In case the treatment is unlawful and you request the restriction of such treatment instead of the deletion of your personal data.
3. In the event that we no longer need the personal data of the interested party for their treatment, but they request them for the establishment, exercise or defense of legal claims.
4. In case you object to the treatment while we verify if our legitimate reasons override yours.
Right to portability: You have the right to receive the personal data you have provided to us, and, to the extent technically possible, request the transmission of said data to another organization, if:
1. We process your personal data by automated means.
2. We base the processing of your personal data on your consent, or our processing of your personal data is necessary for the performance of a contract to which you are a party.
3. The personal data has been provided to us by the interested party.
4. The data subject's right to portability does not adversely affect the rights and freedoms of other people.
You have the right to receive your personal data in a structured manner and in a commonly used and machine-readable format. Your right to receive your personal data must not adversely affect the rights and freedoms of other people. Your right to have us transmit your personal data to another organization is subject to the fact that such transmission is technically possible.
Right to erasure: You have the right to request the deletion of the personal data that we process. If we process the personal data of the interested party, we must comply with this request, unless such treatment is necessary:
1. For the exercise of the right to freedom of expression and information.
2. For the fulfillment of an obligation of the laws of the Union or of a Member State to which we are subject.
3. For archiving purposes of public interest, scientific or historical research purposes, statistical purposes.
4. For the establishment, exercise, or defense of legal claims.
Right to object: You can oppose, at any time, the processing of your personal data for reasons of any particular situation, to the extent that the processing is not based on your consent but on our legitimate interests or those of third parties. In such a case, we will stop processing your personal data, unless we can demonstrate compelling legitimate grounds and an essential interest for the processing or for the establishment, exercise, or defense of legal claims. In case of opposition to the treatment, specify if you also want your personal data to be deleted; otherwise, we will only proceed to its restriction. The customer also has the right to object, at any time, for whatever reason, to the processing of their personal data for direct marketing purposes (including profiling to the extent that they are related to such direct marketing), if the customer said treatment is based on our legitimate interest. If such marketing is based on your consent, the customer can withdraw that consent (see above).
Right to lodge a complaint: The interested party has the right to file any claim with the supervisory authority in charge of data protection or any other equivalent authority in the EU. However, we would appreciate it if you could contact us in advance to try to resolve your problem, for which you will find our contact details below.

The interested party can exercise their rights in relation to us through the respective form, which will allow us to attend to their request properly. The online form contains the information we need to verify your identity and review your application. For requests made by phone or email, the interested party must provide us with sufficient information that allows us to verify that it is really the person from whom we are collecting personal data, and describe their request as precisely as possible, so that we can evaluate it. and respond appropriately. If the information provided by the interested party does not allow us to verify their identity to meet their request to access and delete their data, we may request additional information.

You may exercise these rights in relation with all the responsible groups mentioned in this statement.

6. Contact information

In order to exercise your rights, Please use the web form in Section 5.

For any other question related to the protection of personal data, you can contact Gildemeister Costa Rica, S.A. here:

Company: GILDEMEISTER COSTA RICA, S.A.

Address: San José, Escazú, San Rafael, 450 meters south of Multiplaza Escazu.

Email: rmalavasi@gildemeister.cr - mromero@gildemeister.cr

You can contact the Data Protection Officer of Volvo Car Corporation, whose details are set out below:

Company: Volvo Car Corporation

Postal address: Volvo Car Corporation, Assar Gabrielssons Väg, SE-405 31 Gothenburg, Sweden

Email: globdpo@volvocars.com

7. Changes to our Privacy Notice

We reserve the right, at our sole discretion, to change our privacy practices and to update and modify this privacy statement at any time. For this reason, we recommend that you periodically review this privacy statement. This privacy statement is effective from the date that appears at the top of the document. Your personal data will be treated in accordance with the privacy statement under which they were collected, unless you consent to them being treated otherwise.