(Version dated: March 2025 – The Privacy Policy is updated regularly. The current version can always be found online at https://consent.vwgroup.io/consent/v1/texts/VWConnectTouareg/ie/en/dataprivacy_T/latest/html)
This Privacy Policy provides information on the processing of personal data by Volkswagen AG in connection with the use of mobile online services (“VW Connect”). The Privacy Policy for the use of vehicles can be accessed under “Legal” on the vehicle screen and online at https://consent.vwgroup.io/consent/v1/texts/VWConnectTouareg/ie/en/dataprivacy_car/latest/html.
As a German company, Volkswagen AG is bound to German law and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation)(“GDPR”). This also applies when Volkswagen AG processes personal data of persons with a permanent residence outside of Germany. Part I of this Privacy Policy contains information on the processing of personal data as required by German law and the GDPR.
To some extent, Volkswagen AG may also be bound by national legislation of other countries. Persons with a permanent residence in one of the countries specified in Part II of this Privacy Policy, can find further information in that section.
Part I
A. General information on the processing
of personal data
I. Person responsible for processing data
II. Data protection officer
III. Purposes for which data is processed when you use the mobile online services
IV. Processing for the purposes of Volkswagen AG advertising and contract communication
V. Data processing for the purpose of business reporting
VI. Erasure and rectification of data
VII. Data recipients
B. Your rights
I. Right to information
II. Right to rectification
III. Right to erasure
IV. Right to restriction of processing
V. RIGHT TO OBJECT
VI. Right to data portability
VII. Right to withdraw consent
VIII. Right to lodge a complaint
C. Data processing in detail
I. Volkswagen ID
II. Volkswagen Ident
III. Data processing with the use of mobile online services
IV. Service portfolio
The responsible office for the processing of personal data is Volkswagen AG (hereafter also referred to as “we” or “us”).
Volkswagen AG can be reached at:
Volkswagen AG
Berliner Ring 2
38440 Wolfsburg
Germany
Tel.: +49-5361-9-0
Register of companies number HRB 100484 (Braunschweig district court)
Our data protection officer is the contact person for all matters relating to data protection and for exercising data subject rights (see Section B. “Your rights”).
Please address requests to:
Datenschutzbeauftragter der Volkswagen AG
Berliner Ring 2
38440 Wolfsburg
Germany
Data subject rights can also be exercised by using the email address info-datenschutz@volkswagen.de (Germany) and privacy@volkswagen.de (outside of Germany) or our Volkswagen Privacy Portal https://www.datenschutz.volkswagen.de. You can select the desired language in the Volkswagen Privacy Portal.
We will process personal data of our customers that our customers have provided to us while registering for the mobile online services, such as email address, password, S-PIN, name, address, User - ID, vehicle identification number (VIN), vehicle brand, nickname, preferred language, time the order was placed (Start Timer 72 hours), time of activation, date of birth (for VW Ident) and IT usage data, for the purposes of concluding and fulfilling the contract for mobile online services (Article 6(1)(b) GDPR).
With a view to improving user friendliness, ensuring smooth functionality and enhancing the process of activating the mobile online services for a vehicle, we will analyse the following data:
A pseudonymised user ID that is generated by means of a pseudonymisation algorithm, combining the user ID and vehicle identification number.
IT usage data that is generated in the context of the activation process and allows information to be inferred about the running and status of the activation process.
The data processing described above is based on our legitimate interest to offer our customers and potential customers newly developed as well as improved products and services (Article 6(1)(f) GDPR).
If the vehicle is used with the mobile online services activated, we will process personal data from the vehicle, to the extent that this is necessary, for the purpose of providing said services.
If a vehicle user is logged in at the vehicle as the primary user, a secondary user or a guest user with Volkswagen ID, we will process their personal data for the purpose of meeting our contractual obligations (Article 6(1)(b) GDPR). The use of mobile online services does not require logging in at the vehicle with an account. This requires that the settings in the vehicle are set to the Online mode. After that, the personal data of the vehicle user will be processed according to the selected privacy settings. This data processing is based on our legitimate interest to make the mobile online services available on the vehicle accordance with the contract (Article 6(1)(f) GDPR). For information on the privacy settings and user concept, please see Section “C. Data processing in detail” under “III.1 Privacy settings and managing services” and “III.2 User concept”.
The following will always be processed when using the services: vehicle identification number (VIN), vehicle IP address, the data of the SIM card of the vehicle and an internal Volkswagen customer identification number (if available). The additional data that will be processed and information on the privacy settings, user concept and individual user roles, is available in Section C. “Data processing in detail” under “III. Data processing when using mobile online services”.
When a customer logs in with the Volkswagen ID in the vehicle, we will process the vehicle identification number (“VIN”) and the IP address of the vehicle for the functionality of the login process. This is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest to perform the contract for mobile online services with the guest user.
The Emergency Call Service is available in the vehicle even if no mobile online services have been purchased for the vehicle. The data processing to provide this service occurs for the protection of vital interests (Article 6(1)(d) GDPR).
The vehicle normally connects once to the Volkswagen data server before it is handed over to the vehicle purchaser or user at the dealership (but certainly no later than when the vehicle has reached an initial odometer reading of 25 km) so that the software certificates can be updated and the vehicle registered on the Volkswagen data server. The vehicle odometer reading and the vehicle identification number (VIN) are processed for this purpose. This update process is necessary so that the mobile online services can be made available ready for activation and so that the services that are already available in the vehicle function without concluding a contract for mobile online services. If the vehicle was set to “Maximum privacy” in the privacy settings immediately before the start of the update process, it will automatically return to this privacy level on completion of the update process, no later than at the next vehicle start. Data processing is carried out for the purpose of performing the sales contract for the Internet-enabled vehicle agreed between the vehicle purchaser and the dealership (Article 6(1)(b) GDPR).
To enable technical provision of the services following their activation (particularly in order to authenticate the vehicle and establish a secure connection between the vehicle, the user and the Volkswagen data server), the VIN, IP address, SIM card data of the vehicle and the internal Volkswagen customer identification number will be processed. This internal customer identification number will be used to uniquely identify the vehicle user and to check that the vehicle user is authorised to use a particular service in the vehicle. The aim of this is to prevent unauthorised persons from gaining access to the services. This data processing is carried out for the purpose of providing the services (Article 6(1)(b) GDPR) and is necessary for authenticating the vehicle and establishing secure communication between the vehicle and the respective vehicle user and the data server.
In addition, when the vehicle is started, the time of the vehicle systems is synchronised with that of the data server. This data is processed to ensure the IT security for the mobile online services. The vehicle must have the correct time in order to check the validity of the certificates transmitted from the vehicle for secure communication. This is a necessary prerequisite to ensure secure communication with the data server and combat cyber attacks by third parties. Data processing is carried out for the purpose of fulfilling the sales contract for the Internet-enabled vehicle between the vehicle purchaser and the dealership and, if applicable, for initiating the contract or fulfilling the “VW Connect” contract (Article 6(1)(b) GDPR).
In addition to the VIN, we will also log the time and type of any service used and, where applicable, further usage data in relation to the mobile online services to identify and analyse faults and security threats. This takes place in order to protect our legitimate interest of improving the mobile online services so that we can provide the IT security for the mobile online services without faults to all our customers to the maximum possible extent (Article 6(1)(f) GDPR).
In the event of a fault being detected, we may process the contact details of our customers we hold on file to contact them should the need arise. Data processing is carried out for the purpose of the performance of a contract (Article 6(1)(b) GDPR).
Certain mobile online services enable access to the vehicle and/or control the vehicle’s warning signals, e.g. the Lock & Unlock function. Before these are used for the first time, a one-off identity verification process must be performed. As part of this, personal data provided by the customer to us will be compared with the details on the relevant identification document. Notification of this process occurs in advance. The data will be processed only once the customer has given consent Article 6(1)(a) GDPR) and for the purpose of activating the relevant mobile online services.
