GM EUROPE PRIVACY STATEMENT

Your privacy is important to us as is your trust in our products and services. We want you to know that the personal data you share with us will be treated with care. This Privacy Statement addresses the personal data we collect and how we use and share that personal data.

This Privacy Statement applies to personal data we collect from and about individuals interacting with GM companies and our websites, products, programs, and services across Europe, including the European Union (including the countries of the European Economic Area), Switzerland, and the United Kingdom. It includes those products and services that GM may offer under different brands, such as Cadillac. As used in this Privacy Statement, the term GM means the specific GM group company acting as the data controller for your personal data. You can determine which of the GM group companies is the data controller by reviewing the “Data Controller” section below. 

Certain products and services may also be subject to separate privacy statements, independently or in combination with this Privacy Statement, which we recommend you review. For example, GM’s mobile applications may have separate privacy statements, as described in the Mobile Applications section below. 

Our complete Privacy Statement can be found below. Here is a summary of some key points in our Privacy Statement:

• Collection: We may collect personal data about you and your vehicle, such as name, address, email address, phone number, vehicle identification number (VIN) and vehicle performance data through your use of our products, services, websites, or call centers, or through GM affiliates, dealers, agents or authorized repairers, licensees, partners, or others who provide personal data to us. 
• Use: We may use your personal data to develop, provide, and maintain our products and services, to set up, operate and maintain your account with us, to interact with you, for safety, security, fraud detection and prevention, and product research purposes, to provide customer and vehicle support and service, and, subject to an opt-in by you, for marketing. 
• Sharing: We may share your personal data as required or permitted by law, within GM and with our subsidiaries and affiliates, dealers, agents or authorized repairers, licensees, service providers, and other companies with whom we enter into business arrangements. 
• Legal Basis: We process your personal data using a variety of legal bases, such as where you have given your consent, to perform a contract with you, to comply with a legal obligation we are subject to or for our legitimate interests. 
• Cookies and Tracking: We may use cookies, pixel tags, web beacons and other similar tracking technologies to help provide our products and services, understand and customize your preferences, and display relevant advertising. 
• Mobile Applications: GM has developed certain mobile applications that you may download to your mobile device or vehicle (GM Applications). When you download a GM Application, we may collect data from and about you, your vehicle, and your use of the GM Application.
• Third Party Products and Services: Through the use of GM products and services, you may be able to access third party services, applications and websites not controlled by GM or covered by this Privacy Statement.
• Dealers or Authorized Repairers: GM and the dealers, agents or authorized repairers who sell or service GM vehicles are separate and independent legal entities with their own privacy practices. For questions about their privacy practices, including opting out of marketing communications from your these third parties, please contact them directly. ´
• Accuracy and Updates: You may access your online accounts with us to update much of the personal data we collect about you or you may contact us to learn about how to do so by using the methods explained below. 
• Rights and Choices: You may have certain rights and choices regarding how we collect, use and share your personal data, which you can submit to us using the methods explained below.
• Security Measures: We maintain reasonable security controls and practices to protect the personal data we collect about you and require similar controls by our service providers.
• Data Retention: We keep your personal data for as long as necessary to provide our products and services, operate our business, and comply with legal obligations.
• Children’s Privacy: We do not target, or knowingly collect any personal data from children.
• International Data Transfers: We maintain appropriate protections for cross-border transfers as required by law for international data transfers.
• Data Controller: This Privacy Statement applies to the personal data individual GM group companies process about data subjects across Europe, including the countries of the European Economic Area, Switzerland and the United Kingdom. You can determine which of the GM group companies is the data controller by reviewing the “Data Controller” section below.
• Contact Us: If you have concerns or questions regarding GM's consumer privacy practices or this Privacy Statement, please contact us at privacy.europe@gm.com.
• Changes: We may update this Privacy Statement from time to time. 

This Privacy Statement does not apply to personal data that we obtain in our capacity as an employer. If you are a current or former GM employee, you can visit our company intranet site or contact your human resources representative for a copy of our employee privacy statement. If you were considered for employment with GM, please visit careers.gm.com/privacy for more information about how GM collects, uses, and shares your personal data.

