Subaru is More than a Car Company. The Love Promise is our vision to show love and respect to all customers at every interaction with Subaru. Your privacy is no different. This Privacy Policy explains how Subaru of America, Inc. (“Subaru”, “we”, “us” or “our”) collects, uses, shares and endeavors to protect your Information (as defined below).
DISCLOSURES FOR CALIFORNIA RESIDENTS
DISCLOSURES FOR VIRGINIA RESIDENTS
Quick links:
This Privacy Policy applies when Subaru collects Information from or about individuals using our Services (as defined below). There are two primary Services: (1) “Technology Services,” which means any Subaru-controlled websites, such as Subaru.com or applications that link to this Privacy Policy, or Subaru-controlled apps, such as the MySubaru app, or services accessed or used on a mobile, handheld or other device; and (2) “Connected Vehicle Services,” means in-vehicle services, including the Subaru Starlink service, that use mobile phone or mobile data networks. “Services” encompasses the Technology Services, Connected Vehicle Services, and the production, distribution, sale and maintenance of Subaru vehicles, and any other related services or business operations causing Subaru to receive Information, including when you send us email or contact our call centers.
This Privacy Policy applies to each user of the Services, including any “Vehicle Occupant,” which includes each driver or passenger in a Subaru vehicle that uses Connected Vehicle Services, such as Subaru Starlink (such vehicle, a “Connected Vehicle”), whether or not such driver or passenger is the vehicle owner or a registered user of the Connected Vehicle Services. For the avoidance of doubt, for purposes of this Privacy Policy, “using” the Services includes being a Vehicle Occupant in a Connected Vehicle. This Privacy Policy also applies to Information individuals voluntarily provide to us “offline,” such as at events, and to Information we receive from third parties, such as Retailers. “You” or “your” means any person described in this paragraph.
This Privacy Policy does not apply to Retailers, Retailer Service Providers (as defined below), Distributors (as defined below), Subaru Gear, or to Subaru Motors Finance. “Retailers” mean authorized sellers of Subaru vehicles, which are independent companies and not Affiliates (as defined below) of Subaru. This Privacy Policy also does not apply to Information we receive from our employees or Service Providers (as defined below). Additionally, certain Connected Vehicle Services may require subscriptions to third party services and any Information disclosed by you to, or collected by, such third parties is subject to the privacy policies of such third parties and not this Privacy Policy.
By disclosing your Personal Information to us, registering or enrolling in certain Services, or otherwise using our Services, or interacting with us offline, you consent to our collection, use, and disclosure of your Personal Information as described in this Privacy Policy. If you are a vehicle owner or are otherwise registering for certain in-vehicle Services, you also consent to this Privacy Policy on behalf of all Vehicle Occupants. Your continued use of our Services indicates your consent to the Privacy Policy then posted.
If you are a California resident please see Section 11, Additional Disclosures for California Residents. If you are a Virginia resident please see Section 12, Additional Disclosures for Virginia Residents.
“Personal Information” includes information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Subaru collects and uses the Personal Information you provide to us. We may also obtain Personal Information about you from third parties, including Retailers. We collect “Location Data” as part of the Subaru Starlink service.
We also collect non-Personal Information relating to the Services, that is, information that does not personally identify an individual (“Non-Personal Information”). The Non-Personal Information we collect includes how you interact with the Services, information generally collected or “logged” by Internet websites or Internet services when accessed or used by users, information about your web browser or device accessing or using the Services, and anonymized information relating to Connected Vehicle usage. We also create Non-Personal Information by aggregating or anonymizing Personal Information.
We will not use Non-Personal Information to try to identify you, and if we associate any Non-Personal Information with information that personally identifies you, then we will treat it as Personal Information. “Information” means Personal Information and/or Non-Personal Information, as applicable.
We collect the following categories of Personal Information, including in the last 12 months, in connection with the Services:
Category |
Examples / Description |
Identifiers |
A real name, username or alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, vehicle information (such as model and year), vehicle identification number (VIN), vehicle telemetry data, or other similar identifiers. |
Other Personal Information subject to certain laws |
A name, signature, Social Security number, address, telephone number, driver’s license or state identification card number. Some Personal Information included in this category may overlap with other categories. |
Commercial information |
Records of personal property, products or services purchased, obtained, or considered. |
Internet or other similar network activity. |
Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement. |
Geolocation data. |
Physical location and movements, including from Connected Vehicle Services or Technology Services. |
Inferences drawn from other Personal Information. |
Profile reflecting a person’s preferences, characteristics, predispositions, behavior, or attitudes. |
Recordings |
Audio recordings of Vehicle Occupants. Audio recordings when you call our call centers or a Retailer. |
Payment information |
Credit card information for optional Services, such as Subaru Starlink. |
From IndividualsWe collect Personal Information and Non-Personal Information directly from individuals, such as when they register for or provide information through Technology Services or Connected Vehicle Services, when they call our call centers, send email to us or make customer service requests from us, register for events, sign up for Added Security, or provide information to a Subaru Ambassador.
Retailers
We collect Personal Information from Retailers, such as when a consumer purchases a vehicle, has it serviced, or makes an appointment.