Related details are available in Section C. “Data processing in detail” under “II. Volkswagen Ident”.
Information on consultation for customer care can be found online in the “Privacy Policy for use of the Customer Interaction Centre (CIC)”. You can access this at https://cic-legal.volkswagen.com.
The Customer Interaction Center may contact individual customers to the extent necessary for the execution of the “VW Connect” contract. In doing so, the contact details on file with us will be processed for the purpose of contract performance (Article 6(1)(b) GDPR).
Applies to customers in Germany only:
Contact your authorised Volkswagen repairer (authorised workshop and/or dealership) for customer-focused support for our mobile online services, who handles the customer care for Volkswagen AG. The following data is included in the transmission to the authorised Volkswagen repairer and processed by the authorised Volkswagen repairer as a processor: contract data, name, first name, Volkswagen ID user account (email), VIN and vehicle data, verification status, user status (primary user yes/no), Service scheduling (service active / not active), preferred authorised workshop (service selected / not selected) and further data that you provide to us as part of your request. We will process this data in accordance with Article 6(1)(b) GDPR for the purpose of performing the contract for mobile online services or – if you are not already a customer – in order to initiate a contract for the use of the mobile online services.
Volkswagen AG always endeavours to send you information that is personally tailored to you as much as possible and thus improve advertising for the marketing of your products and services. This requires the well-founded analysis of your usage of our products and services. If you have given your consent to do so, Volkswagen AG will therefore process data from the Volkswagen ID user account and from VW Connect. We also use your data to contact you in the context of contract communication (e.g. if contracts are expiring). Details on processing this data (e.g. exactly what data is processed and how) is provided in the Volkswagen ID Privacy Policy at https://vwid.vwgroup.io/data-privacy.
As part of business reporting, data is processed to manage the business model of mobile online services and to enhance the customer experience. In doing so, we process data that is used in the vehicle in relation to the digital products and services purchased. Once it has been analysed, the data is made available to the responsible departments within Volkswagen AG only to the extent required for the respective purpose.
The following personal data will thereby be processed:
• Personal contact and identification data (e.g.: User ID)
• Vehicle data (e.g. vehicle identification number (VIN), vehicle equipment, country of delivery (importer))
• Contract data (e.g. customer type (private or business customer), customer ID, contract date, customer history (e.g. interest without conclusion of a contract, conclusions, payments, reimbursements, bonuses, reminders, terminations), customer complaints, information on products purchased (article number, activation status, activation date, duration, country selected on registration, payment method), status of marketing consent declaration, licence data (for example, licences purchased, expiration date))
• IT usage data (e.g. User ID, log file information for service calls, IP addresses)
• Vehicle usage data with VIN/registration number that is of importance in relation to guarantee, warranty, product liability, safe vehicle operation (e.g. country of delivery, chassis number, delivery data, equipment)
The data is processed for the following purposes:
• Analysis for sales control and product improvement
We process data to manage distribution, develop new products and services, and to improve existing ones, by analysing acceptance rates and important performance indicators (KPIs). The corresponding analyses include the tracking of the number of produced, delivered and registered vehicles and the corresponding product licenses as well as the calculation of enrolment and extension rates. For the above stated purpose, your personal data is processed on the basis of our legitimate interest in accordance with Article (6)(1)(f) GDPR. Our legitimate interest is in the estimation of acceptance rates of new products/services, and in the evaluation of the acceptance rates of existing products/services.
• Accounting
For accounting purposes, fault recognition and risk management, we compare shop offers with actual purchases and invoices from payment service providers. Additionally, as measures for quality control, license information and E-Commerce transactions are analysed to correct errors and minimise incorrect offers in the Volkswagen Connect Shop. For the above stated purpose, your personal data is processed on the basis of our legitimate interest in accordance with Article (6)(1)(f) GDPR. Our legitimate interest is in ensuring that accounting processes are error-free and financial documents match the actual transactions, as well as recognising and mitigating risks in relation to incorrect offers or purchases.
• Payment of commissions and compensations to the dealership and importer
For the calculation and payments of commission and compensation to dealerships and importers, we prepare reports by market and dealership with information on purchased products, product life, purchase date, price and commission value. The relevant data is then provided to the importers to derive the sales commissions. For the above stated purpose, your personal data is processed on the basis of our legitimate interest in accordance with Article (6)(1)(f) GDPR. We have a legitimate interest in the precise calculation and payment of commissions, provide the required data to importers and dealerships, and to manage the data specific to the market to ensure operational efficiency.
• Product monitoring, error analysis and implementation of fault rectification measures
We process data on the contract status, including the VIN, to identify and rectify product faults, and to determine if an affected customer is considered for receiving compensation, or to take other measures for fault rectification. For the above stated purpose, your personal data is processed on the basis of our legitimate interest in accordance with Article (6)(1)(f) GDPR. Our legitimate interest is in the monitoring of the product behaviour, analyse and rectify faults as well as determining if affected customers are entitled to compensation.
• Remunerating the service providers that we use for the mobile online services
We internally compare the licenses obtained in the Volkswagen Connect Shop with the license information stored in our systems to settle services utilised by us and process the payments to the service providers. For the above stated purpose, your personal data is processed on the basis of our legitimate interest in accordance with Article (6)(1)(f) GDPR. Our legitimate interest is in ensuring a correct settlement and payment to our service providers by checking and calculating the remuneration on the basis of the purchased licenses and the provided services.
The following data recipients are used as processors:
• Amazon Web Services Inc. (USA) – To provide an analysis and data platform
• Amazon Web Services EMEA SARL (Luxembourg) – To provide an analysis and data platform
• ADASTRA GmbH (Germany) – As a developer of dashboards and reports
• CARIAD SE (Germany) – As a developer of dashboards and reports
• P3 Automotive GmbH (Germany) – To support internal colleagues in communicating with importers
• SCREEN GmbH Training-Beratung (Germany) – To support internal colleagues in training importers to handle dashboards and reports
• Volkswagen Group Services GmbH (Germany) – To support internal colleagues in communicating with importers
Other third parties:
• Importers (as controllers) – For remuneration of dealers and importers within the scope of the contractually stipulated profit sharing for sales revenue of digital products
Recipients domiciled in third countries:
• Your personal data will be processed in an Amazon Web Services Cloud operated by Amazon Web Services EMEA SARL (“Amazon”) (as processor) in the European Union for the purpose of internal company reporting. Access to personal data by Amazon Web Services, Inc. (as processor), based in the USA, cannot be excluded, thus the relevant EU standard contractual clauses (a set of contractual clauses approved by the European Commission that accords the same protection to personal data that it has in the EU during data processing in non-EU countries) have been concluded.
• You can access the EU standard contractual clauses used at https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32021D0914. Volkswagen AG erases your personal data after 10 years or in accordance with the legal requirements, e.g. as soon as the purpose for which the data was collected no longer applies and provided that there are no other retention obligations.
If the personal data is no longer needed for the purpose or purposes for which it was collected, it will be erased by us if there are no statutory archiving obligations that prevent erasure.
Furthermore, our customers can rectify the data they have entered at any time in the settings of their Volkswagen ID – if they have created such an ID.
1. Data servers
The data may be processed on servers of the following service providers on our behalf and in accordance with our instructions:
CARIAD SE
Major-Hirst-Straße 7
38442 Wolfsburg
Germany
AUDI AG
Auto-Union-Straße 1
85057 Ingolstadt
Germany
Amazon Web Services, Inc. (“AWS”)
410 Terry Ave. North
SEATTLE WA 98109
USA
Amazon Web Services EMEA SARL
Avenue John F. Kennedy 38
1855 Luxemburg
Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
D18 P521
Ireland
Cubic Telecom GmbH
Eschersheimer Landstraße 14
60322 Frankfurt am Main
Germany
Vodafone GmbH
Ferdinand-Braun-Platz 1
40549 Düsseldorf
Germany
2. IT support service providers
In addition, we use various IT service providers both within and outside the EU. These assist us with the maintenance of our IT systems and with technical support, for example. Insofar as the service providers have access to personal data, they will process this data on our behalf and in accordance with our instructions only.
