Thank you for taking an interest in a service provided by Volkswagen AG, Berliner Ring 2, 38440 Wolfsburg, Germany, entered in the register of companies at the Local Court of Brunswick under the number HRB 100484 ("Volkswagen AG" or "we" or "us"). Protecting your data is very important to us. The following policy sets out how your data is collected, processed and used by the "Volkswagen Media Control" mobile application ("App"). We are the data controller as defined by Art. 4(7) of the EU General Data Protection Regulation ("GDPR").
A. General information
We only ever collect, process and use your personal data in accordance with the applicable data protection regulations.
I. Personal data
When you use the App, we process data that relates to you as an individual and can be used to identify you (either directly or in combination with other information) or data that relates to other individuals ("personal data").
The personal data that we process falls into the following categories:
• IP address;
• Geodata.
II. Why and on what legal basis do we process your personal data?
We process your personal data for the following purposes:
• To provide you with services (App functionality provision) in accordance with our contract; legal basis: Art. 6(1)(b) GDPR or
• To comply with a legal obligation imposed on Volkswagen AG (e.g. needing to supply an authority with personal data should this be required by statutory provisions); legal basis: Art. 6(1)(c) GDPR or
• To safeguard our legitimate interests (e.g. to ensure that our IT systems are secure); legal basis: Art. 6(1)(f) GDPR.
III. Who has access to your personal data?
Within Volkswagen AG, the only persons who have access to your personal data are management and individuals who require such access for the purposes listed in point II above, or to the extent required or permitted by the applicable law.
Personal data is only ever transferred to third parties if this is necessary for performance of the contract, and in particular for providing Media Control services. We exercise due care when selecting external service providers and third parties. We require them to have adequate technical and organisational security measures in place to protect your personal data, and we ensure that they only process your personal data as instructed by us and not for other purposes.
We may also disclose your personal data to authorities if this is required or permitted by law. Your personal data will only be disclosed to these third parties if this is necessary or if this is authorised, required or permitted by law in connection with performance of the contract, with the business activities of Volkswagen AG and with the purposes listed in point II above.
IV. How long do we store your personal data?
We will not store your personal data for longer than the period permitted by the applicable data protection laws. The appropriate retention period for personal data depends on the quantity, nature and sensitivity of the data, as well as on the potential risk of damage that unauthorised use or publication of the personal data would pose, on the purposes for which we are processing the personal data and whether we can fulfil these purposes by other means, and on the applicable statutory provisions. We will not store your personal data for longer than is necessary to fulfil the purposes listed in this Privacy Policy, unless the applicable laws or statutory regulations require a longer retention period or a longer retention is justified according to the applicable legal provisions on limitation periods.
B. Individual services and functions of the App
You can use the individual services contained in this App without telling us who you are. When you use services in this App, your data is generally only stored on your mobile device. Sometimes, however, we will need to process and transfer personal data (such as geodata) in order to make our services available to you. The term "geodata" refers to your mobile device's positioning data. Geodata will only be transmitted if you have enabled this function in the App. If you have enabled the geodata function, geodata will be transferred whenever you use the App – even if the specific function you are using does not require geodata transmission.
I. Navigation:
a) Google Maps and Google Search
i. The user is shown their position on the map and can search for places using the Google Maps and Google Search services.
ii. Google Maps processes the latitude and longitude of the user's geoposition in order to do this.
iii. The user can start navigation to a destination on their infotainment system. This function uses addresses saved in the calendar or phone book on your smartphone or tablet ("mobile device"); you can also enter a destination using "Last destinations" or "Favourites", or via a Google search. Google Maps converts addresses into latitude and longitude (and vice versa). Only the address or coordinates, which cannot be used to identify a specific individual, are transmitted in this process.
Information about third parties:
Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Legal basis for transferring data to Google Inc.:
Art. 6(1)(b) GDPR.
Google Inc. is certified in accordance with the EU-US Privacy Shield: https://www.privacyshield.gov/EU-US-Framework
More information about data processing by Google Inc. can be found at the following address: https://policies.google.com/privacy
b) Sharing addresses n social networks
The user can share an address on social networks (e.g. Facebook and Twitter) using corresponding links. The device's own internal sharing function is used to do this. To share the address, the user must log in to the relevant social network using their personal login details.
II. Media:
a) Remotely controlling the radio and media
i. The user can remotely control the radio and any media connected to it via the App. The radio station and connected media will be played via the infotainment system.
ii. For displaying the radio station logos, the relevant country is ascertained locally via the location of the end device in order to select the correct logos.
b) Shared Audio playlist for Discover Media
Multiple users can create a shared playlist, the content of which is saved on each mobile device and can be played via the infotainment system.
c) Local media playback for tablets
The driver or passengers can play videos on connected tablets via the vehicle's infotainment system.
C. Automated individual decision-making
We will never make decisions for you that are based solely on automated processing (including profiling) and have legal consequences for you (Art. 22 GDPR).
D. Your rights
You can exercise the following rights against Volkswagen AG at any time free of charge. You can find more information about how to exercise your rights at https://www.datenschutz.volkswagen.de.
Right of access: You have the right to obtain information from us about the processing of your personal data.
Right to rectification: You have the right to request that we rectify incomplete or inaccurate personal data concerning you.
Right to erasure: If the conditions of Art. 17 GDPR are met, you have the right to request that your data be erased. For example, you can request the erasure of your data if it is no longer needed for the purposes for which it was collected. You can also request erasure if we are processing your data because you gave us permission to do so but you now wish to withdraw your consent.
Right to restriction of processing: If the conditions of Art. 18 GDPR are met, you have the right to request that the processing of your data be restricted. This is the case, for example, if you contest the accuracy of your data. You can then request to have processing restricted for the period during which the accuracy of your data is being verified.
Right to object: You have the right to object to your data being processed if processing is in the public interest or the exercise of a public authority, or if processing is based on a legitimate interest of Volkswagen AG or a third party. Should you have an objection, please tell us why you object to your data being processed. You also have the right to object to your data being processed for direct marketing purposes. This includes profiling, if carried out in relation to direct marketing.
Right to data portability: Where data processing is based on consent or performance of a contract, and such processing is automated, you have the right to obtain your data in a structured, commonly used and machine-readable format and to transmit this data to another data processor.
Right to withdraw consent: Where data processing is based on consent, you have the right to withdraw this consent at any time, free of charge and with future effect by writing to info-datenschutz@volkswagen.de or using the contact details listed under "Company details".
Right to lodge a complaint: You also have the right to lodge a complaint with a supervisory authority (e.g. the data protection authority of the state of Lower Saxony) about how we process your data.
E. Your point of contact: Data Protection Officer
Our Data Protection Officer is your point of contact if you have any requests concerning data protection or if you would like to exercise your rights. Please address any concerns you have to the Volkswagen AG Data Protection Officer:
Volkswagen AG Data Protection Officer
Berliner Ring 2, 38440 Wolfsburg, Germany
info-datenschutz@volkswagen.de
F. Changes to this Privacy Policy
If we change how we handle personal data or change this Privacy Policy, we will issue a revised Privacy Policy and/or take other measures to make you aware of these changes in accordance with the applicable law.
This Privacy Policy takes effect on 27.08.2018.