OnStar privacy statement

We may collect information about you when you access or use the Connected Services and otherwise with your consent. We may also collect your information from automotive dealers, licensees, service providers, other independent third party sources, and companies we do business with. The types of information that we may collect include:

• Information about you and your accounts with us: such as your name, postal address, telephone number, date of birth, e-mail address, screen name, account ID, customer number, login information, demographic data or protected classification information, gender, password, PIN, emergency contact information, information about the acquisition and financing of your vehicle, recordings of when you speak with our customer call centers, biometric information such as voiceprints as described in the Biometric Technology Section below, whether or not you have financed or leased your vehicle, the lease/financing term, and billing information, your credit card number, CVV code and expiration date. We may also collect information related to My Rewards and the My GM Rewards Card Program (“GM Card”) including rewards points, account type, tier status, enrollment, and redemption. In limited circumstances, we may collect a Social Security Number, for example if you win a sweepstakes or receive compensation that must be reported for government tax purposes
• Information about your vehicle: such as license plate number, vehicle identification number (VIN), mileage, vehicle status (such as oil/battery status, ignition, window, and door/trunk lock status), fuel or charging/discharging history, electrical system function, gear status, battery diagnostic and health, and diagnostic trouble codes.
• Information about the use of your vehicle, including operational and safety related information: such as geolocation, route history, driving schedule, speed, air bag deployments, crash avoidance alerts, impact data, safety system status, braking and swerving/cornering events, event data recorder (EDR) data, seat belt settings, vehicle direction (heading), audio or video information such as information collected from camera images and sensor data, voice command information, stability control or anti-lock events, security/theft alerts, and infotainment (including radio and rear-seat infotainment) system and WiFi data usage.
• Information about your devices and how you interact with our Connected Services: such as IP address, browser type, unique device identifier, cookie data, energy usage (such as your charging and discharging of electric vehicles and stationary storage), associated identifying and usage information from your mobile phone, laptop, or other device.

We may use your information in order to:

• provide our products, programs, and services
• improve the quality, safety, and security of our Connected Services
• develop new Connected Services, including autonomous vehicle and car-sharing Connected Services
• maintain customer relationships and communicate with you
• administer your account(s) and process your payments for Connected Services
• operate our websites and applications, including online registration processes
• provide customer and vehicle support and service (for example, recall information and maintenance or warranty servicing)
• for warranty administration and validation
• provide product and service updates
• evaluate the quality, safety, and security of our Connected Services
• collect outstanding debts for Connected Services
• for research, evaluation of use, and troubleshooting purposes
• protect the safety of you or others
• verify eligibility for vehicle purchase and incentive programs
• verify eligibility for GM Card and provide GM Card account management services
• perform marketing, including interest-based marketing and advertising across your devices (with necessary consents)
• administer your participation in contests, quizzes, surveys, promotions and offers
• customize and improve communication content and your experience with GM
• comply with legal, regulatory or contractual requirements
• protect our rights, or to detect, investigate, and prevent fraud or other illegal activity

We may de-identify your information in a way that it can't reasonably be associated with you or your vehicle,
and maintain and use such de-identified information or share it with third parties for any legitimate business purpose. When we maintain or use information that has been de-identified, we take reasonable steps to ensure that such information is maintained and used only in de-identified form, and will not attempt to re-identify such information unless required or permitted by law.

Communications with you in connection with these uses may be via mail, telephone, e-mail, text message and other electronic messages, through the in-vehicle infotainment or Connected Services system or via our websites and applications. Texting with GM is subject to the GM Consolidated Texting Policy (“Texting Policy”), available at gm.com/texting-policy.  See “Choices” below to learn more about how you can manage your communication preferences.  

We may share the categories of your information described above as follows:

GM Family of Companies:  Within the GM family of companies (for example, including OnStar) for the above uses.

Emergency Service Providers:  With emergency service providers, such as law enforcement, roadside assistance providers, and ambulance providers, to protect your safety or the safety of others, and to deliver related services (for example, Stolen Vehicle Assistance Services).

Third-Party Business Relationships:  With business that GM enters into business relationships, such as SiriusXM, in connection with their products and services; research institutes, for research and development purposes (for example, improving highway safety); or dealers, fleet, or rental car companies, for service or maintenance of your vehicle.  We may also share data with third parties for marketing activities (with necessary consents) or where you have elected to receive a service from them and/or authorized them to request data from GM (for example, financial organizations who offer financing for the purchase or lease of GM vehicles or usage based insurance providers).

Service Providers:  With our product and service providers who work on our behalf in connection with the uses described in the preceding section, such as dealer managed service providers, wireless service providers (e.g. AT&T), companies that administer our contests and promotions, host and/or operate our websites, send communications, perform data analytics, process, store, or manage credit card, information (we will not otherwise share your credit card information).