Service Providers
We collect Personal Information and Non-Personal Information from Service Providers in connection with the services they provide to us, such as data analytics services.
Data Services Companies
We collect Personal Information and Non-Personal Information from third parties, such as lead generation companies, API Providers (as defined below) or Data Providers (as defined below), who provide data products to us (collectively, “Data Services Companies”).
Connected Vehicle Services
We collect Personal Information and Non-Personal Information automatically from Connected Vehicles. This Information includes vehicle and service-related information, including but not limited to VIN and vehicle description; vehicle maintenance information; mechanical condition or incidents involving the vehicle such as crash severity sensor data; time, LOCATION and speed of vehicle; a Vehicle Occupant’s search content; your personal identification number (“PIN”); and information about calls related to the Services or your account, such as the date, time and duration of the call, the identity and phone number of the caller, and contents of or notes about the call. In addition, your vehicle may be equipped with one or more sensing or diagnostic modules capable of automatically retrieving, recording, transmitting, or storing certain vehicle data, including but not limited to trouble codes, tire pressure, battery voltage, coolant temperature, and service requirements. We may collect and retain data from any such modules in your vehicle.
Additionally, we may record the location of a Connected Vehicle, (i) when a Vehicle Occupant requests a Starlink service; (ii) when your vehicle’s air bag deploys or a severe impact occurs; (iii) when you report your vehicle as stolen; (iv) while diagnostic trouble codes are being transmitted; (v) when the vehicle’s ignition is turned off; or (vi) when we are required to do so by applicable local, state or federal laws, rules or regulations or law enforcement authorities. In addition, the location of fleet vehicles used by employees as company cars may be monitored by the employer or by the fleet management company leasing the vehicle to the employer.
Online Activity
We collect Personal Information and Non-Personal Information through your use of the Technology Services as well as third party online services, such as social media platforms. Certain Technology Services may also access certain features of your mobile device, including its camera, location services (GPS), microphone and contacts, and collect Information from those features, such as photographs, videos, your precise location, audio recordings, and contact information. You consent to this access. Additionally, our Technology Services may integrate with social media platforms, including Facebook, Twitter, Tik Tok, and Instagram. When you like or share our content through social media, interact with us on social media, or connect a social media account to our Services, then we may collect Information about that social media account and share Information with that social media account. This collected Information, as determined by your social media privacy settings, may include, but is not limited to, your name, email address, demographic Information from your profile, friend lists, postings or other content, and your profile picture. You acknowledge and agree that we are not responsible for the data collection or use practices of any such social media platform. You should read each social media platform’s privacy policy.
Affiliates and Distributors
We collect Personal Information and Non-Personal Information through our operations with Affiliates and our agreements with Distributors.
We collect and use Personal Information and Non-Personal Information for business and commercial purposes in accordance with the practices described in this Privacy Policy, including, but not limited to, in the last 12 months, to do the following:
Subaru may disclose and share Personal Information and Non-Personal Information in accordance with the practices described in this Privacy Policy. The categories of entities to whom we disclose Personal Information (including in the last 12 months) include the following:
Non-Personal Information
Subaru may disclose Non-Personal Information about you to Service Providers and other third parties if we deem such disclosure, in our sole discretion, to have sound business reasons or justifications.
With Your Authorization
We may disclose Personal Information to provide the Services, or when you authorize or instruct us to do so, for example when you ask us to connect you with a local Retailer.
Service Providers
“Service Providers” are service providers, vendors, and suppliers who provide products and services to Subaru or its Retailers, including in connection with the functionality of the Service. To the extent it is necessary for these entities to provide their products and services to us or to you, these entities may have access to your Personal Information, but they are prohibited by us to use your Personal Information on their own behalf or for any purpose other than providing products and services to us or to you. Subaru may sometimes permit authorized Service Providers to create or access Non-Personal Information in the form of aggregate and anonymized statistics about our customers, sales, traffic patterns, and related Services information.
Emergency Contacts
We may disclose Personal Information to roadside assistance providers, emergency service dispatchers, law enforcement, your designated emergency contacts, or our Affiliates in connection with vehicle-related accidents or other emergencies, or if you report your vehicle stolen.
Affiliates and Distributors
“Affiliate” means a company directly or indirectly controlling, controlled by, or under common control with Subaru. “Distributor” means a third party with agreements with Subaru Affiliates allowing for the distribution of Subaru branded vehicles by the third party. Subaru may disclose Personal Information to Affiliates and Distributors and, in some cases, Affiliates and Distributors may use Personal Information for their own benefit, subject to each Affiliate’s or Distributor’s privacy policy.
API Providers and Data Providers
“API Provider” means a third party licensor of software that we include in, or use with, the Services, including an API or SDK, that provides a specialized function or service to us and that requires the transmission of Personal Information and/or Non-Personal Information to the API Provider.
“Data Provider” means a third party provider of data aggregation products and services. We may disclose Personal Information and Non-Personal Information to API Providers and Data Providers and, in some cases, API Providers and Data Providers may use Personal Information and Non-Personal Information for their own benefit. In such cases, their privacy policies will apply to their use of such Information.