IT support is provided in particular by the following service provider:
CARIAD SE
Major-Hirst-Straße 7
38442 Wolfsburg
Germany
3. Other VW Connect users of the vehicle
Some services may allow vehicle users who have been assigned the primary and secondary user roles to view certain vehicle usage data (where applicable: including vehicle position data) via their personal login area in the web browser and/or via the “Volkswagen” app. To prevent access, the primary user and secondary user can deactivate certain services in the settings in the personal login area in the web browser under https://www.volkswagen.de/ or in the “Volkswagen” app. In addition, each vehicle user can restrict this data processing in the privacy settings. Detailed information on the privacy settings is provided in Section “C. Data processing in detail, III. Data processing when using mobile online services” under number “1. Privacy settings and managing services” and number “2. User concept”. Detailed information on data processing as part of the individual services is also available in Section “IV. Service portfolio”.
4. Other recipients
Personal and/or vehicle-related data will also be forwarded to third parties where this is necessary for improving our online presence or performing the contract, particularly for providing the mobile online services. See Section C. “Data processing in detail” for information about how data is forwarded to third parties in the context of providing specific mobile online services.
5. Recipients domiciled in third countries
For the purposes outlined in this Privacy Policy, Volkswagen AG also transfers personal data to recipients and processors domiciled outside the EU. Volkswagen AG agrees to EU standard contractual clauses with recipients in unsafe third countries to ensure that personal data is adequately protected. The EU standard contract clauses used in the EU languages can be accessed via the URL https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32021D0914.
If required by the applicable data protection legislation, other protective measures (such as encryption and additional contractual provisions) are also put in place to ensure that personal data is adequately protected.
6. Legal requirements for the disclosure of data
Insofar as legal regulations apply, we are obliged to hand over data stored by us to the necessary extent at the request of government agencies (e.g., in the investigation of a criminal offence). The legal basis for the transfer of data to the respective government agency is provided by the respective legal obligation (Article 6(1)(c) GDPR in conjunction with the respective legal obligation).
You can exercise the following rights with respect to Volkswagen AG at any time and free of charge.
If a primary user has activated mobile online services for a vehicle that you then use without logging in with your own Volkswagen ID, we will not be able to identify you while you are using it. If you assert data subject rights, we will have to check your identity and may ask you to provide additional information or clarification where necessary (in particular, information relating to the period or other circumstances of vehicle use). We can request this additional information so that we can identify the relevant personal data and make it available to you. We must also ensure when we provide personal data that we do not infringe the rights of other vehicle users.
More information on asserting your rights can be found at: https://datenschutz.volkswagen.de/.
You have the right to request confirmation from us as to whether or not personal data concerning you is being processed and – if it is – to be informed what personal data concerning you is being processed, and also which third parties within and outside the EU have had your data forwarded to them. You also have the right to obtain a copy of the personal data concerning you that is being processed by us.
You have the right to have incorrect or incomplete personal data concerning you rectified by us.
You have the right to demand erasure of your data if the requirements stated in Article 17 GDPR are met. According to this, you can request, for example, that your data be erased if it is no longer necessary for the purposes for which it was collected. In addition, you can request erasure if we process your data on the basis of your consent and you withdraw this consent.
you have the right to request restricted processing of your data if the requirements stated in Article 18 GDPR are met. This is the case, for example, if you dispute the accuracy of your data. You can request that processing is restricted for the period during which the accuracy of the data is being checked.
You have the right to object to the processing of your personal data in the following cases:
If processing takes place for direct marketing purposes (including profiling for direct marketing purposes).
If processing (including profiling) takes place on the basis of the following legal bases:
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Article 6(1)(e) GDPR).
Processing is necessary for the protection of our legitimate interests or those of a third party (Article 6(1)(f) GDPR). If you do raise any objection of this kind, we kindly request that you inform us of the reasons why you are objecting to data processing. If you object, we will no longer process your data unless we can prove compelling reasons for processing that outweigh your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.
If data processing is based on consent or contract performance and processing takes place using automated means, you have the right to obtain your data in a structured, commonly used and machine-readable format and to transmit this data to another controller. In addition, you have the right to have the personal data transmitted directly by us to another controller.
Where data processing is based on consent, you have the right to withdraw your consent, free of charge, at any time with effect for the future by sending an email to info-datenschutz@volkswagen.de (Germany); privacy@volkswagen.de (outside of Germany) or at our Volkswagen Privacy Portal https://www.datenschutz.volkswagen.de or through the contact details in the site notice.
You also have the right to lodge a complaint with a data protection supervisory authority or another competent data protection authority about our processing of your data. This can, for example, be the data protection authority in your country of residence. A list of all data protection authorities in the European Union and the European Economic Area can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en#member-ie.
Customers domiciled in Jersey have the right to lodge a complaint at the Jersey data protection authority, which can be contacted at https://jerseyoic.org/.
Customers domiciled in the United Kingdom have the right to lodge a complaint at the UK Information Commissioner's Office (ICO), the British regulatory authority for data protection matters, which can be contacted at https://ico.org.uk/.
The Volkswagen ID provides our customers with the option to log in at various online services of Volkswagen AG or third parties. The data processing necessary for this is carried out for the performance of a contract (Article 6(1)(b) GDPR). The Volkswagen ID acts as a central user account where our customers can centrally manage their personal data. In order to use a mobile online service, it may be necessary to create a Volkswagen ID or to log in with an existing Volkswagen ID. The mobile online service selected by the customer is linked with the Volkswagen ID of the customer. This linking will only take place if the customer has given consent for this (Article 6(1)(a) GDPR). Information on data processing in relation to the Volkswagen ID is available in the Privacy Policy, which can be accessed online under https://consent.vwgroup.io/consent/v1/texts/IdentityKit/de/en/volkswagen-dataPrivacy/latest/html.
An identity check (Volkswagen Ident) is required before using mobile online services that allow access to the vehicle (such as by “Lock & Unlock”).
1. Volkswagen Ident process per AutoIdent via myVolkswagen und the Volkswagen app
AutoIdent by IDnow is an identification solution that enables customers to identify themselves online and in real time. The customer uploads a machine-readable identification document, such as an identification card, passport or driving licence (depending on the applicable regulations in the country of the customer) and records a short selfie-video. The AutoIdent software then automatically checks the authenticity of the document and compares it with the video to ensure that this is the actual person who wants to identify themselves. As soon as the identity has been checked successfully, customers can verify their identity online and use mobile online services, such as those permitting access to the vehicle (e.g. “Lock & Unlock”).
The Volkswagen ID (internal identification number enabling the unique assignment of customer data) will be sent to the commissioned service provider.
This identification number will be enriched with further data (e.g. portrait image) by the commissioned service provider during the identification process. The customer will be notified of this separately in advance and must expressly consent before we are allowed to process the data in this way. In this case, the data will be processed by virtue of the customer’s consent on the basis of Article 6(1)(a) GDPR and Article 9(2)(a) GDPR solely for the purpose of identifying the customer in order to activate mobile online services for which unique identification is required. The data will be transmitted exclusively in encrypted format.
On conclusion of the identification process, the service provider will send the customer's surname, first name, date of birth and Volkswagen ID, as well as the time of identification, back to us for the purpose of documenting the result and enabling the mobile online services. In addition, the following will be sent for the purpose of documenting which identification document was used to identify the customer: type of document, the document number, country of issue, date of issue and date of expiry.
We analyse whether the Volkswagen Ident processes have been completed successfully or aborted. This is why we store the status of the verification process of a customer.
