Toyota Canada Inc.
Connected Services Privacy Notice

Updated as of June 24, 2022

We may modify this Privacy Notice by posting a new version at www.toyota.ca/connectedservices-privacy or www.lexus.ca/connectedservices-privacy, effective on the date of publication. Your continued use of the Services (as that term is defined in the Vehicle Connected Services Terms of Use) after we make changes indicates that you accept and consent to those changes, so please check this Privacy Notice periodically for updates. We will notify you in advance of any material changes to this Privacy Notice and obtain your consent to any new ways that we collect, use, and disclose your personal information.

Toyota Supra Connect: This Privacy Notice DOES NOT apply to use of Toyota Supra Connect. Please visit supraconnect.ca for relevant terms.

This Privacy Notice DOES NOT apply to data collection unrelated to the Services, for example: on Toyota or Lexus websites, on sites that we do not own, operate, or control, or at in-person events.

This Privacy Notice DOES NOT apply to any Toyota or Lexus vehicles equipped with the Services located outside of Canada, the continental United States, Alaska, and Hawaii.

This Privacy Notice MAY NOT apply to rental vehicles to the extent certain Services are not made available by the rental company. For rental vehicles, the terms and conditions and privacy policy of the applicable rental company may also govern how data about the vehicle is collected and used.

I. INTRODUCTION

This Privacy Notice applies to your personal information and vehicle data that we collect, use, store, share and secure to provide the Services to you, including when you use the Toyota or Lexus apps. This Privacy Notice also applies to vehicles manufactured in partnership with other companies that are equipped with Toyota Connected Services, including the Subaru Solterra.

Privacy laws in Canada generally define "personal information" as any information about an identifiable individual, which includes information that can be used on its own or with other information to identify, contact, or locate a single person.

1. How We Use, Store, Share and Secure Data From You and Your Vehicle Equipped With the Services. When you purchased or leased your vehicle, your vehicle may have been equipped with an active “Connected Services” or “Vehicle Wireless Services” system which operates by collecting data from you and your vehicle, including vehicle location, vehicle health and driving data, to support navigation assistance, emergency services, remote engine start, maintenance alerts, infotainment apps and more, all as described in this Privacy Notice. When you purchased or leased a vehicle equipped with a “Connected Services” system, you had the opportunity to opt-in to receiving the Services, and in the event you did not want to receive the Services, you were presented with instructions on how to disable the Services upon taking possession of the vehicle. When opting-in to receive the Services, you also specifically consented to our collection, use, and disclosure of your personal information and vehicle data and our storage of such data as described in this Privacy Notice. You are in control over the “Connected Services” system. You can choose to opt-out of the Services at any time. You can also request deactivation of data transmission, which disables our collection and use of vehicle data and certain personal information through the Services.
   

   The bolded terms used below are defined in Section II of this Privacy Notice.

