processing of your data relating to our cars, which is explained in our Car Privacy Notice [coming soon], and
processing of your data in relation to our apps, which is explained in our privacy notice for each app [coming soon].
This policy is updated continuously to reflect the measures taken by Polestar in relation to your personal data. Read more.
The concepts “controller” and “joint controllers” are terms used in the EU GDPR. A controller is the company that determines the purposes (why) and the means (how) of personal data processing – in other words, the controller is responsible for the processing of the personal data. When two or more companies jointly determine the purpose and means of the personal data processing, those companies are called joint controllers. The term “processor” refers to a service provider or third party under US privacy laws, which processes personal data on behalf of the controller. In the text below, you will find who acts as a controller/business, joint controller, or processor/service provider for each processing and we explain their respective roles below.
2. When do we process your personal data?
In this section, we will inform you about what personal data we process about you, for what purposes, what our legal basis for the processing is, how long we will process your personal data for, and who the controller/controllers are for each processing purpose. We may process your personal data for several of the following purposes at once. The information is divided into the following parts:
Polestar website, which includes information about our processing of personal data related to our chat function, your account on polestar.com and our processing of personal data collected using cookies. Read more.
When providing our products and services, which includes information about our processing of personal data relating to your Polestar ID accounts, your purchase of products and services, your reservation of a build slot for a vehicle and our waiting list for such build slots, test drive bookings, service bookings, our referral program, our Polestar Fleet Portal, our administration of request for change of ownership of a vehicle and our Guest Wi-Fi. Read more.
When we are in contact with you, which includes information about our processing of personal data relating to our customer support, our contacts with you on social media and on Polestar Community, our virtual and digital consultations, our events and competitions and our contact with you to remind you of non-completed orders. Read more.
When marketing our business, brands, products and services, which includes information about our processing of personal data relating to marketing through telephone, e-mail, websites, social media and press releases and our use in marketing material of photos and videos of participants at events. In this section you will also find information about our profiling for marketing purposes. Read more.
When developing our business, products and services, which includes information about our processing of personal data relating to our use of surveys and market research, training of our employees and our continuous work with developing our business, systems, products and services. Read more.
When you apply for a job at Polestar. Read more.
To comply with laws, legal obligations and voluntary undertakings and in the event of claims, disputes, supervision etc. This part includes information about our processing of personal data relating to recalls, claims and complaints, data subject requests, data subject complaints, data breaches and supervision, disputes, bookkeeping, financial reporting, transfer of data in the event om merger and acquisition and sharing of personal data with authorities. Read more.
2.2 Polestar’s website
2.2.1 Web analytics/cookies
2.2.2 The chat
To chat with you and answer your questions and provide you with requested information, products and services, we process your personal data. Read more about our processing related to the chat under customer support. Polestar Performance AB and Polestar Automotive USA Inc. are joint controllers for processing relating to the chat.
2.2.3 Your Polestar ID account on polestar.com
For you to be able to create and log in to your account on our website and use those web services that require a Polestar ID, we will process your name, e mail address, phone number, password, relevant market and preferred language. Our legal basis for processing your personal data is to perform the contract (GDPR, article 6.1 (b)). We will continue to process your personal data for up to thirty (30) days after you have terminated your account. Polestar Performance AB is controller for the processing relating to your Polestar ID account.
We will collect, process and combine certain types of personal data (as explained in the next paragraph) to predict your personal preferences and categorize you into a “segment affiliation”. This is a group of approximately 5,000-15,000 individuals with similar preferences, interests, and behavior. Everyone categorized into the same segment affiliation will receive the same type of marketing. We do this in order to provide you with marketing and other communication which is relevant to you considering your specific situation, needs and interests, The segments we create can for example include “people that visited the product page, started configuration, and chose the color red".
Your segment affiliation may also be used to create so-called lookalike audiences, meaning that we create a target audience based on the same characteristics of the individuals belonging to a certain segment affiliation. This enables us to target potential customers with similar interests, behavior or characteristics as the people that already have shown an interest in our products and services. In other words, we will use your segment affiliation to target other individuals with the same characteristics.
