(Version dated: March 2024 – the current version is always available online at https://consent.vwgroup.io/consent/v1/texts/WeConnect/gb/en/dataprivacy/latest/html).
This Privacy Policy provides information on the processing of personal data when using Volkswagen AG's “We Connect, VW Connect” mobile online services (in the following combined under “VW Connect”) in vehicles of the “ID. family”. The Privacy Policy for the use of vehicles of the “ID. Family” is available under “Legal information” or online at https://consent.vwgroup.io/consent/v1/texts/WeConnect/gb/en/dataprivacycar/latest/html.
As a German company, Volkswagen AG is bound to German law and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation)(“GDPR”). This also applies when Volkswagen AG processes personal data of persons with a permanent residence outside of Germany. Part I of this Privacy Policy contains information on the processing of relevant data as required by German law and the GDPR.
To some extent, Volkswagen AG may also be bound by national legislation of other countries. Persons with a permanent residence in one of the countries specified in Part II of this Privacy Policy, can find further information in that section.
Content:
Part I
A. Person responsible for processing the data
B. Data Protection Officer, contact person
C. Your rights
I. Right to information
II. Right to rectification
III. Right to erasure
IV. Right to restriction of processing
V. RIGHT TO OBJECT
VI. Right to data portability
VII. Right to withdraw consent
VIII. Right to lodge a complaint
D. Description of data processing
I. Purposes of the data processing
II. Data recipients
III. Deletion and correction of personal data
E. Data processing in detail
I. Volkswagen ID
II. Volkswagen Ident
F. “VW Connect” service portfolio in vehicles of the “ID. family”
Part II
The responsible office for the processing of personal data is Volkswagen AG (hereafter also referred to as “we” or “us”).
Volkswagen AG can be reached at:
Volkswagen AG
Berliner Ring 2
38440 Wolfsburg
Germany
Tel.: +49-5361-9-0
connect-support@volkswagen.de
Commercial register number HRB 100484 (Braunschweig district court)
Our data protection officer available as the contact person for all matters relating to data protection and for the exercising of data subject rights (see Section C. “Your rights”).
Please address requests to:
Data Protection Officer at Volkswagen AG
Berliner Ring 2
38440 Wolfsburg
Germany
dataprivacy@volkswagen.de
Data subject rights can also be exercised by using the email address info-datenschutz@volkswagen.de (Germany) and privacy@volkswagen.de (outside of Germany) or our Volkswagen Privacy Portal https://www.datenschutz.volkswagen.de.
You can exercise the following rights with respect to Volkswagen AG at any time and free of charge.
Please note that we do not identify the respective vehicle user if there is no user concept (only available depending on model and equipment) or if you use the vehicle as an anonymous guest. As a result, in the case of multiple vehicle users, we are unable to identify which driver's personal data relates to which driver. If you assert data subject rights, we will have to check your identity and may ask you to provide additional information or clarification where necessary (in particular, information relating to the period or other circumstances of vehicle use). We can request this additional information so that we can identify the personal data relating to you and make it available to you. We must also ensure when we provide personal data that we do not infringe the rights of other vehicle users.
More information on asserting your rights can be found at: https://datenschutz.volkswagen.de/.
You have the right to request confirmation from us as to whether or not personal data concerning you is being processed and – if it is – to be informed what personal data concerning you is being processed, and also which third parties within and outside the EU have had your data forwarded to them. You also have the right to obtain a copy of the personal data concerning you that is being processed by us.
You have the right to have incorrect or incomplete personal data concerning you rectified by us.
You have the right to demand erasure of your data if the requirements stated in Article 17 GDPR are met. Accordingly, you can request, for example, that your data be erased if it is no longer required for the purposes for which it was collected. In addition, you can request erasure if we process your data on the basis of your consent and you withdraw this consent.
You have the right to request restricted processing of your data if the requirements stated in Section 18 GDPR are met. This is the case, for example, if you dispute the accuracy of your data. You can demand that processing be restricted while the accuracy of the personal data is being checked.
You have the right to object to the processing of your personal data in the following cases:
• If processing takes place for direct marketing purposes (including profiling for direct marketing purposes).
• If processing (including profiling) takes place on one of the following legal bases:
o Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Article 6(1)(e) GDPR).
o Processing is necessary for the protection of our legitimate interests and those of a third party (Section 6(1)(f) GDPR). If you do raise any objection of this kind, we kindly request that you inform us of the reasons why you are objecting to data processing. If you object, we will no longer process your data unless we can prove compelling reasons for processing that outweigh your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.
