Europe Privacy Statement for Application Services

Last Updated: January 2024

Introduction

Your privacy is important to us. This Privacy Statement describes how General Motors Holdings LLC and its group companies collect, use, and share personal data (including the location of your Connected Services-equipped eligible vehicle (your “Vehicle”) and how your Vehicle is used) when you download this software application (“Application”) to your phone or other Internet-connected device (your “Device”) and when you use the services available through the Application. This Application provides access to various functions and services, which may include services that allow you to view the location and diagnostic information of your Vehicle, to issue commands to your Vehicle, such as door lock/unlock and remote engine start commands, to schedule services you request with third party service providers, such as dealer maintenance appointments and roadside assistance, to access vehicle functions or locate your Vehicle as well as to access third party service provider services (the “Application Services”).

This Privacy Statement is a supplement to the GM Europe Privacy Statement, which is posted at https://www.cadillaceurope.com/se-en/legal/privacy-statement. Together these privacy statements describe our privacy practices for the Application Services.

This Privacy Statement applies to you if you download the Application or use the Application Services in Europe, including the European Union, the countries of the European Economic Area, Switzerland, and the United Kingdom. The Application may be offered by GM or under another of our brands, such as Cadillac. As used in this Privacy Statement, the term “GM” means the specific GM group company acting as the data controller for your personal data. You can determine which of the GM group companies is the data controller by reviewing the “Data Controller” section below.

It is your responsibility to ensure that all users of your Vehicle know that anyone with access to the Application Services through your Device may be able to access information about your account and your Vehicle, including the location of your Vehicle.

In some cases, this Application may let you grant other people access to your Vehicle or the Application Services. If you grant access, those people may be able to view your Account Information, Vehicle Related Information and Driving Information, including location of your Vehicle.

Information We Collect

When you download the Application or use the Application Services, the types of your personal data that we may collect include:

Device information, such as the location of your Device, Device type, Device operating system, Internet Protocol (IP) address, unique identifier, type of browser, Internet service provider, information about your use of the Application, and phone number;
Information about your use of the Application, including screen view time, scrolling, specific actions to activate features or otherwise navigate the application, reactions to alerts, searches, and your interactions with in-application marketing offers; and
Account information, vehicle-related information, and driving information, such as the location and speed of your Vehicle based on GPS.

Use

We use the personal data we collect to:

Provide the Application Services;
Communicate with you about your account or the Application Services; and
Provide you with marketing offers that may interest you, including offers relevant to the location of your Device;
Improve, troubleshoot, and evaluate the use of our products and Services (including the Application); and
Conduct research

Sharing

We may share personal data we collect with necessary third parties when you use the Application to make requests for third party or related services available through the Application, such as for dealer maintenance appointments or roadside assistance. We may share the location of your Device in the same manner as we share location and speed of your Vehicle. For example, we may share the location of your Device with:

third party service providers working on our behalf,
emergency service providers,
others when required by law, and
those you ask us to share this personal data with.

We may also share the location of your Device when necessary to provide the Application Services to you; to comply with legal obligations; to protect the safety and rights of you and others; and for product safety and security purposes.

Restricting the Collection of Location and Speed Information

You can restrict our access to and collection of the location of your Device by disabling location-sharing on your Device, if that feature is available on your Device.

Some of the Application Services require access to and collection of the location and speed of your Vehicle. We collect location and speed of your Vehicle when you access or use the Application Services. You can restrict our access to and collection of location and speed of your Vehicle, or the location of your Device, by not using the Application Services.

Legal Basis for Processing

We rely on the following legal basis for using and sharing your personal data for the Application Services as described in “Use” and “Sharing” above:

When you have given your consent to the processing of your data for one or more specific purposes. Where our processing relies on your consent, you may withdraw consent at any time by contacting us (see also "Rights and Choices" below).
When the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, including:

to provide the Application Services;
to administer your account(s) and process your payments for products and services

When the processing is necessary for compliance with a legal obligation applicable to the GM data controller.
When the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular if you are a child, such processing including:

to communicate with you about your account or the Application Services;
to provide you with marketing offers that may interest you, including offers relevant to the location of your Device;
to improve, troubleshoot, and evaluate the use of our products and Services (including the Application);
to conduct research;

Where there is another applicable legal basis for data processing, especially provisions set out by applicable law.

Tracking Technologies

GM may use device tracking technologies that allow us to identify you on your Device in a unique manner, such as use of IP address or VIN, to gather data about your activity within the Application Services, such as demographic data, browser type, pages visited, activities conducted on the page, and the day and time of your visit. GM uses this data, sometimes across devices, to measure your activity, remember your preferences, maximize and improve the performance of our products and services, and customize your experience.

