Privacy Notice – Consumer surveys

Effective from: 2025-01-14

Published at: 2025-01-14

This document describes how Volvo Cars (as defined below) processes your personal data when you engage with one of our consumer surveys (hereinafter “Consumer Survey”).

You can find below:

1. Who we are

The entities that are jointly responsible for the processing of personal data in relation to the Consumer Surveys are Volvo Car Corporation, having its registered office at Assar Gabrielssons Väg, 40531 Gothenburg, Sweden, company registration number 556074-3089, and Auto Asia, Inc. having its registered office at 2272 Don Chino Roces Ext. Magallanes Makati City, Philippines, hereinafter referred to as “Volvo Cars”, “we”, or “us”.

2. What personal data we collect and why

When you interact with our Consumer Survey, we process the following categories of data about you:

Identifiers such as name, e-mail address, telephone number, salutation, age, gender, postal code, and city. We process this data in order to send the Consumer Survey and assess consumer performance by segmentation. The data is processed based on our legitimate interest to improve the business purpose and customer experience that your survey response concerns (Section 12(f) Data Privacy Act of 2012).
Your Vehicle data such as vehicle type, Vehicle Identification Number (VIN), and registration number (REG). We process this data based on our legitimate interest to assess field action and warranty performance (Section 12(f) Data Privacy Act of 2012).
Contract type, subscription number, vehicle relationship (contract/sales type starting and end date). We process this data in order to send the Consumer Survey and assess consumer performance by segmentation allowing us to improve the overall business operations and the consumer experience. The data is processed based on our legitimate interest to improve the business purpose and customer experience that your survey response concerns (Section 12(f) Data Privacy Act of 2012).
Opening/clickthrough rates. We process this data for statistical analysis and range measurement, and to understand the interests of our consumers. For this analysis, the e-mail invites contain so-called web beacons or tracking pixels, which display single-pixel image files that are also embedded in our website, where we ask for your consent in order to deploy those. The data is processed based on our legitimate interest to understand overall survey performance and survey interaction (Section 12(f) Data Privacy Act of 2012).

3. How long we keep your data

Your survey feedback responses will be kept up to five (5) years from the time you submit your response, after which time it will be anonymized.

In order to keep your responses secure, the invitation for feedback provides you with an individualised questionnaire that no other person can access. The survey web site and our data storage facilities have security measures in place to protect the loss, misuse, and alteration of the information under our control.

Only certain employees have access to the personal information you provide us. They have access only for case handling, data analysis and quality control purposes. Rest assured, these persons do not process your information except only upon instructions and in accordance with the Data Privacy Act of 2012, other related local and international laws, issuances, rules, and circulars.

4. Who we share your personal data with

We will share your personal data with the following categories of third parties, only when there is a legitimate interest and purpose for such disclosure:

Our processors supporting our activity in general, such as providers of IT solutions;
Our processors supporting delivering the Consumer Surveys, which are limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with each data processing agreement in place:
Medallia, Inc (EU, United States) – Customer experience management.

Your personal data will be disclosed to and processed by your selected retailer (if applicable) and companies within the same group of companies as VCC so that [we could make sense of the data resulting from the Consumer Survey]. In relation to companies within the same group of companies as VCC located outside EEA, we will transfer your personal data with the basis of the Standard Contractual Clauses adopted by the European Commission. Said parties enumerated above are also subject to the same security guidelines for data privacy and processing and are required to uphold your data privacy rights as owner of the information.

In any case, your sensitive personal information will not be disclosed to third parties without your consent, except when disclosure is required for compliance with existing laws and regulations.

5. Potential risks associated with data processing

We implement commercially reasonable administrative, technical, and physical safeguards to protect your personal data that we hold, including robust information security and access policies. However, it is important to note that no organization can fully eliminate the risks or guarantee absolute security of your personal data. Factors such as unauthorised access, hardware or software failures and other unforeseen circumstances may compromise the security of your personal data. To the extent permitted by law, we disclaim any liability for unauthorised access, use, or disclosure of your personal data resulting from theft or other malicious actions.

6. Your rights in relation to the data processing we perform

As a data subject you have specific legal rights granted by the Data Privacy Act of 2012, the General Data Protection Regulation, and other related laws, relating to the personal data we process about you. These are briefly explained below, and you can exercise them by filling out the dedicated form indicated below.