If data processing is based on consent or contract performance and processing takes place using automated means, you have the right to obtain your data in a structured, commonly used and machine-readable format and to transmit this data to another controller. In addition, you have the right to have the personal data transmitted directly by us to another controller.
Where data processing is based on consent, you have the right to withdraw your consent, free of charge, at any time with effect for the future by sending an email to info-datenschutz@volkswagen.de (Germany), privacy@volkswagen.de (outside of Germany), at our Volkswagen Privacy Portal https://www.datenschutz.volkswagen.de or through the contact details in the site notice.
You also have the right to lodge a complaint with a supervisory authority or another competent data protection authority about our processing of your data. This can, for example, be the data protection authority in your country of residence. A list of all data protection authorities in the European Union and the European Economic Area can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en#member-gb.
This section contains the description of the data processing procedures relating to the activation and use of the “VW Connect” mobile online services in vehicles of the “ID. Family”. When using the vehicle, the Privacy Policy for vehicles of the “ID. Family” must be observed and can be viewed in the vehicle under “Legal information” or online at https://consent.vwgroup.io/consent/v1/texts/WeConnect/gb/en/dataprivacycar/latest/html.
a) Activation of “VW Connect” for a vehicle
In order for the “VW Connect” services to be available in the vehicle, the vehicle must be connected to “VW Connect” in the settings (“activation”). This requires the creation of a central user account – the “Volkswagen ID” – as well as the “Volkswagen” app mobile application (“app”).
The respective Privacy Policies for the “Volkswagen ID” and the app must be observed and can be viewed online at https://consent.vwgroup.io/consent/v1/texts/identitykit/de/en/volkswagen-dataprivacy/latest/html and https://consent.vwgroup.io/consent/v1/texts/WeConnectID/gb/en-gb/dataPrivacy/latest/html.
In addition, the following data is processed when the services are activated:
Surname, first name, email address, password, vehicle identification number (VIN), vehicle make, user role, nickname, S-PIN, place of residence, preferred language, user ID, time of activation, front end used for activation, scope of services subscribed.
Once the services for the vehicle have been activated, the “VW Connect” customer is the primary user and can use the services both directly in the vehicle and in the app; alternatively, they can use the personal login area in their web browser at www.myvolkswagen.de. Every time a primary user logs in at the vehicle, the following data is also processed:
Vehicle identification number (VIN), International Mobile Equipment Identity ("IMEI") number, email address, username, password, S-PIN, profile picture, user role.
The legal basis for data processing is the fulfilment of the “VW Connect” contract (Section 6(1)(b) GDPR).
(b) Becoming a guest user
Depending on the model and equipment, the “Guest User” user role is also available when using “VW Connect” if the vehicle already has a primary user. While the “primary user” role is intended for the primary user of the vehicle and can only be used by one person, a vehicle can be used by several guest users. The respective guest user can log into the vehicle themselves with their "Volkswagen ID" for this purpose. To do this, they press the “Plus” symbol in the User Overview in the vehicle's infotainment system and create a “VW Connect” profile (“Profile”). Settings such as privacy settings are then saved in the profile of the respective guest user and are not required to be entered again each time the vehicle is used.
The following data is processed during registration and each time you log in to the vehicle as a guest user:
Vehicle identification number (VIN), International Mobile Equipment Identity ("IMEI") number, email address, username, password, S-PIN, profile picture, user role.
The primary user can view the nicknames and profile photos of the guest users registered in the vehicle in their personal login area in the web browser.
The legal basis for data processing is the fulfilment of the “VW Connect” contract (Section 6(1)(b) GDPR).
In addition, the Privacy Policy for the “Volkswagen ID” must be observed and is available online at https://consent.vwgroup.io/consent/v1/texts/identitykit/de/en/volkswagen-dataprivacy/latest/html.
Only certain mobile online services are available to guest users.
There is a differentiation between the guest user and the so-called “anonymous guest”, which means a vehicle user that is not known to Volkswagen AG. Vehicle users who do not wish to create a personal profile in the vehicle can use the “Guest” profile user selection in the infotainment system (available for certain models and equipment). This is not a personalised profile. It is not necessary to create a Volkswagen ID or conclude a “VW Connect” contract. If an anonymous guest uses the vehicle in online mode, only a few selected online services are available to them. At the end of the journey, the privacy settings in this profile are reset, and the vehicle is set back to the offline mode.
a) Use of the services
When using “VW Connect”, only data (vehicle usage data in particular) that is required for the provision of the respective services is processed. For primary and guest users, data processing is carried out for the fulfilment of the contract (Section 6(1)(b) GDPR). For all other vehicle users, including an anonymous guest, the data is processed on the basis of our legitimate interest in providing the services in accordance with the “VW Connect” contract concluded for the vehicle itself (Section 6(1)(f) GDPR) when the vehicle is used online. A description of the user roles is provided under D.I.1.
