Privacy Notice – Volvo ID

Effective from: 2021-08-09

Published at: 2021-08-09

This document describes how Volvo Cars (as defined below) processes your personal data when you create and use your Volvo ID to get access to services within the Volvo Cars digital ecosystem (hereinafter “Volvo ID”).

You can find below:

1. Who we are

The entity responsible for the processing of personal data in relation to the creation and use of your Volvo ID is Volvo Car Corporation, having its registered office at Assar Gabrielssons Väg, SE-405 31, Gothenburg, Sweden, company registration number 556074-3089, hereinafter referred to as “Volvo Cars”, “we”, or “us”.

2. What personal data we collect and why

The creation and use of your Volvo ID, to get access to services within the Volvo Cars digital ecosystem, involves the processing of the following categories of personal data:

We collect from you your identifiers (such as first and last name, phone number, preferred language, country, E-mail address and password) to create an account with us, provide you with access to the Volvo Cars Services that require a Volvo ID and to communicate with you regarding your Volvo ID. The legal basis of this data processing is performance of the contract you have entered into with Volvo Cars.

To provide an overview of your Volvo ID and its connected services on the Volvo ID Portal, we process your Volvo ID, vehicle information (VIN, car details) and services connected to your Volvo ID. The legal basis for this processing is the legitimate interest to outline all cars and services that are associated with your Volvo ID.

We also process your personal data for troubleshooting purposes, in connection with the creation or use of your Volvo ID, to improve the reliability of our product. We then use part of your Volvo ID (user name and user ID). The legal basis for this is our legitimate interest to secure a stable and reliable product to you.

We will identify the categories of personal data that are mandatory (with an asterisk (*) or via other methods) to be provided by you to create and use Volvo ID (collectively, “compulsory personal data”). We may refuse to process the personal data for any of the purposes set out in this privacy notice if you fail to supply the compulsory personal data.

3. How long we keep your data

We will keep your personal data as long as you have a registered Volvo ID. If you delete your Volvo ID (which you can do through the Volvo ID Portal) the Volvo ID together with associated data will be deleted thirty (30) days after your deletion request.

4. Who we share your personal data with

We will share your personal data with the following categories of third parties, on a need-to-know basis:

our processors supporting in delivering the Volvo ID;
account creation and authentication service providers;
data hosting service providers;
emails and sms distribution service providers; and/or
troubleshooting service providers

They are limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with each data processing agreement in place. In some of these situations the use of the processors involves limited transfers of personal data outside of the European Union and/or Malaysia. We have taken precautions that such transfers are limited to the minimum necessary, and only involve data that cannot directly identify you and thus poses a very low risk in case of unauthorised disclosure. In this regard, you acknowledge that your personal data may be transferred to a place outside of Malaysia and processed by a third party located outside Malaysia subject to and for the purposes specified under this privacy notice and you hereby consent to such transfer and processing.

When you provide personal data relating to a third party, you must ensure that such third party has read this privacy notice and consented to Volvo Cars collecting the third party personal data for any of the purposes specified in this privacy notice prior to the supply of such third party personal data to Volvo Cars.

5. Your rights in relation to the data processing we perform

5.1. Your rights under GDPR

As a data subject you have specific legal rights granted by the General Data Protection Regulation (“GDPR”) relating to the personal data we process about you if the GDPR applies. These are briefly explained below, and you can exercise them (to the extent the GDPR applies to you or the processing of your personal data by Volvo Cars) by filling out the dedicated form indicated below.