Retailers
Certain requests or questions that you direct to us are more appropriately answered by a Retailer, such as a request for a price quote on a particular vehicle. In those instances, we will provide your Personal Information, along with your request or question, to a Retailer or Retailers for a response. We may also disclose Personal Information to a Retailer in connection with product recalls, warranty service or other business purposes in connection with vehicles sold or serviced by a Retailer. The Retailer(s) will have the right to use your Personal Information for purposes of responding to your request, servicing your vehicle, and for its/their own marketing purposes that may not relate to your requests or questions. Retailers’ use of your Personal Information will be subject to the Retailers’ own privacy policies. Please contact your Retailer for more information, including how to access its privacy policy.
Retailer Service Providers
We may partner with third parties to provide services to or on behalf of Retailers (collectively, “Retailer Service Providers”), including collecting Personal Information and Non-Personal Information provided by consumers through co-branded websites that may display Subaru’s logo and trademarks. These websites are not part of the Services and Subaru is not responsible for and cannot control the privacy practices of other websites or third parties. We encourage you to read the privacy policies for these other websites, as they may differ from ours. Such websites may be identified by the fact that they do not display a Subaru (or Subaru brand) URL, they may have information identifying a third party as the host of the particular website or application, and/or they do not link to this Privacy Policy. Please read the privacy policy on the co-branded website for the applicable privacy practices relating to Personal Information collected via that website, as it may differ from this Privacy Policy.
Contests and Promotions
Subaru occasionally partners with trusted third parties (each, a “Promotions Partner”) for promotions, events, sweepstakes, contests, and other similar activities (collectively, “Promotions”), and may share your Personal Information with such Promotions Partners for Subaru’s marketing purposes and for the Promotions Partners’ own marketing purposes unless you opt out of such sharing by contacting us. The use of your Personal Information by Promotions Partners for their own purposes will be subject to their privacy policies. The Personal Information we collect from you in connection with Promotions will be used as described in the official rules for that Promotion and may also be used by us for marketing purposes. Certain Promotions may be run by on behalf of Subaru by a Marketing Partner, co-branded with one of our Marketing Partners, or run on a third party website or social media platform, such as Facebook. In these instances a third party, rather than Subaru, may collect your Personal Information. The Promotion will state the policies governing the collection of such Personal Information if they should differ from this Privacy Policy or if a third party will be collecting such Personal Information.
Third Party Marketing
We share your Personal Information with third parties (each, a “Third Party Marketer”) for their own marketing purposes from time to time. For example, we may provide Personal Information to Service Providers to permit them to market services to you for your vehicle (such as for WiFi hotspot or satellite radio services, or insurance or financial products). You may opt out of this sharing by contacting us.
Mergers, Acquisitions, and Insolvency
If Subaru should ever file for bankruptcy or merge with another company, or if Subaru should decide to buy, sell, or reorganize some part or all of its business, Subaru may disclose your Personal Information, including to prospective or actual purchasers in connection with one of these transactions.
As Required by Law and Other Extraordinary Disclosures
Subaru may be required to disclose your Personal Information, including location data, if it: (i) believes it is reasonably necessary to comply with legal process (such as a court order, subpoena, search warrant, etc.) or other legal or regulatory requirements or requests of any governmental authority, (ii) would potentially mitigate our liability in an actual or potential lawsuit or investigation, (iii) is necessary to protect our rights or property or enforce our contracts, (iv) is necessary to protect the legal rights, safety or property of others, (v) will prevent, solve or prosecute a crime, or protect national security, or (vi) detect, prevent or otherwise address fraud, security or technical issues.
A. Account Information
MySubaruIf you are a registered user of MySubaru, including in connection with your use of Subaru Starlink, you may change or delete certain Personal Information in your profile by logging on to https://www.mysubaru.com or the MySubaru App or you may disable your account by going to the “Contact Us” form at Subaru.com. In the MySubaru App, you can choose to stop the collection of certain location data.
Subaru University
If you are a registered user of Subaru University you may change or delete certain Personal Information in your profile by logging in to the Subaru University web portal.
Subarunet
If you are a registered user of Subarunet, you may change or delete certain Personal Information contained in your profile by logging into your account.
Please note that we cannot change or delete Personal Information in the databases of third parties with whom we have already shared your Personal Information.
B. Communications
Emails. All users may opt-out of receiving marketing emails and newsletters at any time by changing their preferences (if registered on MySubaru), or by contacting the Subaru Customer Service Department at 1-800-782-2783 or by using the opt-out link located at the bottom of our emails.
Push Notifications. If you have opted-in to receive push notification on your device, you can opt-out at any time by adjusting the permissions in your device or uninstalling our app.
Please note that your opt out is limited to the email address, device, and phone number used to contact you and if you re-subscribe at a later time we will resume contacting you with the communications that you choose to re-subscribe to.
Text Messages and Calls. You can opt-out of receiving text messages or calls to your phone number at any time by (i) for text messages, texting “STOP” in response to any text message you receive from us or contacting us as set out in the “Contact Us” section below and specifying you want to opt-out of text messages; and (ii) for calls, requesting opt-out during any call you receive from us or contacting us as set out in the “Contact Us” section below and specifying you want to opt-out of calls. For more information, please see the SMS Terms and Conditions.
