CUPRA Privacy policy
“For CUPRA, privacy matter is part of our core business. We design and make cars and mobility products that process big data to make your life enjoyable, making it possible to enjoy CUPRA experience at the highest level. We give you control at any time over your information and data, so that you, and only you, decide what to share, when to share, and who you share with. It’s a big value still our essence”.
This Privacy Policy describes how CUPRA processes your personal data in the context of www.cupraofficial.com and the utilisation and applications offered therein, as well as with respect to other data processing that may be carried out by CUPRA in its interaction or relationship with you. Separate data protection or privacy notices may apply to other websites, Apps, products, and services of CUPRA.
We inform you that when you purchase a CUPRA brand vehicle at a dealership or you go to the after-sales official services, each of these entities, as independent entities, will be responsible for the processing of the personal data that you provide to them. Additionally, CUPRA will be responsible, as the manufacturer and guarantor of the vehicle purchased for the purposes derived from the warranty and responsibilities of the vehicle, or for those products and/or services that it supplies to you directly.
Who is the data controller of your personal data?
Identity: | SEAT, S.A., with TAX ID A-28 049 161, (hereinafter, ‘CUPRA’) |
Address: | Autovía A-2, Km. 585, Martorell, Barcelona (Spain) |
Contact: | customercare@cupraofficial.com |
What types of data do we process?
Within the functionalities, products and services offered by CUPRA, and subject to the purposes set out in this Policy, at CUPRA we process the following categories of personal data, without limitation:
- Your identification data and your contact details.
- Your data related to your navigation on the web.
- Identification data of your vehicle.
- Data derived from your identity and digital account; in case you have created one.
How do we use your personal data and what is the lawful basis for processing them?
At CUPRA we process the personal data you provide us with, as well as those that derive from your relationship with us, for the following purposes set out below:
Web forms and general processing’s | ||
Purpose | Legal Basis | Description
|
Contact form | Legitimate interest | Manage your request and contact you to fulfil your specific request/enquiry/claim. Identification data (name, surname, gender), contact details (e-mail, postal address) and identification data of your vehicle (VIN) are processed. The legal basis for the processing of your personal data through these forms is the legitimate interest considering that your interests as the person affected are not harmed, due to CUPRA is giving response to your queries and doubts. |
Whistle-blower System | Compliance with a legal obligation | Handling your complaints that you have filed through the Whistleblowing channel and the e-mail address: transparencia@seat.es. Contact details data (e-mail, telephone number, postal address) are processed. Data processing is covered under the CUPRA’s compliance with a legal obligation (Art. 6.1.c of the GDPR), in accordance with the provisions of the Law 2/2023 of 20th February, regulator for the protection of people who report on regulatory violations and the fight against corruption. CUPRA will keep your personal data for the time strictly necessary to decide on the appropriateness of initiating an investigation into the alleged facts and once decided, they will be duly blocked-in order to comply with the corresponding legal obligations in each case. In any case, your personal data will be deleted within a maximum period of three months from their introduction in the complaints channel, even though they can be kept anonymised in order to certify the functioning of CUPRA's crime prevention model. |
Cybersecurity vulnerability attempts | Legitimate interest | You can use this e-mail address: vulnerability@seat.es, to notify us regarding cybersecurity vulnerabilities/incidents or hacking. The aim of the data processing is to manage your request and alerts regarding safety and cybersecurity activities of our products through the cybersecurity channel of the website. Your contact details (e-mail) are processed. The legal basis for the processing of your personal data is the legitimate interest considering that your interests as the person affected are not harmed, because we are ensuring product safety, security, and quality. |
Vehicle’s manufacturer obligations | Compliance with a legal obligation | CUPRA, as the vehicle's authorised manufacturer, might receive your data from the Authorised Servicer Partner and the Importer of your country, in order comply with legal obligations and responsibilities derived from your vehicle commercialization and guarantees. Data processing is covered under the CUPRA’s compliance with a legal obligation (Art. 6.1.c of the GDPR), as the vehicle's manufacturer. |
