GENERAL MOTORS EUROPE PRIVACY STATEMENT
Last Updated: April 2025
View and print our entire Europe Privacy Statement (PDF)
We envision a world with zero crashes, zero emissions and zero congestion. To achieve this bold vision, evolve our vehicles, and create safer experiences for you and others, we collect information about you and the world around you that we need to power the products and services we offer, to improve your experience in your vehicle, and to advance future technologies like electric vehicles and autonomous driving.
We are committed to providing you with a trusted experience and respecting your privacy when it comes to Personal Data. When we say Personal Data, we mean information that identifies, relates to, or could reasonably be linked to you.
This Privacy Statement includes details about:
- Personal Data we collect from and about you
- How we use this Personal Data to deliver products and services, keep vehicles and roadways safe, and innovate and evolve our vehicles for the next generation
- How and when we may disclose Personal Data, and
- Your choices and rights regarding privacy and access to Personal Data about you.
De-identified data: We may use privacy-enhancing and technical protection measures like de-identification to prevent data from being reasonably associated with you or your vehicle. When we de-identify data, we take reasonable steps to help ensure that the de-identified data is not re-identified. Data that has been de-identified is not covered by this Privacy Statement.
I. What this Privacy Statement covers
Controllers and Countries: Our Privacy Statement covers Personal Data that GM collects online and offline across all GM brands of products, services, websites and apps across Europe, including the countries of the European Economic Area, Switzerland, and the United Kingdom. When we say GM, we mean the specific GM group company acting as the data controller for your personal data. You can determine which of the GM group companies is the data controller by reviewing the “Data Controller” section below.
What This Privacy Statement Doesn’t Cover
US GM group companies and affiliates: This Privacy Statement does not apply to products or services offered by GM’s United States companies or affiliates.
GM Business Partners: Dealers, agents and authorized service outlets and centers appointed by GM to sell, lease, or provide aftersales service, repair or maintenance for GM vehicles (collectively GM Business Partners), providers of financing, leasing and online vehicle selling platforms, trade-in partners for pre-owned vehicles, and charging solution providers are separate legal entities from GM with their own privacy practices. This Privacy Statement does not apply to any GM Partner and its collection, use, or sharing of Personal Data. We encourage you to contact your GM Partner if you have questions about its privacy practices. Note that we may collect and receive your Personal Data from our GM Business Partners.
Third-party services: Through the use of GM products and services or its website, you may be able to access third party services, applications, social media/networks, and websites not offered or controlled by GM. These may be available to you on your vehicle, such as Google Automotive Services, browser, navigation services, electric vehicle charging solutions, or apps available to download such as through an app store on your connected vehicle. We recommend that you review the privacy disclosures and permissions of these third-party services before using them or providing Personal Data to them. Unless otherwise expressly stated by GM, this Privacy Statement does not apply to your use of these third-party services or any Personal Data third-party services may collect, use, or disclose.
GM employees and candidates for employment: Candidates for employment at GM should refer to the separate privacy statement at https://search-careers.gm.com/en/privacy/ to learn more. Current and former GM employees can find the privacy statement applicable to their relationship with GM on the company intranet site or via their human resources representative.
II. Personal Data we collect and how and why we collect it
GM offers a variety of products, apps and services. GM may collect Personal Data directly from you or automatically through your interaction with our products or services or we may receive Personal Data from: GM Business Partners, licensors, service providers, other business partners, financiers, insurers, logistic, vehicle registration and delivery service providers, advertising platforms or third-party sources. For example, GM collects Personal Data about you when you:
- Interact with us online, including while researching and shopping for products and services, engaging with our customer care or experience centers, interacting with your GM account, and interacting with email, event invitations, surveys, raffles or other marketing and promotional activities
- Buy, rent, borrow, seek financing for, test drive or lease a GM vehicle, or purchase parts, accessories or services from GM or GM Business Partners
- Have your vehicle serviced by GM or a GM Business Partner or other business that you may use to maintain or service your GM vehicle
- Enroll in Connected Services by accepting the Connected Services User Terms through the myCadillac app or offline.• Use Connected Services. Connected Services in vehicles encompass digital and network-enabled capabilities that facilitate interaction between a vehicle and external systems, infrastructure, other vehicles, and the cloud. These services are designed to enhance convenience, safety, performance, and the overall user experience through the seamless exchange of real-time data and the provision of remote functionalities. Which Connected Services are available depends on your vehicle’s make, model and year and your vehicle sale agreement. May include Google Automotive Services, remote commands, remote diagnostics, infotainment, browser/video streaming/Wi-Fi data, battery/diagnostic safety monitoring, over-the-air software and map updates, and driver control assistance functions such as Driver Assistance Package. May include advanced driver assistance systems such as Super Cruise at a later date. See www.cadillaceurope.com/se-en/connected-services for individual service descriptions.