   1. Safety Connect. Your vehicle’s Safety Connect feature provides roadside and emergency assistance, automatic collision notifications, stolen vehicle assistance and accident advisory services. Safety Connect uses your vehicle’s Location Data or “vehicle location” (your vehicle’s latitude and longitude) to determine where your vehicle needs assistance and to dispatch assistance to you, your Vehicle Information (such as your vehicle’s model, year, and VIN) to verify your vehicle type and to help emergency responders identify your vehicle, your Account Information (such as your name, address, phone number, email address, etc.) to verify your identity and account, and your Voice Recordings (when you call our Response Center) for quality assurance.
   2. Service Connect. Your vehicle’s Service Connect feature uses your Account Information and your Vehicle Health Data (such as odometer readings, fuel level, oil life, and diagnostic trouble codes) to send you vehicle health reports, alert you of needed maintenance, and subject to your consent, to contact you by phone for service-related marketing.
   3. Remote Connect. Certain Remote Connect services such as vehicle finder, vehicle status, remote door lock and unlock, guest driver monitor, and vehicle alerts use your vehicle’s Location Data to find your vehicle and Vehicle Health Data to provide status updates as well as facilitate repairs.
   4. Navigation. Your vehicle’s navigation feature (such as Drive Connect) allows you to choose a place of interest, a location on a map, one of your favorites, a destination from your history, or enter an address or coordinates (latitude and longitude). In certain vehicles, navigation includes the Destination Assist program, which connects you with a live agent to provide navigation directions. Your vehicle’s Location Data and your Account Information are used to verify your account and to offer these features.
   5. Digital Key. Digital Key technology allows you to access (e.g. unlock, lock, start) your vehicle through the Toyota or Lexus app. When you bring your smartphone close to your vehicle, the app authenticates an encryption key before performing a vehicle function (e.g. unlock, lock, start). Your Account Information is used to offer this feature.
   6. App Suite, Toyota/Lexus+ Compatible Third Party Services, and other Services You Connect. The App Suite is available even if you do not have a subscription for the Services. To use the App Suite, you must download the application and accept the End User License Agreement. When you use our App Suite for traffic, fuel, weather, music or other apps, you will need to sign into your account with each compatible third party service in the App Suite; and we will pass the log-in information that you provide to us to the corresponding compatible third party service. Each compatible third-party service in the App Suite will also be given access to the vehicle data necessary for you to use its service. For more information about the vehicle information needed by each third-party service, please review the applicable third-party service’s privacy policy. We will use Voice Recordings to improve our responses and voice recognition. To facilitate functionality of your App Suite and linked third party services, your vehicle may share your Location Data and Voice Recordings transcriptions with your third-party services and upon their receipt, the respective third party’s privacy policy and terms will apply to their use of your Location Data and Voice Recording.
2. We Protect Your Data
   1. We protect your data through multi-layer defense technologies determined by the use of a risk-based secure by design program that relies upon a range of technical and administrative controls, such as the use of dedicated networks and encryption, as appropriate. Your vehicle is designed only to respond to commands from you and any authorized users, or from us and only for those features we provide, including door unlock, remote engine start and vehicle finder.
   2. Your Account Information (e.g., name, address, phone number, email), provided when you subscribe for the Services, is retained on servers that are secured according to industry best practices and which provide a level of protection that is reasonable given the sensitivity of the information, the purposes for which it is to be used, the quantity and distribution of the information and the medium on which it is stored.
3. Your Responsibilities

   As the owner/lessee of a vehicle equipped with a “Connected Services” system, you are responsible for: (1) informing passengers and drivers of your vehicle of how and why data is collected and used by us, (2) notifying us of a subsequent sale or transfer of your vehicle to another owner/lessee, and (3) deleting your personal and vehicle information contained in the vehicle, and your vehicle information contained in your Toyota or Lexus app, prior to the sale or transfer of your vehicle to another owner/lessee. If you do not notify us of a sale or transfer, your information may continue to be accessible from the vehicle and/or we may continue to send data about the vehicle to your account. To avoid this from occurring, and to ensure your privacy and that of the new owner/lessee, you must advise us of the sale or transfer and delete your personal and vehicle information prior to the sale or transfer. We are not responsible for any privacy related damages suffered by you or the new owner/lessee as a result of failure to take these steps.

