Customer Privacy Policy

Effective from: 2024-08-05

Published at: 2025-01-14

Scope and purpose

This policy is applicable to the Processing of customers' Personal Data at Volvo Car Taiwan Limited("VCTL", “our”, “us” or "we"). The purpose of this policy is to provide our current, former and potential customers (jointly referred to as "customers" or "you") with a general understanding of:

The circumstances under which we collect and process your Personal Data
The types of Personal Data we collect
The reasons for collecting your Personal Data
How we handle your Personal Data

Commitment

The Processing of your Personal data forms an important part of our provision of products and services to you. We appreciate the trust you place in us when providing us with your Personal data, and consider your privacy an essential part of the services we offer.

In order to safeguard your Personal Data while increasing the customer value and offering enhanced and safer driving experiences, we adhere to the following five general principles.

Freedom of choice

Your Personal Data belongs to you. We strive not to make any assumptions regarding your privacy preferences and aim to design our services so that you can choose whether or not to share your Personal Data with us.

Balance of interests

In compliance with the Personal Data Protection Act of Taiwan (PDPA), where the Processing of your Personal Data is necessary for the pursuit of a legitimate interest, and where this interest outweighs the need to protect your privacy, we may process certain Personal Data without obtaining your consent if so permitted by law. For more information, see the "Consent" section below.

We will assess whether there are such legitimate interests based on the potential benefits (including safety) of our customers and the general public.

Proportionality

VCTL will only process our customers' Personal Data if it is adequate, relevant and necessary in relation to the purpose for which it has been gathered. We aim to anonymize your Personal Data when a function or service can be achieved with anonymized data. If we combine anonymized or non-Personal Data with your Personal Data, it will be treated as Personal Data for as long as it remains combined.

Transparency

On request, VCTL will provide customers with further information regarding our Processing and protection of your Personal Data, including excerpts from our internal instructions and guidelines.

Legal compliance

It is VCTL's policy to comply with the applicable laws, rules and regulations governing privacy and data protection in each and every country where we operate. Where necessary, we will adjust our Processing of your Personal Data as described in this policy to ensure legal compliance.

Helpful definitions

The following terms are widely used in this policy, which have the same meaning as those in PDPA regarding the Processing and the free transfer of Personal Data. Accordingly:

"Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data;
"Processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller;
"Personal Data" means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as an identification number or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
"Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
”Sensitive Personal data” means personal data that reveals racial or ethnic origin, political views, religious or philosophical beliefs, trade union membership, criminal records, as well as data concerning health (including medical records, medical treatment, genetic information, health examinations) or sexual life.

Data collection

You may provide us with information about you or your vehicle when utilising VCTL's services in or outside a vehicle or in other contacts with VCTL, for example through our websites or customer centres. We may also obtain such data from our authorised dealers and repairers and other third parties. Such data (Customer-provided Personal Data) may include:

your contact information (name, address, telephone number, email address, etc.);
demographic information (age, marital status, household composition, etc.);
vehicle information (vehicle identification number (VIN), model, date of purchase, service history, etc.);
location data generated by your activities (navigation assistance, search queries, location sharing, etc.);
data pertaining to your purchase and use of our products and services (customer preferences and settings, purchase history, Volvo ID, My Volvo, etc.).

Your vehicle will also automatically collect data relating to the vehicle and its surroundings, primarily of technical nature and not directly related to you as a person. Such data ("Vehicle-recorded data") is typically connected to the vehicle identification number (VIN) of the vehicle and may therefore be traceable to you. Vehicle-recorded data may include:

safety information (whether airbags or belt tensioners have been triggered, whether the doors and windows are locked or open, etc.);
system functionality status (of the engine, throttle, steering, and brakes, etc.);
driving data (vehicle speed, brake and accelerator pedal use, steering wheel movement, etc.);
location data (the position of the vehicle in case of an accident, etc.); and
surroundings data (temperature outside the vehicle, images, etc.).

Information about certain Vehicle-recorded data is also included in the Owner's Manual.

We are particularly careful and apply additional measures if and when collecting and Processing Sensitive Personal Data, as required by applicable law. The data such as personal ID numbers and credit card numbers stored by VCTL is also regarded as Sensitive Personal Data. For avoidance of doubt, it is noted that applicable law may require other kind of data to also be treated as Sensitive Personal Data. Applicable laws may also restrict the processing of location data in certain countries.