The front and back of the document, recorded security features of the identification documents and photos of the face are stored by IDnow for evidence purposes and erased after a maximum of thirty (30) days.
Volkswagen will store the personal data until the customer deletes the Volkswagen ID user account.
Third-party provider information:
IDnow GmbH
Auenstraße 100
80469 München
Germany
This recipient will process the personal data only on our behalf and in accordance with our instructions.
2. Volkswagen Ident process at your Volkswagen authorised workshop
As an alternative, the Volkswagen Ident process can be carried out on site at any Volkswagen authorised workshop if it offers this service. The customer must first complete the registration process in the customer’s personal login area in the web browser by providing the customer's surname, first name and date of birth.
On site at the Volkswagen authorised workshop, the data provided will then be compared with the details on the customer's driving licence. In this case, the data will be processed by virtue of the customer’s consent on the basis of Article 6(1)(a) GDPR and Article 9(2)(a) GDPR solely for the purpose of identification in order to activate mobile online services for which unique identification is required. The recorded data (driving licence number, date of issue, where applicable: country of issue, validity period) will be sent to us. The data will be transmitted exclusively in encrypted format. The Volkswagen authorised workshop does not store any data. The Volkswagen authorised workshop will process the data only on our behalf and in accordance with our instructions.
To activate mobile online services in the vehicle, a Volkswagen ID, a contract for mobile online services and a registration as the primary user of the vehicle are required.
When using mobile online services, the vehicle communicates with the Volkswagen AG data server. In the course of this, personal data (such as the vehicle identification number (VIN)) and technical data will be processed.
Privacy settings allow you to restrict the connection and, in turn, the processing of personal data. However, it may not be possible for mobile online services to be provided in full while data processing remains restricted.
1. Privacy settings and managing services
Privacy settings control the flow of data between the vehicle and the Volkswagen data server. In addition, other vehicle users who have been assigned the primary and secondary user roles may be able to view certain vehicle usage data (where applicable: including vehicle position data), depending on which services are available and have been activated on the vehicle. This, particularly the sharing of vehicle position data, can also be restricted with the privacy settings in the vehicle.
One of the following settings can be selected:
This setting offers maximum privacy. All mobile online services are deactivated with the exception of “Emergency Call Service”.
The SIM card is always registered in the mobile network to make sure an emergency call is made in case of an accident (for details on data processing in this case, see number “IV. Service portfolio”, under “Emergency Call Service”).
Vehicle and usage data will be processed. This prevents the processing of location data. Processing of other data, such as the vehicle identification number (VIN), is permitted.
All mobile online services are activated and the mobile online services can use the vehicle position. The vehicle position may be visible to other vehicle users within their personal login area in the web browser or in the “Volkswagen” app, insofar as this is permitted by the services. Information on the user concept is provided in the following section.
The primary user and secondary user can also activate or deactivate the services individually in the “Volkswagen” app or in the personal login area in the web browser under www.myvolkswagen.de. For instance, even before switching to another privacy level, services to be activated and deactivated for that level can be selected.
2. User concept
Users of the mobile online services can assume different user roles. Based on the user role, different authorisations are granted for using the mobile online services and the vehicle:
The user role “Primary user” is intended for the owner, keeper or another user of the vehicle who primarily uses the vehicle (e.g. lessee, company car user, etc.). The primary user has full access to the scope of mobile online services. There is only one primary user per vehicle. The primary user can be removed by resetting the vehicle to the factory settings via the menu of the infotainment system (under User -> Setup -> User Setting -> Information on Primary User). This is required before a new primary user can be added. The current primary user is clearly displayed in the vehicle for every user. This information is displayed in order to fulfil the contract for mobile online services (Article 6(1)(b) GDPR).
The primary user can view the nicknames and profile photos of the secondary and guest users with Volkswagen ID registered in the vehicle in their personal log-in area in the web browser.
The “secondary user” role is intended for users who regularly share use of the vehicle, e.g. as a family member, partner or friend of the primary user. Secondary users obtain their status from the primary user: secondary users have to be approved for the vehicle by the primary user; the primary user can withdraw the user role from the secondary user at any time. Secondary users can also end their assignment to the vehicle as secondary user themselves. Secondary users have nearly the same rights and options as primary users with regard to the use of mobile online services. If the primary user who granted authorisation to the secondary user loses their primary user status, the secondary user will lose their status as well.
The “Guest user with Volkswagen ID” user role is intended for users who use a vehicle occasionally or only once. Guest users can log into any Volkswagen AG Internet-enabled vehicle themselves for this purpose. Guest users have only limited access to certain mobile online services.
The “Anonymous guest“ user role is intended for users who use the vehicle without registering using the Volkswagen ID. The “Anonymous guest” profile in the vehicle cannot be deleted or renamed. Compared to the guest user with Volkswagen ID, access to mobile online services is further restricted for an anonymous guest. The anonymous guest starts every trip in offline mode and can then switch to online mode.
The “Local guest“ user role is intended for users who use the vehicle without registering using the Volkswagen ID. In contrast to the “Anonymous guest”, it is possible to create multiple local guests for each vehicle and name them individually.
Depending on what privacy level has been set by the current vehicle user, some services (such as the vehicle status service) allow the primary and/or secondary user to view certain data via their “Volkswagen” app or their personal login area in the web browser. In the case of logged-in users, the data is shared with other users for the purpose of performing a contract (Article 6(1)(b) GDPR) and in the case of anonymous guests, it is shared with other users on the basis of our legitimate interest to make the services available on the vehicle in accordance with the contract (Article 6(1)(f) GDPR).
Details regarding the services are provided under number “IV. Service portfolio”.
The mobile online services listed below may be available in the vehicle depending on the model and model year of the vehicle, the equipment, the country and the service plans which may or may not have been subscribed.
An overview is provided below of the data processed in the context of the respective service, the legal bases for processing and the respective data recipients. Details of the data recipients who receive data across multiple services are provided in Section “A. General information on the processing of personal data” under “VII. Data recipients”.
We are providing information about the services and which ones are associated with a particular service package under the following link: http://connect.volkswagen.com.
Services that process the current location of the vehicle user are identified with an *.
1. Departure times (VW Connect Plus)*
The “Departure Times” function allows vehicle users to specify when the battery of an electric or hybrid vehicle will be charged and whether this vehicle should be air-conditioned at the desired departure time. The data can be set and accessed by primary users and secondary users via the “Volkswagen” app.
Personal data: vehicle identification number (VIN), departure timer with settings for charging, air conditioning and off-peak electricity
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
2. Emergency Call Service*
If you get into a traffic accident or a medical emergency is detected, an automatic emergency call is sent to the Volkswagen Emergency Call Centre via the “Emergency Call Service”. The vehicle recognises when an accident has occurred via sensors and activates the “Emergency Call Service” in this case. Using the control located in the roof console (or in the infotainment system) of your vehicle, you can also manually report an emergency involving your own vehicle at any time via the “Emergency Call Service” or request assistance for other road users who are in an emergency situation.
The “Emergency Call Service” function can be deactivated by any participating authorised Volkswagen repairer. Further information is provided in the vehicle wallet of the vehicle.
Emergency Call Service:
Personal data: Vehicle identification number (VIN), vehicle type, time, location, direction of travel, number of people inside the vehicle, selected infotainment system language, severity of accident, direction in which accident occurred (e.g. frontal or side collision), triggering event, drive type
Legal basis: Art. 6(1)(d) GDPR (protection of interests that are essential for life); Art. 6(1)(f) GDPR (protection of legitimate interests)
Other data recipients: Bosch Service Solutions GmbH, Mainzer Landstraße 193, 60326 Frankfurt am Main, Germany (This recipient will process data only on our behalf and in accordance with our instructions.)