II. COLLECTION AND USE

1. On a Regular and Continuous Basis, We Collect and Use Your
   1. Account Information. When you enter or update your name, address, phone number, email address, language preference and other information linked or directly related to you (“Account Information”), we create or update your account so that we can provide the Services and communicate with you. We collect and use Account Information so that we can provide the Services and communicate with you.
   2. Vehicle Information. We collect your vehicle’s make, model, year, body type, VIN and other information linked to your vehicle (“Vehicle Information”) so we can verify your vehicle type and provide the Services.
   3. Location Data. We collect and use your vehicle’s latitude and longitude (“Location Data” or “vehicle location”) to deliver the Services and App Suite services to you and for quality confirmation and product development. We record and transmit your vehicle’s Location Data when you contact us for emergencies, roadside assistance, stolen or missing vehicle, missing persons, and destination services.
   4. Remote Data. At last ignition off, we may collect the real time status of your vehicle (i.e., vehicle location, status of powered doors, windows, hood, trunk, sunroof, hazard lights, odometer reading, oil life, fuel economy, trip distance, distance to empty) so you can remotely access your vehicle’s most recent information. This information is used to deliver Remote Connect services to you.
   5. Driving Data. We collect your driving behavior data (“Driving Data”) which includes the acceleration and speed at which your vehicle is driven, travel direction, and use of the steering and braking functionality in your vehicle. Driving Data is used to deliver the Services and App Suite services to you, and for quality confirmation, and product development.
   6. Vehicle Health Data.
      1. “Vehicle Health Data” includes odometer readings, fuel level, oil life, Diagnostic Trouble Codes, and related data from your vehicle’s on-board diagnostic system to identify malfunction events. Related data includes engine coolant temperature, fuel injection volume, engine rotation per minute (RPM), and other data to assist in identifying issues and analyzing the performance of your vehicle. For hybrid vehicles, Vehicle Health Data includes hybrid battery data correlated to Location Data. For electric vehicles, Vehicle Health Data includes battery charge data and electricity consumed for charging.
      2. If you opt-in to Service Connect, we use Vehicle Health Data to (a) tell you when your vehicle is due for maintenance or service, (b) provide you with vehicle health reports (maintenance and malfunction statuses, and service campaign and safety recall information) and vehicle alerts (notifications when your vehicle reports malfunction-related events) and (c) contact you.
   7. Multimedia Screen Data. We may collect and use Multimedia Screen Data (how you interact with your screen) for quality confirmation, and to improve functionality and product offerings.
   8. Voice Recordings. If you or anyone in your vehicle speaks with the Response Center for purposes of emergency services, roadside assistance, stolen vehicle locator, Destination Assist, or any other reason, your conversation will be recorded (“Video Recordings”) to deliver the Services to you and for quality assurance.
   9. Voice Recognition Recordings. In select models with hands-free control of in-car multimedia and a linked smartphone, we may collect Voice Recordings to improve the quality and performance of voice recognition capabilities.
   10. Anonymized or Aggregated Information. We may anonymize or aggregate personal information collected from you and use such anonymized and aggregated information for data-analysis, research, and any other purposes.
   11. Other Uses. Where applicable, we use Location Data, Driving Data, Vehicle Health Data, data derived from Safety Connect (which includes automatic collision notification, roadside, emergency and stolen vehicle assistance), navigation, Remote Connect, Service Connect, and Wi-Fi connectivity for the following purposes:
       1. Improve Safety.
       2. Develop New Vehicles and Features.
       3. Confirm Quality.
       4. Analyze Data (e.g., Vehicle Trends).
       5. Prevent Fraud or Misuse.
       6. As Required by Law or Legal Process.

III. STORAGE OF INFORMATION

1. Account Information
   1. We store your Account Information for four (4) years after expiration of your subscription for the Services.
2. Vehicle Location, Driving Data, Health Data, Multimedia Screen Data, Voice Recordings, and Remote Data
   1. Data collected from your vehicle is stored for different periods of time.
      1. Location Data. We will store Location Data in an identifiable format for a period of time not to exceed 10 years from the date of creation.
      2. Driving Data. We will store Driving Data in an identifiable format for a period of time not to exceed 15 years from the date of creation.
      3. Multimedia Screen Data. We will store Multimedia Screen Data in an identifiable format for a period of time not to exceed 10 years from the date of creation.
      4. Vehicle Health Data. We will store Vehicle Health Data in an identifiable format for a period of time not to exceed 15 years from the date of receipt by us. We will also store your vehicle health reports for 12 months from the date of creation.
      5. Voice Recordings. If you (or vehicle occupants) speak with the Response Center, your conversation may be recorded and stored for up to two (2) years; and a record of your conversation may be stored for up to four (4) years.
      6. Remote Data. We store the real time status and Location Data of your vehicle from the last ignition off for the purpose of delivering your vehicle’s most recent information in support of Remote Connect services. We retain this data for four (4) years.
      7. As Required by Law. For all of (a) through (f), notwithstanding the retention periods set out above, we may retain such information as required by law, legal process or litigation, and to support requests from you or law enforcement.