The vehicle identification number (VIN) and the IP address are always processed during use. In addition, the user ID of the primary user and the current user, their role as well as information on the vehicle model and its equipment are processed in order to check which products of “VW Connect” have been activated by a primary user for the vehicle and can be used by the respective driver. Part E “Service portfolio” provides information on other personal data that is processed.
b) Troubleshooting and security
In addition to the VIN and User ID of the primary user, we will also log the time and type of any service used in order to identify and analyse faults and security threats. This takes place in order to protect our legitimate interest of improving the mobile online services so that we can provide the IT security for the mobile online services without faults to all our customers to the maximum possible extent (Section 6(1)(f) GDPR).
If a malfunction is detected, Volkswagen AG will process the contact details provided by the user to contact the user should it be necessary. Data processing is carried out for the purpose of the performance of a contract (Article 6(1)(b) GDPR).
c) Restrict data processing (privacy settings)
Various privacy settings are available in the vehicle (see “Privacy Policy for vehicles of the Volkswagen ID. family”). Depending on the setting, certain mobile online services may no longer be usable. The mobile online services can also be activated and deactivated individually by the primary and guest users via their personal login area in the web browser or in their app ("Service management").
There is an option to contact the Customer Interaction Center (“CIC”) with concerns about Volkswagen AG apps, services and websites (e.g., by post, email, contact form or telephone). In doing so, Volkswagen AG processes the personal data (e.g. name, email address, address, telephone number, country and language) that is required to respond to requests and provide customer care. Additional information on data protection when using the CIC is provided in the CIC Privacy Policy at https://cic-legal.volkswagen.com.
The CIC may contact individual customers to the extent necessary for the performance of the “VW Connect” contract. In doing so, the contact details on file with us will be processed for the purpose of contract performance (Section 6(1)(b) GDPR).
Applies to customers in Germany only:
Contact your authorised Volkswagen repairer (authorised workshop and/or dealership) for customer-focused support for our mobile online services, who handles the customer care for Volkswagen AG. The following data is included in the transmission to the authorised Volkswagen repairer and processed by same as a processor: contract data, name, first name, Volkswagen ID user account (email), VIN and vehicle data, verification status, user status (primary user yes/no), Service scheduling (service active / not active), preferred authorised workshop (service selected / not selected) and further data that you provide to use as part of your request. We will process this data in accordance with Section 6(1)(b) GDPR for the purpose of performing the contract for mobile online services or – if you are not already a customer – in order to initiate a contract for the use of the mobile online services.
Other recipients: Audi AG, Auto-Union-Straße 1, 85057 Ingolstadt, Germany, as technical service provider (This recipient processes personal data only on our behalf and in accordance with our instructions.)
We process data relating to the vehicle and the digital products purchased, as well as data concerning the use of the services on the vehicle.
The data is processed for the following purposes:
• Improving customer care
• Sales management
• Ensuring correct accounting
• Product monitoring, fault analysis, implementing fault rectification measures and paying compensation to customers as a goodwill gesture
• Improving products
• Derivation of marketing measures
• Commissioning payments to importers and dealerships
• Remunerating the service providers that we use for the mobile online services
Once it has been analysed, the data is made available to the responsible departments within Volkswagen AG only to the extent required for the respective purpose (and, where possible, in anonymised form).
The following personal data will be processed:
• Vehicle identification number (VIN)
• User ID
• Information on products purchased (item number, activation status, activation date, duration, selected country when registering, payment method).
• Log file information on service calls
• Information on vehicle equipment
• Type of customer (private or commercial customer)
• Status of the marketing consent declaration
• Information concerning whether a preferred authorised workshop has been specified
The legal basis for the processing is Article 6(1)(f) GDPR (legitimate interest: management of the business model of the mobile online services, as well as enhancement of the customer experience in the context of the above-mentioned purposes).
The data will be processed by CARIAD SE, Berliner Ring 2, 38440 Wolfsburg, Germany.
This recipient will process personal data on our behalf and in accordance with our instructions only.
We can analyse data on how often and how the primary user operates the vehicle services and functions via the infotainment system. The data is processed as part of field campaigns that take place over a limited period of time and for specific vehicle models, delivery countries, model years and model-specific equipment features. The purpose of the analysis is to optimise and develop the operating and display concepts for the infotainment and convenience features based on field data (UX/UI optimisation).