Where Required or Permitted by Law:  As required or permitted by law, such as in conjunction with a subpoena, government inquiry, litigation, dispute resolution, or similar legal process, when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, to detect, investigate and prevent fraud or other illegal activity, or to conduct screening to ensure you are not on any government list of restricted parties.

Business Transfers:  With a prospective or completed sale, transfer, or financing of a part of a GM business or its assets.

Depending on where you reside you may have the right to submit one or more of the following privacy requests in accordance with your local laws:

• to obtain access to the personal information that we collect about you, which we will provide in a commonly used electronic format – to do so, submit a request to Access My Personal Information,
• to delete the personal information that we collect about you – to do so, submit a request to Delete My Personal Information, or
• to correct inaccuracies in the personal information that we collect about you – to do so, submit a request to Correct My Personal Information.

Some of the ways in which we share your personal information with third party businesses that we work with on marketing activities may also qualify as “sales” of your personal information under your local laws.  The categories of personal information that we share with these third parties may include identifiers and information about your connected devices and how you interact with our products, services, apps and websites.

You may also have the right under your local laws to opt-out of these “sales” and certain other uses of your personal information:

• to opt-out of the “sale” of your personal information to the category of third party businesses identified above, submit a request to “Do Not Sell My Personal Information.”,
  
• to opt-out of certain types of targeted advertising based on your activity across other sites, submit a request to Opt-out of Targeted Advertising (for California residents, Do Not Share My Personal Information); please note, after opting out of targeted advertising, you may still see advertising from us on other sites based on your current visits to those sites, or
• to opt-out of certain types of automated processing of your personal information, submit a request to Opt-out of Profiling.

To exercise the rights described above, please submit a verifiable consumer request to us by either:

• Calling us at 1-866-MYPRIVACY (1-866-697-7482)
  
• Visiting GM’s Consumer Privacy Request Form

We do not discriminate against consumers who exercise these rights. We take reasonable steps to respond to all requests and our processing times may vary. We will work to process your request in accordance with the laws that apply where you reside. We may retain the information you submit in connection with a request for as long as required or permitted by applicable law.
Other than as required by law, we do not respond to signals or mechanisms enabled in web browsers indicating a preference to exercise the rights listed above.

Authorizing an Agent

You may be permitted by law to authorize someone else to act as your agent to exercise some of your privacy rights on your behalf. In such cases, your authorized agent must provide documentation supporting his or her authority to make this request on your behalf.  In some cases, we may also require you to verify your identity directly with us and confirm the request before we will process it. 

Further information about how to submit this request and the documentation we require to support it is available within our U.S. Consumer Privacy Request Form.  Your authorized agent can also contact us at gm.datacompliance@gm.com to request a copy of our Authorized Agent Form and to submit this request on your behalf.  Documentation supporting your authorized agent’s right to submit this request on your behalf, such as a copy of our Authorized Agent Form signed by you or a Power of Attorney, must be submitted with this request.  If this request is submitted over the phone, your authorized agent will be asked to email supporting documentation to gm.datacompliance@gm.com.  

Verifying Your Request

For your protection, we take reasonable steps to verify all requests before they are processed.  This may include, for example, a request from us for you to confirm your identity, to validate documents you submit to us, to verify your authority to make the request, or for other purposes.  In all cases, we reserve the right to deny your request in accordance with applicable law if we cannot verify you or your authority to make the request.  

If we decline to take action on your request, you may have the right to appeal. Please contact us at gm.datacompliance@gm.com if you would like to submit such an appeal.

The nature of our Connected Services means that there may be circumstances where you might let someone else use a product or service that we provide to you (for example, you enrolled your vehicle in Connected Services services and then let someone else drive the vehicle).  It is important that if you do let someone else use one of our products or services that you inform them of this Privacy Statement and of the privacy choices that you have made.

If you sell or otherwise transfer your vehicle, it is your responsibility to delete all information (such as contacts, address look-ups, saved map addresses, or preferences) from the vehicle and contact us to transfer or cancel your account.  If you do not delete this information, it may remain in the vehicle and may be accessible to future users of the vehicle. For instructions on how to delete information from your vehicle, please refer to your vehicle owner’s manual.

Our Connected Services use cookies, web beacons, pixels and other device tracking technologies that allow us to identify you on your devices in a unique manner, such as through IP address or VIN (“cookies”), to gather information about your activity, such as demographic data, browser type, pages visited, activities conducted on the page, and the day and time of your visit.  We use cookies, sometimes across devices, to measure your activity, remember your preferences, maximize and improve the performance of our Connected Services, and customize your experience (for example, maintaining your account login or contact information, helping you locate a nearby dealer, autofilling fields on forms).

We may also combine this information with other information collected online or offline about you, including information provided by third party sources, and it may be used or shared for the purposes described in this Privacy Statement.  We may also allow third party advertising and personalization companies that we work with to use cookies on our website in order to develop personalized content and appropriate advertising based on your visits over time on GM websites and applications and non-GM websites and applications.  This information may also be used to evaluate our online advertising campaigns or to tailor promotions and other marketing messages to you.