- Use other products and services GM develops, including our myCadillac vehicle mobile app (Vehicle Mobile App), the Cadillac Charge app, or, if available, our Home Energy Products, such as vehicle-to-home solutions or stationary home energy storage (collectively, Home Energy Products), or connect non-GM products such as your solar panels to our Home Energy Products.
- Participate in events, competitions and business conferences sponsored and/or hosted by us.
We may combine information that we receive from various sources, including third-party sources, with information you provide and use or disclose it for the purposes identified in this Privacy Statement.
The types of Personal Data that GM collects about you when you interact with us include and have the following legal bases and purposes of use:
Identifiers and Commercial Information:
Data collected
- Identifiers: Can include name, postal address, email address, screen name, photo, account ID, customer number, driver’s licence number, social card number, or telephone number..
- Commercial Information: Can include (a) information about vehicle purchases or leases, information you have provided when seeking financing for or leasing of your vehicle, and information shared with us about your vehicle when it is serviced by a GM Business Partner or other business that you may use to maintain or service your GM vehicle, such as service history, mileage, and diagnostic information, (b) relationships that you have with third parties in connection with your use of GM products and services, such as GM Business Partners, energy utilities, and companies offering or operating in-vehicle applications, (c) information about your accounts with us, or (e) information about how you use our products and services, including, if available, home charging preferences and energy usage, and records of your use of public charging. We also use qualified IT service providers to help manage our offerings, including cloud-based customer relationship management (CRM) software such as Salesforce.
Legal basis and purposes of use
- When you have given your consent to the processing of your data for one or more specific purposes. Where our processing relies on your consent, you may withdraw consent at any time by contacting us (see also “How to contact us” below).
- When the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, including for the following purposes of use:
- Provide our products, programs, and services, such as to access your GM Account, save a vehicle configuration, use vehicle diagnostic tools, enable in-vehicle connectivity, enable entertainment or navigation, or, if you have an electric vehicle, to deliver charging programs
- Support mobility service providers such as car rentals and other companies with whom we enter into business relationships, in order for them to provide a service you have elected to receive from them
- Evaluate or improve the quality, safety, and security of our vehicles, products, and services
- Provide customer and vehicle support and services (such as recall information)
- Administer, validate and insure warrantieso For operations, compliance, or warranty purposeso Administer your account(s) and process your payments for products and services
- When the processing is necessary for compliance with a legal obligation applicable to the GM data controller, including for the following purposes of use:
- Evaluate, monitor, or improve the quality, safety, and security of our vehicles, products, and services
- Comply with legal, regulatory, or contractual requirements, including lawful orders from a criminal investigation body, foreign (non-EU) legal or regulatory requirements, report environmental, vehicle systems-related or emissions performance, and support the mandatory European 112-based eCall in-vehicle emergency call system in accordance with applicable law
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claims or collecting outstanding debts
- Prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; and preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action
- When the processing is necessary in order to protect your vital interests of you or of another natural person, including for the following purposes of use:
- Provide customer and vehicle support and services (such as recall information)
- When the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular if you are a child, such processing including for the following purposes of use:
- Develop new products and services, including connected, autonomous, and car-sharing products and services
- Evaluate, monitor or improve the quality, safety, and security of our vehicles, products, and services
- Provide information and product updates
- Conduct internal research to develop, improve, or repair products, services, or technology
- Operate our websites and applications, including online registration processes
- Improve your online experiences, such as autofill data fields on our websites
- For marketing and analytics purposes, including to personalize our products to your interests by automatically processing your personal data, including your interactions with us (such as how often you look at a product or page) and products you have purchased or looked at, to create a profile and predictive assessments about you; these automated processes may affect the products, services and pricing being offered to you
- Administer your participation in contests, quizzes, surveys, promotions, and offers
- Provide customer feedback opportunities on products or services purchased by you
- Evaluate or conduct a merger, divestiture, acquisition, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claims or collecting outstanding debts
- Maintain customer relationships and communicate with youo Provide our products, programs, and services, such as test drives, and maintain customer relationships
- Verify eligibility for purchase or incentive programs including for GM’s compliance with export control laws and regulations of the United States (i.e. The Arms Export Control Act (22 U.S.C. 2778), International Traffic in Arms Regulations (22 C.F.R. Parts 120-130), Export Control Reform Act of 2018 (50 U.S.C. 4801 et seq.), and the Export Administration Regulations (15 C.F.R. Parts 730-774)) and other relevant jurisdictions which restrict sharing certain technologies with certain countries and their nationals. These laws may apply regardless of where in the world (or by whom) such transfer takes place
- Customize and improve communication content and your experience with GM
- Comply with legal, regulatory, or contractual requirements, including lawful orders from a criminal investigation body, foreign (non-EU) legal or regulatory requirements, report environmental, vehicle systems or emissions performance
- Where there is another applicable legal basis for data processing, especially provisions set out by applicable law.