Notice

Where reasonably practical or as required by applicable law, we will, in connection to collecting or registering your Personal data, provide you with (i) specific information as to the purposes of the Processing of your Personal Data, (ii) the identity of the Controller, (iii) the identities of any third parties to whom the data may be disclosed and (iv) other information which may be necessary to ensure that you are able to safeguard your rights(including the period, regions, recipient and methods of using your Personal Data, as well as the rights you can exercise in accordance with Article 3 of PDPA).

The above information may, for example, be provided when you purchase a vehicle, in the vehicle's infotainment system, in mobile applications developed by VCTL, at https://www.volvocars.com or otherwise in an agreement which you enter into with VCTL.

Consent

Where reasonably practical or as required by applicable law, we will obtain your consent prior to collecting or using your Personal Data. The request for your consent will be clear and specific and you will also have a reasonable amount of time to make a decision. Your consent is voluntary and may always be revoked, for example by terminating a particular service or contacting VCTL at the address indicated in the "Information and access" section below.

The collection and use of Vehicle-recorded data may be necessary in order for (i) technicians to diagnose and rectify faults in vehicles during the service and maintenance of vehicles, (ii) VCTL product development, for example enhancements of the vehicles' quality and safety features, (iii) managing VCTL´ warranty undertakings and (iv) fulfilment of legal requirements. When collecting or using Vehicle-recorded data for these purposes, and for similar legitimate interests pursued by VCTL, we will generally not seek your consent unless this is deemed necessary in the individual case or required by applicable law.

VCTL Authorised Dealers and Repairers

VCTL strictly specifies the rules for compliance with data protection requirements in its contracts with its authorised dealers and repairers. However, please note that VCTL and its authorised dealers and repairers are independent legal entities. Generally speaking, we are not liable if such entities fail to comply with applicable laws. If you have any questions regarding the use of your Personal Data by dealers or repairers, please contact the dealers or repairers directly.

Third party applications

You may access applications and other services linked with the vehicle but provided by a third party, which may, for example, require transmission of location data and other Vehicle-recorded data to this third party. VCTL is not responsible for the collection or use of Personal Data in applications or services provided by a third party, and recommends that you carefully review applicable terms for (and any integrity policy related to) such applications or services before you use them. If you have questions concerning a certain third party's use of your Personal Data, please contact the third party directly.

Data use

The Personal Data which VCTL collects from you and your vehicle will be used:

to provide you with products and services, including to verify your eligibility for certain purchases and services as well as to offer you better discounts and experiences;
to inform you of updates to, or changes in, our products and services, including but not limited to changes to our terms and conditions and policies;
to inform you of new products, services and events;
to provide vehicle support and services (warranty service, recall information, etc.);
for product development purposes, for example to improve vehicle performance, quality and safety;
to evaluate and improve our offering to, and communication with customers; to comply with legal requirements.( collectively referred to as the "Purpose of this Policy”)

For most Processing acts, you are able to terminate our use of your Personal Data by updating your preferences, terminating a particular service, revoking your consent to the Processing by contacting VCTL at the address indicated in the ”Information and access” section below or as otherwise instructed by us. However, and unless otherwise follows from applicable law, you may generally not opt out of the Processing of your Personal Data:

in relation to certain acts of collection and further Processing of your Vehicle-recorded data (please refer to the “Consent” section above);
which we perform in order to send you important notices, such as changes to our terms and conditions and policies or in case of product recalls;
which we perform in order to comply with our legal obligations.

Retention

We will only retain your Personal Data for as long as it is necessary to fulfil the purposes outlined in this policy or the purposes of which you have otherwise been informed. And your Personal Data may be retained or processed within or outside Taiwan.

This means that when you have consented to our Processing of your Personal Data, we will retain the data until you withdraw your consent. If you have revoked your consent, we may nevertheless retain certain Personal Data for the period required in order for us to meet our legal obligations and defend ourselves in legal disputes. If we have not received your consent for Processing again, the Personal Data will only be retained to the extent we are permitted to do so by law.

Data quality

When we process your Personal Data, we strive to ensure that it is correct and up to date. We attempt to delete or correct Personal Data that is incorrect or incomplete. For more information regarding your right to ensure the accuracy of your Personal Data held by us, please see the "Information and access" section below.

