PRIVACY NOTICE VOLVO MERCHANDISE

This version was published and is valid from 2024/07/01

This notice provides information on the processing of your personal data by Volvo Merchandise AB which is part of the Volvo Group. For the purpose of this notice the “Volvo Group” means AB Volvo (publ.) and entities directly or indirectly controlled by AB Volvo including but not limited to entities belonging to any of the Volvo Group’s principal Business Areas and Truck Divisions (as may exist from time to time) such as Volvo Trucks, Volvo Buses, Volvo Construction Equipment, Renault Trucks, Arquus, Volvo Penta, Mack Trucks, Volvo Financial Services, Volvo Group Connected Solutions, Volvo Technology, Volvo Group Purchasing, Volvo Group Real Estate, Volvo Treasury, Volvo Information Technology, Volvo Group Trucks Operations, Volvo Autonomous Solutions, and Volvo Energy. This Privacy Notice applies when Volvo Merchandise AB has collected or otherwise processed personal data about you when you have purchased a product offered on the Volvo Merchandise web shop (“Web Shop”) in the capacity of a private consumer regardless of if you are an employee of a Volvo Group company or not.

Identity and contact details of the controller and group privacy officer

Volvo Merchandise AB (below referred to as “VOLVO”) is the controller of the personal data that Volvo obtains from you and the other sources described below.

“Controller” means that it is Volvo that decides on the purpose and means for the processing of your personal data. Volvo is responsible for the processing of your personal data under applicable data privacy laws and regulations.

If you have questions regarding the processing of your personal data please contact the Volvo Group Privacy Officer at gpo.office@volvo.com or by post or phone at:

What categories of personal data will VOLVO process?

For the purposes of this Privacy Notice “personal data” is any information about a specific individual or that identifies or may identify a specific individual. In other words, it is any piece of information than can be linked to you.

For the purposes of this Privacy Notice the term "process” or “processing” means any use of personal data including but not limited to the collection, recording, organization, storing, adaptation, alteration, transferring, making available, blocking, deletion, or destruction of personal data.

Legal ground

Volvo may process your personal data based on any one or more of the following legal grounds (see also further details below):

• Contractual obligation: Volvo may process your data if such processing is necessary to fulfil a contractual obligation towards you e.g. to be able to pay your contractually agreed salary, pension, and other benefits.
• Legal obligation: Volvo may process your personal data if such processing is necessary to comply with a legal obligation e.g. to report your income to the tax authorities or to comply with court orders and legal reporting requirements.
• Legitimate interests: Volvo may process your personal data if such processing is necessary for the purposes of a legitimate interest pursued by Volvo or a third party. It is generally considered to be in Volvo’s legitimate interest to manage its daily operations, secure its facilities and equipment, and keep internal control. In order to base its processing of personal data of its employees on the legitimate interest-basis, Volvo makes an assessment on case-by-case basis. For example, Volvo needs to process certain personal data to enable administration of your business-related travels where Volvo’s legitimate interest is to manage its daily operations; or Volvo needs to process certain personal data to review the status and location of its IT-equipment where Volvo’s legitimate interest is to secure its equipment. Where it is stated herein that Volvo relies on its legitimate interests for a given processing purpose, Volvo is of the opinion that its legitimate interests are not overridden by your interests, rights, or freedoms given (i) the transparency Volvo provides on the processing activity, (ii) Volvo’s privacy by design approach, (iii) Volvo’s regular privacy review, and (iv) the rights you have in relation to the processing activity. If you wish to obtain further information on this balancing test approach, please contact the Volvo Group Privacy Officer via the contact details set out above.
• Vital interests: Volvo may process your personal data to protect the vital interest of you and others if Volvo has valid reasons to believe that such processing of your personal data may prevent or reduce any significant potential harm to you or others.
• Consent: In exceptional cases or if no other legal ground can be applied, Volvo may ask for your explicit consent to process certain personal data. Your consent is free and informed; you have the possibility or not to give it as well as to withdraw it at any time.

Volvo may process the following categories of data which in itself or in combination with other data may constitute personal data and for the general purposes stated in Table 1 below.

Table 1 – Categories, Purpose, and Legal Ground for Processing

From where will VOLVO obtain your personal data?

VOLVO will obtain all your personal data from yourself. Some personal data might also be automatically generated from VOLVO’s IT-system or equivalent when you are creating or accessing the Web Shop provided by VOLVO.

What happens if you do not provide VOLVO with any personal data?