3. Driving Data (VW Connect)
This service allows primary or secondary users of the vehicle to have certain driving data displayed in their personal login area in the web browser and in the “Volkswagen” app. At the end of the journey, the aforementioned vehicle data will be sent to Volkswagen AG after switching off the ignition and will then be available for retrieval in their personal login area in the web browser and via the “Volkswagen” app.
Personal data: vehicle identification number (VIN), average speed, duration of journey, distance covered (not the actual route), average overall consumption
Legal basis: For the primary and secondary users: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the service for the primary and secondary users in accordance with the contract)
Other data recipients: none
4. Vehicle Status including Doors & Lights (VW Connect)
The “Vehicle Status” function allows the primary or secondary user to display various items of status data for the vehicle in the “Volkswagen” app.
Personal data: vehicle identification number (VIN), drive type, state of charge, tank levels, remaining range, mileage (km), window, door and gate status, central locking system status, light status, time stamp
Legal basis: For the primary and secondary users: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the service for the primary and secondary users in accordance with the contract)
Other data recipients: none
5. Horn & Turn Signals (VW Connect Plus)*
“Horn & Turn Signals” allows the primary user and secondary user to control the hazard warning lights and the horn of the vehicle remotely via the “Volkswagen” app if the user is within visual range (approx. 100 metres) of the vehicle, and also to display the current turn signal and horn status. The primary user and each secondary user can view the activity log for this service in their personal login area in the web browser.
Personal data: vehicle identification number (VIN), position of the vehicle and of your mobile device
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
6. Air Conditioning (VW Connect Plus)
“Air Conditioning” gives primary users and secondary users the ability to control the temperature inside of the electric or hybrid vehicle before they enter it using the air conditioning system (stationary air conditioning) and to activate (or deactivate) the window heating without having to be physically near the vehicle. The data can be set and accessed via the “Volkswagen” app.
Personal data: vehicle identification number (VIN), air conditioning status and settings, window heating status
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
7. Charging (VW Connect Plus)
“Charging” allows primary users and secondary users to control charging of the hybrid vehicle’s battery and check the charge level. The data can then be set and accessed via the “Volkswagen” app.
Personal data: vehicle identification number (VIN), charging status and settings
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
8. Navigation: Online Map Update (VW Connect Plus)*
This service allows the map material to be updated online directly on the vehicle. For this purpose, the vehicle analyses which regions in a country are relevant for the vehicle / travelled most frequently.
Personal data: Vehicle identification number (VIN), IT usage data, the most frequented regions (only in the case of an automatic update); version number of the currently stored map data
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: HERE Europe B.V., Kennedyplein 222 – 226, 5611 ZT Eindhoven, Netherlands (the recipient will process data only on our behalf and in accordance with our instructions).
9. Navigation: Parking Spaces (VW Connect Plus)*
“Parking Spaces” searches for suitable parking spaces in the vicinity of the current vehicle position. The application provides information about price, opening hours, distances and telephone numbers.
Personal data: Vehicle identification number (VIN), geoposition data (location), IT usage data
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: Valtech Mobility, Toulouser Allee 23a,40211 Düsseldorf, Germany; HERE Europe B.V., Kennedyplein 222-226, 5611 ZT Eindhoven, Netherlands (These recipients will process data on our behalf and in accordance with our instructions only.)
10. Navigation: Filling Stations and Charging Stations (VW Connect Plus)*
This service searches for suitable filling stations and charging stations in the vicinity of the current vehicle location. The application also shows the total number of charging stations and which ones are available. The application also provides information about the price, opening hours, distances and telephone numbers.
Personal data: Vehicle identification number (VIN), geoposition data (location), IT usage data
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: Valtech Mobility, Toulouser Allee 23a,40211 Düsseldorf, Germany; HERE Europe B.V., Kennedyplein 222-226, 5611 ZT Eindhoven, Netherlands (These recipients will process data on our behalf and in accordance with our instructions only.)
11. Online Anti-Theft Alarm (VW Connect Plus)
“Online Anti-Theft Alarm System” allows primary users and secondary users to select the means of communication (push notification and/or email) and thus activate the service in their personal login area in a web browser or in the “Volkswagen” app. After activating the service, they will be informed whenever the anti-theft alarm system is triggered. The primary user and each secondary user can view the activity log for this service in their personal login area in the web browser.
Personal data: vehicle identification number (VIN), User ID, reason why and time when system was triggered
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
12. Over-the-Air-Update / Online system update (VW Connect)
This service updates the vehicle software and the data of the infotainment system, e.g. to obtain new functions or get the systems ready for the latest changes relating to road traffic.
Personal data: vehicle identification number (VIN), software versions and hardware versions, as well as the hardware serial numbers and the selected infotainment system language, primary user (check for existence), email address
Legal basis: Article 6(1)(b) GDPR
Other data recipients: Arvato Supply Chain Solutions SE, Reinhard-Mohn-Str. 22, 33333 Gütersloh, Germany; CARIAD SE, Major-Hirst-Straße 7, 38442 Wolfsburg, Germany (These recipients will process data on our behalf and in accordance with our instructions only.)
13. Online POI Search (VW Connect Plus)*
The “Online POI Search” function (text/voice) allows the vehicle user to search for specific points of interest according to personal favourites.
Personal data: Vehicle identification number (VIN), geoposition data (location), IT usage data
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (This recipient will process data only on our behalf and in accordance with our instructions.)
14. Online Auxiliary Heater (VW Connect Plus)
“Online Auxiliary Heater” allows primary users and secondary users to control the auxiliary heater via the “Volkswagen” app.
Personal data: Vehicle identification number (VIN), departure times, air conditioning status and settings
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
15. Remote Ventilation Control (VW Connect Plus)
“Remote Ventilation Control” allows primary users and secondary users to control the auxiliary ventilation via the “Volkswagen” app.
Personal data: vehicle identification number (VIN), departure times, ventilation status and settings
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
16. Online Traffic Information (VW Connect Plus)*
The “Online Traffic Information” service provides information about current traffic events and shows the traffic flow on the map and along the route of the navigation system.
Personal data: Vehicle identification number (VIN), IT usage data
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: HERE Europe B.V., Kennedyplein 222 – 226, 5611 ZT Eindhoven, Netherlands. (This recipient will process data only on our behalf and in accordance with our instructions)
17. Breakdown Call (VW Connect)
The Breakdown Call function can be triggered both by breakdown events (with or without a warning lamp lighting up) and by minor accidental damage below the level required to trigger the restraint systems (such as the airbag and belt tensioner) or manually. Once the airbag control unit has detected an impact of this kind, the function offers the vehicle user to establish an audio connection with the Emergency Call Service or Breakdown Call via the infotainment system. As part of this, certain data will be transmitted automatically, such as details of the vehicle equipment, to help the Breakdown Call employees and, where applicable, those of the towing company to provide rapid and effective assistance.
We process your data to improve our products and business processes, customer functionality of the breakdown call, optimise customer benefit and to eliminate product faults. We will analyse your data for the purpose of product improvement and quality assurance of the breakdown call and to prevent interruptions or delays in the process sequence of processing requests. For example, we check for faults in the transmission of data to your authorised workshop (such as incomplete data or delays within the data transmission) for early detection and elimination. This allows us to offer the best possible customised service and increase customer satisfaction with digital services. Furthermore, the indicated data is forwarded to the responsible importer for their country for process management and improvement, such as by way of quality audits. The provided data will be erased after five years (the service is not supported in the following countries where only a recorded message will be played: Albania, Malta, Ukraine).