Information and access

As stated in the “Notice” section above, we may provide you with specific information concerning our Processing of your Personal Data when collecting or registering such data. You are entitled to the right to request and receive the following information for free once a year (i) what Personal Data relating to you that we process, (ii) where the Personal Data is collected, (iii) the purpose of the Processing, and (iv) the recipients or recipient categories with which the Personal Data is shared. Requests for such information must be made in writing and be signed by you personally, and include information on the name, address and ideally the email address as well. You are also entitled to request that we correct, block or delete any incorrect information related to you. Requests should be sent to Volvo Car Taiwan (addressed to: 38th Floor, No. 7, Section 5, Xinyi Road, Xinyi District, Taipei City).

Your requests will be dealt with in a prompt and proper manner. Requests to delete Personal Data will be subject to any applicable legal requirements. Where the applicable law provides for an administrative fee for complying with such a request, such a fee may be charged by VCTL.

In addition, you may be able to access an overview of certain Customer-provided Personal Data held by VCTL, and correct or update your information, by logging in to your My Volvo account.

Security

VCTL has taken appropriate technical and organisational measures in order to protect your Personal Data against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure or access and any other unlawful forms of Processing. We aim to ensure the security level of your Personal Data and to confirm that the protection measures we adopt can appropriately counteract the risks arising from the nature and use of your Personal Data.

Disclosures to third parties

Based on the aforementioned purposes of data use or in compliance with other provisions of PDPA, VCTL may share your Personal Data:

among VCTL units;
with your consent, with VCTL authorised dealers and repairers, for the purpose of distributing product and service offers and other communications to you;
with suppliers providing services to VCTL in accordance with data processing agreements (as required by law);with your consent, with other business partners for the purpose of distributing product and service offers and other communications to you or for research and development purposes;
in connection with the sale or transfer of a VCTL entity or its assets;
as required by law, for example in connection with a government inquiry, dispute or other legal process or request;
when we, in good faith, believe that disclosure is necessary in order to protect our rights, for example in order to investigate potential violations of our terms and conditions or to detect, prevent or disclose fraud or other security issues;

A VCTL entity being the Controller of your Personal Data will, as a general rule, only disclose your Personal Data to a third party if it has received your consent to do so. However, we may share your Personal Data without your consent, unless we consider your consent necessary in the individual case or your consent is required by law, in the following situations:

Processing Vehicle-recorded data for purposes other than confirming or developing our products and services, or to manage our legal obligations;
Based on the Purpose of this Policy, transfer your Personal Data between VCTL entities;
Transfer your Personal Data to suppliers who provide services within VCTL;
when disclosure is required by law;
when disclosure is necessary for the purpose of a legitimate interest pursued by VCTL (for example in order to protect our legal rights, as described above).

When we disclose your Personal Data to third parties or between VCTL entities, we will assess whether additional protection measures are needed at the time of disclosure (for example, when it is necessary to transfer Personal Data across countries).

Data Processing on our behalf

We restrict access to your Personal Data to VCTL's employees and suppliers who need to use the information in order to process it on our behalf, and who are contractually required to keep your Personal Data secure and confidential. We aim to choose the option for Processing services that best safeguards the integrity of your Personal Data towards any third party.

Marketing

We will not sell or trade your Personal Data with third parties unless we have your consent to do so.

We will not share your Personal Data with third parties for their marketing purposes, unless we have received your consent for such disclosures. If you have provided such consent, but wish to stop receiving marketing materials from a third party, please contact that third party directly.

We may provide you with information regarding new products, services, events or similar marketing activities. If you wish to unsubscribe to a particular e-mail newsletter or similar communication, please follow the instructions in the relevant communication. You may also use your My Volvo account to opt out of specific types of communication from Volvo Cars and to change previously submitted preferences.

Websites and cookies

All VCTL websites open to our customers include online privacy statements and information concerning our use of cookies. For certain countries there is also an online procedure for accepting or declining cookies. For more information regarding our use of cookies, please refer to www.volvocars.com/tw/v/legal/cookies.

We encourage you to review and consider the applicable statements and information when visiting our websites.

Your Rights

Apart from what is stated in the "Information and Access" section, based on Article 3 of PDPA, you may exercise the following rights by writing or emailing to us (email address: data.protection@volvocars.com):

Inquire about or request to access your Personal Data;
Request a copy of your Personal Data that we have collected;
Request to supplement or correct your Personal Data;
Request to stop collecting, processing or using your Personal Data;
Request to delete your Personal Data.

However, this does not apply if such data is necessary for us to perform our business or to comply with our contractual relationship with you.

Updates

VCTL reserves the right to update this policy at any time. The date of the last update is listed at the end of this policy. If we make any changes to this policy and the way we use your Personal Data, we will provide an updated version of this policy.

Date of last update: 2024/08/