Digital Activity Information:
Data collected
- Can include IP address, browser type, unique device identifier, cookie data, associated identifying and usage information of computers and mobile devices that interact with our products, and information about how you use our products and services, such as Connected Services usage, infotainment system usage, Wi-Fi data usage, and information about your use of Vehicle Mobile Apps.
Legal Basis and Purposes of Use
- When you have given your consent to the processing of your data for one or more specific purposes. Where our processing relies on your consent, you may withdraw consent at any time by contacting us (see also “How to contact us” below).
- When the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, including for the following purposes of use:
- Provide our products, programs, and services, such as to access your GM Account, save a vehicle configuration, use vehicle diagnostic tools, enable in-vehicle connectivity, enable entertainment or navigation, or, if you have an electric vehicle, to deliver charging programs
- Provide information and product updates
- When the processing is necessary for compliance with a legal obligation applicable to the GM data controller, including for the following purposes of use:
- Evaluate or improve the quality, safety, and security of our vehicles, products, and serviceso Provide information and product updates
- Comply with legal, regulatory, or contractual requirements, including lawful orders from a criminal investigation body, foreign (non-EU) legal or regulatory requirements, report environmental or emissions performance, and support the 112-based eCall in-vehicle system
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claims or collecting outstanding debts
- Prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; and preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action
- Comply with legal, regulatory, or contractual requirements, including lawful orders from a criminal investigation body, foreign (non-EU) legal or regulatory requirements, report environmental or emissions performance, and support the 112-based eCall in-vehicle emergency call system
- When the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular if you are a child, such processing including for the following purposes of use:
- Develop new products and services, including connected, autonomous, and car-sharing products and services
- Evaluate or improve the quality, safety, and security of our vehicles, products, and services
- Operate our websites and applications, including online registration processes
- Improve your online experiences, such as autofill data fields on our websites
- Conduct internal research to develop, improve, or repair products, services, or technology
- For marketing and analytics purposes, including to personalize our products to your interests by automatically processing your personal data, including your interactions with us (such as how often you look at a product or page) and products you have purchased or looked at, to create a profile and predictive assessments about you; these automated processes may affect the products, services and pricing being offered to you
- Provide customer feedback opportunities on products or services purchased by you
- Customize and improve communication content and your experience with GM
- Provide you with marketing offers that may interest you, including offers relevant to location of your vehicle or device
- Provide more useful and relevant advertising to you on our and non-GM websites about the products and services we offer
- Measure site activity, provide a better user experience, and tailor our marketing communications
- Evaluate our online advertising campaigns or tailor promotions and other marketing messages to you across your deviceso Administer your participation in contests, quizzes, surveys, promotions, and offers
- Enroll you in programs, services, or memberships with businesses that can assist with how you use your electric vehicle (such as energy utility companies and charge station operators)
- Prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; and preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action
- Evaluate or conduct a merger, divestiture, acquisition, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claims or collecting outstanding debts
- Where there is another applicable legal basis for data processing, especially provisions set out by applicable law.
Geolocation Information:
Data collected
- Can include information that is your geographic location, including the location of a vehicle or other device that is linked to you or can reasonably be linked to you. When location services are enabled in your vehicle, we collect Geolocation Information while the vehicle is used and upon the occurrence of certain events. Some model year 2019 and later vehicles may have an option to disable location services. If you disable location services, we collect Geolocation Information only in the event of an emergency (such as in the event of a crash or when the emergency call button is pressed). Consult your vehicle Owner’s Manual for more information. In addition, when you use Vehicle Mobile Apps, we may collect mobile device Geolocation Information, such as location and speed based on your device’s GPS sensors.