Personal data: vehicle identification number (VIN), phone number of the integrated SIM card in the vehicle, title, form of address, name, date of birth, address, country, phone number, email address, number plate, vehicle data (brand, mileage (km), remaining range, model name, model year, colour, gearbox, powertrain, year of manufacture, vehicle type, equipment features), insurance details (name of insurance provider of the party reporting the accident, insurance policy number of the party reporting the accident, nature of damage, name of the other party's insurance provider), case details (impact zone, severity of impact, date of accident, time of accident, cause, warning lamps, event memory entries, vehicle position, accuracy of GPS data, direction of travel, nature of damage, date of damage assessment, preliminary damage costing, service schedule, most recent service) and any other personal data shared by the vehicle user during the call; for data processing as part of the analysis: vehicle identification number (VIN), service requirement category, send date of the breakdown call data, the selected authorised workshop and information on the agreed appointment. Additionally, the relevant authorised workshop transmits the following data: vehicle identification number, time of lead acceptance, time of contact and time of lead closing.
Legal basis: for primary users, secondary users and guest users with Volkswagen ID: Article 6(1)(b) GDPR (for contract performance); with regard to data of any additional vehicle user Article (6)(1)(f) GDPR (legitimate interests: provision of the in-vehicle service in accordance with the contract); for data processing as part of the analysis: Article 6(1)(f) GDPR (legitimate interests: improvement of the products and business processes, customer functionality of the breakdown call, optimisation of customer use; elimination of product faults; process control and improvement in trade; increase of customer satisfaction with the services)
Other data recipients: A call centre appointed by the national sales company with responsibility for the respective country (importer), where applicable: a Volkswagen authorised workshop or a towing company as well as your insurance company after you have given your consent. As part of the analysis, the data is transmitted to CARIAD SE, Major-Hirst-Straße 7, 38442 Wolfsburg, Germany (CARIAD SE will process the data on our behalf and in accordance with our instructions only).
If the vehicle is in offline mode, the Breakdown Call is still available offline; however, in this case, automatic transmission of data from the vehicle to the call centre does not take place.
If this service was deactivated via the individual service deactivation in the “Volkswagen” app or under myVolkswagen, the Breakdown Call will not be available.
18. Parking Position (VW Connect)*
“Parking Position” allows the primary and secondary users to retrieve the last known vehicle location.
Personal data: vehicle identification number (VIN), most recent parking position when vehicle was switched off (removal of key, activation of Start/Stop button)
Legal basis: For primary and secondary users: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service in accordance with the contract)
Other data recipients: none
19. Satellite Maps (VW Connect Plus)*
This service allows the vehicle user to display a high-resolution navigation map with satellite images. The necessary data is transmitted to our service provider Google without the service provider being able to associate it with the vehicle user or the vehicle.
Personal data: Vehicle identification number (VIN), geoposition data (location), IT usage data
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: HERE Europe B.V., Kennedyplein 222 – 226, 5611 ZT Eindhoven, Netherlands. (This recipient processes data solely on our behalf and in accordance with our instructions.) Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (the only data transmitted is positioning data or the requested map tile, including the zoom level)
20. Service Scheduling (VW Connect)*
If the “Service Scheduling” service has been activated by the primary user, the Volkswagen authorised workshop (or where applicable: a national sales company appointed by the Volkswagen authorised workshop or a call centre) will contact the primary user via their selected communication channel (email or telephone) in the event of any necessary service work (oil changes, inspections and specific driver messages as stipulated by Volkswagen AG) for the purpose of scheduling an appointment.
Additionally, the status of the service scheduling requests will be transmitted back to the initiating service to identify and rectify product faults. This return transmission enables Volkswagen AG to identify process faults and their related causes early on.
If the authorised workshop specified by the primary user ceases trading or stops operating a Volkswagen authorised workshop as part of its business activities and the primary user has not yet selected any other Volkswagen authorised workshop, the national sales company with responsibility for the respective country will contact the primary user if any service work becomes necessary to offer an appointment with a suitable Volkswagen authorised workshop.
We process the data of their service scheduling request to improve our products and business processes, customer functionality of service scheduling, optimise customer benefit and to eliminate product defects.
We will analyse your previously indicated data for the purpose of product improvement and quality assurance of the service scheduling request and to prevent interruptions or delays in the process sequence of processing requests. For example, we check for faults in the transmission of data to your authorised workshop (such as incomplete data or delays within the data transmission) for early detection and elimination. This allows us to respond to the customer request for a service appointment in the best possible way and improve customer satisfaction with the digital services.
In addition, the specified data will be forwarded to the sales company responsible for the relevant country (for Germany, this is Volkswagen Deutschland GmbH & Co. KG) for the purpose of process control and improvement, e.g. through quality audits. The provided data will be erased after five years.
The primary user can deactivate the “Service Scheduling” service and the associated data transfer of servicing requirements at any time in the primary user’s personal login area in the web browser or in the settings of the “Volkswagen” app. Here, the primary user can also select, change or delete the primary user’s desired communication channel or preferred Volkswagen authorised workshop.
Personal data: vehicle identification number (VIN), trigger for data transfer (e.g. specific servicing requirements), mileage (km), brand, model, model year, engine code, gearbox code, inspection service interval, oil service interval, driver messages, form of address, title, first name/surname, desired communication channel (telephone/email); when data is processed in the context of analysis: vehicle identification number, servicing requirements category, date on which service appointment request was sent, the selected authorised workshop, agreed service appointment. In addition, the respective authorised workshop transmits the following data to us: vehicle identification number, time of lead initiation, time of contact initiation and time of lead closing.
Legal basis: for the primary user: Article 6(1)(b) GDPR (for contract performance) and, where applicable, Article 6(1)(f) GDPR (for the return transmission of the service scheduling request status for the identification, analysis and elimination of product faults / flaws as well as for the transmission of data to the responsible sales company, if the selected authorised workshop has ceased trading or stops operating a Volkswagen authorised workshop as part of its business activities; see above); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service in accordance with the contract); when data is processed in the context of analysis: Article 6(1)(f) GDPR (legitimate interests: improvement of business processes, functionality of service scheduling; optimisation of customer benefit; elimination of product defects; process control and improvement in trade; increase customer satisfaction with the services)
Other data recipients: we will transmit the servicing requirements to the primary user’s selected Volkswagen authorised workshop or to a national sales company with responsibility for the respective country and, where applicable, to a call centre appointed by the Volkswagen authorised workshop or a national sales company appointed by the Volkswagen authorised workshop (in the event of being appointed by the Volkswagen authorised workshop, the respective call centre or respective national sales company will process your data on behalf of and in accordance with the instructions of the Volkswagen authorised workshop only); in the context of analysis, the data will be sent to CARIAD SE (Major-Hirst-Straße, 38440 Wolfsburg, Germany) as our processor. If the selected authorised workshop has ceased trading or stops operating a Volkswagen authorised workshop as part of its business activities, Volkswagen Deutschland GmbH & Co. KG (Berliner Ring 2, 38440 Wolfsburg, Germany) will act as processor for us.
If the primary user has chosen a preferred authorised workshop located in Germany, Great Britain, Italy, France, Ireland, the Czech Republic, Spain (and the Canary Islands), Belgium, Switzerland, Sweden, Poland, Denmark, Finland, Norway, Portugal, Luxembourg, Hungary, Austria, Estonia, Latvia, Lithuania, Slovenia, Romania, Bulgaria, Netherlands, Serbia, Montenegro, Bosnia and Herzegovina, Croatia, Albania, North Macedonia, Iceland, Malta or Cyprus, Volkswagen AG will use the following processors: Volkswagen Software Asset Management (SAM) GmbH (Berliner Ring 2, 38440 Wolfsburg, Germany), dx.one GmbH (Berliner Ring 2, 38440 Wolfsburg, Germany) and Salesforce.com Germany GmbH, (Erika-Mann-Straße 31, 80636 München, Germany).
In relation to the use of processors, it is not possible to rule out that sub-processors based outside the EU/EEA may access the data. In order to guarantee an adequate level of protection for your personal data, Volkswagen AG safeguards this data transfer with appropriate guarantees or obliges its processors to do so where necessary. If required by the applicable data protection legislation, other protective measures (such as encryption and additional contractual provisions) are also put in place in order to ensure that your personal data is adequately protected. If processors or sub-processors located in the USA are certified in accordance with the Data Privacy Framework between the EU and USA, the EU-US adequacy decision applies accordingly, and the USA is considered a safe third country in this regard.