As you interact with GM or our products, programs, and services, there may be opportunities for you to provide us with your personal data. Additionally, we may collect certain personal data about you or your vehicle as further described below. 

You may provide us with personal data about you or your vehicle through a number of sources: GM websites, applications, services, product and related events, surveys, social media platforms, sweepstakes entries and through our customer call centers. We may also collect personal data that is publicly available. For example, we may collect publicly available information you submit to a blog, a chat room, or a social media platform, and we may use your personal data for the purposes set out in this Privacy Statement. GM engages with consumers on multiple social media platforms and if you contact us on one of our social media pages, request assistance via social media or otherwise direct us to communicate with you via social media, we may contact you via direct message or use other social media tools to interact with you. In these instances, your interactions with us are governed by this Privacy Statement as well as the privacy policy of the social media platform you use. 

We also receive data about you through vehicle sales records provided by your dealer and we may obtain, with your consent, data obtained from your vehicle’s Event Data Recorder (EDR). For additional information about EDR data, please see your owner’s manual. We also may obtain personal data about you and your vehicle from GM affiliates, dealers, agents or authorized repairers, GM licensees for consumer merchandise, GM partners (for example, credit card or bank partners) and other sources such as companies that provide lists of potential vehicle purchasers and current owners, if such companies are permitted to share your personal data with us pursuant to their privacy statements. We may combine personal data that we receive from the various sources described in this Privacy Statement, including third-party sources, with personal data you provide and use or share it for the purposes identified below. 

The types of personal data that GM collects about you, your vehicle, or your connected devices (such as your mobile phone, computer, or tablet) may include, but are not limited to: 

• identifiers (such as name, postal address, email address, screen name, account ID, login information, customer number, and telephone number; citizen identification numbers issued by government bodies or agencies (e.g., depending on the country you are in, social security, citizen service or Personal Public Service (PPS) number or national insurance number, passport number, ID number, tax identification number, driver’s license number); copy of your passport or driver’s license
• payment information (such as your credit card number, CVV code and expiration date) 
• information about your vehicle (such as license plate number, vehicle identification number (VIN), make, model, model year, selling dealer, servicing dealer, date of purchase or lease, the lease/financing term, service history, mileage, oil/battery status, fuel history, battery charging and discharging history, electrical system function, gear status, and diagnostic trouble codes)
• information about your connected devices and how you interact with our products, services, apps and websites (such as IP address, browser type, unique device identifier, cookie data, and associated identifying and usage information) 
• demographic or protected classification data (such as gender, date of birth, marital status, household composition, nationality veteran or military status and citizenship status) ,
• commercial information (such as when you plan to purchase or lease the vehicle in which you're interested) 
• audio or video data (such as data collected by sensors or cameras in the vehicle, or photographs and videos such as those that you may submit for contests, sweepstakes, and social sharing)
• relationships you have with GM in addition to the purchase and servicing of your vehicle 
• relationships you have with third parties in connection with your use of GM products and services (such as GM dealers, agents or authorized repairers, energy utilities, and companies offering or operating in-vehicle applications)
• feedback, ratings, or evaluations of GM products and services attributable to you

The personal data GM collects about you, your vehicle, or your connected devices may be used: 