Legal Basis and Purposes of Use:
- When you have given your consent to the processing of your data for one or more specific purposes. Where our processing relies on your consent, you may withdraw consent at any time by contacting us (see also “How to contact us” below).
- When the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, including for the following purposes of use:
- To deliver our products and services where precise Geolocation Information is reasonably necessary or is otherwise compatible with your reasonable expectations (such as vehicle locate features in our Vehicle Mobile Apps)Provide information and product updates
- For operations, compliance, or warranty purposes
- When the processing is necessary for compliance with a legal obligation applicable to the GM data controller, including for the following purposes of use:
- To prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action
- Comply with legal, regulatory, or contractual requirements
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claims
- When the processing is necessary in order to protect your vital interests of you or of another natural person, including for the following purposes of use:
- As reasonably necessary to protect the safety, property, or rights of us, our customers, or members of the public
- When the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular if you are a child, such processing including for the following purposes of use:
- As reasonably necessary to protect the safety, property, or rights of us, our customers, or members of the public
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claimso For internal research or product development
- Prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; and preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action
- Where there is another applicable legal basis for data processing, especially provisions set out by applicable law.
Driver Behavior Information:
Data collected
- Can include information about how you drive a vehicle that is linked or reasonably linkable to you, such as vehicle speed, seat belt usage, and information about braking habits.
Legal Basis and Purposes of Use
- When you have given your consent to the processing of your data for one or more specific purposes. Where our processing relies on your consent, you may withdraw consent at any time by contacting us (see also “How to contact us” below).
- When the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, including for the following purposes of use:
- To deliver our products and services where Driver Behavior Information is reasonably necessary or otherwise compatible with your reasonable expectations Provide information and product updates
- For operations, compliance, or warranty purposes
- When the processing is necessary for compliance with a legal obligation applicable to the GM data controller, including for the following purposes of use:
- To prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; and preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action
- Comply with legal, regulatory, or contractual requirements
- When the processing is necessary in order to protect your vital interests of you or of another natural person, including for the following purposes of use:
- As reasonably necessary to protect the safety, property, or rights of us, our customers, or members of the public
- When the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular if you are a child, such processing including for the following purposes of use:
- As reasonably necessary to protect the safety, property, or rights of us, our customers, or members of the public
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claims
- For internal research or product development
- Prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; and preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action
- Where there is another applicable legal basis for data processing, especially provisions set out by applicable law.
Audio or Video Information:
Data collected
- Can include recordings of when you speak with our customer call centers or photographs and videos such as those that you may submit for contests, sweepstakes, and social sharing; that made be made at events or at our experience centers; or that may be made in the vehicle such as voice command details, and facility security camera footage.
Legal Basis and Purposes of Use
- When you have given your consent to the processing of your data for one or more specific purposes. Where our processing relies on your consent, you may withdraw consent at any time by contacting us (see also “How to contact us” below).
- When the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, including for the following purposes of use: o To deliver our products and services o For operations, compliance, or warranty purposes
- When the processing is necessary for compliance with a legal obligation applicable to the GM data controller, including for the following purposes of use:
- To prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action
- Comply with legal, regulatory, or contractual requirements
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claims
- When the processing is necessary in order to protect your vital interests of you or of another natural person, including for the following purposes of use:
- As reasonably necessary to protect the safety, property, or rights of us, our customers, or members of the public
- When the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular if you are a child, such processing including for the following purposes of use:
- As reasonably necessary to protect the safety, property, or rights of us, our customers, or members of the public, including facility security
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claims
- For internal research or product development
- Prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; and preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action
- Where there is another applicable legal basis for data processing, especially provisions set out by applicable law.
Vehicle Information:
Data collected
- Can include information about your vehicle or information that is obtained from your vehicle that is linked to you or can reasonably be linked to you. For example, we may be able to link information to you from your vehicle, including license plate number and vehicle identification number (VIN), model, production year, hardware and software information, or vehicle status, including mileage, oil/battery status, ignition, window, door/trunk lock status, vehicle diagnostic information, EV charging and discharging and stationary energy storage details, and information generated by the use of driver assistance systems, including state changes and timestamps.
Legal Basis and Purposes of Use
- When you have given your consent to the processing of your data for one or more specific purposes. Where our processing relies on your consent, you may withdraw consent at any time by contacting us (see also “How to contact us” below).