Market Research & Digital services | |||
Purpose | Legal Basis | Description | Type of data |
Surveys and market research | Legitimate interest | In the context of market research or surveys, CUPRA might receive your data from other sources such as the importer in your country and might process your data based on our legitimate interests as brand vehicle’s manufacturer. The information obtained by these kinds of studies will be used by an aggregated way to product improvement and optimization of our sales processes. Please, read the data protection information included in the market research study before participating or follow the right’s instruction in case you want to object it. | |
Connectivity services and Apps
| Execution of a contract, compliance with a legal obligation or Legitimate Interest. | CUPRA will process your identification and contact data, as well as other data related to your vehicle or the use of your device to offer you digital connectivity services through the App or your vehicle. Before accessing the service, the applicable Privacy Policy of the App and the connected services of the vehicle is made available to the user. If you want to know more about how CUPRA will process your data through connectivity services and apps, please read the specific privacy policy for each service, product, or app. | |
Customer Interaction Center | ||
Purpose | Legal Basis | Description |
Processing of Requests and Customer Care | Legitimate Interest | CUPRA will process the personal data required to deal with your request and for the purpose of Customer Care (identification data). CUPRA may also process additional data to deal with individual requests, such as contract data, vehicle usage data, service data, hardware and software data or payment data. |
Satisfaction surveys to get your feedback. | Legitimate Interest | CUPRA will process your data when you take part in a satisfaction survey on our offered service and attention of our customer care. |
Analysing of requests and satisfaction surveys. | Legitimate Interest | When you contact us with requests on our digital services or apps, we pseudonymise and analyse the requests captured by us in writing by the agent for the purpose of improving Customer Care and our products and services. |
Recording and analysing of requests by telephone and satisfaction surveys | Consent | Assist when you contact us with questions on our digital services and apps or take part in satisfaction surveys over the phone. We record the calls for quality assurance for our Customer Care and improving our Customer Care services. |
How long will we keep your data?
CUPRA will process your personal data for the time necessary to fulfil the purpose for which it was collected, and in any case, in general, for a maximum period of 10 years for the purposes based on your consent, as well as for those from which legal liabilities may arise in relation to the vehicle or other product or service sold.
Specifically, for personal data that you have provided only as an interested party in a CUPRA vehicle, as a participant in an event, survey or study of the brand or through the contact forms and Call Center, a maximum retention period of 3 years will apply.
As soon as the above purposes are extinguished, your personal data will be blocked, as a general rule, for a period of 3 years. After this period, your personal data will be permanently deleted.
Which recipients will the data be disclosed to?
CUPRA will disclose your personal data to other third parties when such disclosure is laid down by law. On the other hand, we want to inform you that CUPRA will give access to data to Volkswagen Group companies and other third parties acting them as data processors for the purpose of offering our product and services (e.g., CUPRA CONNECT, CUPRA ID). Likewise, in order to provide you with the services described above, we require the support of service providers. These third parties may have access to your data and will act in our name and on our behalf, following our instructions, and in no case will they have access to your data for their own purposes.
In certain cases, CUPRA, as the approved manufacturer of the vehicle, will be also obliged, at the request of the competent authorities, to process and communicate certain data stored in the vehicle related to the vehicle owner. Some of these obligations may derive from the investigation of crimes, traffic accidents, control of second-hand sales, etc. In this way, data on the operation, use, control, condition, and technical data of the vehicle associated with its VIN may be communicated, such as, for example: mileage, speed, acceleration, navigation control, seat belt condition, environmental conditions, battery condition, liquids, and pressures, etc. The processing and communication of data to the Authorities is covered in compliance with a legal obligation (Art. 6. 1 c) General Data Protection Regulation) of CUPRA, as manufacturer of the vehicle.