For Starlink subscribers, you can change your communication preferences at anytime through MySubaru.com or the app.
C. Tracking Technology Choices
Cookies and Pixels
When you use the online Services (e.g., access a Services webpage, or navigate to a specific location within the Services mobile apps), we collect Personal Information and Non-Personal Information regarding that use. For example, to improve our Services, we collect how, when, and which parts of the Services or its features you use. Also, we may use your device’s unique identifier (UDID) or other unique identifiers to assist us in collecting and analyzing this data. On Subaru.com you can set your preferences by clicking on Cookie and Ad Preferences in the banner.
To assist us in collecting and storing this Information, we may employ a variety of technologies, including “Cookies,” local browser storage, and “web beacons,” “pixels,” or “tags.” A Cookie is a small amount of data a website operator, or a third party whose content is embedded in that website, may store in your web browser and that the website operator or, as applicable, the third party, can access when you visit the website. A web beacon, pixel or tag is a small, usually transparent image or script placed on a web page that allows the operator of that image or script, which may be the operator of the website you visit or a third party, to read or write a Cookie.
We may use third parties that use Cookies and related technologies to collect Personal Information and Non-Personal Information for interest-based advertising purposes (for example, advertisements that are tailored to your likely interests or based on categories in which you have shown an interest).
You can instruct your browser, by changing its settings, to decline or delete Cookies. If you use multiple browsers on your devices, you will need to instruct each browser separately on each device. Your ability to limit Cookies is subject to your browser settings and limitations. Our Service Providers may also use Cookies and related technologies in order to personalize your experiences and adapt a particular part of our Service's functionality to your preferences and other purposes. You may set your browser to notify you when you receive a Cookie or to refuse receiving it. You should be aware that this may interfere with or make you unable to use certain functionality on websites using Cookies. For example, many websites will ask your permission to use a Cookie that will enable you to automatically log onto the website. Disabling or removing Cookies may require you to manually log on each time you wish to visit that website. When multiple devices are used by the same person to access Subaru-controlled websites and/or applications, we may link those devices. For more information about device linking or for information on how to opt-out of this linking, please go to https://www.adobe.com/privacy/opt-out.html. You may also update your preferences by clicking the Cookie and Ad Preferences link on Subaru.com.
Do Not Track
Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. Note, however, there is no industry consensus as to what site and app operators should do with regard to these signals. Accordingly, unless and until the law is interpreted to require us to do so, we do not monitor or take action with respect to “Do Not Track” signals. For more information on “Do Not Track,” visit http://www.allaboutdnt.com.
App and Location Technologies
You can stop all collection of Information via an app by uninstalling the app. You can also reset your device at any time through your device settings, which may allow you to limit the use of Information collected about you. You can stop all collection of precise location data through an app by uninstalling the app or withdrawing your consent through your device settings.
Please be aware that if you disable or remove tracking technologies some parts of the Service may not function correctly.
D. Your Nevada Rights
Nevada law (NRS 603A) requires each business to establish a designated request address where Nevada consumers may submit requests directing the business not to sell certain kinds of Personal Information that the business has collected or will collect about the consumer. A sale under Nevada law is the exchange of Personal Information for monetary consideration by the business to a third party for the third party to license or sell the Personal Information to other third parties. If you are a Nevada consumer and wish to submit a request relating to our compliance with Nevada law, please contact us as at https://www.subaru.com/support/consumer-privacy.html.
Subaru’s Service is intended for a general audience and not directed at children under (13) years of age.
We do not knowingly gather Personal Information (as defined by the U.S. Children’s Privacy Protection Act, or “COPPA”) in a manner not permitted by COPPA. If a person under 13 submits Personal Information through any part of a Subaru Service, and we learn the person submitting the Personal Information is a child, we will attempt to delete this Personal Information as soon as possible. If you are a parent or guardian and you believe we have collected Personal Information from your child in a manner not permitted by law, contact us as set out in the “Contact Us” Section below. We will remove the data to the extent required by applicable laws.
Transmission of data over the Internet is not 100% secure. Consequently, we cannot ensure or warrant the security of any Personal Information you transmit to us, and you do so at your own risk. Once we receive your transmission, we make reasonable efforts to ensure security on our systems. Subaru uses secure server software and firewalls designed to protect your Personal Information from unauthorized access, disclosure, alteration, or destruction. However, please note that this is not a guarantee that such Personal Information may not be accessed, disclosed, altered, or destroyed by breach of such firewalls and secure server software.
In providing Subaru Starlink to you, your voice and data are transmitted between our response centers and your vehicle over a cellular telephone network. This network is complex and not necessarily secure. The privacy and security of conversations or data transmitted to and from the vehicle cannot be guaranteed.
If Subaru learns of a breach in its security system that results in a disclosure of users’ Personal Information, we may attempt to notify you electronically so that you can take appropriate protective steps. By providing Personal Information to us or using our Service, you agree that we can communicate with you electronically regarding security, privacy, and administrative issues. Subaru may post a notice on our Services if a security breach occurs. Subaru may also send an email to you at the email address you have provided to us. Depending on where you live, you may have a legal right to receive notice of a security breach in writing.