GM adheres to the Digital Advertising Alliance's Self-Regulatory Principles for Online Behavioral Advertising.  To learn more about behavioral advertising please visit www.AboutAds.info.  If you do not wish to receive personalized advertising or content from us, please visit the Digital Advertising Alliance's Opt-Out page or click on the AdChoices icon located at the bottom of the website page (for GM websites) or on GM advertisement (for non-GM websites). Even if you opt-out of behavioral advertising from us, you will still receive advertising, but the advertisements will not be personalized to your interests.

Similarly, we may also place cookies in our emails to measure the effectiveness of our email campaigns by identifying the individuals who open or act upon an email message, when an email message is opened, how many times an email message is forwarded, the type of software, device, operating system and browser used to open the email and any URL accessed through our email message.

At this time, we do not honor “do not track” signals if enabled in a web browser.

You may choose to decline or delete some or all of the cookies that we use on our websites; however, doing so may impair the functionality of our websites.  Please refer to your browser for instructions to learn more about cookies and other technologies and how to manage their use.  If you elect to refuse or delete cookies, you will need to repeat this process if you use another computer or device or change web browsers. If you choose to decline cookies, some of the functionality of a website may be impaired.   

Certain third party services or applications (for example, your carrier data plan, navigation services) you download, that are pre-installed, or which you may sign up for may have separate user terms and privacy statements, which are independent of our Privacy Statement.  GM is not responsible for the personal information practices of these third party services or applications and your use is subject to the user terms and privacy statement for those third party services or applications. We recommend that you carefully review the user terms and privacy statement of each third party service or application before using that service or application. Similarly, our websites may contain links to independent sites outside of and not controlled by GM, such as those belonging to GM dealers, GM licensees, or independent product review sites. GM is not responsible for these sites or the omissions, policies, or content of these sites, and GM is not responsible for the personal information practices of such third parties. We recommend that you read the privacy policies of these third parties before providing them any personal information and before using their sites.

Instead of being asked security questions, we may offer voice verification services when you contact our call centers. If you consent to use this service, we will use a mathematical model when you speak to a call center Advisor to compare your voice in real-time against a voice print provided during enrollment.  If we detect a match, you may be automatically authenticated and may not have to provide a PIN or answer account security questions. 

For your security:

• Voice biometric data is only used to confirm your identity when you contact a participating call center.
  
• Voice biometric data will not be sold or shared without your consent.
  
• When we use your voice to create a voiceprint, we will encrypt your biometric data so that it cannot be used by 3rd parties.
  
• We will permanently destroy the biometric data we collect about you when you close your account or opt out of this service, or within three years of your last interaction with us (whichever occurs first).

You can access your online account to view or update your information in that account.  You may also contact us, as provided below, to learn about how to access, review, correct, update, or delete the information about you in our records.  We may need to retain certain information for recordkeeping purposes, to complete any transactions that you began prior to your request, or for other purposes as required or permitted by applicable law. 

Please Note: We do not generally provide access to written or audio records of service events (for example, when you request service, one of our advisors calls in to your vehicle, or when we provide crash, theft, or emergency services) unless we are required to do so under an appropriate court order or by applicable law.

We maintain reasonable technical, administrative, and physical security and confidentiality measures designed to help protect your information from unauthorized access or use.  We also require (other than in certain emergency situations) third party service providers acting on our behalf or with whom we share your information to provide similar security and confidentiality measures.

We may keep the information we collect for as long as necessary to provide products or services to you, to operate our business, to enable us to communicate with you, for our safety, research, evaluation of use, or troubleshooting purposes, or to satisfy our legal or contractual obligations.  Where required, we will de-identify or dispose of the information we collect when we no longer need it for the uses described in this Privacy Statement.  

GM websites, in-vehicle applications, and other online services do not target or knowingly collect any information from children under the age of 13.

We store your information in the United States, the European Economic Area (EEA), and other locations where we or our service providers maintain servers.  We provide appropriate protections for cross-border transfers as required by law for international data transfers.  With respect to such transfers from the EEA to the United States and other non-EEA jurisdictions, we implement standard contractual clauses and other mechanisms to protect such data.  

We may need to update this Privacy Statement from time to time as our business and products or services expand or change, or as required to by law. If we do, we will post the updated version of the Privacy Statement on our website or otherwise notify you, and ask for your consent to the changes if legally required.  

If you have concerns or questions regarding GM's consumer privacy practices or this Privacy Statement, please press the blue button in your vehicle, visit our website(s), or call us at 1-866-MYPRIVACY (1-866-697-7482) or 1-888-4ONSTAR (1-888-466-7827) for Connected Services questions.  You may also contact the Privacy Manager by mail at OnStar Subscriber Services, P.O. Box 1027, Warren, Michigan USA 48090-1027 or by email at privacy@gm.com.