- When the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, including for the following purposes of use:
- Provide our products, programs, and services, such as to access your GM Account, save a vehicle configuration, use vehicle diagnostic tools, enable in-vehicle connectivity, enable entertainment or navigation, or, if you have an electric vehicle, to deliver charging programs
- Provide information and product updates
- Administer and validate warranties
- Provide customer and vehicle support and services (such as recall information)
- For operations, compliance, or warranty purposes
- Enroll you in programs, services, or memberships with businesses that can assist with how you use your electric vehicle (such as energy utility companies and charge station operators)
- When the processing is necessary for compliance with a legal obligation applicable to the GM data controller, including for the following purposes of use:
- Evaluate or improve the quality, safety, and security of our vehicles, products, and services
- Provide information and product updates
- Comply with legal, regulatory, or contractual requirements, including lawful orders from a criminal investigation body, foreign (non-EU) legal or regulatory requirements, report environmental or emissions performance, and support the 112-based eCall in-vehicle emergency call system
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claims or collecting outstanding debts
- Prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; and preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action
- When the processing is necessary in order to protect vital interests of you or of another natural person, including for the following purposes of use:
- Provide customer and vehicle support and services (such as recall information)
- Evaluate, monitor or improve the quality, safety, and security of our vehicles, products, and services
- Protect the safety of you or others
- Contact and inform you of potential concerns
- When the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular if you are a child, such processing including for the following purposes of use:
- Develop new products and services, including connected, autonomous, and car-sharing products and services
- Conduct internal research to develop, improve, or repair products, services, or technology
- Evaluate or improve the quality, safety, and security of our vehicles, products, and services
- Provide information and product updates
- Evaluate or conduct a merger, divestiture, acquisition, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claims or collecting outstanding debts
- Prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; and preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action
- Where there is another applicable legal basis for data processing, especially provisions set out by applicable law.
Payment Information:
Data collected
- Can include your payment information. We may collect payment information when you interact with our websites and shopping tools, get a GM account, or enroll in Connected Services.
Legal Basis and Purposes of Use
- When you have given your consent to the processing of your data for one or more specific purposes. Where our processing relies on your consent, you may withdraw consent at any time by contacting us (see also “How to contact us” below).
- When the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, including for the following purposes of use:
- Provide our products, programs, and services, such as to access your GM Account, save a vehicle configuration, use vehicle diagnostic tools, enable in-vehicle connectivity, enable entertainment or navigation, or, if you have an electric vehicle, to deliver charging programs
- Evaluate or improve the quality, safety, and security of our vehicles, products, and services
- Provide customer and vehicle support and services (such as recall information)
- Administer your account(s) and process your payments for products and services
- When the processing is necessary for compliance with a legal obligation applicable to the GM data controller, including for the following purposes of use:
- Evaluate or improve the quality, safety, and security of our vehicles, products, and services
- Comply with legal, regulatory, or contractual requirements, including lawful orders from a criminal investigation body, foreign (non-EU) legal or regulatory requirements, report environmental or emissions performance, and support 112-based eCall in-vehicle system
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claims or collecting outstanding debts
- Prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; and preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action
- When the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular if you are a child, such processing including for the following purposes of use:
- Administer your participation in contests, quizzes, surveys, promotions, and offers
- Conduct internal research to develop, improve, or repair products, services, or technology
- Verify eligibility for purchase or incentive programs including for GM’s compliance with export control laws and regulations of the United States (i.e. The Arms Export Control Act (22 U.S.C. 2778), International Traffic in Arms Regulations (22 C.F.R. Parts 120-130), Export Control Reform Act of 2018 (50 U.S.C. 4801 et seq.), and the Export Administration Regulations (15 C.F.R. Parts 730-774)) and other relevant jurisdictions which restrict sharing certain technologies with certain countries and their nationals. These laws may apply regardless of where in the world (or by whom) such transfer takes place
- Evaluate or conduct a merger, divestiture, acquisition, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claims or collecting outstanding debts
- Prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; and preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action
- Where there is another applicable legal basis for data processing, especially provisions set out by applicable law.
Cookies & Tracking Technologies
GM may use tracking technologies, such as cookies and pixel tags, on our websites, applications, email messages and advertisements, sometimes across devices, to gather information about your visit, such as your activity in our Vehicle Mobile Apps, browser type, IP address, pages visited, activities conducted on the page, and the day and time of your visit.