• To provide products and services, programs like test drives, and maintain customer relationships
• to improve the quality, safety, and security of our products and services 
• to administer your account(s) and process your payments for products and services 
• to operate our websites and applications, including online registration processes
• to facilitate and support GM dealer, authorized repairer, and supplier diversity programs and GM grant programs
• to autofill data fields on our websites to improve your online experience or to store a car configuration
• to develop new products and services, including connected, autonomous and car-sharing products and services
• to provide customer and vehicle support and service (such as recall information)
• for warranty administration and validation 
• to provide information and product updates
• to evaluate vehicle performance and safety
• for research, evaluation of use, and troubleshooting purposes
• to verify eligibility for vehicle purchase or incentive programs including for GM’s compliance with export control laws and regulations of the United States (i.e. The Arms Export Control Act (22 U.S.C. 2778), International Traffic in Arms Regulations (22 C.F.R. Parts 120-130), Export Control Reform Act of 2018 (50 U.S.C. 4801 et seq.), and the Export Administration Regulations (15 C.F.R. Parts 730-774)) and other relevant jurisdictions which restrict sharing certain technologies with certain countries and their nationals. These laws may apply regardless of where in the world (or by whom) such transfer takes place
• for marketing and analytics purposes, including to personalize our products to your interests by automatically processing your personal data, including your interactions with us (such as how often you look at a product or page) and products you have purchased or looked at, to create a profile and predictive assessments about you; these automated processes may affect the products, services and pricing being offered to you
• to analyze your feedback about our websites, apps, brands, products, and services
• to support the electronic signature and delivery process
• to customize and improve communication content
• to evaluate or conduct a merger, divestiture, acquisition, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets
• to comply with legal, regulatory or contractual requirements 
• to protect our rights, or to detect, investigate and prevent fraud or other illegal activity 

When we maintain and use personal data that has been deidentified, we take reasonable steps to ensure that such personal data is maintained and used only in deidentified form, and will not attempt to reidentify such personal data unless required or permitted by applicable law.

GM may share the personal data it collects about you, your vehicle, or your connected devices (including the categories of personal data listed above) in the following instances and with the following categories of third parties: 

• within GM, with our GM controlled subsidiaries and affiliates, with GM dealers, agents or authorized repairers, with service providers we or our dealers, agents or authorized repairers use to deliver products and services to you, and with GM licensees
• with our service providers who work on our behalf and who do not have an independent right to use the personal data to which they have access or that we disclose to them  
• with companies we enter into business or marketing arrangements with, such as arrangements supporting products and services we offer to you 
• with public safety entities, if the 112-based eCall in-vehicle system is activated automatically by means of in-vehicle sensors in the event of a severe accident, or manually by button press within the vehicle
• with third parties you have authorized to request from or exchange data with GM (for example, financial organizations who offer financing for the purchase or lease of GM vehicles) 
• with third parties for research and development purposes (such as university research institutes for improving highway safety) 
• in connection with the sale, transfer or financing of a significant part of a GM business or its assets, including any such activities associated with a bankruptcy proceeding 
• when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, detect, investigate and prevent fraud or other illegal activity, or respond to a law enforcement request 
• as required or permitted by law, such as in conjunction with a subpoena, government inquiry, litigation, dispute resolution or similar legal process 

Apart from the purposes listed above, GM will not share personal data about you or your vehicle with other third parties for their independent use without your prior consent. 

• When you have given your consent to the processing of your data for one or more specific purposes. Where our processing relies on your consent, you may withdraw consent at any time by contacting us (see also "Choices" below).
• When the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, including: 
  • to provide you with a product, service, or program that you’ve requested from us
  • to administer and validate warranties
  • to administer your account(s) and process your payments for products and services

• When the processing is necessary for compliance with a legal obligation applicable to the GM data controller, including:
  • to report environmental or emissions performance to regulatory bodies
  • to support the electronic signature and delivery process
  • to comply with lawful order from a criminal investigation body
  • to support the 112-based eCall in-vehicle system in accordance with Directives 95/46/EC ( 1 ) and 2002/58/EC ( 2 ) of the European Parliament and of the Council

•  When the processing is necessary in order to protect your vital interests of you or of another natural person, including:
  • to provide customer and vehicle support and service (such as recall information)

