Privacy

Vehicle Privacy Notice

Privacy Notice - Marketing Communication

Volvo Cars App Privacy Notice

Privacy Notice – Volvo ID

Privacy Notice – Consumer surveys

Privacy Notice – Data subject rights and request

Business information

Article version 2021.121.0

Privacy Notice – Data subject rights and request

Effective from:

Published at:

This document describes how Volvo Cars (as defined below) processes your personal data when you submit a Data Subject Rights Request (hereinafter “DSRR”) in any form (e-mail, phone, webform or letter).

You can find below:

  1. Who we are;
  2. What personal data we process and why;
  3. How long we keep your data;
  4. Who we share your personal data with;
  5. What rights you have in relation to the data processing we perform;
  6. How to contact us;
  7. Changes to our Privacy Notice.

1. Who we are

The entity that is responsible for the processing of personal data in relation to the DSRR is Volvo Car Corporation , having its registered office at Assar Gabrielssons Väg, 405 31 Gothenburg, Sweden, company registration number 556074-3089, hereinafter referred to as “Volvo Cars”, “we”, or “us”.

2. What personal data we collect and why

DSRR involves the processing of the following categories of personal data:

  1. In order to verify your identity upon submission of a DSRR, we process your personal data. The legal basis of this data processing is our legitimate interest to ensure that we execute permissible and accurate DSRRs. The data that we process for verification purposes depends on the type of data that the DSRR is concerned with. For data about:
    1. you as a customer, we process your e-mail and/or postal address;
    2. your car, we process the VIN of the vehicle(s) in question;
    3. digital services data, we process the Volvo ID (e-mail address or phone number) that you used to register for such services.
  2. Once your identity is verified, we process your full name, postal address(es), phone number(s), e-mail address(es), and VIN(s) in order to manage and fulfill your request. Depending on which data subject right the DSRR is concerned with, the handling of such request consists of finding and collecting the data in question, changing or erasing it, and collecting all information that pertains to the actions carried out in a cover letter, which presents the results of the proceedings for yor review. The legal basis for this data processing is compliance with a legal obligation to which we are subject (Art. 6(1)(c) GDPR).
  3. Furthermore, we process data related to your case such as type of request, relevant market, and duration of case handling for the creation of DSRR related statistics and the improvement of our DSRR management process. The legal basis for this data processing is our legitimate interest to optimize our DSRR processes and procedures (Art. 6(1)(f) GDPR).
  4. We also process data related to your case such as type of request, relevant market, duration of case handling and other case-related details based on our legitimate interst to document our practices for internal and external auditing purposes (Art. 6(1)(f) GDPR).

3. How long we keep your data

We keep the data that is related to your DSRR for three (3) years. If the data relates to an ongoing complaint or litigation, the data is kept throughout such proceedings.

4. Who we share your personal data with

We will share your personal data with the following categories of third parties, on a need-to-know basis:

  • Our processors supporting our activity in general, such as providers of IT solutions;
  • Our processors supporting delivering the DSRR, which are limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with each data processing agreement in place.
  • Other third parties:
    • Companies within the Volvo Car group (EEA) – for fulfilling the DSRR if your personal data is kept by another legal entity than Volvo Car Corporation.

5. Your rights in relation to the data processing we perform

As a data subject you have specific legal rights granted by the General Data Protection Regulation relating to the personal data we process about you. These are briefly explained below, and you can exercise them by filling out the dedicated form indicated below.

  1. Right to withdraw consent: Where you have given consent for the processing of your personal data, you may withdraw your consent at any moment with effect for the future.
  2. Right to access your personal data: You may ask from us information regarding personal data that we hold about you. We will provide you with a copy of your personal data upon request. If you request further copies of your personal data, then we can charge you with a reasonable fee that we base on the administrative costs. You have the right to the information about our safeguards for the transfer of your personal data to a country that is outside the EU and the EEA if you request that we confirm whether or not we process your personal data, and we transfer your personal data to a country that is outside the EU and the EEA.
  3. Right to rectification: You may obtain from us rectification of incorrect or incomplete personal data concerning you. We make reasonable efforts to keep personal data in our possession or control which are used on an ongoing basis, accurate, complete, current and relevant, based on the most recent information available to us.
  4. Right to restriction: You may obtain from us restriction of processing of your personal data, if:
    1. you contest the accuracy of your personal data, for the period we need to verify the accuracy,
    2. the processing is unlawful and you request the restriction of processing rather than erasure of your personal data,
    3. we do no longer need your personal data for the processing purpose but you require them for the establishment, exercise or defense of legal claims, or
    4. you object to the processing while we verify whether our legitimate grounds override yours.
  5. Right to portability: You have the right to receive your personal data that you have provided to us, and, where technically feasible, request that we transmit your personal data (that you have provided to us) to another organization, if:
    1. we process your personal data by automated means;
    2. we base the processing of your personal data on your consent, or our processing of your personal data are necessary for the execution or performance of a contract to which you are a party;
    3. your personal data are provided to us by you; and
    4. your right to portability does not adversely affect the rights and the freedoms of other persons.
    • You have the right to receive your personal data in a structured, commonly used and machine-readable format. Your right to receive your personal data must not adversely affect the rights and the freedoms of other persons. Your right to have your personal data transmitted from us to another organization is a right you have if such transmission is technically feasible.
  6. Right to erasure: You have the right to request that we delete the personal data we process about you. We must comply with this request if we process your personal data, unless processing is necessary:
    1. for exercising the right of freedom of expression and information;
    2. for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject;
    3. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or
    4. for the establishment, exercise or defense of legal claims.
  7. Right to object: You may object – at any time – to the processing of your personal data due to your particular situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing or for the establishment, exercise or defense of legal claims. If you object to the processing, please specify whether you also wish the erasure of your personal data, otherwise we will only restrict it. You also have the right to object at any time, regardless of any reason, to the processing of your personal data for direct marketing (which includes profiling to the extent that it is related to such direct marketing), if such processing was based on our legitimate interest. If the marketing was based on your consent, you can withdraw consent (see above).
  8. Right to lodge a complaint: You can lodge a complaint to your local data protection supervisory authority or with any other data protection authority in the EU. However, we will appreciate if you first contact us to try and solve your problem – you can find our contact details below.

6. Contact information

In order to exercise your rights, please use the applicable web form that can be found in the Customer Privacy Policy mentioned above. If you have any other questions regarding the subject matter of personal data protection, you can contact us at the following contact details:

Data Protection Officer

Post address: Volvo Car Corporation, Attention: The Data Protection Officer, avd 50092, VAK, 405 31 Gothenburg, Sweden.

E-mail address: globdpo@volvocars.com

7. Changes to our Privacy Notice

We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. Whenever we make substantial changes to this notice, and in particular when this notice underlies your consent, we will inform you of the changes. This privacy notice is current as of the date which appears at the top of the document.