The tracking technologies we place in our emails help measure the effectiveness of our email campaigns by identifying the individuals who open or act upon an email message, when an email message is opened, how many times an email message is forwarded, the type of software, device, operating system and browser used to deliver the email, and any URL accessed through our email message.
We use and disclose the information collected by these tracking technologies, in some cases together with other information that we collect online and offline about you, for the purposes described in this Privacy Statement, including to help us reach you on third-party advertising networks. The third-party advertising networks and other businesses who operate some of these tracking technologies may also compile information about you that is used to personalize ads delivered to you on third-party websites.
Details for how we use cookies and tracking technologies as well as any choices you may have to consent to loading cookies are described in our Cookie Policy.
Event Data Recorder (EDR) Information
Some of our vehicles may be fitted with EDR systems that capture details in the event of an accident. GM does not collect Personal Data from your vehicle’s EDR system without your consent. For additional information about EDR data, please see your owner’s manual.
III. Disclosing of Personal Data
We may disclose Personal Data within GM, including to GM affiliates. We also may disclose Personal Data to the following categories of third parties and for the following purposes:
- To GM Business Partners and their service providers to deliver their products and services to you and to GM licensees;
- To our service providers who work on our behalf and who do not have an independent right to use the Personal Data, such as companies that administer our contests and promotions, host or operate our websites, send communications, perform data analytics; or process, store, or manage credit card information
- To fleet owners, dealers or rental car companies, for service or maintenance of their vehicles that you may use
- To companies with which GM enters into business or marketing arrangements, such as third-party advertising networks
- To wireless or mobile telecommunications service providers, to deliver cellular or Wi-Fi connectivity to your vehicle (e.g. Cubic)
- To third parties where you have chosen to receive a service from them or authorized them to request data from GM (for example, financial organizations who offer financing for the purchase or lease of GM vehicles, or mobility service providers such as car rental companies)
- With emergency service providers, such as law enforcement, roadside assistance providers, and ambulance providers, to protect your safety or the safety of others, and to deliver related services (for example, 112-based eCall services).
- To third parties for research and development purposes (such as university research institutes for improving highway safety)
- In connection with the sale, transfer or financing of a GM business or its assets, including any such activities associated with a bankruptcy proceeding
- In Sweden, to If Skadeförsäkring AB to document GM’s insurance coverage for its manufacturer’s warranty and to Transportstyrelsen for its public register, for statistical purposes and for transmission to If Skadeförsäkring AB to verify GM’s insurance coverage by IF Insurance AB;
- As required or permitted by law, such as to comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities
- As permitted by law, such as (a) when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, (b) to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or other illegal activity, or preserve the integrity or security of systems, (c) to investigate, establish, exercise, prepare for, or defend legal claims, or (d) to conduct screening to ensure you are not on any government list of restricted parties
Apart from the purposes listed above, GM will not share personal data about you or your vehicle with other third parties for their independent use without your prior consent.
IV. How we use and disclose connected vehicle Personal Data
When you enroll in and use Connected Services, GM may use and disclose Driver Behavior Information and precise Geolocation Information for the limited purposes outlined below..