• When the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular if you are a child, such processing including:
  • to operate our websites and applications, including online account creation and administration processes
  • to contact you with information, product updates, and for marketing and analytics purposes, including profiling and predictive assessments
  • to analyze feedback about our websites, apps, brands, products, and services
  • to provide customer and vehicle support and service (such as recall information)
  • to provide products and services, programs like test drives, and maintain customer relationships
  • to improve the quality, safety, and security of our products and services
  • to evaluate vehicle performance and safety
  • to facilitate and support GM dealer, agent, authorized repairer and supplier diversity programs and GM grant programs
  • to autofill data fields on our websites to improve your online experience or to store a car configuration
  • to develop new products and services, including connected, autonomous and car-sharing products and services
  • to perform research, evaluate product and services use, and troubleshooting
  • to protect our business, websites, products and services from network and personal data security risks
  • to verify eligibility for vehicle purchase or incentive programs including for GM’s compliance with export control laws and regulations of the United States (i.e. The Arms Export Control Act (22 U.S.C. 2778), International Traffic in Arms Regulations (22 C.F.R. Parts 120-130), Export Control Reform Act of 2018 (50 U.S.C. 4801 et seq.), and the Export Administration Regulations (15 C.F.R. Parts 730-774)) and other relevant jurisdictions which restrict sharing certain technologies with certain countries and their nationals. These laws may apply regardless of where in the world (or by whom) such transfer takes place
  • to customize and improve communication content
  • to protect our rights, or to detect, investigate and prevent fraud or other illegal activity
  • to share service history data with dealers, agents or authorized repairers and their respective service providers
  • to share relevant data with our services providers who work on our behalf and who do not have an independent right to use the data to which they have access or that we disclose to them

• Where there is another applicable legal basis for data processing, especially provisions set out by applicable law.
  

Communications with you in connection with the “Use” above may be via mail, telephone, e-mail, social media, and other electronic messages, through the in-vehicle infotainment or via our websites and applications. To unsubscribe from a particular email newsletter or other communication, you should follow the instructions in the email or on a related website, such as in the data and privacy section of your GM account. To opt-out of receiving text messages from GM, you should follow the opt-out instructions in that specific text message program. If you have opted into any of our text message programs and you later decide to change your phone number or cancel your phone plan you should immediately opt-out of any text message programs and re-opt in with your new phone number if you wish to continue to receive text messages from GM. This will help us ensure we continue to honor your preferences and text the correct phone number. 

If you opt out of receiving marketing communications from GM, your personal data will not be used to send marketing communications, but may still be used for the other purposes described in this Privacy Statement (such as vehicle support and service). Some collection and sharing practices are necessary to provide products and services we offer or to support mandated features such as eCall. To stop processing of some data, with the exception of eCall, you may have to decline those products and services or be willing to accept limited functionality.

Where we rely on your consent as the legal basis for processing your personal data, you may withdraw your consent at any time. See “How To Contact Us” below.

GM may use cookies, pixel tags, web beacons and other tracking technologies on our websites, applications, email messages and advertisements, sometimes across devices, to gather data about your visit (such as demographic data, browser type, IP address, pages visited, activities conducted on the page, and the day and time of your visit). Details for how we use cookies and tracking technologies as well as any choices you may have to consent to loading cookies are described in our Cookie Policy.

GM may offer certain mobile applications that you have the option to download to or use with your connected device or vehicle (GM Applications). When you choose to download or use a GM Application, there may be an opportunity for you to provide us with, or for us to obtain, data about you, your connected device, or your vehicle. Each GM Application may display a separate privacy statement that will inform you about how any personal data is collected, used and shared via the application and how to decline such use or uninstall the application.

Through the use of GM products and services, you may be able to access third party services, applications, and websites not offered or controlled by GM (Third Party Services). We recommend that you carefully review the privacy disclosures of these Third-Party Services, before interacting with them or providing your personal data to them. Unless otherwise expressly indicated by GM, this Privacy Statement does not apply to your use of such Third Party Services or how such Third Party Services may collect, use, or share your personal data.

When you take delivery of a vehicle from a dealer or agent or have your vehicle serviced by an authorized repairer, they will share certain data with GM. Please be aware that these entities are separate from GM and you should read their privacy statement to ensure that you understand their privacy practices and procedures. For questions about dealer, agent or authorized repairer privacy practices including opting out of marketing communications from them, please contact them directly. 