Right to withdraw consent: Where you have given consent for the processing of your personal data, you may withdraw your consent at any moment with effect for the future.
Right to access your personal data: You may ask from us information regarding personal data that we hold about you. We will provide you with a copy of your personal data upon request. If you request further copies of your personal data, then we can charge you with a reasonable fee that we base on the administrative costs. You have the right to the information about our safeguards for the transfer of your personal data to a country that is outside the EU and the EEA if you request that we confirm whether or not we process your personal data, and we transfer your personal data to a country that is outside the EU and the EEA.
Right to rectification: You may obtain from us rectification of incorrect or incomplete personal data concerning you. We make reasonable efforts to keep personal data in our possession or control which are used on an ongoing basis, accurate, complete, current and relevant, based on the most recent information available to us.
Right to restriction: You may obtain from us restriction of processing of your personal data, if:
1. you contest the accuracy of your personal data, for the period we need to verify the accuracy,
2. the processing is unlawful and you request the restriction of processing rather than erasure of your personal data,
3. we do no longer need your personal data for the processing purpose but you require them for the establishment, exercise or defense of legal claims, or
4. you object to the processing while we verify whether our legitimate grounds override yours.
Right to portability: You have the right to receive your personal data that you have provided to us, and, where technically feasible, request that we transmit your personal data (that you have provided to us) to another organization, if:
1. we process your personal data by automated means;
2. we base the processing of your personal data on your consent, or our processing of your personal data are necessary for the execution or performance of a contract to which you are a party;
3. your personal data are provided to us by you; and
4. your right to portability does not adversely affect the rights and the freedoms of other persons.
You have the right to receive your personal data in a structured, commonly used and machine-readable format. Your right to receive your personal data must not adversely affect the rights and the freedoms of other persons. Your right to have your personal data transmitted from us to another organization is a right you have if such transmission is technically feasible.
Right to erasure: You have the right to request that we delete the personal data we process about you. We must comply with this request if we process your personal data, unless processing is necessary:
1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject;
3. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or
4. for the establishment, exercise or defense of legal claims.
Right to object: You may object – at any time – to the processing of your personal data due to your particular situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing or for the establishment, exercise or defense of legal claims. If you object to the processing, please specify whether you also wish the erasure of your personal data, otherwise we will only restrict it. You also have the right to object at any time, regardless of any reason, to the processing of your personal data for direct marketing (which includes profiling to the extent that it is related to such direct marketing), if such processing was based on our legitimate interest. If the marketing was based on your consent, you can withdraw consent (see above).
Right to lodge a complaint: You can lodge a complaint to your local data protection supervisory authority or with any other data protection authority in the EU. However, we will appreciate if you first contact us to try and solve your problem – you can find our contact details below.

You can exercise your rights in relation to us by filling out this form, which will help us to deal with your request properly. The online form contains the information that we need to verify your identity and review your request. For requests submitted by telephone or email, you will need to provide us with sufficient information that allows us to reasonably verify that you are the person whose personal data we collected and describe your request in sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information.

5.2. Your rights under the Malaysian Law

You have specific legal rights granted by the Malaysian Personal Data Protection Act 2010 (“MY PDPA”) relating to the personal data we process about you if MY PDPA applies to you or the processing of your personal data by Volvo Cars. Such rights include (subject to the MY PDPA):

Right to access and correct your personal data: You have the right to request access to and to request correction of your personal data subject to the following: (i) you may make a data access request (upon payment of a prescribed fee (if any)) or a data correction request in writing to us; and (ii) we may refuse to comply with your data access request or a data correction request pursuant to the MY PDPA and shall, by notice in writing, inform you of our refusal and the reasons of our refusal.
Right to prevent processing for purposes of direct marketing: You may, by providing us a notice in writing, request us to cease or not begin processing your personal data for purposes of direct marketing subject to a reasonable duration of time for the request to be effected.
Right to withdraw consent: You may by notice in writing withdraw your consent to the processing of your personal data.
Right to make a complaint: You can make a complaint to the Malaysian data protection authority/commissioner in accordance with the MY PDPA. However, we will appreciate if you first contact us to try and solve your problem – you can find our contact details below.

You may also contact Volvo Cars with any inquiries or complaints in respect of your personal data or to exercise your rights (you can find our contact details below). If you limit the processing or withdraw your consent to any or all use of your personal data, we may not be in a position to continue to administer any arrangement or contractual relationship in place, which in turn may result in: (i) us being unable to (continue to) process your personal data for any of the purposes specified in this privacy notice or provide you access to, or with any of, our services/products; and/or (ii) the termination of any arrangements/agreements you have with us.

You are responsible for ensuring that the information you provide to us is accurate, complete, not misleading and kept up to date. You may update your personal data by contacting Volvo Cars through the methods provided below.

6. Contact information

In order to exercise your rights, please see section 5 above. If you have any other questions regarding the subject matter of personal data protection, you can contact us at the following contact details:

Volvo Car Malaysia Sdn Bhd

Designation: Customer Care Manager

Post Address: Lot 01-13A, 13A Floor, Menara Symphony, No. 5, Jalan Prof. Khoo Kay Kim, Seksyen 13, 46200 Petaling Jaya, Selangor

Email Address: mycare@volvocars.com

Phone Number: +603 7947 1800

7. Changes to our Privacy Notice

We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. Whenever we make substantial changes to this notice, and in particular when this notice underlies your consent, we will inform you of the changes. This privacy notice is current as of the date which appears at the top of the document.

8. Language

This privacy notice is drafted in the English and Bahasa Malaysia language. In the event of any inconsistency between the English version and the Bahasa Malaysia version of this privacy notice, the English version shall prevail over the Bahasa Malaysia version.