CONNECTED TRAVEL ASSIST PRIVACY POLICY
This Privacy Policy aims to inform you about the collection, processing and use of your personal data when you use the “Connected Travel Assist with mass location data” driver assist function.
Connected Travel Assist with mass location data is a driver assist function which supports the driver through active longitudinal and lateral guidance. Sensor data from the front camera and from the front and rear radar systems as well as current route information are used for this purpose.
1. Who is the data controller?
Data controller: SEAT, S.A.U. (hereinafter, the “Entity”), with tax identification number A-28049161
Address: Autovía A-2, Km. 585, Martorell (Barcelona)
Contact email address: customercare@cupraofficial.com
2. What personal data do we process, how do we use it, what is its legal basis and how long do we keep the data?
The Entity will process your personal data for the purpose of downloading route information. When “Connected Travel Assist with mass location data” is used, learned routes in the form of route information are required which need to be downloaded during the journey on demand. To retrieve the necessary route information for your route, an online connection between the vehicle and our data server is established and the current geolocation of the vehicle is transmitted. The route information associated with the vehicle’s geolocation is then sent back to the vehicle, where available (see next section) and used by the “Connected Travel Assist with mass location data” driver assist function.
Type of personal data: IP address, GPS position of the vehicle is sent from the vehicle and is going to be process by the Entity.
Legal basis: in case of being the main user, the provision of Connected Travel Assist function (article 6.1 b) of General Data Protection Regulation) according to Terms & Conditions accepted by you at the time of downloading the functionality.
On the other hand, if you are a guest user, the legal basis for the processing of your personal data is the legitimate interest (article 6.1 f) of General Data Protection Regulation) since the processing of the aforementioned data is originated by the mere use of Connected Travel Assist with mass location data function. Otherwise, the function cannot work properly. Therefore, the Entity as data controller needs to process your personal data in order to enable you as guest user to use this function since it is considered that your interests as an individual are not overridden by this processing. Taking into account the data that the function needs to be enabled, it will not be possible for you as guest user to exercise your right to object due to it is not possible to use the function without processing personal data. If you do not want your data be processed, note that you cannot use this function.
3. Who are the recipients of my personal data?
The disclosure of your personal and vehicle data to third parties only will take place in compliance with the appropriate legal obligations.
The Entity will give access to data to third parties, such as IT service providers, acting as data processors for the purpose of offering this function. These third parties will process the personal data always on our behalf and in accordance with our instructions.
Volkswagen AG is our service provider for anonymising the data, which in turn hires other service providers such as AUDI AG and CARIAD SE to carry out this anonymisation service, with all of them acting as subprocessors. The data is encrypted in accordance with the agreements made with Volkswagen and exclusively processed on data servers in the EU. Some of these service providers may be located in the United States, therefore access to data from the United States cannot be ruled out. A corresponding EU standard data protection agreement (as a guarantee for data processing in non-EU countries) was concluded to ensure that your personal data is sufficiently protected.
4. What are your rights as data subject?
You can exercise the following rights:
Access: you can obtain from the Entity confirmation as to whether your personal data are being processed and access to your personal data.
Rectification: you can obtain the rectification of inaccurate personal data concerning you. You also have the right to have incomplete personal data completed.
Erasure: you can request the deletion of your personal data when, among others, the personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
Object: you can object to the processing of your personal data. The Entity will no longer process your personal data unless it has compelling legitimate grounds for the processing or for the establishment, exercise, or defence of legal claims.
Restriction of processing: you can request the restriction of the processing of your personal data where one of the following grounds applies:
The accuracy of the personal data is contested by you, for a period enabling the Entity to verify the accuracy of such data.
The processing is unlawful, and you oppose the erasure of your personal data and request the restriction of their use instead.
The Entity no longer needs your personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
You have objected to the processing, pending the verification whether CUPRA’s legitimate grounds override yours.
Portability: you can receive the personal data that you provided to the Entity in a structured, commonly used, and machine-readable format. You can also have these data transmitted to another controller.
Consent withdrawal: you can withdraw your consent at any time. Your consent withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.
You can exercise these rights by submitting a written request to SEAT, S.A.U., Autovía A-2 Km. 585, Martorell (Barcelona) or by sending an email to customercare@cupraofficial.com. Your request must specify the right you wish to exercise. The exercise of these rights is free of charge.
Should you consider that the Entity has not processed your personal data in accordance with applicable law, you can lodge a complaint with the relevant supervisory authority.
Contact channels
You can manage your personal data at any time in the CUPRA ID Portal: cupraid.vwgroup.io/account or by sending an e-mail to customercare@cupraoffical.com.
Our data protection officer is your contact person for matters relating to data protection, you can get in touch with him by sending an email to dataprotection@seat.es
5. Deactivation of the Connected Travel Assist function and privacy settings
Any vehicle user can deactivate the sharing of data for “Connected Travel Assist with mass location data” function by switching the vehicle to offline mode in the privacy settings. It is also possible, provided that you are a CUPRA CONNECT customer, to only prohibit the transmission of data in “Connected Travel Assist with mass location data” (see section 2 of this privacy policy) in you App. In this case, Travel Assist can still be used but without the support of the mass location data and the information on the learned routes. This can be done also by deactivating the sharing of GPS data in the privacy settings.