While GM encourages dealers, agents and authorized repairers to ensure full compliance with all applicable privacy legislation and has provided personal data to them relating to privacy obligations, GM is not responsible for their compliance with applicable law. When completing a purchase or lease agreement or signing a service repair order, you should be provided with information describing the dealer, agent, or authorized repairer’s privacy practices and related policies that explain that certain personal data that you provide to the dealer may be shared with GM.

Dealers, agents or authorized repairers who provide vehicle diagnostic, maintenance, and repair services typically collect and share vehicle data with GM. This data may include the vehicle identification number associated with your vehicle, vehicle diagnostic and maintenance data, and vehicle systems status data.

GM uses this data to assist them in diagnosing and repairing your vehicle, to maintain a service history of your vehicle, for warranty and recall purposes, for GM’s research and development purposes, for analytics purposes, and to help GM comply with our legal or regulatory obligations. This data is transferred out of Europe to General Motors Holdings, LLC in the United States or other jurisdictions where we operate as described in the “International Data Transfers” section of this Privacy Statement. 

You may view or update many of the pieces of personal data we process about you in your online account. To learn about how to update your mail, email or telephone information please review your account or contact us at: support@cadillaceurope.com.

We maintain reasonable and appropriate technical, administrative, organizational, and physical security and confidentiality measures designed to help protect your data from unauthorized access or acquisition and to ensure a level of security appropriate to the risk of varying likelihood and severity for your rights and freedoms related to personal data. We also require by contract (other than in an emergency situations) that third party service providers acting on our behalf or with whom we share your data also undertake to provide such security and confidentiality measures in accordance with industry standards.

We may keep the data we collect for as long as necessary to provide products or services to you, to operate our business, to enable us to communicate with you, for our safety, research, evaluation of use, or troubleshooting purposes, or to satisfy our legal or contractual obligations. We regularly delete or anonymize personal data subject to our information lifecycle management policy and record retention schedule. We are required to maintain data to comply with taxation or other applicable laws or if we need your personal data to establish, exercise or defend a legal claim. To the extent possible, we will restrict the processing of your personal data for the limited purposes that require its retention.

GM websites and other online services do not target or knowingly collect any personal data from children.

GM stores your data in the United States, the European Union (including the countries of the European Economic Area (EEA)), Switzerland, and other locations where GM, our brands or our service providers operate worldwide. With respect to such transfers from the EEA, Switzerland or the United Kingdom to the United States and other non-EEA jurisdictions which are not deemed to have adequacy under applicable data protection laws, we implement standard contractual clauses and other mechanisms, such as supplementary measures, to provide adequate protection for the transfer of this personal data. GM Holdings, LLC (GMH) acts as a data processor for its GM controlled subsidiaries, including the data controllers listed below, by providing data hosting, maintenance, support, and troubleshooting of services, as well as other redundant back office support.

In addition, anonymized and aggregated data is shared with GMH to evaluate or research the safety, quality, usage, and functionality of vehicles and services, including providing customers with vehicle support and services, and to ensure accurate customer records and maintain customer relationships

In some instances, your vehicle may be equipped with features for which you are the Data Controller, such as performance data monitors or other technologies. For those features, you are responsible to ensure compliance with applicable laws and regulations, including, but not limited to: data protection laws, laws related to camera surveillance and recordings, road traffic and security laws, and laws on the protection of publicity and personality rights. You should comply with any notice and consent requirements before capturing and/or recording the voices or images of other persons or before collecting other personal data and notify other drivers of your vehicle about these features and their obligations under applicable laws and require them to comply.

GM has appointed a Data Protection Officer (DPO) for Europe pursuant to applicable data protection laws. With respect to any questions regarding the protection of your personal data or your rights under applicable data protection laws, our DPO can be contacted at privacy.europe@gm.com. Our DPO can also be reached at the following address: FAO General Motors Europe DPO, 100 New Bridge Street, London, EC4V 6JA, United Kingdom.