Subaru retains Personal Information only as long as necessary to fulfill a legitimate business purpose or as required by law.
All information posted in the Services is intended for the U.S. market only and will be interpreted and governed solely by applicate U.S. and state laws. If you access this site from a location outside the U.S., Subaru is not responsible for compliance with all non-U.S. laws and regulations. Subaru distributes vehicles only in the U.S. (and excluding Hawaii). If you are accessing the Services from outside of the U.S., please be aware that Information collected through the Services may be transferred to, processed, stored, and used in the U.S. and other jurisdictions. Data protection laws in the U.S. and other jurisdictions may be different from those of your country of residence. Your use of the Services or provision of any Information therefore constitutes your consent to the transfer to and from, and processing, usage, sharing, and storage of Information, including Personal Information, about you in, the U.S. and other jurisdictions as set out in this Privacy Policy.
We may modify or update this Privacy Policy periodically with or without prior notice by posting the updated policy on this page. You can always check the “Last Updated” date at the top of this document to see when the Privacy Policy was last changed. If we make any material changes to this Privacy Policy, we will notify you by reasonable means, which may be by e-mail or posting a notice of the changes on our website or through the relevant Service’s mobile app prior to the changes becoming effective. We encourage you to check this Privacy Policy from time to time. IF YOU DO NOT AGREE TO CHANGES TO THIS PRIVACY POLICY, YOU MUST STOP USING THE SERVICES AFTER THE EFFECTIVE DATE OF SUCH CHANGES (WHICH IS THE “LAST UPDATED” DATE OF THIS PRIVACY POLICY).
The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, the “CCPA”), provides California residents with specific rights regarding their Personal Information, including rights to know, delete and opt out, and requires businesses collecting or disclosing Personal Information to provide notice of rights California residents have and can exercise. This Section 11 (this “California Notice”) describes the CCPA rights of California residents and explains how to exercise those rights.
A. Definitions
For the purposes of this California Notice, the following definitions shall apply.
“Sell,” “Selling,” “Sale,” or “Sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, Personal Information to another business or a third party for monetary or other valuable consideration.
“Share”, “Shared,” or “Sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, Personal Information to a third party for Cross-context Behavioral Advertising, whether or not for monetary or other valuable consideration.
“Cross-context Behavioral Advertising” means the targeting of advertising to a consumer based on that consumer’s Personal Information obtained from activity across businesses or distinctly-branded websites, applications, or services, other than the business or distinctly-branded website, application, or service with which the consumer intentionally interacts. (In other words, if we send you an ad based solely on your interaction with us or our Services, this is not Cross-context Behavioral Advertising.)
“Sensitive Personal Information” means Personal Information that is not publicly available and reveals one or more of the following: (i) Social Security, driver’s license, state identification card, or passport number; (ii) account log-in, financial account, debit card or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (iii) precise geolocation; (iv) racial or ethnic origin, religious or philosophical beliefs, or union membership; (v) mail, email, and text messages unless we are the intended recipient of the communication; (vi) genetic or biometric data; or (vii) Personal Information collected and analyzed concerning a consumer’s health, sex life, or sexual orientation.
“Verifiable Request” means that the identifying information provided by a consumer in connection with a request matches the Personal Information of the consumer already maintained by us. See the Consumer Requests section below for more information about submitting Verifiable Requests.
B. Information We Collect
Within the past twelve (12) months, Subaru has collected the categories of Personal Information listed in the INFORMATION WE COLLECT section above, including:
Category |
Examples / Description |
Identifiers |
A real name, username or alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, vehicle information (such as model and year), vehicle identification number (VIN), vehicle telemetry data, or other similar identifiers. |
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e) |
A name, signature, Social Security number, address, telephone number, driver’s license or state identification card number. Some Personal Information included in this category may overlap with other categories. |
Commercial information |
Records of personal property, products or services purchased, obtained, or considered. |
Internet or other similar network activity. |
Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement. |
Geolocation data. |
Physical location and movements, including from Connected Vehicle Services or Technology Services. |
Inferences drawn from other Personal Information. |
Profile reflecting a person’s preferences, characteristics, predispositions, behavior, or attitudes. |
Recordings |
Audio recordings of Vehicle Occupants. Audio recordings when you call our call centers or a Retailer. |
Payment information |
Credit card information for optional Services, such as Subaru Starlink. |
Subaru obtains this Personal Information from the following types of sources: California residents or their representatives, Retailers, Service Providers, Data Services Companies, Connected Vehicle Services, online activity, Affiliates, and Distributors.
Personal Information we collect may include Sensitive Personal Information. Sensitive Personal Information we collect includes precise geolocation data in connection with Connected Vehicle Services. If you do not consent to the collection and processing of Sensitive Personal Information within these categories, please do not access or use the Connected Vehicle Services. In addition, you can stop the collection and processing of Sensitive Personal Information within these categories by canceling or requesting the STARLINK account holder to cancel the Connected Vehicle Services in accordance with the STARLINK Terms and Conditions.