Limiting Marketing and Promotional Communications

You may choose to limit the marketing and promotional communications we send you. We provide opt-out instructions in all of our promotional communication channels; for example, an unsubscribe option is included at the bottom of all marketing-related emails.

Biometric Authentication

If you elect to use biometric authentication (e.g. Touch ID, fingerprint scanning, or Face ID) you should refer to your Device manufacturer’s product information regarding biometric authentication. We do not collect biometric data or control biometric authentication on your Device. After successful authentication, you will be given the choice to enable biometric authentication on your Device to access Application Services in the future. If you change your mind, you may disable this feature through your Device settings or by logging out of Application Services and turning biometric authentication off.

Security

We use technical, administrative, and physical safeguards designed to protect your personal data and we require third party service providers to maintain similar safeguards against loss, misuse, and unauthorized access, disclosure, alteration, destruction, or theft of your personal data.

How long we keep your personal data and how we store it

We may keep the data we collect for as long as necessary to provide Application Services to you, to operate our business, to enable us to communicate with you, for our safety, research, evaluation of use, or troubleshooting purposes, or to satisfy our legal or contractual obligations. We regularly delete or anonymize personal data subject to our information lifecycle management policy and record retention schedule. We are required to maintain data to comply with taxation or other applicable laws or if we need your personal data to establish, exercise or defend a legal claim. To the extent possible, we will restrict the processing of your personal data for the limited purposes that require its retention.

Rights and Choices

If you are a resident of the European Union, the countries of the European Economic Area, Switzerland, or the United Kingdom, you may have data subject rights in respect of your personal data, as described in the data protection laws applicable to your jurisdiction. You can learn more about available rights and how to exercise them with GM by reviewing the GM Europe Privacy Statement, which is posted at https://www.cadillaceurope.com/se-en/legal/privacy-statement.

Where we rely on your consent as the legal basis for processing your personal data, you may withdraw your consent at any time. See “How To Contact Us” below.

Data Controller

The data controller for your personal data is the General Motors entity that offers you the Application Services and for which you hold a relationship with based on your country. The table below describes the data controllers covered under this Privacy Statement in association with the countries that each processes personal data in. When you are dealing with one of these GM companies for the country covered, that GM company is the Data Controller for your personal data. If you are in a country that is not listed below, the data controller is Cadillac Europe GmbH.

Countries of Controllership	Data Controller	Address
France	General Motors France SAS	183 Rue de Courcelles 75017 Paris, France
Germany	General Motors Germany GmbH	Eschersheimer Landstraße 14, 60322 Frankfurt am Main, Germany
Sweden	General Motors Sweden AB	P.O. Box 16285 103 25 Stockholm, Sweden
Switzerland	Cadillac Europe GmbH	Albisriederstrasse 253, 8047 Zürich, Switzerland
United Kingdom	GM Specialty Vehicles UK Limited	100 New Bridge Street, London, EC4V 6JA

International Data Transfers

GM stores your data in the United States, the European Union, the countries of the European Economic Area (EEA), Switzerland, the United Kingdom and other locations where GM, our brands or our service providers operate worldwide. With respect to such transfers from the EU, EEA, Switzerland or the United Kingdom to the United States and other non-EEA jurisdictions which are not deemed to have adequacy under applicable data protection laws, we implement standard contractual clauses and other mechanisms, such as supplementary measures, to provide adequate protection for the transfer of this personal data. General Motors Holdings, LLC acts as a data processor for its controlled subsidiaries, including the data controllers listed above, by providing data hosting, maintenance, support, and troubleshooting of services, as well as other redundant back office support. In addition, it uses anonymized and aggregated data to evaluate or research the safety, quality, usage, and functionality of vehicles and services, including providing customers with vehicle support and services, and to ensure accurate customer records and maintain customer relationships.

Changes to This Privacy Statement

We may amend this Privacy Statement from time to time. In some cases, we will notify you of this change only by posting a new effective date at the top of this Privacy Statement and your continued use of our products and services covered by this Privacy Statement will mean you accept the changes. In other cases, if we intend to collect, use, or share personal data in a way that is materially different from the way that we disclosed at the time of collecting your personal data, then we will notify you as required by law, such as by email or through a notice on the applicable website.

How to Contact Us

With respect to any questions regarding the protection of your personal data or your rights under applicable data protection laws, our Data Protection Officer for Europe can be contacted at privacy.europe@gm.com. Our Data Protection Officer can also be reached at the following address: Cadillac Europe GmbH, Albisriederstrasse 253, 8047 Zürich, Switzerland.