Driver Behavior Information
We use Driver Behavior Information for the following categories of limited purposes:
- To deliver our products and services where Driver Behavior Information is reasonably necessary or otherwise compatible with your reasonable expectations
- As reasonably necessary to protect the safety, property, or rights of us, our customers, or members of the public
- For operations, compliance, or warranty purposes
- For internal research or product development
- To prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; and preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action• Comply with legal, regulatory, or contractual requirements
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claims
We may disclose Driver Behavior Information collected from connected vehicles to our affiliates and categories of third parties for the following limited purposes:
- Where you have chosen to receive a product or service from a third party or affiliate or have authorized them to request data from GM
- Service providers who work on our behalf and who do not have an independent right to use the Driver Behavior Information, such as companies that help us develop our products and services or perform data analytics
- As permitted by law, such as (a) when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, (b) to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or other illegal activity, or preserve the integrity or security of systems, or (c) to investigate, establish, exercise, prepare for, or defend legal claims
- As reasonably necessary to comply with a lawful government request, regulatory requirement, legal order, or similar obligation, which must be in the form of a warrant or court order, absent exigent circumstances or applicable statutory authority
Precise Geolocation Information
We use precise Geolocation Information for the following categories of limited purposes:
- To deliver our products and services where precise Geolocation Information is reasonably necessary (such as for driver assistance systems) or is otherwise compatible with your reasonable expectations (such as vehicle locate features in our Vehicle Mobile Apps)
- As reasonably necessary to protect the safety, property, or rights of us, our customers, or members of the public
- For operations, compliance, or warranty purposes
- For internal research or product development
- To prevent, detect, protect against, or respond to security incidents, identity theft, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action
- Comply with legal, regulatory, or contractual requirements
- Protect our rights, such as investigating, establishing, exercising, preparing for, or defending legal claims
We may disclose precise Geolocation Information collected from connected vehicles to our affiliates and the following categories of third parties for the following limited purposes:
- Where you have chosen to receive a product or service from a third party or affiliate or have authorized them to request data from GM
- Service providers who work on our behalf and who do not have an independent right to use the precise Geolocation Information, such as companies that help us develop our products and services or companies that help GM analyze data
- Fleet owners, dealers, or rental car companies, for service or maintenance of their vehicles that you may use
- Affiliates or third parties for research and development purposes (such as university research institutes for improving road safety)
- As permitted by law, such as (a) when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, (b) to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or other illegal activity, or preserve the integrity or security of systems, or (c) to investigate, establish, exercise, prepare for, or defend legal claims
- As reasonably necessary to comply with a lawful government request, regulatory requirement, legal order, or similar obligation, which must be in the form of a warrant or court order, absent exigent circumstances or applicable statutory authority
V. Sharing or transferring your connected vehicle
The nature of our connected vehicles means that there may be circumstances where you might let someone else use a product or service that we provide to you (for example, you enrolled your vehicle in Connected Services and then let someone else drive the vehicle). It is important that if you do let someone else use one of our products or services that you inform them of this Privacy Statement and of the privacy choices that you have made.
If you sell or otherwise transfer your vehicle, we strongly encourage you to delete all Personal Data (such as contacts, address searches, saved map addresses, or preferences) from the vehicle and contact us to transfer or cancel your account. If you do not delete this Personal Data, it may remain in the vehicle and may be accessible to future users of the vehicle. For instructions on how to delete Personal Data from your vehicle, please refer to your owner’s manual.
VI. Your rights
If you are a resident of the European Union (including the countries of the European Economic Area), Switzerland, or the United Kingdom, you may have the following rights in respect of your personal data, as described in the data protection laws applicable to your jurisdiction:
- Request from us access to your personal data
- Request from us rectification or completion of your incorrect or incomplete personal data
- Request from us erasure of your personal data
- Request from us temporary restriction of processing
- Right to data portability
- Right to object: You have the right to object the processing of personal data concerning you under the conditions specified in applicable data protection laws. Note that if you do this, it may impact our ability to provide certain products and services to you.
- Right to withdraw consent: If processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. If you withdraw your consent at any time, this does not affect the lawfulness of the processing of your personal data prior to the withdrawal of your consent. Note that if you do this, it may impact our ability to provide certain products and services to you.
- Right to lodge a complaint: You can lodge a complaint under applicable data protection laws with the competent data protection supervisory authority.
- Right to object to automated decision-making, including profiling: You can request to not be subject to individual automated decision-making, including profiling; to obtain human intervention, to express your point of view; and to contest the decision where our processing produces a legal effect or similarly significantly affects you, except where the processing is necessary for entering into, or the performance of, a contract between you and us, is based on explicit consent, or is based on another exception under applicable law. You have the right to withdraw your consent to individual automated decision-making, including profiling, at any time.
For your protection, we take reasonable steps to verify all requests before they are processed. This may include, for example, a request from us for you to confirm your identity, to validate documents you submit to us, to verify your authority to make the request, or for other purposes. In all cases, we reserve the right to deny your request in accordance with applicable law if we cannot verify you or your authority to make the request. Some collection and sharing practices are necessary to provide products and services we offer or to support mandated features such as eCall. To stop processing of some data, with the exception of eCall, you may have to decline those products and services or be willing to accept limited functionality. Where we rely on your consent as the legal basis for processing your personal data, you may withdraw your consent at any time. If you have any questions or if you want to exercise your rights, see “How to contact us” below.
Processing expectations
You may exercise your right by contacting us in writing (refer to the “How to contact us” section below).
We do not discriminate against consumers who exercise these rights. We take reasonable steps to respond to all requests and will process them in accordance with the applicable laws where you reside. While our response time may vary, we typically aim to respond within 30 days. However, in some cases, we may require up to 45 days to fully process your request. We may retain the Personal Data you provide with your request for as long as necessary or permitted by applicable law.