For more information on Personal Information we collect, including the sources we receive Personal Information from, please review the Information We Collect, Use of Information, How We Collect Information and When Subaru Shares Information sections above. We collect and use these categories of Personal Information for the business purposes described in the Use of Information and When Subaru Shares Information sections.
We may disclose your Personal Information to a third party for a Business Purpose (as defined below) or Sell or Share your Personal Information, subject to your right to opt-out of Sales and Sharing as described below.
C. Use Personal Information
We may use, Sell, Share, or disclose the Personal Information we collect for one or more of the following “Business Purposes:”
We may use, Sell, Share, or disclose the Sensitive Personal Information we collect for one or more of the following “Business Purposes:”
Unless we notify you otherwise, we will not collect additional categories of Personal Information, nor use the Personal Information we collect for any other materially different, unrelated, or incompatible purposes.
D. Disclosure of Personal Information for a Business Purpose
Subaru discloses the following categories of Personal Information of California residents:
Subaru discloses Personal Information to the following categories of third parties:
Service Providers, emergency contacts, Affiliates, Distributors, API Providers, Data Providers, Retailers, Retailer Service Providers, Marketing Partners, Third Party Marketers, and governmental regulators having jurisdiction for our products or services as required to comply with the law.
When we disclose Personal Information for a Business Purpose, we enter into an agreement with the receiving party that describes the purpose for sharing the Personal Information and requires the receiving party to keep that Personal Information confidential, except as necessary for the Business Purpose; provided that when we disclose Personal Information to governmental entities, we may not be able to enter into such an agreement.
Additionally, we Sell Personal Information, subject to your right to opt-out of those Sales.
We also Share Personal Information for Cross-context Behavioral Advertising, subject to your right to opt-out of such processing.
E. Retention of Personal Information
We retain each category of your Personal Information for no longer than is reasonably necessary for one or more Business Purposes, subject to your right to request we delete your Personal Information. Due to the nature of the Services, it is not possible to predict the length of time that we will retain Personal Information. Instead, we use the following criteria to determine whether it remains reasonably necessary to retain your Personal Information for one or more disclosed Business Purpose(s): (i) whether there is a retention period required by statute or regulations; (ii) the existence of actual or threatened litigation for which we are required to preserve the information; (iii) the statutes of limitations for potential legal claims; and (iv) generally accepted best practices in our industry. When we determine that it is no longer reasonably necessary to retain your Personal Information for one or more disclosed Business Purposes based on the above criteria, we will delete your Personal Information.
F. Consumer Requests
Right to Know
California residents have the right to request that we disclose certain information to you about our collection of your Personal Information over the past 12 months, including: (i) the categories of Personal Information we collected about you; (ii) the categories of sources for the Personal Information we collected about you; (iii) our business or commercial purpose for collecting or selling that Personal Information; (iv) the categories of third parties to whom we disclose that Personal Information; and (v) the specific pieces of Personal Information we collected about you. If we Sold, Shared or disclosed your Personal Information for a Business Purpose, you have the right to request that we disclose to you the Personal Information, by category, for each type of third party to whom such Personal Information was sold or disclosed.
Right to Delete
You have the right to request that we delete any of your Personal Information that we collected from you and retained. Be aware, however, that certain exceptions apply to the right to delete Personal Information. We may deny your deletion request if retaining your Personal Information is necessary for us or our Service Providers to:
Right to Correct
California residents have the right to request that we correct any of your Personal Information that is inaccurate by submitting a Verifiable Request. We will correct any inaccurate Personal Information pursuant to your request, taking into account the nature of the Personal Information and the purposes of the processing of your Personal Information. We may deny your correction request if the Personal Information is accurate. We may also delete your Personal Information instead of correcting it to the extent such deletion would not negatively impact you.
Right to Opt Out of Selling or Sharing
To the extent Subaru Sells or Shares your Personal Information, you have the right to direct us to not Sell or Share your Personal Information at any time (the “right to opt-out”).
Right to Limit Use of Sensitive Information
You have the right to request that we limit the use and disclosure of Sensitive Personal Information by submitting a Verifiable Request. If you submit such a Verifiable Request, we may continue to use or disclose your Sensitive Personal Information to (i) complete the transaction for which we collected your Sensitive Personal Information, provide goods or services that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you; (ii) detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities; (iii) use in a short-term and transient manner, including, but not limited to, to facilitate non-personalized advertising shown as part of your current interaction with the Services, but not including disclosure to third parties or use outside your current interaction with the Services; (iv) enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us; or (v) make any other uses of that information that are permitted by the CCPA and its implementing regulations.
To exercise any of these rights, you (or your authorized representative) may submit a Verifiable Request to us by either: Calling us at 1-800-782-2783; or clicking here.