We will also use your segment affiliation to get a better general understanding of you and your needs, provide better customer support, and to keep track of your interactions with us.
3. Where do we get your personal data from?
We mainly collect your personal data directly from you, but in some cases, we also collect personal data from other sources, namely when:
you decide to finance your vehicle through leasing or a loan: we collect information about the status of your finance or leasing application from the finance or leasing company.
service is performed on your vehicle: we collect information about the services performed on your vehicle in the workshop.
we receive a request for change of ownership from the registered owner of the vehicle: we collect the new owner’s e-mail address from the registered owner.
we create some personal data about you, such as Vehicle Identification Number (VIN) and individual license plate of your purchased vehicle, which will be personal data about you. We may also observe and infer personal data about you, such as your online behavior and segment affiliation. Read more.
recorded phone calls between you and Polestar retailers from the Polestar retailers you have been in contact with via phone.
4. Sharing of your personal data
4.1 How we share your personal data and who we share it with
To provide our products and services and to comply with laws and regulations, we need to share your personal data with others, including other companies within the Polestar Group and third parties assisting us in various parts of our business and helping us to deliver our products and services. In each table you can find information about whom the data is shared with, and you can also find the categories of recipients listed below.
IT providers, e.g. companies that manage the necessary operation, technical support and maintenance of our IT solutions,
Subcontractors: mail and messaging services, banks and payment service providers, providers of analytics services
Authorities, e.g. the police, the privacy protection authority, tax authorities, public courts, authorities for official registering of the vehicle, enforcement agencies.
Business partners, e.g. workshops, finance and leasing companies, insurance companies, legal counsels, printing companies (marketing purposes), advertising agencies/companies, market research companies, and
Providers of social media platforms.
4.2 Specific sharing in the Preceding Twelve (12) Months:
4.2.1 Sharing for a business purpose within the preceding twelve (12) months
In the preceding 12 months, we have disclosed for a business purpose:
Your personal identifiers with retailers so that the retailer can respond to your request to schedule a test drive.
Your personal identifiers with retailers so that the retailer can facilitate your vehicle purchase.
Your internet activity information to our IT support to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, identify and repair Website errors, and to maintain and improve the Website.
Your personal identifiers with our service providers that assist us in providing the Website, including IT support, customer service, and website host.
Your personal identifiers with our marketing providers and media agency for our own direct marketing purposes.
4.2.2 Sales within the preceding twelve (12) months
In the preceding 12 months, we have shared your personal identifiers and commercial information with advertising platforms to engage in lookalike advertising to target our communications more accurately to audience segments, provide personalized content communications to existing of perspective consumers, and to generate marketing leads. We also shared internet activity information with advertising platforms via cookies to provide targeted advertising. We have shared your personal identifiers (e-mail address and VIN) with a radio broadcast provider. These advertising platforms and radio broadcast may keep and use your personal information for their own purposes, and is a sale/sharing under CCPA/CPRA. To opt-out of the sale/sharing, submit your request in our web form.
4.3 Processing of your personal data outside of the US
Polestar Automotive USA Inc. transfers personal data to the European Union and the United Kingdom.
In providing its services to Polestar Automotive USA Inc., Polestar Performance AB also sometimes transfers the personal data to service providers outside of EU/EEA or back into the US. Under EU privacy law this constitutes a reverse transfer. Transfers to the United Kingdom are carried out pursuant to its adequacy decision. For transfers to other countries outside of EU/EEA that do not have an adequacy decision, we use EU Model Clauses entered into by all relevant third parties (article 46 of the GDPR). In addition, we take additional technical and organizational security measures when needed, such as encryption (TLS) and pseudonymization.
5. Information security
To protect your personal information from loss, theft, and unauthorized access, use, or disclosure, we have implemented technical, administrative, and physical security measures including encryption of transmitted and stored data, and access right concepts. Unfortunately, no method of transmission over the Internet, or method of electronic storage, is 100% secure or impenetrable.
