Subaru

We ding this product because it sells personal information unless you opt out. Also because they collect data from third parties, including data brokers, to combine with data they have on you.

Subaru Privacy Policies

"This Privacy Policy applies to each user of the Services, including any “Vehicle Occupant,” which includes each driver or passenger in a Subaru vehicle that uses Connected Vehicle Services, such as Subaru Starlink (such vehicle, a “Connected Vehicle”), whether or not such driver or passenger is the vehicle owner or a registered user of the Connected Vehicle Services. For the avoidance of doubt, for purposes of this Privacy Policy, “using” the Services includes being a Vehicle Occupant in a Connected Vehicle."

"By disclosing your Personal Information to us, registering or enrolling in certain Services, or otherwise using our Services, or interacting with us offline, you consent to our collection, use, and disclosure of your Personal Information as described in this Privacy Policy."

"Additionally, we Sell Personal Information, subject to your right to opt-out of those Sales. We also Share Personal Information for Cross-context Behavioral Advertising, subject to your right to opt-out of such processing."

"Subaru discloses the following categories ..."
Identifiers;
Other Personal Information subject to certain laws;
Commercial information;
Internet or other similar network activity;
Geolocation data;
Inferences drawn from other Personal Information;
Recordings; and
Payment information."

"We may use, Sell, Share, or disclose the Sensitive Personal Information we collect for one or more of the following “Business Purposes:”
Assist us in providing, maintaining, and protecting the Services;
Set up, maintain, and protect accounts to use the Services;
Analyze and improve our products, Services, and operations, including the security of our products, Services and operations, and develop new products and Services;
Process transactions and other requests for products and Services;
Provide customer service;
Respond to customer inquiries;
Communicate with you, such as provide you with Subaru-related communications, newsletters, and/or other communications relating to our products and Services, including vehicle maintenance notices;
Send or display Subaru and third party offers and other content that is customized to your interests or preferences;
Conduct events, sweepstakes, promotions, and contests, which may be subject to applicable rules;
Investigate and address breaches of security or breaches of our terms of service or other agreements with customers;
Detect and prevent criminal activity and other actual or threatened harm to Subaru or third parties;
Comply with legal and regulatory requirements, including product recalls;
Manage and maintain the systems that provide the Services; and
For any other purpose described to you when we collect your Sensitive Personal Information."

"We collect and use Personal Information and Non-Personal Information for business and commercial purposes in accordance with the practices described in this Privacy Policy, including, but not limited to, in the last 12 months, to do the following: ...
Send or display Subaru and third party offers and other content that is customized to your interests or preferences ... "

"Subaru discloses Personal Information to the following categories of third parties:
Service Providers, emergency contacts, Affiliates, Distributors, API Providers, Data Providers, Retailers, Retailer Service Providers, Marketing Partners, Third Party Marketers, and governmental regulators having jurisdiction for our products or services as required to comply with the law. "

"“Data Provider” means a third party provider of data aggregation products and services. We may disclose Personal Information and Non-Personal Information to API Providers and Data Providers and, in some cases, API Providers and Data Providers may use Personal Information and Non-Personal Information for their own benefit. In such cases, their privacy policies will apply to their use of such Information."

"Third Party Marketing
We share your Personal Information with third parties (each, a “Third Party Marketer”) for their own marketing purposes from time to time. For example, we may provide Personal Information to Service Providers to permit them to market services to you for your vehicle (such as for WiFi hotspot or satellite radio services, or insurance or financial products). You may opt out of this sharing by contacting us."

"As Required by Law and Other Extraordinary Disclosures
Subaru may be required to disclose your Personal Information, including location data, if it: (i) believes it is reasonably necessary to comply with legal process (such as a court order, subpoena, search warrant, etc.) or other legal or regulatory requirements or requests of any governmental authority, (ii) would potentially mitigate our liability in an actual or potential lawsuit or investigation, (iii) is necessary to protect our rights or property or enforce our contracts, (iv) is necessary to protect the legal rights, safety or property of others, (v) will prevent, solve or prosecute a crime, or protect national security, or (vi) detect, prevent or otherwise address fraud, security or technical issues."

"HOW WE COLLECT INFORMATION
Data Services Companies
We collect Personal Information and Non-Personal Information from third parties, such as lead generation companies, API Providers (as defined below) or Data Providers (as defined below), who provide data products to us (collectively, “Data Services Companies”)."

"App and Location Technologies
You can stop all collection of Information via an app by uninstalling the app. You can also reset your device at any time through your device settings, which may allow you to limit the use of Information collected about you. You can stop all collection of precise location data through an app by uninstalling the app or withdrawing your consent through your device settings."