As part of a Verifiable Request, we may require specific Personal Information from you to help us verify your identity and process your request, which may include, but may not be limited to, your name, contact information and Vehicle Identification Number, if applicable. Generally, when an authorized agent makes a request to know or a request to delete on behalf of a California resident, the following is required: (i) signed permission by the California resident that the resident has authorized the agent to act on behalf of the resident; (ii) the resident must verify the resident’s identity directly with Subaru; and (iii) the resident must directly confirm with Subaru that the resident has provided the authorized agent permission to submit the request. However, if the resident has provided the authorized agent with power of attorney pursuant to Cal. Probate Code sections 4121 to 4130, the authorized agent must instead provide written verification of such power of attorney and the agent must confirm the agent's identity in order to verify the request. If we are not able to verify your identity in accordance with the CCPA, we may deny your request.
We will not discriminate against you for exercising any of your CCPA rights. For example, we will not:
G. California Minors
We do not knowingly Sell Personal Information of minors under 16 who are residents of California without their affirmative authorization, or the affirmative authorization of their parent or guardian for minors under 13.
California residents who are under 18 years of age and registered to use the Services may request removal of any content posted by them on the Services. To exercise a request, please write us at the email or postal address set out on our customer service contact page and specify that you are making a “California Minor” request. We may require additional Personal Information from you to allow us to verify your identity as well as details about where the content is posted. We will make reasonable good faith efforts to remove the post from prospective public view, although we cannot ensure the complete or comprehensive removal of the content and may retain the content as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.
H. Shine the Light Law
Under California Civil Code Section 1798.83, also known as California's “Shine the Light Law,” residents of California may request and receive, free of charge, a copy of Subaru's California Information Disclosure Notice for the previous calendar year. This notice lists the third party entities with which Subaru shared Personal Information for the third parties' direct marketing purposes. To request this notice, please go to the Contact Us page on this site.
The Virginia Consumer Data Protection Act (the “VCDPA”) provides Virginia residents with specific rights regarding their Personal Information. This section 13 (this “Virginia Notice”) describes the VCDPA rights of Virginia residents and explains how to exercise those rights.
A. Definitions
For the purposes of this Virginia Notice, the following definitions shall apply.
“Sell,” “Selling,” “Sale,” or “Sold” means the exchange of Personal Information for monetary consideration by us to a third party. This does not include the following: (i) disclosure of Personal Information to a third party that processes data on behalf of us; (ii) disclosure of Personal Information to a third party for purposes of providing a product or service requested by you; (iii) disclosure or transfer of Personal Information to an Affiliate of Subaru; (iv) disclosure or transfer of Personal Information to a third party as an asset that is part of a proposed or actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of our assets; and (v) disclosure of Personal Information that is intentionally made available by you to the general public via a channel of mass media without restricting the Personal Information to a specific audience.
“Sensitive Personal Information” means any of the following: (i) Personal Information revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life or sexual orientation, or citizenship or citizenship status; (ii) genetic or biometric data that may be processed for the purpose of uniquely identifying an individual; (iii) Personal Information from a person known to be under 13 years of age; or (iv) precise geolocation data.
“Verifiable Request” means the identifying information provided by a consumer in connection with a request matches the Personal Information of the consumer already maintained by us. Identifying information includes your name, contact information, and Vehicle Identification Number, if applicable.
“Targeted Advertising” means displaying to a consumer an advertisement that is selected based on Personal Information obtained or inferred over time from the consumer’s activities across nonaffiliated websites, applications, or online services to predict consumer preferences or interests. “Targeted Advertising” does not include the following, (i) advertising to a consumer in response to a consumer request; (ii) advertisements based on activities within our own websites or online applications; (iii) advertisements based on the context of a consumer’s current search query, visit to a website, or online application; or (iv) processing Personal Information solely for measuring or reporting advertising performance, reach, or frequency.
“Profiling” means any form of automated processing of Personal Information to evaluate, analyze, or predict personal aspects concerning an identified or identifiable individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
B. Information We Collect or Process
Subaru has collected the categories of Personal Information listed in the INFORMATION WE COLLECT section above from Virginia residents, including:
Category |
Examples / Description |
Identifiers |
A real name, username or alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, vehicle information (such as model and year), vehicle identification number (VIN), vehicle telemetry data, or other similar identifiers. |
Other Personal Information subject to certain laws. |
A name, signature, Social Security number, address, telephone number, driver’s license or state identification card number. Some Personal Information included in this category may overlap with other categories. |
Commercial information |
Records of personal property, products or services purchased, obtained, or considered. |
Internet or other similar network activity. |
Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement. |
Geolocation data. |
Physical location and movements, including from Connected Vehicle Services or Technology Services. |
Inferences drawn from other Personal Information. |
Profile reflecting a person’s preferences, characteristics, predispositions, behavior, or attitudes. |
Recordings |
Audio recordings of Vehicle Occupants. Audio recordings when you call our call centers or a Retailer. |
Payment information |
Credit card information for optional Services, such as Subaru Starlink. |
Subaru obtains this Personal Information from the following types of sources: Virginia residents or their representatives, Retailers, Service Providers, Data Services Companies, Connected Vehicle Services, online activity, Affiliates, and Distributors.
Personal Information we collect may include Sensitive Personal Information. Sensitive Personal Information we collect includes precise geolocation data in connection with the Connected Vehicle Services. If you do not consent to the collection and processing of Sensitive Personal Information within these categories, please do not access or use the Connected Vehicle Services. In addition, you can stop the collection and processing of Sensitive Personal Information within these categories by canceling or requesting the STARLINK account holder to cancel the Connected Vehicle Services in accordance with the STARLINK Terms and Conditions.