6. Your rights
Below, you can find a list of your rights related to our processing of your personal data under the GDPR and US privacy laws.
We have specified if a certain right only applies to residents in any of the applicable US States.
To exercise any of your rights, fill in this web form, call our toll-free number at (800) 806-2504 or contact us as described in this policy. To opt out of the sale of your personal information via cookies under applicable US State Privacy Laws, please visit our . For requests submitted via telephone or email, other than a request to opt out of sale/sharing, you must provide us with name, e-mail address, zip code and residency to allows us to reasonably verify that you are the person about whom we collected the personal information and describe your request with sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for requests to access, delete, or know with the information provided, we may ask you for additional pieces of information.
Only you, or a person that you authorize to act on your behalf, may make a request related to your personal information. If you are an authorized agent making a request on behalf of another individual, you must provide us with signed documentation that you are authorized to act on behalf of that individual.
If you have any objections or complaints about the way we process your personal data, please let us know and we will try to help.
You always have the right to lodge a complaint with the relevant supervisory authority. In Sweden, you have the right to lodge a complaint with the Swedish Supervisory Authority for Privacy Protection (IMY).
6.1 Right to information and a copy of your personal data
You have the right to know if we process personal data about you. If we do, you also have the right to receive information about the personal data we process. Furthermore, you have the right to receive a copy of all personal data we have about you.
If you are interested in specific information, please indicate it in your request. For example, you can specify if you are interested in a certain type of information, such as what specific contact details we have about you, or if you want information from a certain period.
6.2 Right to have erroneous or outdated personal data corrected, updated or supplemented
If the personal data we hold about you is incorrect, you have the right to have it corrected. You also have the right to supplement incomplete information with additional information that may be needed for the information to be correct.
If you request to have data corrected, you also have the right to request that we restrict our processing during the time we investigate the matter (this is in addition to your general right to restriction, described below).
6.3 Right to have personal data deleted
Your right to request the deletion of your personal information that we collect or maintain is subject to certain exceptions. For example, if we are required by law to retain the information that you are asking to be deleted, we would not be able to delete the information until we are legally permitted to delete it. In some cases, you have the right to have your data deleted, including when:
the data is no longer needed for the purposes for which we collected it,
you withdraw your consent and there is no other legal ground for the processing (if applicable),
the data is used for direct marketing, and you unsubscribe from it,
you oppose use that is based on our legitimate interest, and we cannot show compelling grounds for the processing which override your interests and rights,
the personal data has been used unlawfully, or
deletion is required to fulfil a legal obligation.
If we delete personal data following your request, we will also inform those we have shared your data with and direct them to delete your data (unless this proves impossible or involves disproportionate effort).
6.4 Objecting to our use
You have the right to object to processing that is based on our legitimate interest. If you object to the use, we will, based on your situation, evaluate if our interests in using the personal data outweigh your interests in the personal data not being used for that purpose. If we are unable to provide compelling legitimate grounds that override yours, we will stop using the personal data you object to – provided we do not have to use the data to establish, exercise or defend legal claims. If you object to the use, you also have the right to request that we restrict our use during the time we investigate the matter.
You always have the right to object to, and unsubscribe/opt out from, direct marketing.
6.5 Right to withdraw your consent
You have the right to withdraw your consent for a specific processing at any time. You can withdraw your consent by contacting us.
Your withdrawal will not affect processing that has already been carried out.
6.6 Right to request restriction
Restriction means that the data is marked so that it may only be used for certain limited purposes. The right to restriction applies:
when you believe the personal data are incorrect/inaccurate and you have requested correction. If so, you can also request that we limit our use while we investigate if the data are correct or not.
if the use is unlawful but you do not want the personal data to be erased.
when we no longer need the data for the purposes for which we collected it, but you need it to be able to establish, exercise or defend legal claims.
if you object to the use. If so, you can request that we limit our use while we investigate if our interest in processing your data outweighs your interests.