"Transmission of data over the Internet is not 100% secure. Consequently, we cannot ensure or warrant the security of any Personal Information you transmit to us, and you do so at your own risk. Once we receive your transmission, we make reasonable efforts to ensure security on our systems. Subaru uses secure server software and firewalls designed to protect your Personal Information from unauthorized access, disclosure, alteration, or destruction. However, please note that this is not a guarantee that such Personal Information may not be accessed, disclosed, altered, or destroyed by breach of such firewalls and secure server software.

In providing Subaru Starlink to you, your voice and data are transmitted between our response centers and your vehicle over a cellular telephone network. This network is complex and not necessarily secure. The privacy and security of conversations or data transmitted to and from the vehicle cannot be guaranteed."

"We may modify or update this Privacy Policy periodically with or without prior notice by posting the updated policy on this page. You can always check the “Last Updated” date at the top of this document to see when the Privacy Policy was last changed. If we make any material changes to this Privacy Policy, we will notify you by reasonable means, which may be by e-mail or posting a notice of the changes on our website or through the relevant Service’s mobile app prior to the changes becoming effective. We encourage you to check this Privacy Policy from time to time. IF YOU DO NOT AGREE TO CHANGES TO THIS PRIVACY POLICY, YOU MUST STOP USING THE SERVICES AFTER THE EFFECTIVE DATE OF SUCH CHANGES (WHICH IS THE “LAST UPDATED” DATE OF THIS PRIVACY POLICY)."

EU Privacy Statement

"We shall only disclose your personal data to third parties in accordance with the applicable legal framework.

In connection with the purposes described above in section 3, we may need to share your personal data with the following recipients:
• Service providers: Subaru sometimes uses third parties, such as marketing companies or IT service providers, to perform tasks on its behalf and may need to share your personal data with them to provide the services described above. Any processing of that personal data will be on our instructions and in line with the original purposes.
• Authorized distributors or dealers: your personal data might be shared with your nearest Subaru authorized distributor or dealer to establish a quick and more flexible connection to fulfil your request.
• Legal obligations: as required by law, Subaru may disclose your personal data to law enforcement officials, in order to comply with legal requirements, court orders, government or law enforcement agency requests, including to meet national security or law enforcement requirements, and including to agencies and courts in the countries where we operate. Where permitted by law, we may also disclose such information to third parties (including legal counsel) when necessary for the establishment, exercise or defense of legal claims or to otherwise enforce our rights, protect our property or the rights, property or safety of others, or as needed to support external audit, compliance and corporate governance functions.

With regard to data protection, an agreement has been concluded with all these service providers to ensure that they manage your personal data securely, with respect and with due care and diligence."

We can not confirm if all users, regardless of location, can get their data be deleted.

"We retain each category of your Personal Information for no longer than is reasonably necessary for one or more Business Purposes, subject to your right to request we delete your Personal Information. Due to the nature of the Services, it is not possible to predict the length of time that we will retain Personal Information. Instead, we use the following criteria to determine whether it remains reasonably necessary to retain your Personal Information for one or more disclosed Business Purpose(s): (i) whether there is a retention period required by statute or regulations; (ii) the existence of actual or threatened litigation for which we are required to preserve the information; (iii) the statutes of limitations for potential legal claims; and (iv) generally accepted best practices in our industry. When we determine that it is no longer reasonably necessary to retain your Personal Information for one or more disclosed Business Purposes based on the above criteria, we will delete your Personal Information."

The right to delete information is mentioned for California residents:
"You have the right to request that we delete any of your Personal Information that we collected from you and retained. Be aware, however, that certain exceptions apply to the right to delete Personal Information. We may deny your deletion request if retaining your Personal Information is necessary for us or our Service Providers to:
- complete a transaction for which we collected your Personal Information, provide goods or Services that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
- help ensure security and integrity, including to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
- debug Services, products and websites to identify and repair errors that impair existing intended functionality;
- exercise free speech, ensure the right of another consumer to exercise their right of free speech, or exercise another right provided for by law;
- comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.);
- engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the achievement of such research, if you previously provided informed consent;
- enable solely internal uses that are reasonably aligned with the expectations of consumers; or
- comply with a legal obligation, including in connection with product recalls."

The rights are also mentioned for residents covered by GDPR:
"You have at any time the right to object to the use of your personal data for the purposes mentioned in article 2. Besides, you can make use of the following rights:

the right to access your personal data;
• the right to rectification of your personal data;
• the right to erasure of your personal data;
• the right to restriction of processing of your personal data;
• the right to object to the processing of your personal data:
• the right to data portability of your personal data;
• the right to open a claim at the privacy commission;
• the right to withdraw any previously given consent. "