Personal data: vehicle identification number (VIN), vehicle model, delivery country, model year, model-specific equipment features, use of the infotainment system via the display/control panel, climate control settings, seat adjustment, use of steering wheel and windscreen heating, use of Active Cruise Control (ACC), use of traffic sign recognition, use of factory reset of assist systems
Legal basis: Article 6(1)(f) GDPR (legitimate interests: product optimisation)
Other data recipients: none
Applies to customers in Germany:
Volkswagen AG always strives to send information to its customers that is personally tailored to them as much as possible and thus improve advertising for the marketing of its products and services. This requires a well-founded analysis of their use of our products and services. If the user has given consent, Volkswagen AG will therefore process data from the Volkswagen ID user account and from “VW Connect”. Details concerning this data processing (e.g. which data exactly will be processed) is available in the Volkswagen ID Privacy Policy under https://vwid.vwgroup.io/data-privacy.
Applies to customers in other VW Connect countries with the exception of Germany:
Volkswagen AG always strives to send information to its customers that is personally tailored to them as much as possible and thus improve advertising for the marketing of its products and services. An in-depth analysis of products and services (analytics) is required to accomplish this goal. For this reason, Volkswagen AG processes data from the Volkswagen ID user account and from “VW Connect”, for example:
• Identification data (e.g. name, email, telephone number, vehicle identification number, if applicable)
• User account data (e.g. preferred partners)
• Transaction data (e.g. completed agreements)
• Vehicle usage data (e.g. logbook, fluid levels, mileage (km))
• Contract data (e.g. vehicle equipment, ongoing contracts with related services)
• IT usage data (e.g. last login to services, use of functions)
• Location data (e.g. truncated GPS data)
In the event that vehicles are recorded, Volkswagen AG will also process the vehicle identification number and add additional equipment data of the vehicle to the information listed above and builds segments. Volkswagen AG transmits these segments as well as the raw data to the competent national sales company (importer) for the respective country for the improvement of advertising. In the course of processing, the personal data is treated personalised.
The described processing of the data is based on the consent given by the user (Section 6(1)(A) GDPR) in personalised advertising by Volkswagen AG. If the user does not consent, the user's data will not be processed for the named purpose.
Volkswagen AG deletes the personalised data after five years or in accordance with the legal requirements, e.g. as soon as the purpose for which the data was collected no longer applies and provided that there are no other retention obligations.
Further information on the analysis of personalised data to improve advertising and on consenting to receiving advertising communications from Volkswagen AG and from the national sales company (importer) responsible for the respective country is provided in the comprehensive Volkswagen ID Privacy Policy. This information is available under https://vwid.vwgroup.io/data-privacy.
Note: the Section “Analysis for the improvement of products” only applies to customers in Germany, Austria, Denmark, France, Spain, Italy, Ireland, United Kingdom (incl. Northern Ireland), Switzerland, Netherlands, Belgium, Norway and Sweden.
Volkswagen AG continually strives to develop new products and services and improve existing products and services. An in-depth analysis of products and services (analytics) is required to accomplish this goal. For this reason, Volkswagen AG processes data from the Volkswagen ID user account and from “VW Connect”, for example:
In case of vehicles that are stored in the Volkswagen ID user account, Volkswagen AG processes the vehicle identification number and enhances the data listed above with further equipment data of the respective vehicle. In the course of processing, the personal data is pseudonymised. Pseudonymisation involves removing all direct personal identification features (e.g. vehicle identification number). Indirectly traceable identification features (pseudonyms) are retained. In addition, we also truncate the GPS data. The data is only analysed in the Volkswagen AG analytics systems once this pseudonymisation and reduction has been completed. The direct reference to a specific person is not restored at any time. The results of the analysis (especially metrics and key figures) are completely anonymous.
The processing of pseudonymous data (e.g. User ID, pseudonymised vehicle identification number) is necessary to be able to detect longer term interactions between our customers’ use of the vehicle and services and the vehicle condition (e.g. battery functionality). This is the only way for us to determine suitable new and enhancement measures and offer new and improved products and services to our customers.
Only the personal data of the last primary user logged in at the vehicle will be processed and only to the extent that the primary user has activated and uses the corresponding services from the service portfolio. (see Section E. “VW Connect” service portfolio in vehicles of the “ID. family”). Vehicle users can also enter individual privacy settings and thereby control the data that can leave the vehicle (see Section D.I.2.c) “Restricting data processing (privacy settings)”).
The data processing described above is based on the legitimate interest of Volkswagen AG to offer its customers newly developed as well as improved products and services (Article 6(1)(f) GDPR).
Volkswagen AG erases any pseudonymous data no later than after seven years or in accordance with the legal requirements, e.g. as soon as the purpose for which the data was collected no longer applies and provided that there are no other retention obligations.