For more information on Personal Information we collect, including the sources we receive Personal Information from, please review the Information We Collect, Use of Information, How We Collect Information and When Subaru Shares Information sections above. We collect and use these categories of Personal Information for the business purposes described in the Use of Information and When Subaru Shares Information sections.
We may disclose your Personal Information to a third party for a Business Purpose (as defined below) or Sell your Personal Information, subject to your right to opt-out of Sales and Sharing as described below.
C. Use of Personal Information
We may use, Sell, Share, or disclose the Personal Information we collect for one or more of the following “Business Purposes:”
We may use, Sell, or disclose the Sensitive Personal Information we collect for one or more of the following “Business Purposes:”
Unless we notify you otherwise, we will not collect additional categories of Personal Information, nor use the Personal Information we collect for any other materially different, unrelated, or incompatible purposes.
D. Disclosure of Personal Information
Subaru discloses the following categories of Personal Information of Virginia residents:
Subaru discloses Personal Information to the following categories of third parties:
Service Providers, emergency contacts, Affiliates, Distributors, API Providers, Data Providers, Retailers, Retailer Service Providers, Marketing Partners, Third Party Marketers, and governmental regulators having jurisdiction for our products or services as required to comply with the law.
When we disclose Personal Information for a Business Purpose, we enter into an agreement with the receiving party that describes the purpose for sharing the Personal Information and requires the receiving party to keep that Personal Information confidential, except as necessary for the Business Purpose; provided that when we disclose Personal Information to governmental entities, we may not be able to enter into such an agreement.
Additionally, we Sell Personal Information, subject to your right to opt-out of those Sales.
We also process Personal Information for Targeted Advertising, subject to your right to opt-out of such processing.
E. Your Rights and Choices
If you are a Virginia resident, you may request information about our collection and processing of your Personal Information, whether or not it was collected electronically. If you submit a Verifiable Request, we will disclose whether we have collected or processed your Personal Information and allow you to access the Personal Information we have collected, to the extent we continue to retain the Personal Information. To the extent technically feasible, we will disclose this information to you in a readily usable format that allows you to transmit the data to another entity without hindrance.
You also have the right to request that we delete any of your Personal Information that we collect or maintain by submitting a Verifiable Request. We may deny your deletion request if retaining your Personal Information is necessary for us or our Service Providers to:
If you are a Virginia resident, you further have the right to request that we correct any of your Personal Information that is inaccurate by submitting a Verifiable Request. We will correct any inaccurate Personal Information pursuant to your request, taking into account the nature of the Personal Information and the purposes of the processing of your Personal Information. We may deny your correction request if the Personal Information is accurate.
You may submit a Verifiable Request for the information listed above, or exercise any of your rights enumerated under this Virginia Notice, by calling us at 1-800-782-2783 or submitted your request through our website.
You may also submit a Verifiable Request on behalf of your minor child who is under 13 years of age.
After we receive your Verifiable Request, we will provide to you, in writing, the requested information. You can choose to have this information delivered to you by postal mail or electronically. We will try to respond to your Verifiable Request within forty-five (45) days of receipt, but if we require more time (up to another forty-five (45) days) we will inform you of the reason and extension period in writing. If we decline to act on your request for any reason permitted under the VCDPA, we will notify you of our decision within forty-five (45) day of receiving your request. If we deny your request, our response will explain the reasons why we cannot comply with your request.
If we deny your request in part or full, or fail to act on it within the required time period, you may have the right to appeal this decision by submitting a new Verifiable Request in which you conspicuously note that you are appealing a previous decision. If you are a Virginia resident, we will respond to your Verifiable Request to appeal within sixty (60) days of receipt. If applicable, our response will explain the reasons why we are denying your appeal, and any further steps that may be available to you.
You have the right, at any time, to direct us to stop processing your Personal Information for Targeted Advertising, Profiling, and/or Sale to third parties. You may opt-out of these uses of your Personal Information by submitting a Verifiable Request. However, if you change your mind, you may opt-in to the processing of your Personal Information for Targeted Advertising, Profiling, and/or Sale to third parties at any time. Consumers who opt-in to processing of their Personal Information for Targeted Advertising, Profiling, and/or Sale to third parties may opt-out at any time.
If you choose to exercise a privacy right under the VCDPA, you have the right not to receive unlawful discriminatory treatment. For example, we will not:
However, please be aware that it may be a functional necessity for our Services to have Personal Information about you in order to operate, and we may not be able to provide some or all of our Services to you if you direct us to delete your Personal Information.
To exercise any of these rights, you (or your authorized representative) may submit a Verifiable Request to us by either: Calling us at 1-800-782-2783; or clicking here.
We are committed to protecting your privacy and to being transparent about how we use your Personal Information. We use the Information we gather from this site to enhance your overall experience with Subaru. If you have any questions or concerns about our Privacy Policy, please contact us at 1-800-782-2783 or Subaru.com/contactus and we'll be happy to help in any way we can.
