General Motors Europe

CUSTOMER SCREENING

Version 24.10.2023 

Cadillac Europe GmbH (Cadillac) has compliance obligations under the export control laws and regulations of the United States, United Kingdom, European Union, and other relevant jurisdictions which may restrict exchanging commodities with designated individuals or certain countries and their nationals. The data included in the export compliance list that Cadillac needs to screen against under the compliance obligations may relate to criminal convictions and offenses. 

 

If you consent, your personal data will be processed to verify your eligibility to purchase a vehicle from Cadillac by screening you against export compliance lists.

 

The personal data we will process includes your:  

 

First and last name; 

Full address; and

Where applicable, personal data relating to criminal convictions and offences.

 

You may choose not to consent to this processing, but in that case you will not be permitted to complete a transaction with us.

 

You have a right to withdraw your consent at any time, but your withdrawal will not affect personal data that has already been processed for this screening prior to the withdrawal of your consent. Our DPO can be contacted at privacy.europe@gm.com or at following address: FAO GM Europe DPO, 100 New Bridge Street, London, EC4V 6JA, United Kingdom.

 

Learn more by reviewing the Customer Screening Fair Processing Information.

Customer Screening Fair Processing Information.

Purpose of processing & legal basis

Cadillac has compliance obligations under the export control laws and regulations of the United States, United Kingdom, European Union, and other relevant jurisdictions which may restrict exchanging commodities with designated individuals or certain countries and their nationals. The data included in the export compliance list that Cadillac needs to screen against under the compliance obligations may relate to criminal convictions and offenses.


We will rely on your explicit consent to process your personal data for the export compliance screening. Processing your personal data is a requirement necessary to enter into a reservation or purchase contract with Cadillac. If you choose not to consent, you will not be permitted to proceed with a reservation or purchase


With your consent, Cadillac will search the following for your first and last name and full address against the following lists:

 

  • US - OFAC, Non-SDN Chinese Military-Industrial Complex Companies List
  • Cuba Restricted List
  • U.S. Federal Register General Orders
  • Denied Persons ListDesignated Terrorist Organizations
  • Entity List
  • US - Military End User (MEU) List
  • Nonproliferation Orders
  • Palestinian Legislative Council List
  • Terrorist Exclusion List
  • Unverified List
  • WMD Trade Control Designations
  • HM Treasury Consolidated List
  • European Union Consolidated List
  • Foreign Sanctions Evaders
  • US - Non-SDN Menu-Based Sanctions (NW-MBS)
  • Specially Designated Nationals and Blocked Persons
  • Sectoral Sanctions Identifications
  • United Nations Consolidated List

 

Cadillac will contact you, unless prohibited by law, in the event of a screening match, and may ask for further information to determine the accuracy of the match. If we believe we have a confirmed match we cannot proceed with the transaction. Cadillac is prohibited by engaging in transactions with prohibited parties regardless of where they may be located.

Sharing your information

Cadillac may share your data with the following parties:

 

  • Companies within the group of companies to which Cadillac belongs, including General Motors Company (GM), that will process the personal data as a data controller or a data processor
  • Third party service provider, Descartes Visual Compliance, for export compliance screening purposes who processes and stores data on our behalf as a data processor
  • Professional advisors that process the personal data as a data controller
  • Other companies and organizations that process the personal data as a data controller, if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce any contract with you; or to protect our rights, property, or the safety of our employees, customers or others. This includes exchanging information with other companies and organisations for the purposes of our compliance with laws and regulations
  • Companies and consultants providing services to us (for example, Information Technology service providers who provide and maintain our systems and our website host). Those companies and consultants providing services to us will only use your information to provide those services and process the personal data as a data processor; or
  • The courts in connection with court proceedings that will process the personal data as a data controller

How long we keep your information and how we store it

We will only retain your personal data for as long as necessary for the export compliance purposes described in this Customer Screening Fair Processing Information. Typically, we will retain these records for five years. For example, we will only retain personal data we collect from you where we have an ongoing legitimate need to comply with applicable legal requirements. When we have no ongoing need to maintain your personal data, we will either delete it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it until deletion is possible.

International data transfers

Cadillac stores and accesses your data in the United States, the European Economic Area (EEA), Switzerland, and other locations where GM, our brands or our service providers operate worldwide. With respect to such transfers from the UK, the EEA or Switzerland to the United States and other non-EEA jurisdictions which are not deemed to have adequacy under data protection laws, we implement standard contractual clauses and other mechanisms, such as supplementary measures, to provide adequate protection for the transfer of this personal data. GM acts as a data processor for its GM controlled subsidiaries, including Cadillac and affiliates in Europe by providing data hosting, maintenance, support, and troubleshooting of services, as well as other redundant back office support. 

Your rights

If you are a resident of the European Economic Area, the UK or Switzerland, you may have the following rights in respect of your personal data, as described in the data protection laws applicable to your jurisdiction:

 

  • Request from us access to your personal data
  • Request from us rectification or completion of your incorrect or incomplete personal data
  • Request from us erasure of your personal data
  • Request from us temporary restriction of processing
  • Right to data portability, i.e. the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, under the conditions specified in data protection laws
  • Right to object: You have the right to object the processing of personal data concerning you under the conditions specified in data protection laws. Note that if you do this, it may impact our ability to provide certain products and services to you
  • Right to withdraw consent: If processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. If you withdraw your consent at any time, this does not affect the lawfulness of the processing of your personal data prior to the withdrawal of your consent. Note that if you do this, it may impact our ability to provide certain products and services to you
  • Right to lodge a complaint: You can lodge a complaint under data protection laws with the competent data protection supervisory authority

 

You can also access your online account to view or update certain of your personal data in that account.

How to contact us

For the purposes of data protection, the data controller is Cadillac Europe GmbH a company registered under the laws of Switzerland and having its registered office at Boulevard Lilienthal 6, 8152 Glattpark, Switzerland. Cadillac Europe GmbH has appointed a Data Protection Officer (DPO) in the EU pursuant to data protection laws. 

 

With respect to any questions regarding the protection of your personal data or your rights under the data protection laws, our DPO can be contacted at . Our DPO can also be reached at the following address: FAO GM Europe DPO, 100 New Bridge Street, London, EC4V 6JA, United Kingdom.

 

Learn More by reviewing the GM Europe Privacy Statement.