The “Charging Stations data service” function is used to display detailed information on public charging stations: the exact location and number of available charging points, their current occupation status and capacity utilisation as well as expected availability, currently existing defects or incompatibilities with the vehicle, available plug types and expected charging capacities as well as charging times and opening hours and access times. This information can be read in the vehicle and in the Volkswagen app.
To provide the function, the data that is collected as part of the “Charging”, “Parking Position” and “Departure Times” services is processed and anonymised for the “Charging Stations data service” function prior to analysis.
If the vehicle is used in offline mode, no data will be collected and forwarded to the backend. The offline mode can be set in the vehicle.
Personal data: vehicle identification number (VIN); parking position; timestamp; actual charging station capacity; current type (AC or DC); status of the charging connector; connector type used; set charging limit; timer charging; state of charge (SOC); information on the section of the charging process; reason for end of charging
Legal basis: Section 6(1)(f) GDPR for the anonymisation of data
Other data recipients: CARIAD SE, Berliner Ring 2, 38440 Wolfsburg, Germany
The personal data is stored on servers of the following service providers only on our behalf and in accordance with our instructions:
CARIAD SE
Berliner Ring 2
38440 Wolfsburg
Germany
WirelessCar Sweden AB
Vädursgatan 6
412 50 Gothenburg
Sweden
Amazon Web Services, Inc. (“AWS”)
410 Terry Ave. North
Seattle WA 98109
USA
Amazon Web Services EMEA SARL
Avenue John F. Kennedy 38
1855 Luxembourg
Luxembourg
Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
D18 P521
Ireland
Ford Motor Company
One American Road
Dearborn, MI 48126
USA
(Applies only to the Volkswagen Amarok)
In addition, we use various IT service providers both within and outside the EU. These assist us with the maintenance of our IT systems and with technical support, for example. Insofar as the service providers have access to personal data, they will process this data on our behalf and in accordance with our instructions only.
IT support is provided in particular by the following service providers:
CARIAD SE
Berliner Ring 2
38440 Wolfsburg
Germany
Details of other recipients of personal data are provided in the information that has been provided in this Privacy Policy in relation to the specific services and functions concerned.
For the purposes outlined in this Privacy Policy, Volkswagen AG also transfers personal data to recipients and processors domiciled outside the EU. Volkswagen AG agrees to EU standard contractual clauses with recipients in unsafe third countries to ensure that personal data is adequately protected. The EU standard contract clauses used in the EU languages can be accessed via the URL https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32021D0914. If required by the applicable data protection legislation, other protective measures (such as encryption and additional contractual provisions) are also put in place to ensure that personal data is adequately protected.
Insofar as legal regulations apply, we are obliged to hand over data stored by us to the necessary extent at the request of government agencies (e.g., in the investigation of a criminal offence). The legal basis for the transfer of data to the respective government agency is provided by the respective legal obligation (Article 6(1)(c) GDPR in conjunction with the respective legal obligation).
If the personal data is no longer needed for the purpose or purposes for which it was collected, it will be erased by us if there are no statutory archiving obligations that prevent erasure.
If the vehicle is erased from a virtual garage in the app, the user will also be removed from the list of users for the vehicle. Please note that the data will not be erased from the vehicle until the vehicle has been reset to the factory settings via the infotainment system.
Furthermore, our customers can rectify the data they have entered at any time in the settings of the Volkswagen ID, if they have created such an ID.
The Volkswagen ID provides our customers with the option to log in at various online services of Volkswagen AG or third parties. The data processing necessary for this is carried out for the performance of a contract (Section 6(1)(b) GDPR). The Volkswagen ID acts as a central user account where our customers can centrally manage their personal data. In order to use a mobile online service, it is necessary to create a Volkswagen ID or to log in with an existing one. The mobile online service selected by the customer is linked with the Volkswagen ID user account of the customer. This linking will only take place if the customer has given consent for this (Section 6(1)(a) GDPR). Information on data processing in relation to the Volkswagen ID is available in the Privacy Policy, which can be accessed online under https://consent.vwgroup.io/consent/v1/texts/IdentityKit/de/en/volkswagen-dataPrivacy/latest/html.
An identity check (Volkswagen Ident) is required before using mobile online services that allow access to the vehicle (such as by “Lock & Unlock”).
To do this, customers have the option of starting a video call in the “Volkswagen” app and being connected to a central call centre of our service provider IDnow GmbH (“IDnow”). The customers require the IDnow Video Ident app to execute the Ident process. A call centre employee then guides the customer through the necessary steps of the verification. During this, the details from the customer's Volkswagen ID will be compared with the information on the customer’s machine-readable identification document (driving licence, identity card or passport, depending on the applicable regulations in the country of the customer) to check the authenticity of the details. In the course of the conversation, some pictures will be taken of the customer and the customer’s machine-readable identification document and used as the basis for a biometric check, and some questions will be asked to check the accuracy of the details on the document.