If we do not grant you access to your Personal Data, we will tell you why. If you request corrections to your Personal Data and we do not agree to your request for correction, we will notify you of the reasons we do not agree and upon your request will note your request on the records we hold about you.
Authorizing an agent
You may be permitted by law to authorize someone else to act as your agent to exercise some of your privacy rights on your behalf. In such cases, your authorized agent must provide documentation supporting his or her authority to make this request on your behalf. In some cases, we may also require you to verify your identity directly with us and confirm the request before we will process it.
Verifying your request
For your protection, we take reasonable steps to verify all requests before they are processed. This may include, for example, a request from us for you to confirm your identity, to validate documents you submit to us, to verify your authority to make the request, or for other purposes. In all cases, we reserve the right to deny your request in accordance with applicable law if we cannot verify you or your authority to make the request.
VII. How we safeguard Personal Data
We maintain reasonable technical, administrative, and physical security and confidentiality measures designed to help protect Personal Data from unauthorized access or use. We also require (other than in certain emergency situations) third party service providers acting on our behalf or with whom we disclose Personal Data to provide similar security and confidentiality measures. Learn more about cybersecurity at GM by visiting https://gm.com/cybersecurity.
VIII. How long we keep Personal Data
We may keep the Personal Data we collect for as long as necessary for the purposes described in this Privacy Statement or as required by law to retain the Personal Data. Where required by law, we will de-identify or securely dispose of the Personal Data we collect when we no longer need it for the uses described in this Privacy Statement or required by law to retain the Personal Data. We are required to maintain data to comply with taxation or other applicable laws or if we need your personal data to establish, exercise or defend a legal claim. To the extent possible, we will restrict the processing of your personal data for the limited purposes that require its retention.
IX. Children’s privacy
GM websites and other online services operated by GM do not target or knowingly collect any Personal Data from children under the age of 15.
X. International transfers of Personal Data
GM stores your data in the United States, the European Union (including the countries of the European Economic Area (EEA)), Switzerland, and other locations where GM, our brands or our service providers operate worldwide. With respect to such transfers from the EEA, Switzerland or the United Kingdom to the United States, and to other non-EEA jurisdictions which are not deemed to have adequacy under applicable data protection laws, we implement standard contractual clauses and other mechanisms, such as supplementary measures, to provide adequate protection for the transfer of this personal data. General Motors Holdings, LLC (GMH) acts as a data processor for its GM controlled subsidiaries, including the data controllers listed below, by providing data hosting, maintenance, support, and troubleshooting of services, as well as other redundant back office support.
In addition, anonymized and aggregated data is shared with GMH to evaluate or research the safety, quality, usage, and functionality of vehicles and services, including providing customers with vehicle support and services, and to ensure accurate customer records and maintain customer relationships.
XI. Data Controller
The data controller for your personal data is the General Motors entity that you hold a relationship with or who offers products or services to you based on your country. The table below describes the data controllers covered under this Privacy Statement in association with the countries or regions that each processes personal data in. When you are dealing with one of these GM companies for the country covered, that GM company is the Data Controller for your personal data. If you are in a country that is not listed below, the data controller is Cadillac Europe GmbH.
In some instances, your vehicle may be equipped with features for which you are the Data Controller, such as performance data monitors or other technologies. For those features, you are responsible to ensure compliance with applicable laws and regulations, including, but not limited to data protection laws and road traffic and security laws. You should comply with any notice and consent requirements before collecting personal data and notify other drivers of your vehicle about these features and their obligations under applicable laws and require them to comply.
XII. How to contact us
GM has appointed a Data Protection Officer (DPO) for Europe pursuant to applicable data protection laws. With respect to any questions regarding the protection of your personal data or your rights under applicable data protection laws, our DPO can be contacted at privacy.europe@gm.com. Our DPO can also be reached at the following address: FAO General Motors Europe DPO, Albisriederstrasse 253, 8047 Zurich, Switzerland.
XIII. Changes to this Privacy Statement
We may amend this Privacy Statement from time to time. In some cases, we will notify you of this change by posting a new effective date at the top of this Privacy Statement and your continued use of our products and services covered by this Privacy Statement will mean you accept the changes. When there is a material change to this Privacy Statement, then we will notify you as required by law, such as by email or through a notice on the applicable website.