IV. SHARING OF INFORMATION

1. Account Information
   1. We may share your Account Information with:
      1. Emergency Responders. To provide emergency assistance to you with our Safety Connect feature. This includes roadside assistance providers.
      2. Our Affiliates. To support vehicle improvement. Also, if your lienholder/lessor is Toyota Credit Canada Inc. (“TCCI”) and TCCI requests that we find your vehicle because of (1) alleged fraud or (2) breach of your lease, retail installment contract or vehicle loan with TCCI, we can try to locate your vehicle and share that location with TCCI. TCCI will be required to contact us directly and provide us with the information we request to verify the fraud or breach of your lease, retail installment contract, or vehicle loan.
      3. Our Parent Company. We may also share your personal information to support safety, research, analysis, and product development by our parent company, Toyota Motor Corporation.
      4. Third Party Service Providers. We contractually bind our third party service providers and contractors to keep your personal information confidential and to use it only for the purposes for which we disclose it to them, and to process your personal information in accordance with the same standards set out in this Privacy Notice. For example, Toyota Connected North America, Inc. provides customer support and the other services that are part of the Services, and apps such as Amazon (example: “Alexa, start my vehicle”) may store and use the information you provide to them in order to verify your account and provide you with their services.
      5. Your Dealer. We may share your Account Information and Vehicle Health Data (for Service Connect) with a specified dealer only if you have provided your prior express consent or as required by law.
      6. Vehicle Sale or Transfer. As the owner/lessee of a vehicle equipped with a “Connected Services” system, if you do not notify us of a sale or transfer of your vehicle, and do not take steps to remove your information from the vehicle and from your Toyota or Lexus app, your information may continue to be accessible from the vehicle and/or we may continue to send data and reports about the vehicle to your account. We are not responsible for any privacy related damages suffered by you or the new owner/lessee as a result of failure to take these steps.
      7. Law Enforcement. We DO NOT share your personal information with law enforcement unless we are required to do so by law or legal process, in response to government investigations, as may be required for national security, or where we believe it necessary to prevent harm, injury or loss, or to investigate suspected instances of fraud.
   2. We DO NOT share your Account Information with:
      1. Data Resellers.
      2. Social Networks.
      3. Ad Networks.
      4. Insurance Providers, unless we have your consent or as required by law.
2. Your Vehicle Location Data, Driving Data, and Health Data

   We may share the following data with our affiliates and business partners for quality confirmation, and product development. We also share the following data with others if required by law, litigation, legal process, customer service and our legitimate business purposes.

   1. Location Data. We may share your vehicle’s Location Data, linked to your VIN, and Account Information with emergency responders, law enforcement, our affiliates and service providers acting on our behalf, as well as any compatible third party services you have authorized to receive your vehicle’s Location Data. With your consent, if your vehicle is stolen or you are attempting to locate missing persons, we can try to locate your vehicle and share that Location Data with local authorities. We can work with local authorities to recover the vehicle utilizing the vehicle’s GPS.

      Automatic collision notification operates so that if the airbag sensor is triggered or there is a severe rear-end collision of your vehicle, your vehicle will send an electronic signal to our Response Center and record and transmit your vehicle location, so that we can share your Account Information and vehicle location with emergency responders and provide assistance to you. If you press the “SOS” button, your vehicle will send an electronic signal to our Response Center and record and transmit your vehicle location so that we can share your Account Information and vehicle location with emergency responders and provide assistance to you.