To this end, the appointed service provider will be sent the customer's form of address, surname, first name, date of birth and preferred language for the purpose of comparing the data with the customer's machine-readable identification document and identification. The Volkswagen ID (internal identification number enabling the unique assignment of your data) will be sent as well.
This personal data will be enriched with further data (e.g. portrait image) by the appointed service provider during the identification process. The customer will be notified of this separately in advance and must expressly consent before we are allowed to process the data in this way. In this case, the data will be processed by virtue of the customer’s consent on the basis of Article 6(1)(a) GDPR and Article 9(2)(a) GDPR solely for the purpose of identifying the customer in order to activate mobile online services for which unique identification is required. The data will be transmitted exclusively in encrypted format.
On conclusion of the identification process, the service provider will send the customer's form of address, surname, first name, date of birth and Volkswagen ID, as well as the time of identification, back to us for the purpose of documenting the result. In addition, the following will be sent for the purpose of documenting which identification document was used to identify the customer: type of document, the document number, country of issue, date of issue, date of expiry and authority responsible for issuing the document.
Finally, a video recording of the identification process and the images of the identification document and the customer’s face that have been taken in the course of it will be stored by IDnow for evidence purposes and deleted after a maximum of thirty (30) days.
We analyse whether the Volkswagen Ident processes have been completed successfully or aborted. No further data over and above this status information will be analysed in the context of the Volkswagen Ident process.
Volkswagen will store the personal data until the customer deletes the Volkswagen ID user account.
Third-party provider information:
IDnow GmbH
Auenstraße 100
80469 Munich
Germany
This recipient will process the personal data only on our behalf and in accordance with our instructions.
AutoIdent by IDnow is an identification solution that enables customers to identify themselves online and in real time. The customer uploads a machine-readable identification document, such as an identity card, passport or driving licence (depending on the applicable requirements in the country of the customer) and records a short selfie-video. The AutoIdent software then automatically checks the authenticity of the document and compares it with the video to ensure that this is the actual person who wants to identify themselves. As soon as the identity has been checked successfully, customers can verify their identity online and use mobile online services, such as those permitting access to the vehicle (e.g. “Lock & Unlock”).
The Volkswagen ID (internal identification number enabling the unique assignment of customer data) will be sent to the commissioned service provider.
This identification number will be enriched with further data (e.g. portrait image) by the commissioned service provider during the identification process. The customer will be notified of this separately in advance and must expressly consent before we are allowed to process the data in this way. In this case, the data will be processed by virtue of the customer’s consent on the basis of Article 6(1)(a) GDPR and Article 9(2)(a) GDPR solely for the purpose of identifying the customer in order to activate mobile online services for which unique identification is required. The data will be transmitted exclusively in encrypted format.
On conclusion of the identification process, the service provider will send the customer's surname, first name, date of birth and Volkswagen ID, as well as the time of identification, back to us for the purpose of documenting the result and enabling the mobile online services. In addition, the following will be sent for the purpose of documenting which identification document was used to identify the customer: type of document, the document number, country of issue, date of issue and date of expiry.
We analyse whether the Volkswagen Ident processes have been completed successfully or aborted. This is why we store the status of the verification process of a customer. The front and back of the document, recorded security features of the identification documents and photos of the face are stored by IDnow for evidence purposes and erased after a maximum of thirty (30) days.
Volkswagen will store the personal data until the customer deletes the Volkswagen ID user account.
Third-party provider information:
IDnow GmbH
Auenstraße 100
80469 Munich
Germany
This recipient will process the personal data only on our behalf and in accordance with our instructions.
As an alternative, the Volkswagen Ident process can be carried out on site at any Volkswagen authorised workshop if it offers this service. The customer must first complete the registration process in the customer’s personal login area in the web browser by providing the customer's surname, first name and date of birth.
On site at the Volkswagen authorised workshop, the data provided will then be compared with the details on the customer's driving licence. In this case, the data will be processed by virtue of the customer’s consent on the basis of Article 6(1)(a) GDPR and Article 9(2)(a) GDPR solely for the purpose of identification in order to activate mobile online services for which unique identification is required. The captured data (driving licence number, date of issue, where applicable: country of issue, validity period) will be sent to us. The data will be transmitted exclusively in encrypted format. The Volkswagen authorised workshop does not store any data. The Volkswagen authorised workshop will process the data only on our behalf and in accordance with our instructions.