Even if you have requested that we restrict our use of your data, we have the right to use it for storage, if we have obtained your consent to use it, to assert or defend legal claims or to protect someone’s rights. We may also use the information for reasons relating to an important public interest.
We will let you know when the restriction expires.
If we limit our use of your data, we will also inform those we have shared your data with (when applicable) - if it is not impossible or too cumbersome. If you ask us, we will also tell you who we have shared your data with.
6.7 Right to data portability
If the processing is based on your consent or an agreement between us, you have the right to obtain personal data that you have provided to us in a structured, commonly used, machine-readable format and transfer it to another controller (“data portability”).
6.8 Right to opt-out of sale/sharing
If you are a resident of California, Colorado, Nevada, Utah, Virginia, or Connecticut, you have the right to opt out of the sale or sharing of your personal information to third parties.
The definition of a sale/sharing in California, Colorado, and Connecticut is: Any selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, of a consumer's personal information by the business to another business or a 3rd party for monetary or other valuable consideration.
The definition of a sale in Virginia and Utah is: Exchange of personal data for monetary consideration to a third party.
The definition of a sale in Nevada is: Exchange of personal data for monetary consideration to a recipient for that recipient to license or sell that information (such as the sale of information to data brokers).
To exercise your right to opt out of the sale or sharing of your personal information through cookies or other trackers, please visit our. To opt out of the sale or sharing of your personal information more generally, visit our web form.
6.9 Right to non-discrimination
You have the right to not receive discriminatory treatment if and when you exercise your data subject rights under applicable US State Privacy Laws.
6.10 Right to limit use of sensitive personal information
If you are a resident of California, you have the right to limit how we collect, use, and disclose your sensitive personal information to only what is necessary to perform the services or provide the goods reasonably expected by an average consumer, with some narrow exceptions. Sensitive information includes Social Security number, driver’s license number, biometric information, precise geolocation, and racial and ethnic origin.
6.11 Right to appeal
If you are a resident of Virginia, Colorado, or Connecticut and you submit a request to exercise any rights (under VCDPA, CPA, or CTDPA) and we do not take action on your request, you have the right to appeal our decision in accordance with the information provided in our privacy notice.
6.12 Right to opt out of profiling or targeted ads
If you are a resident of California, Virginia, Colorado, or Connecticut, you have the right to opt out of profiling or targeted ads under certain scenarios.
7. Do not track
We do not respond to Do Not Track (DNT) signals. DNT is a preference you can set on your web browser to inform websites that you do not want to be tracked. You can enable or disable DNT by visiting the preferences or settings page of your web browser.
Polestar Performance AB is the primary point of contact for data subjects that wish to exercise their rights and the main responsible for providing information to data subjects, for the uses of data where the controller is a company in the Polestar Group. You are of course entitled to exercise your rights under the GDPR in respect of and against each controller mentioned in this policy.
Each controller’s identity and contact details are listed below.
Polestar Performance AB is a Swedish legal entity with company registration number 556653-3096, with mailing address Assar Gabrielssons Väg 9, 405 31 Gothenburg, Sweden, and visiting address Polestar HQ, Assar Gabrielssons Väg 9, 418 78 Göteborg.
Polestar Automotive USA Inc is a US legal entity with company registration number 82-5420108 having its address at 1 Volvo Dr., Rockleigh, NJ 07647, United States. Polestar Automotive USA Inc is – within the joint controllership – generally responsible for marketing, sales and customer relations as well as market specific services in its market.
Polestar has appointed a Data Protection Officer for the Polestar Group who can be reached via e mail or via post as set out below:
E-mail address: [email protected]
Postal address: Polestar Performance AB, Attention: The Data Protection Officer, 405 31 Göteborg, Sweden
Prominate Ltd., a UK legal entity with company registration number 07795532, with address 21 Lombard Street, London, ECV3 9AH, United Kingdom.