Privacy Notice - Digital Key App Polestar 2

This document describes how Polestar processes your personal data when you use Polestar Digital Key in-car app.

Polestar Performance AB, a Swedish legal entity with company registration number 556653-3096 with address Assar Gabrielssons Väg 9, SE-405 31 Gothenburg, Sweden, hereinafter referred to as “Polestar”, “we” and “our”, will as controller process your personal data as described below.

Digital Key in-car app can fully replace the conventional car key and allows you to conveniently lock, unlock, or start your vehicle using your smartphone. It also enables sharing of your digital key with additional users through various digital channels. The Digital Key requires a network connection only during the initial setup, as well as when sharing or revoking keys. Once set up, administration is handled over the internet, while the key functionality operates via local Bluetooth.

During setup, your key is added to the Polestar app on your smart device. From the app, you can share your key through messaging apps, email, or via Airdrop®. You may also revoke shared keys through the mobile app or the in-car app. Please note that the Digital Key in-car app is currently available for Polestar 2. For information related to Polestar 3 and 4, refer to the Car Privacy Notice.

Personal data processed for providing the Digital Key app

To provide the Digital Key in-car app and fulfil our contractual obligations to you (performance of a contract, GDPR Article 6(1)(b)), we process the following personal data:

• Vehicle Identification Number (VIN)
• Polestar ID
• Name
• Email address
• Phone number
• Pairing code 

App analytics

We process certain usage data to understand how the Digital Key in-car app is used and to improve its functionality, performance, and user experience. This processing is based on your explicit consent (GDPR Article 6(1)(a)).

After you have accepted the Privacy Notice and successfully logged into the application, you will be presented with a dedicated consent dialog requesting your permission to collect analytics data. All analytics data collected is anonymized and used solely to improve the service.

How your choice is handled

• If you select “Consent”, anonymised analytics data will be collected and shared with Google services for app improvement purposes.
• If you select “Decline”, no analytics data will be collected.

Your choice is stored securely in persistent storage and remains valid for the duration of your active session (until logout). You can change your preference at any time by logging out and logging back into the application. Upon re-login, the consent dialog will be presented again, allowing you to update your selection.

Types of analytics data collected on the basis of your consent:

If consent is given, the following anonymized data points may be collected:

• When the user uses the app for the first time
• When the user logs in with the Polestar ID
• When the setup process is completed
• When failures occur during setup
• When keys are shared
• When a digital key is connected to a user profile
• Frequency of specific error messages

We will retain your personal data for as long as you have a valid contract with Polestar. All data will be deleted after maximum period of 90 days from contract termination.

We will disclose your personal data with the following categories of recipients, on a need-to-know basis.

Our processors support delivering the Polestar app, which are limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with each data processing agreement in place:

• Amazon Web Services Ireland Limited and its sub processors (European Union) – data hosting.
• Google Ireland Limited and its sub processors, data center Europe-west1 (Belgium) https://www.google.com/about/datacenters/inside/locations/index.html; data transfer also to Google LLC, USA, under the Standard Contractual Clauses adopted by the European Commission, available here) – the following Google Firebase services are used within the scope of the Digital Key app:
• Cloud functions
• Firebase authentication
• Firebase Crashlytics
• Firebase Realtime database
• Firebase remote configurations

We strive to process your personal data within the EU/EEA area. However, your personal data will be transferred outside the EU/EEA in some situations, such as when we share your information with a business partner or subcontractor operating outside the EU/EEA.

We transfer personal data to the following countries outside of the EU/EEA: the United States and the United Kingdom and India.

We always ensure that the same high level of protection applies to your personal data according to the GDPR, even when the data is transferred outside of the EU/EEA. As regards the United Kingdom, the Commission has decided that it ensures an adequate level of protection (article 45 of the GDPR), but regarding transfers to the United States we have entered into EU Model Clauses with all relevant third parties (article 46 of the GDPR) or they are certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S Data Privacy Framework and/or the Swiss-U.S. Data Privacy Framework with the U.S. Department of Commerce. In addition, we take additional technical and organisational security measures when needed, such as encryption (TLS) and pseudonymisation.

You have specific legal rights granted by the General Data Protection Regulation relating to the personal data we process about you. You can withdraw your consent or object to our processing of your data, access the data we hold about you, ask for rectification or restriction of your data, request to have your data ported to another entity, request that we delete your data, and finally you can file a complaint with a data protection supervisory authority. For more information about your rights, see our Customer Privacy Policy.

In order to exercise your rights, please use this web form. If you have any other questions regarding the subject matter of personal data protection, you can contact us or our Data Protection Officer on the contact details stated on polestar.com/privacy-policy

Polestar Performance AB is a Swedish legal entity with company registration number 556653-3096, with mailing address Assar Gabrielssons Väg 9, 405 31 Gothenburg, Sweden, and visiting address Polestar HQ, Assar Gabrielssons Väg 9, 418 78 Göteborg.

We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. For this reason, we encourage you to refer to this privacy notice on an ongoing basis. This privacy notice is current as of the date which appears at the top of the document. We will treat your personal data in a manner consistent with the privacy notice under which they were collected, unless we have your consent to treat them differently.