Additionally, CUPRA will disclose your personal data to your Importer or Service Partner of your country for fulfil with your request on the “Contact Us Form with the purpose of contacting you and answer your requests. If your Importer or Service Partner is located outside the EU, this might involve a necessary international transfer of your data. CUPRA may also disclose some identification data to the importer in your country for internal administrative purposes such as assigning bonuses to the dealer network or to ensure the proper handling of the customer in the individual countries.
Additionally, we may disclose your data to the Importer of your country with market research and, only in case you have previously consented, for marketing purposes. This will allow the Importer to send you information about its products and services offered. If you want to exercise your rights in relation to this disclosure, you must lead to the Importer since he is considered the data controller.
In relation to the whistle-blower system, your personal data will only be accessed by third parties to whom CUPRA is legally or contractually obliged to provide it, as well as by companies in the legal sector and the Volkswagen Group to whom CUPRA has entrusted the provision of consultancy and advisory services in connection with the management of the channel, on behalf of CUPRA, to the extent necessary for the provision of those services. In those cases, in which it is strictly necessary, disclosure may be made to third parties such as State Security Forces and Corps, Judges and/or Courts, when it is necessary for the correct investigation of the reported facts and/or for the adoption of disciplinary measures or for the processing of the legal proceedings that, where appropriate, may be necessary.
We are assisted in processing your requests, providing Customer Care and advertising by Teleperformance Group Europe, Middle East and Africa SAS (France) and Salesforce.com EMEA Limited (United Kingdom) as processors with a cloud operated within the European Union.
When processing your requests and for the purposes of Customer Care and analysing your data for the purposes of quality assurance and improving Customer Care and our products and services, we are assisted by Amazon Web Services EMEA SARL (Ireland) as a data processor with the cloud operated within the European Union. Recordings for the purposes of improving Customer Care are transcribed using the transcription software ‘Amazon Transcribe’.
Are your personal data be sent outside the EU?
In general, your data will be processed within the European Economic Area. However, some of our suppliers may process your data outside the European Economic Area, such as, for example, Salesforce.com, Inc. which provides our virtual infrastructure on a "cloud computing" model. This entity is stablished in the United States of America. CUPRA regulates in accordance with the applicable regulations the relationship with these suppliers in order to ensure and maintain the adequate level of protection in accordance with European standards so that, in the event that the country receiving the data is not considered adequate level, it will regulate the relationship with the third-party recipient through the corresponding Standard Contractual Clauses adapted by the European Commission whose content can be consulted in European Commission official website and also in this link.
What are your rights?
Right | Content |
Access | You can obtain from CUPRA confirmation as to whether your personal data are being processed and access to your personal data. |
Rectification | You can obtain the rectification of inaccurate personal data concerning you. You also have the right to have incomplete personal data completed. |
Erasure | You may request the deletion of your personal that when, among other reasons, the data is no longer necessary for the purpose that were collected. |
Objection | You can object to the processing of your personal data. CUPRA will no longer process your personal data unless it has compelling legitimate grounds for the processing or for the establishment, exercise or defence of legal claims. |
Restriction of the processing | You can request the restriction of the processing of your personal data where one of the following grounds applies:
|
Portability | You can receive, in electronic format, the personal data that you have given us and those that have been obtained from your contractual relationship with CUPRA, as well as to transmit them to another entity. |
How can you exercise your rights?
You can exercise these rights by sending an email to customercare@cupraofficial.com. In the event of reasonable doubt as to your identity, you may be asked for any additional information necessary to confirm your identity. In case of services that you have log in through CUPRA ID, you can also manage your data and privacy settings through your CUPRA ID account at https://cupraid.vwgroup.io/.
The exercise of these rights is free of charge unless of manifestly unfounded or excessive requests.
If you wish to assert your data protection rights before the Entity’s Importer or their Dealer and Service Partner networks, please contact them directly.
Finally, if you consider that CUPRA has not processed your personal data in accordance with the applicable regulations, you can lodge a complaint with the relevant supervisory authority.
DPO Contact:
If you have any doubts about data protection or wish to get in touch with our data protection officer (“DPO”), you can also contact him by sending an email to dataprotection@seat.es