Privacy Notice - Digital Key App Polestar 2

This document describes how Polestar processes your personal data when you use the Polestar Digital Key in-car app.

Polestar Performance AB, a Swedish legal entity with company registration number 556653-3096 with address Assar Gabrielssons Väg 9, SE-405 31 Gothenburg, Sweden, hereinafter referred to as “Polestar”, “we” and “our”, will, as controller, process your personal data as described below.

Digital Key in-car app can fully replace the conventional car key and allows you to conveniently lock, unlock, or start your vehicle using your smartphone. It also enables sharing of your digital key with additional users through various digital channels. The Digital Key requires a network connection only during the initial setup, as well as when sharing or revoking keys. Once set up, administration is handled over the internet, while the key functionality operates via local Bluetooth.

During setup, your key is added to the Polestar app on your smart device. From the app, you can share your key through messaging apps, email, or via Airdrop®. You may also revoke shared keys through the mobile app or the in-car app. Please note that the Digital Key in-car app is currently available for the Polestar 2. For information related to Polestar 3 and 4, refer to the Car Privacy Notice.

Personal data processed for providing the Digital Key app

To provide the Digital Key in-car app and fulfill our contractual obligations to you (performance of a contract, GDPR Article 6(1)(b)), we process the following personal data:

• Vehicle Identification Number (VIN)
• Polestar ID
• Name
• Email address
• Phone number
• Pairing code 

App analytics

We process certain usage data to understand how the Digital Key in-car app is used and to improve its functionality, performance, and user experience. This processing is based on your explicit consent (GDPR Article 6(1)(a)).

After you have accepted the Privacy Notice and successfully logged into the application, you will be presented with a dedicated consent dialog requesting your permission to collect analytics data. All analytics data collected is anonymized and used solely to improve the service.

How your choice is handled

• If you select “Consent”, anonymized analytics data will be collected and shared with Google services for app improvement purposes.
• If you select “Decline”, no analytics data will be collected.

Your choice is stored securely in persistent storage and remains valid for the duration of your active session (until logout). You can change your preference at any time by logging out and logging back into the application. Upon re-login, the consent dialog will be presented again, allowing you to update your selection.

Types of analytics data collected on the basis of your consent:

If consent is given, the following anonymized data points may be collected:

• When the user uses the app for the first time
• When the user logs in with the Polestar ID
• When the setup process is completed
• When failures occur during setup
• When keys are shared
• When a digital key is connected to a user profile
• Frequency of specific error messages

We will retain your personal data for as long as you have a valid contract with Polestar. All data will be deleted after maximum period of 90 days from contract termination.

We will disclose your personal data with the following categories of recipients, on a need-to-know basis.

Our processors support delivering the Polestar app, which are limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with each data processing agreement in place:

• Amazon Web Services Ireland Limited and its sub-processors (European Union) – data hosting.
• Google Ireland Limited and its sub-processors, data center Europe-west1 (Belgium) https://www.google.com/about/datacenters/inside/locations/index.html; data transfer also to Google LLC, USA, under the Standard Contractual Clauses adopted by the European Commission, available here) – the following Google Firebase services are used within the scope of the Digital Key app:
• Cloud functions
• Firebase authentication
• Firebase Crashlytics
• Firebase Realtime database
• Firebase remote configurations

Because we use service providers that are located in the US, and our service providers in the US also rely on the services of our affiliates in the US and the European Union or United Kingdom, your personal data will be transferred outside the Canadian province where it was collected for these purposes.

Polestar Automotive Canada Inc. transfers personal data to the European Union, the US and the United Kingdom.

In providing its services to Polestar Automotive Canada Inc., Polestar Performance AB also sometimes transfers the personal data to service providers outside if EU/EEA or to the US. Under EU privacy law this constitutes a reverse transfer. Transfers to the United Kingdom are carried out pursuant to its adequacy decision. For transfers to other countries outside of EU/EEA and the US, that do not have an adequacy decision, we use EU Model Clauses entered into by all relevant third parties (article 46 of the GDPR) or they are certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S Data Privacy Framework and/or the Swiss-U.S. Data Privacy Framework with the U.S. Department of Commerce. In addition, we take additional technical and organizational security measures when needed, such as encryption (TLS) and pseudonymization.

You have specific legal rights granted by the General Data Protection Regulation relating to the personal data we process about you. You can withdraw your consent or object to our processing of your data, access the data we hold about you, ask for rectification or restriction of your data, request to have your data ported to another entity, request that we delete your data, and finally, you can file a complaint with a data protection supervisory authority. For more information about your rights, see our Customer Privacy Policy.

In order to exercise your rights, please use this web form. If you have any other questions regarding the subject matter of personal data protection, you can contact us or our Data Protection Officer on the contact details stated on polestar.com/privacy-policy

Polestar Performance AB is a Swedish legal entity with company registration number 556653-3096, with mailing address Assar Gabrielssons Väg 9, 405 31 Gothenburg, Sweden, and visiting address Polestar HQ, Assar Gabrielssons Väg 9, 418 78 Göteborg.

We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. For this reason, we encourage you to refer to this privacy notice on an ongoing basis. This privacy notice is current as of the date which appears at the top of the document. We will treat your personal data in a manner consistent with the privacy notice under which they were collected, unless we have your consent to treat them differently.