21. Online Voice Control (VW Connect Plus)
Depending on the software version, the mobile online services of “VW Connect Plus” also provide all users of the vehicle or only the primary user and secondary user with Online Voice Control in addition to Offline Voice Control in the vehicle (only available in the following languages: English (UK), German, French, Italian, Spanish).
The voice control can be activated via the push-to-talk button on the steering wheel or via the activation word in order to then formulate a request. Other vehicle occupants can also use voice control by means of the activation word. A background service runs on the vehicle’s infotainment system to enable use of the activation word. This service detects when the activation word is spoken. Every now and then, this background service may falsely detect the activation word.
As soon as voice control has been activated by the push-to-talk button or activation word, this is indicated by a graphic symbol on the infotainment system screen.
The advantage of the Online Voice Control compared to offline voice control is that it offers better speech recognition in general and allows online content to be controlled via voice control commands, e.g. streaming services and POIs for navigation.
The Online Voice Control is enhanced with the connection to ChatGPT (for the languages: German, English (UK), Spanish, French and Italian), whereby requests that the Online Voice Control cannot answer are forwarded to ChatGPT. For this, the service provider Cerence GmbH checks if the voice request can be answered. If this is not the case, the voice request is forwarded in text format to ChatGPT. ChatGPT sends a reply in text format to the service provider Cerence GmbH and from there back to the vehicle. When the reply is output in the vehicle, it is made clear that the result was generated by ChatGPT. When the voice request is processed via ChatGPT, the location data is not forwarded to ChatGPT.
With an existing online connection, the customer's voice inputs will also be analysed to continuously improve the voice control and voice recognition for all customers. They are thereby always analysed anonymised with automated processes and are only made accessible to trained employees of our service provider, Cerence GmbH for purposes of analysis for the optimisation of voice recognition.
Online Voice Control can be deactivated in the infotainment system at any time. In this case, the voice data will be processed solely in the vehicle. In addition, the recognition of the activation word can be deactivated in the infotainment system so that voice control can only be used via the push-to-talk button. If the vehicle is used in offline mode, the voice data will be processed solely in the vehicle (offline voice control).
Personal data in the case of an online connection: vehicle identification number (VIN), country stored in system or current vehicle position, selected infotainment system language, vehicle brand, user ID, regional code and version number of the infotainment software, voice control commands and the voice output (only for the languages EN-US, EN-GB, DE, FR, ES, IT, CZ)
Legal basis: for all vehicle users or only for primary and secondary user, depending on the software version: Article 6(1)(b) GDPR (for contract performance) and Article 6(1)(a) GDPR (for providing the “Online Voice Control” service and processing location data); Article 6 (1)(f) GDPR (legitimate interests: provision of the service for anonymous guests in accordance with the contract); the analysis of the voice inputs by Volkswagen AG and the service provider and the anonymisation of the voice inputs for further analysis occur according to Article 6(1)(f) GDPR (legitimate interest: improvement of voice control and voice recognition for all customers)
Other data recipients: e.solutions GmbH, Despag-Straße 4a, 85055 Ingolstadt, Germany; Cerence GmbH, Jülicher Str. 376, 52070 Aachen, Germany. (These recipients will process data on our behalf and in accordance with our instructions only.)
22. Streaming & Internet: Hybrid Radio (VW Connect Plus)*
As part of the “Hybrid Radio” function, the infotainment system identifies radio stations that are received via a radio signal (FM and DAB) and checks online to see whether any streams or metadata are available for these stations. This allows vehicle users to listen to relevant stations via online streaming if they are not currently able to receive them via the radio signal.
Personal data: vehicle identification number (VIN), country in which the vehicle is located; radio stations that can currently be received
Legal basis: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service in accordance with the contract)
Other data recipients: e.solutions GmbH, Despag-Straße 4a, 85055 Ingolstadt, Germany. (This recipient will process data only on our behalf and in accordance with our instructions.)
23. Streaming & Internet: Internet Radio (VW Connect Plus)*
As part of the “Internet Radio” function, the infotainment system makes available an up-to-date and language-specific catalogue of stations and podcasts. This gives vehicle users the option of listening to thousands of stations and podcast episodes of different kinds via online streaming.
Personal data: Vehicle identification number (VIN), country of current geoposition, current system language, software version
Legal basis: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service in accordance with the contract)
Other data recipients: e.solutions GmbH, Despag-Straße 4a, 85055 Ingolstadt, Germany. (This recipient will process data only on our behalf and in accordance with our instructions.)
24. Lock & Unlock (VW Connect Plus)*
“Lock & Unlock” allows primary users and secondary users to operate the vehicle’s central locking system even if they are not in the immediate vicinity of the vehicle. To do this, the user can display and change the locking status of the doors and the luggage compartment of the vehicle in the “Volkswagen” app. For their own security, primary users and secondary users must each define an S-PIN, which must then be entered prior to each lock or unlock operation. Before this function can be used, the Volkswagen Ident process must first be performed by the primary user. The secondary user receives rights via the primary user.
Personal data: vehicle identification number (VIN); user ID; information concerning whether electric windows, doors, bonnet and boot lid are open or closed and whether the vehicle is locked or unlocked; date and time of unlocking and locking; mileage (km)
Legal basis: Article 6(1)(b) GDPR (for contract performance); as regards the unlocking and locking history: Article 6(1)(f) GDPR (legitimate interests)
Other data recipients: none
25. Local Hazard Information (VW Connect Plus)*
The “Local Hazard Information” service notifies the driver of breakdowns, accidents, loss of traction and visual impairments when the vehicle approaches the hazard area.
Personal data: Vehicle identification number (VIN), location
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: HERE Europe B.V., Kennedyplein 222226, 5611 ZT Eindhoven, Netherlands (This recipient will process data only on our behalf and in accordance with our instructions).
26. Streaming & Internet: Gracenote Online (VW Connect Plus*
Gracenote Online enables users to identify audio streams and thereby provides for recognition. Gracenote Online achieves this by offering customers an enrichment of additional meta information, such as cover/album/artist/title in media and radio (including AM/FM, DAB, Internet Radio).
Personal data: vehicle identification number (VIN), country in which the vehicle is located; radio stations that can currently be received
Legal basis: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service in accordance with the contract)
Other data recipients: e.solutions GmbH, Despag-Straße 4a, 85055 Ingolstadt, Germany. (This recipient will process data only on our behalf and in accordance with our instructions.)
27. Legal Web App
The relevant current legal texts, such as the Privacy Policy, can be viewed under “Legal” in the Infotainment system.
Personal data: vehicle identification number (VIN), IP address, country code and language
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
28. News (VW Connect Plus)*
With this service, the vehicle users can select their news channel (Newsfeed) themselves and import it from the personal login area in the web browser to the vehicle.
Personal data: vehicle identification number (VIN), User ID, language setting, Feed ID (for the RSS Feed element only) and news brand (e.g. DW)
Legal basis: Article 6(1)(b) GDPR (for contract performance), Article 6(1)(f) GDPR (legitimate interests: provision of the service for the anonymous guest in accordance with the contract)
Other data recipients: Valtech Mobility GmbH Corneliusstraße 36, 40215 Düsseldorf, Germany (This recipient will process data only on our behalf and in accordance with our instructions.)
29. Weather (VW Connect Plus)*
“Weather” provides vehicle users with up-to-date weather data for their current location, their destination or their favourite locations. This function is also available in the “Volkswagen” app. It displays the temperature at the location of the vehicle and/or the mobile telephone.