Some personal data is necessary in order for VOLVO to interact with its customers for business purposes. Not providing personal data will inhibit the handling and delivery of the products that you might expect from VOLVO.

How will VOLVO share your personal data?

Your personal data may be shared with other Volvo Group companies and with certain categories of third parties (as further detailed below) which may involve transferring your personal data to other countries.

Sharing of personal data within the Volvo Group

The Volvo Group is a global organization with offices and operations throughout the world and your personal data may be transferred or be accessible internationally throughout the Volvo Group’s global business and between its various entities and affiliates.

Any transfers of your personal data to other Volvo Group companies (including transfers from within the EU/EEA to outside the EU/EEA) will be governed by an intercompany agreement based on EU approved Standard Contractual Clauses or such other mechanisms as have been recognized or approved by the relevant authorities from time to time.

Such agreement reflects the standards contained in European data privacy laws (including the EU General Data Protection Regulation). Having this agreement in place means that all Volvo Group entities must comply with the same internal rules. It also means that your rights stay the same no matter where your data is processed by Volvo Group.

Sharing of personal data with third parties outside of the Volvo Group

In addition to the sharing of personal data between Volvo Group companies as set out above, Volvo may also share your personal data with certain categories of third parties, including:

• Business partners, such as Volvo Group’s suppliers and service providers in connection with their provision of products and services to the Volvo Group, such as IT service providers.
• Professional advisors,> such as insurers, lawyers and other professional advisors in connection with insurance claims, audits and the receipt of advisory services.
• Counterparties and their advisors, in connection with merger and acquisition projects.
• Emergency service providers, such as the police, fire brigade, ambulance and roadside assistance to protect the vital interest of you and other such as in connection with emergency assistance.
• Governmental authorities, 
  In the field of law enforcement, regulatory authorities and other public and judicial bodies in connection with legal obligations such as court orders or legal reporting requirements or if considered necessary in exceptional cases to protect the vital interest of you or others.
  Public authorities in charge of export control and customs
• Any third-party service providers and professional advisors to whom your personal data are disclosed, are expected and required to protect the confidentiality and security of your personal data and may only use your personal data in compliance with applicable data privacy laws and regulations.
  
  

Further, in the event any Volvo Group company that is located within the EU/EEA transfers personal data to external third parties that are located outside of the EU/EEA the relevant Volvo Group company will satisfy itself that there are appropriate safeguards in place which provide adequate levels of protection of your personal data as required by applicable data privacy laws (including the EU General Data Protection Regulation). For example, this may include the use of EU approved Standard Contractual Clauses or Data Privacy Framework (DPF) or such other mechanism as have been recognized or approved by the relevant authorities from time to time. If you have questions about how Volvo will share your personal data, please contact the VOLVO Group Privacy Officer via the contact details set out above.

How does VOLVO safeguard your data?

Volvo utilizes appropriate and reasonable legal, technical and organizational security measures, including information technology security and physical security measures, to adequately protect personal data. These measures are appropriate to the risks posed by the processing of personal data and to the sensitivity of the personal data and take into account the requirements of applicable local law. In addition, the measures are continuously improved in line with the development of available security products and services. Volvo requires all persons to abide by applicable security policies related to personal data when using Volvo systems.

For how long will VOLVO keep your personal data?

VOLVO will keep your personal data as long as required to fulfill its legal or contractual obligations taking into account for example the contractual period, warranty and product liability requirements, and no longer than is required for VOLVO to fulfill the purposes for which the personal data was collected.

Your data protection rights

You have the right to request from VOLVO information about the personal data processed about you and access to such personal data. You also have a right to request rectification of your personal data if this is incorrect and request erasure of your personal data. Further, you have a right to request restriction of the processing of your personal data meaning that you request VOLVO to limit its processing of your personal data under certain circumstances. There is also a right for you to object to the processing based on legitimate interest or processing for direct marketing. You have as well the right to data portability (transfer of your personal data to another controller) if VOLVO’s processing if your personal data is based on consent or contractual obligation and is automated.
You also have the right to lodge any complaints you may have regarding VOLVO’s processing of your personal data to a supervisory authority. For more information about these rights and how to exercise them, please contact the VOLVO group privacy officer or please visit Data subject rights.

What happens if this Privacy Notice changes?

Volvo encourages the periodic review of this Privacy Notice to stay aware of any changes to it. We reserve the right to amend this Privacy Notice as needed. When we do, we will note near the top of this Privacy Notice the date that any such changes are made and/or when they become effective.