   2. Voice Recordings. We share Voice Recordings with law enforcement and our service providers acting on our behalf in order to provide Connected Services to you.
   3. Remote Data. We share your vehicle’s Location Data based on last ignition off to assist you in finding your vehicle. When you press the “Destination Assist” button on your in-vehicle navigation unit, your vehicle will send an electronic signal to the Response Center which identifies your vehicle location to the Response Center agent who answers your call. We also share real time status of your vehicle (i.e., vehicle location, status of powered doors, windows, hood, trunk, sunroof, hazard lights, odometer reading, oil life, fuel economy, trip distance, distance to empty) only with you.
   4. Multimedia Screen Data. We may share your Multimedia Screen Data with our parent company for quality confirmation, and to improve functionality and product offerings.
   5. Driving Data. We share Driving Data with our affiliates and business partners so we can work together to provide Connected Services to you and for product improvement. If you provide express prior consent, we may also share your Driving Data with our affiliates and non-affiliated insurance companies to provide you with usage-based insurance information and offers. We will also share Driving Data with compatible third party services but only when you authorize us to do so.
   6. Vehicle Health Data. If you specifically agree to allow us to share your Vehicle Health Data with a specific dealer for its own use, we will share your most current Vehicle Health Data, linked to your VIN and Account Information, and last 12 monthly vehicle health reports with such dealer.
   7. Aggregated Data Sharing. We may sometimes share anonymized and aggregated Location Data, Driving Data and Vehicle Health Data with business partners for education and research related to environmental and energy issues, advanced technologies, and usage analysis.
   8. Compatible Third Party Services. We may send Location Data and voice request transcriptions to compatible third party services or technologies you have linked to your Connected Services account.

V. TRANSFERRING INFORMATION

We may transfer personal information that we collect or that you provide as described in this Privacy Notice to contractors, service providers, and other third parties we use to support our business and who are contractually obligated to keep personal information confidential, use it only for the purposes for which we disclose it to them, and to process the personal information with the same standards set out in this Privacy Notice.

We process, store, and transfer your personal information in and to the USA and Japan, countries with different privacy laws that may or may not be as comprehensive as Canadian law. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of that country may be able to obtain access to your personal information through the laws of the foreign country. Whenever we engage a service provider, we require that its privacy and security standards adhere to this Privacy Notice and applicable Canadian privacy legislation.

VI SECURITY

1. We take information security seriously.
2. We protect your data and secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure through the use of a risk-based security program that relies upon a range of physical, technical and administrative controls, such as the use of dedicated networks and encryption, as appropriate.
3. Our security program includes:
   1. System Defenses. We designed the Services technology to provide data security based on fundamental security principles such as integrity, confidentiality, and availability. It employs layers of defense to drive strong safeguarding practices, such as, where appropriate, code and design reviews, security testing, firewalls, intrusion detection systems, signing and encryption.
   2. Private and Public Wireless Networks. We use both private and public wireless networks to receive data transmitted from your vehicle. If a public network is used, the data is encrypted. In addition, your vehicle is designed only to respond to commands from you and any authorized users, or from us and only for those features we provide such as door lock/unlock, remote engine start/stop and vehicle location.
   3. No Warranties. Please note, however, that we cannot completely ensure or warrant the security of any information transmitted to us by you or your vehicle. Your use of your vehicle’s Connected Services and App Suite is at your own risk. You have the option to opt-out of Connected Services or request deactivation of data transmission (a) by contacting us via the “SOS” button in your vehicle, (b) by calling Customer Care, or (c) via your Toyota or Lexus App.

VII CHOICE

1. Choices. We give you choices about what data you share with us.
   1. Opt-in/Opt-out.
      1. Service Connect Communication. You may opt-in to share Vehicle Health Data with your dealer for its own use and allow your dealer, with your express consent, to contact you by cell phone call for service appointments and service-related marketing at the number you provided.
      1. You may opt-out of Service Connect Communication at any time, and you will no longer receive phone calls about upcoming service appointments and other service-related marketing messages from your dealer. To opt-out, you must use the Toyota or Lexus app. This is the exclusive method to opt-out from Service Connect Communications for service appointments and service-related phone calls from your dealer. Please allow five (5) business days to process revocation status. I understand that opting out of Service Connect Communication does not turn off vehicle data transmission or opt me out of other connected services or opt me out from communications from my dealer generated independent of Service Connect.
      2. Fuel Cell and Plug-in Hybrid Vehicle Applications. You may opt-in or opt-out of fuel cell or electric vehicle plug-in hybrid vehicle applications, such as Low Carbon Fuel Standards and Vehicle Grid Integration. If you opt-out, your vehicle will not send us real time status data, such as the vehicle location, status of powered doors, windows, trunk, hood, sunroof, hazard lights, odometer reading, oil life, fuel economy information, and distance to empty.
   2. Review and Update. You may also review and update your Account Information at any time by contacting us. (See Contact Us Section.)
   3. Deactivation. When you lease or buy a vehicle equipped with Connected Services, data collection is active. You may opt-out of Connected Services or request deactivation of data transmission at any time by contacting us and we will no longer collect certain Account Information, Location Data, Driving Data and Vehicle Health Data.