Right to be informed. As a data subject, you are entitled to be informed whether your personal information are being processed, the description of such personal information, purpose/s for collection, scope and method of processing, recipients of such information, identity and contact information of the controller, period for storage, and the existence of your rights in relation to the collection and processing of your data. (Section 16(a) Data Privacy Act of 2012).
Right to withdraw consent: Where you have given consent for the processing of your personal data, you may withdraw your consent at any moment with effect for the future. (Section 16(b) Data Privacy Act of 2012).
Right to access your personal data: You may ask from us information regarding personal data that we hold about you such as the contents, sources, names of recipients, manner by which they were processed, reasons for disclosure, information on automated processes where your personal data will, or is likely to be made as the sole basis for any decision that significantly affects or will affect you, date last accessed or modified and/or name/designation and address of the information controller (Rule VIII Section 34(c) Implementing Rules and Regulations of the Data Privacy Act of 2012). We will provide you with a copy of the following upon request. If you request further copies, then we can charge you with a reasonable fee that we base on the administrative costs. You have the right to the information about our safeguards for the transfer of your personal data to a country that is outside the EU and the EEA if you request that we confirm whether or not we process your personal data, and we transfer your personal data to a country that is outside the EU and the EEA. Note that any analysis made by the information controller with respect to your personal data, i.e., inferred, derived, modeled, or business-generated data, is excluded from such right to access.
Right to rectification: You may obtain from us rectification of incorrect or incomplete personal data concerning you. We make reasonable efforts to keep personal data in our possession or control which are used on an ongoing basis, accurate, complete, current and relevant, based on the most recent information available to us. As such, recipients or third parties who have previously received your data shall be informed of its inaccuracy and rectification (Rule VIII Section 34(d) Implementing Rules and Regulations of the Data Privacy Act of 2012).
Right to restriction: You may obtain from us restriction of processing of your personal data, if:
1. you contest the accuracy of your personal data, for the period we need to verify the accuracy,
2. the processing is unlawful and you request the restriction of processing rather than erasure of your personal data,
3. we no longer need your personal data for the processing purpose but you require them for the establishment, exercise, or defense of legal claims, or
4. you object to the processing while we verify whether our legitimate grounds override yours.
Right to portability: You have the right to receive your personal data that you have provided to us, and, where technically feasible, request that we transmit your personal data (that you have provided to us) to another organization, if:
1. we process your personal data by automated means;
2. we base the processing of your personal data on your consent, or our processing of your personal data are necessary for the execution or performance of a contract to which you are a party;
3. your personal data are provided to us by you; and
4. your right to portability does not adversely affect the rights and the freedoms of other persons.
You have the right to receive your personal data in a structured, commonly used and machine-readable format. Your right to receive your personal data must not adversely affect the rights and the freedoms of other persons. Your right to have your personal data transmitted from us to another organization is a right you have if such transmission is technically feasible. (Section 18 Data Privacy Act of 2012).
Right to erasure: You have the right to request that we suspend or order the blocking, removal, destruction or deletion of the personal data we process about you. We must comply with this request if we process your personal data, unless processing is necessary:
1. for exercising the right of freedom of expression, speech, information and of the press;
2. for an overriding legitimate interest or other legal ground; or
3. for the establishment, exercise or defense of legal claims.
Third parties who have received your information shall also be notified of such erasure. (Rule VIII Section 34(e) Implementing Rules and Regulations of the Data Privacy Act of 2012).
Right to object: You may object – at any time – to the processing of your personal data due to your particular situation. You may also object or withhold consent to the processing of your data in case of any change or amendment to this privacy notice or other information which may be supplied to you under Item 1. When you object, we shall no longer process your personal data, unless:
1. The personal data is needed pursuant to a subpoena;
2. The collection and processing are for obvious purposes, including, when it is necessary for the performance of or in relation to a contract or service to which the data subject is a party, or when necessary or desirable in the context of an employee-employer relationship between the collector and you as data subject; or
3. Information is being collected and processed as a result of a legal obligation. (Rule VIII Section 34(b) Implementing Rules and Regulations of the Data Privacy Act of 2012).
If you object to the processing, please specify whether you also wish the erasure of your personal data, otherwise we will only restrict it. You also have the right to object at any time, regardless of any reason, to the processing of your personal data for direct marketing (which includes profiling to the extent that it is related to such direct marketing), if such processing was based on our legitimate interest. If the marketing was based on your consent, you can withdraw consent (see above).
Right to lodge a complaint: You can lodge a complaint with the National Privacy Commission in the Philippines or with any other data protection authority in the EU. However, we will appreciate if you first contact us to try and solve your problem – you can find our contact details below.
Right to damages. As data subject, you have the right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data, taking into account any violation of your right and freedoms as data subject. (Section 16(f) Data Privacy Act of 2012).

You can exercise your rights in relation to us by filling out this form, which will help us to deal with your request properly. The online form contains the information that we need to verify your identity and review your request. For requests submitted by telephone or email, you will need to provide us with sufficient information that allows us to reasonably verify that you are the person whose personal data we collected and describe your request in sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information. You can exercise these rights in relation to all of the joint controllers mentioned in this notice.

Your lawful heirs and assigns may also invoke your rights as a data subject to which he or she is an heir or assignee, at any time after your death or when you are incapacitated or incapable of exercising your rights enumerated above. (Section 17 Data Privacy Act of 2012).

7. Contact information

In order to exercise your rights, please use the web form mentioned in the Customer Privacy Policy above. If you have any other questions regarding the subject matter of personal data protection, you can contact directly the data protection officer of Auto Asia, Inc. at the contact details mentioned here:

Company: Auto Asia, Inc.

Postal address: 2272 Don Chino Roces Ext. Magallanes Makati City, Philippines

Email: volvoph@volvophils.com

You can also contact the Volvo Car Corporation Data Protection Officer as follows:

Company: Volvo Car Corporation

Postal address: Volvo Car Corporation, Assar Gabrielssons Väg, SE-405 31 Gothenburg, Sweden

Email: globdpo@volvocars.com

8. Changes to our Privacy Notice

We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. Any changes to this privacy notice are subject to your rights to object or withdraw consent after you are notified of such change. For this reason, we encourage you to refer to this privacy notice on an ongoing basis. This privacy notice is current as of the date which appears at the top of the document. We will treat your personal data in a manner consistent with the privacy notice under which they were collected, unless we have your consent to treat them differently.