The services from the “VW Connect” portfolio listed below are available in the vehicle depending on the model year and equipment of the vehicle, the software version of the mobile online services installed in the vehicle and depending on the country. The primary user and, if applicable, guest users of the vehicle can deactivate individual services of the service portfolio in the “Volkswagen” app (“App”) and reactivate them if required (see Section C.I.2.c) “Restricting data processing (privacy settings)”).
An overview is provided below of the data processed in the context of the respective service, the legal bases for processing and the respective data recipients. Information on data recipients who receive personal data across services is provided in Section C.II. “Data recipients”.
Services that process position data are identified with an *.
Via “Departure times”, the primary user has the option of using the app to configure charging profile settings (minimum charge level, maximum charge level, charging current limit, automatic release of the charging connector, preferred charging times, name of the charging profile) as well as to determine the time at which the ID.vehicle battery should be charged at a charging location. There is also an option to set whether the vehicle should be air-conditioned (stationary air conditioning) at the desired departure time.
Personal data: vehicle identification number (VIN), desired time for the “Charging” and “Air Conditioning” services, (current) status of the charging profile setting
Legal basis: Section 6(1)(b) GDPR (performance of a contract)
Other data recipients: none
“Air Conditioning” gives the primary user the ability to control the temperature in the vehicle interior before entering it using the air conditioning system (stationary air conditioning) and to activate (or deactivate) the window heating without having to be physically near the vehicle.
Personal data: vehicle identification number (VIN), air conditioning status and settings, window heating status, (actual) status of stationary air conditioning
Legal basis: Section 6(1)(b) GDPR (performance of a contract)
Other data recipients: none
Via “Charging”, the primary user has the option of using the app to control the charging of the vehicle battery (start/stop), configure the charging process and check the charging status (battery charge level, remaining range, status of the charging connector, remaining charging time).
Personal data: vehicle identification number (VIN), charging settings, (current) charge level
Legal basis: Section 6(1)(b) GDPR (performance of a contract)
Other data recipients: none
If the main user also uses the “Volkswagen Naturstrom Connect” app in addition to “VW Connect” in order to manage departure times and charging profiles for the “Volkswagen Naturstrom” electricity rate, the data will be transmitted to the electricity rate supplier Elli (“Volkgswagen Group Charging GmbH”), which will further process the data on its own responsibility. The legal basis for transmission is Section 6(1)b of the GDPR (fulfilment of the electricity rate agreement).
The “Free charging stations” In-Car App from “We Charge” allows charging stations to be displayed during navigation. It can be downloaded and installed from the In-Car Shop by the primary user, if it has not already been installed in the vehicle on delivery (dependent on model and equipment level). It shows the vehicle user which charging stations are available and which ones are not. The vehicle user can also see the charging speed.
The in-car app can only be used if we are able to access and process the vehicle's position. The positioning data will only be processed for the “Free charging stations” service if the vehicle user has consented to this processing in the in-car app. Consent can be withdrawn for future processing at any time and without stating a reason via the settings in the in-car app. However, the service is then no longer available.
Personal data: Position
Legal basis: Article (6)(1)(a) GDPR (consent)
Other data recipients: depending on the In-Car App version: HERE Europe B.V., Kennedyplein 222–226, 5611 ZT Eindhoven, Netherlands or Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
If our “We Charge” Customer Care is contacted, we process the details and personal data of the request (e.g. name, email address, telephone number, language and, depending on the request, e.g. language settings, error analyses) in an electronic ticket. This is used to contact you and be able to process you request.
Our Customer Care can be reached at wecharge-support@volkswagen.de or by phone:
Hungary: 001800-43347328
Finland: 990800-43347328
Rest of the world: 00800-43347328
Information on data protection is provided in the Privacy Policy under https://cic-legal.volkswagen.com (see also Section D.I.3. of this Privacy Policy).
“Charging Stations” searches for suitable charging stations in the surrounding area of the current vehicle position. The application shows the total number and free spaces of the charging station and provides information on distances.
Personal data: Vehicle identification number (VIN), location of the vehicle, speed, start/destination, direction of travel
Legal basis: Section 6(1)(b) GDPR for the primary and guest user (for contract performance); Section 6(1)(f) GDPR for each additional vehicle user including the anonymous guest (legitimate interests: performance of the “VW Connect” contract towards the primary user)
Other data recipients: Joynext GmbH, Gewerbepark Merbitz Nr. 5, 01156 Dresden, Germany. (This recipient processes personal data only on our behalf and in accordance with our instructions.)