Personal data: vehicle identification number (VIN), language setting, unit for temperature and wind speed, positioning data (current vehicle location as GPS location (longitude/latitude))
Legal basis: Article 6(1)(b) GDPR (for contract performance), Article 6(1)(f) GDPR (legitimate interests: provision of the service for the anonymous guest in accordance with the contract)
Other data recipients: Valtech Mobility GmbH Corneliusstraße 36, 40215 Düsseldorf, Germany (This recipient will process data only on our behalf and in accordance with our instructions.)
30. Update (VW Connect Plus)
“Update” enables the vehicle user to download and install available WebApps. With the WebApp Update, the user can decide which updates (for WebApplications) should be installed in the vehicle. Each Update has a Release Note that explains what is included in the update. The user can also check which version of a WebApp is currently installed.
Personal data: vehicle identification number (VIN), build status (control unit), HMI language code, HTTP status codes
Legal basis: Article 6(1)(b) GDPR (contract performance), Article 6(1)(f) GDPR (legitimate interests: provision of the service for the anonymous guest in accordance with the contract)
Other data recipients: eSolutions Despag-Straße 4a, 85055 Ingolstadt, Germany; Amazon Web Services, Inc., 410 Terry Ave. North, Seattle WA 98109, USA, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (These recipients will process data on our behalf and in accordance with our instructions only.)
31. Online Destination Import
This service allows primary users and secondary users to send individual points of interest (POI) that have been stored in the “Volkswagen” app to the vehicle’s navigation system even before the start of a journey. The destination is displayed in the navigation system for the current user of the vehicle as soon as the vehicle is used online.
Personal data: Vehicle identification number (VIN), IT usage data
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
32. Vehicle Health Report (VW Connect)
The “Vehicle Health Report” informs primary users or secondary users about the current condition of the vehicle. This allows users to have current driver messages relating to the vehicle and/or any servicing requirements additionally displayed in their personal login area in the web browser and the “Volkswagen” app and manage this information. The driver messages (warning and fault messages) indicated directly in the vehicle remain the sole source of authoritative information.
Personal data: vehicle identification number (VIN), mileage (km), time and distance remaining until next service, driver messages
Legal basis: For primary and secondary users: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service for the primary and secondary users in accordance with the contract)
Other data recipients: none
Besides, from the legal bases described in Part I the legal bases for processing personal data under Albania law is a consent given by the data subjects. The consent of the data subjects is given either by registering for the mobile online services, after they have confirmed that they have read and accepted the Privacy Policy, or by using the vehicle in knowledge of the data processing.
Data controller representative in Albania:
Porsche Albania Sh.p.k
Autostrada Tirane-Durres
Km. 3, Tirane,1051
dataprotection@porsche.al
We are legally obliged to publish mileages (km) of networked vehicles at regular intervals (usually once every quarter) on request from Car-Pass vzw. The data is retained by Car-Pass vzw in a “Car-Pass” so that relevant information about a vehicle can be provided to potential purchasers when buying and selling used cars.
Personal data processed: Vehicle identification number (VIN), mileage (km), time of data collection in the vehicle
Legal basis: Article (6)(1)(c) GDPR in conjunction with Art. 6 Act of 11 June 2004 and Article 3/1, § 2 Royal Decree of 26 August 2006
Recipients: Car-Pass vzw, Woluwedal 46/2, 1200 BRUSSELS, BELGIUM; D’Ieteren Automotive SA/NV, Leuvensesteenweg 639, 3071 KORTENBERG, BELGIUM; CARIAD SE, Major-Hirst-Straße 7, 38442 WOLFSBURG, GERMANY; Audi AG, Auto-Union-Straße 1, 85057 INGOLSTADT, GERMANY (all recipients with the exception of Car-Pass vzw process data solely on our behalf and in accordance with our instructions)
In deviation from the legal bases described in Part I the legal bases for processing personal data under the law of Bosnia and Herzegovina is a consent given by the data subjects. The consent of the data subjects is given either by registering for the mobile online services, after they have confirmed that they have read and accepted the Privacy Policy, or by using the vehicle in knowledge of the data processing.
Data controller representative in Bosnia and Herzegovina:
PORSCHE BOSNA I HERCEGOVINA
Porsche BH d.o.o. Sarajevo
Porsche Inter Auto BH d.o.o. Sarajevo
BIH-71000 SARAJEVO | Bulevar Meše Selimovića 16
zastita.podataka@porschebh.ba
Personal information obtained from residents in Japan (“Personal Data”) shall be handled in accordance with the following rules in addition to the rules set forth in Part I of this Privacy Policy.
1. Purpose: We will handle the Personal Data in accordance with the Purposes set forth in Part I of this Privacy Policy (“Purposes”), and not use Personal Data for any purpose other than such Purposes. We shall promptly notify the relevant data subjects, or disclose to the public of the Purposes (and any subsequent changes thereof), unless the Purposes have already been disclosed to the public;
2. Collection: We will not obtain any Personal Data through any deceptive, fraudulent, or other wrongful means;
3. Accuracy: We will make reasonable efforts to ensure that Personal Data handled by us is accurate and up to date and within the scope necessary to achieve the Purposes;
4. Retention: We will retain Personal Data in accordance with Section A.IV of Part I, and cease retention as soon as it is reasonable to assume that the Purposes are no longer being served by retention of Personal Data;
5. Protection: We will protect Personal Data in its possession or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal, damage, loss or similar risks. We will adequately supervise processing of Personal Data by our officers, employees, third party vendors and any other parties who process Personal Data on our behalf;
6. Transfer: Without obtaining the prior consent of the relevant data subjects, we will not transfer or provide any part of Personal Data to any individual or entity unless an exception under the APPI applies.
7. Extraterritorial Transfer: Without obtaining the prior consent of the relevant data subjects, we will not transfer or provide any part of Personal Data to any individual or entity located outside Japan, European Union or the United Kingdom unless (a) a transferee is located in a country or area certified by the Personal Information Protection Commission of Japan ("PPC") as having data protection standards equivalent to those of Japan or (b) the transferee has data protection standards equivalent to the standards specified by the PPC; and,
8. Data Subject's Right: If a data subject requests pursuant to the APPI disclosure of Purposes, access to, correction, or deletion of any of Personal Data relevant to such data subject, or lodge a complaint, we will respond to such request or complaint promptly and in accordance with the APPI. Any fee charged to data subjects shall be reasonable.
To the extent data processing falls within the scope of the Swiss Federal Act on Data Protection (FADP), (a) the scope of "personal data" shall be determined in accordance with the FADP, and (b) references to the GDPR shall be understood as references to the FADP.
To the extent that the transfer of personal data to recipients outside the EU respectively outside of Switzerland (“third countries”) is safeguarded by the conclusion of standard contractual clauses approved by the European Commission, please note the decision of the Federal Data Protection and Information Commissioner to recognize the EU standard contractual clauses, which is available via the URL https://www.edoeb.admin.ch/edoeb/de/home/datenschutz/arbeit_wirtschaft/datenuebermittlung_ausland.html.
To the extent the data processing falls within the scope of the data protection laws of San Marino, pursuant to Article 13(1)(f) of San Marinese Law n. 171 of 2018, we specify that, considering the data controller’s intention to transfer personal data to third countries or international organisations, the following means by which to obtain a copy of the appropriate or suitable safeguards used or information on where they have been made available are provided:
• You can contact us for exercising your rights, including the right to access your data and to obtain a copy of them, via the contact details provided in Part I (“Data protection officer”).
• The EU standard contractual clauses used can be accessed in EU languages at https://eur-lex.europa.eu/legal-content/it/TXT/?uri=CELEX%3A32021D0914 .
To the extent the data processing falls within the scope of the data protection laws of San Marino, pursuant to Article 13(2)(d) of San Marinese Law n. 171 of 2018, we specify that the data subject has the right to report or to lodge a complaint with the Data Protection Authority of San Marino (https://www.garanteprivacy.sm).
In addition to the rights listed in the section “Your rights” you also have the right to define directives concerning the fate of your personal data after your death (post-mortem right).