Privacy notice – Change of ownership
This document describes how Polestar processes your personal data or personal information (referred to here as “personal data”) when you request a change of ownership of a Polestar car.
2. Who we are
The entity responsible for the processing of personal data in relation to a change of ownership of a Polestar car is Polestar Performance AB, a Swedish legal entity with company registration number 556653-3096 with address Assar Gabrielssons Väg 9, SE-405 31 Gothenburg, Sweden, hereinafter referred to as “Polestar”, “we” and “our”, will act as controller and process your personal data as described below.
3. What personal data we collect and why
When you request a change of ownership of a Polestar car (the “Request”) we process the personal data that you provide, including identifiers such as name, address, telephone number, e-mail address, and Polestar ID, and vehicle information such as Vehicle Identification Number (VIN), and vehicle registration certificate. In some cases, we also collect the contract to ensure the identity of the new owner. We use this information to administer the Request.
When the Request comes from the transferee owner (“New Owner” – we collect the New Owner’s identfiers directly from them.
When the Request comes from the Registered Owner we also collect the New Owner’s e-mail address. By providing us with this e-mail address you, as a Registered Owner, confirm that you have been instructed to do so by the New Owner We use this to send the New Owner a one time e-mail prompting them to provide the identifiers listed above with respect to themselves. The information provided by the New Owner will be used to administer the Request. When the new owner registers their information, we will process their information according to our Privacy Notice and, if they register a Polestar ID, our Polestar ID Notice. To the extent the General Data Protection Regulation (“GDPR”) applies to the processing, the legal basis for our processing of your personal data in order to administer the Request is that this processing is necessary for the purposes of our legitimate interest in administering the Request.
4. How long we keep your data
We will retain your personal data used for administration of the Request up to 5 years from the Request has been approved or declined.
5. Who we share your personal data with
We will share your personal data with the following categories of recipients, on a need-to-know basis:
- Within the Polestar group: We share your personal data with our Polestar Sales unit in the country from which the data originates from in order to address any questions or issues in connection with the Request. To the extent GDPR applies, the legal basis for this sharing is our legitimate interest in carrying out our business and the processing efficiently.
- Processors (Service providers and other parties): Polestar shares your personal data with processors that assist us in administering the Request. These service providers include our cloud software and data hosting providers outlined below. The processing is limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with the data processing agreement in place:
- SalesForce UK Limited (United Kingdom)
- SalesForce Marketing Cloud (United States)
- Amazon Web Services Ireland Limited (European Union)
- Authorities: We may share your personal data to third parties, such as legal advisors, law enforcement agencies, or governmental/regulatory bodies in order to protect our legal interests and other rights, protect against fraud or other illegal activities, for risk management purposes, and to comply with our legal obligations. To the extent GDPR applies, the legal basis for this sharing is compliance with legal obligations and our legitimate interest in compliance with laws applicable to Polestar.
- Business partners: In the event that we enter into, or intend to enter into, a transaction that alters the structure of our business, such as a reorganization, merger, acquisition, sale, joint venture, assignment, consolidation, transfer, change of control, or other disposition of all or any portion of our business, we may share personal data. To the extent GDPR applies, the legal basis for this sharing is our legitimate interest in the efficient operation of our business.
6. Transfer of your personal data
We share the status of all Requests of Canada-based owners with Polestar Automotive Canada Inc so that it can support the Registered Owner and the New Owner if there is a question about the status of the Request. When we share personal data with affiliates, business partners and data processors located outside of the EEA, where the destination country is not subject to an adequacy decision by the European Commission, we will transfer your personal data subject to the Standard Contractual Clauses adopted by the European Commission, available here. To the extent necessary, we also use relevant supplemental measures as necessary when transferring personal data outside of the EEA. More information about which recipients we share personal data with can be found in Section 5.
7. Your rights
If our processing of your personal data is subject to Canadian law, the following section applies to you:Accessing and correcting your personal data: For residents of Canada, you have a right to request access to your personal data and to request a correction to it if you believe it is inaccurate. If you would like to have access to the personal data we have about you, or if you would like to have it corrected, please fill out this form, which will help us to handle your request properly. In some cases, we may not be able to allow you to access certain personal data in certain circumstances: for example, if it contains personal data of other persons, or for legal reasons. To help protect against fraudulent requests for access to your personal data, we may ask you for information to allow us to confirm that the person making the request is you or is authorized to access your information before granting access. You will need to provide us with sufficient information that allows us to reasonably verify that you are the person whose personal data we collected, and you must describe your request in sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and correction requests using the information provided, we may ask you for additional pieces of information.Right to withdraw consent: If you have given consent for the processing of your personal data, you may withdraw your consent with effect for the future. Please note that if you withdraw consent that in necessary for us to provide you with products or services, we may no longer be able to provide those products or services to you. You may withdraw any consent you have provided to our use of personal data to market to you without withdrawing consent needed to provide our goods and services. Your withdrawal of consent does not have retroactive effect, and there may be cases where we are permitted under the applicable law to process certain personal data without consent.Guest information: You may only provide the contact information of friends or family if you have received permission to provide their e-mail address or phone number to us. You may only provide contact information of friends with whom you have had direct, voluntary two-way communication and for whom it is reasonable to conclude that you have a personal relationship, considering shared interests, experiences, opinions, and other relevant factors. You may only provide contact information of family members to whom you are related by marriage, common-law partnership, or a parent-child relationship and with whom you have had direct, voluntary two-way communication.
To the extent GDPR applies, you have specific legal rights relating to the personal data we process about you. You can access the data we hold about you, ask for rectification or restriction of your data, request to have your data ported to another entity, request that we delete your data, and finally you can file a complaint with a data protection supervisory authority.
8. Contact information
In order to exercise your rights, please use this web form. If you have any other questions regarding the subject matter of personal data protection, you can contact us or our Data Protection Officer on the contact details stated on polestar.com/privacy-policy.
9. Changes to our Privacy Notice
We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. For this reason, we encourage you to refer to this privacy notice on an ongoing basis. This privacy notice is current as of the date which appears at the top of the document. We will treat your personal data in a manner consistent with the privacy notice under which they were collected, unless we have your consent to treat them differently. If the changes allow us to use personal data in ways that materially affect your rights, we will post a special note on our digital platforms and, if required by law, will prompt you for your consent for certain changes.