VIII CONSENT

1. You Agree To This Privacy Notice When You:
   1. Opt in to receive the Services using the Connected Services Agreement provided at the time of purchase/lease from an authorized dealer.
   2. Agree to a Connected Services Master Data Consent for the Services through the App or through live agent enrollment.

      Warning: By agreeing to this Privacy Notice, you specifically consent to our collection, use, and disclosure of your personal information and data as described above, and our storage of such data as described in this Privacy Notice. You can choose to opt-out of the Services at any time. You can also request deactivation of data transmission, which disables our collection and use of certain Account Information and vehicle data as described above.

NOTE: If you did not accept the Connected Services Agreement provided to you by your Dealer upon delivery of your vehicle, and if you do not wish to receive Services, please notify us within 15 days of taking delivery of the vehicle and we will cancel your Services. Failure to cancel your Services within 15 days of receipt of the Connected Services Agreement will be deemed acceptance of the Connected Services Agreement. You can disable the Services at any time.

IX YOUR RIGHTS

1. ACCESSING AND CORRECTING YOUR PERSONAL INFORMATION

   It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes. By law you have the right to request access to and to correct the personal information that we hold about you.

   You can review and change your Account Information by logging into the Lexus or Toyota app and visiting your account profile page.

   If you want to review, verify, correct, or withdraw consent to the use of your personal information you may also contact us using the information provided below to request access to, correct, or delete any personal information that you have provided to us. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect. We may charge you a fee to access your personal information, however, we will notify you of any fee in advance.

   We may request specific information from you to help us confirm your identity and your right to access, and to provide you with the personal information that we hold about you or make your requested changes. Applicable law may allow or require us to refuse to provide you with access to some or all of the personal information that we hold about you, or we may have destroyed, erased, or made your personal information anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal information, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

2. WITHDRAWING YOUR CONSENT

   Where you have provided your consent to the collection, use, and disclosure of your personal information, you may have the legal right to withdraw your consent under certain circumstances. To withdraw your consent, if applicable, contact us using the information provided below. Please note that if you withdraw your consent we may not be able to provide you with a particular product or service. We will explain the impact to you at the time to help you with your decision.

X. AGREEMENT

1. Sample Agreements. To view a copy our most recent Services related agreements, please go here www.toyota.ca/connectedservices-privacy or www.lexus.ca/connectedservices-privacy

XI. CONTACT US

1. Contact Us

   If you have questions or concerns about this Privacy Notice, or would like to request deactivation of data transmission, update your Account Information, or opt-in or opt-out from particular features, please contact us.

   • LEXUS VEHICLES:
     Phone: 1-800-265-3987
     Toyota Canada, One Toyota Place,
     Toronto, ON, M1H 1H9
   • TOYOTA VEHICLES:
     Phone: 1-888-869-6828
     Toyota Canada, One Toyota Place,
     Toronto, ON, M1H 1H9

We have procedures in place to receive and respond to complaints or inquiries about our handling of personal information, our compliance with this Privacy Notice, and with applicable privacy laws. To discuss our compliance with this Privacy Notice please contact our Privacy Officer using the contact information listed above.

Click here to see our Privacy Policy.

NOTE: If you did not accept the Agreement, please notify us within 15 days of taking delivery of the vehicle and we will cancel your Services. Failure to cancel your Services within 15 days of receipt of the Agreement will be deemed acceptance of the Agreement.