The Online Map Update service allows the map material to be updated online directly in the vehicle. For this purpose, the vehicle analyses which regions in a country (e.g. North-West Germany) are relevant for the vehicle/travelled most frequently.
Personal data: Vehicle identification number (VIN), the most frequented areas (only in the case of an automatic update); version number of the currently stored map data, vehicle positioning data, speed, start/destination, direction of travel
Legal basis: Section 6(1)(b) GDPR for the primary and guest user (for contract performance); Section 6(1)(f) GDPR for each additional vehicle user including the anonymous guest (legitimate interests: performance of the “VW Connect” contract towards the primary user)
Other data recipients: HERE Europe B.V., Kennedyplein 222 – 226, 5611 ZT Eindhoven, Netherlands. (This recipient processes personal data only on our behalf and in accordance with our instructions.)
“Parking Spaces” can be used to search for suitable parking spaces in the surrounding area of the actual vehicle position, if they are available. The application provides information on prices, opening hours, distances and telephone numbers.
Personal data: Vehicle identification number (VIN), position of the vehicle, direction of travel, start/destination
Legal basis: Section 6(1)(b) GDPR for the primary and guest user (for contract performance); Section 6(1)(f) GDPR for each additional vehicle user including the anonymous guest (legitimate interests: performance of the “VW Connect” contract towards the primary user)
Other data recipients: Parkopedia Ltd. 232 Sladepool Farm Road, Birmingham, B14 5EE, United Kingdom; Joynext GmbH, Gewerbepark Merbitz Nr. 5, 01156 Dresden, Germany. (These recipients processes personal data only on our behalf and in accordance with our instructions.)
“Route Calculation” calculates the best route for the vehicle taking into account the current traffic situation.
Personal data: Vehicle identification number (VIN), position of the vehicle, start/destination, direction of travel
Legal basis: Section 6(1)(b) GDPR for the primary and guest user (for contract performance); Section 6(1)(f) GDPR for each additional vehicle user including the anonymous guest (legitimate interests: performance of the “VW Connect Plus” contract towards the primary user)
Other data recipients: Joynext GmbH, Gewerbepark Merbitz Nr. 5, 01156 Dresden, Germany. (This recipient processes personal data only on our behalf and in accordance with our instructions.)
The “Online Destination Import / Online Route Import” service allows the primary user to send individual points of interest (POI) and created routes stored in the app to the vehicle's navigation system before the start of a journey. The destination or route sent is displayed in the navigation system for the current user of the vehicle as soon as the vehicle is used online.
Personal data: vehicle identification number (VIN), search term, coordinates of the map section, IP address, sent destinations (points of interest), user created routes, availability status of the function in the vehicle (to send destinations)
Legal basis: Section 6(1)(b) GDPR (performance of a contract)
Other data recipients: Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland
The “Over-the-air update/system update” service updates the vehicle software (infotainment system, control unit firmware), e.g. to obtain new functions, rectify faults or get the systems ready for the latest changes relating to road traffic.
Personal data: Vehicle identification number (VIN), software and hardware versions and hardware serial numbers, charge quantity consumed for the service from the vehicle battery for the present calendar year, language set in the infotainment system
Legal basis: Section 6(1)(b) GDPR (contract performance)
Other data recipients: CARIAD SE, Berliner Ring 2, 38440 Wolfsburg, Germany; Harman Connected Services Inc., 636 Ellis Street, 94043 Mountain View, USA; HERE Europe B.V., Kennedyplein 222 - 226, 5611 ZT Eindhoven, Netherlands
“Online Traffic Information” provides information on current traffic events and shows the traffic flow on the map and along the route of the navigation system.
Personal data: Vehicle identification number (VIN), position of the vehicle, position accuracy, direction of travel, speed, gradient, desired destination, traffic information settings, detected event type, timestamp, app version
Legal basis: Section 6(1)(b) GDPR for the primary and guest user (for contract performance); Section 6(1)(f) GDPR for each additional vehicle user including the anonymous guest (legitimate interests: performance of the “VW Connect” contract towards the primary user)
Other data recipients: Robert Bosch GmbH, Theodor-Heuss-Strasse 12, 38122 Braunschweig, Germany; Joynext GmbH, Gewerbepark Merbitz Nr. 5, 01156 Dresden, Germany. (This data recipient processes personal data only on our behalf and in accordance with our instructions.)
The “Online Voice Control” / “Online Voice Assist” service allows primary and guest users to intuitively control vehicle functions using their voice and is available in addition to offline voice control / voice assist in the vehicle (only available in the following languages: English (UK), English (US), German, French, Italian, Spanish, Czech, Dutch, Polish, Portuguese, Swedish, Danish, Norwegian).
“Voice Control” / “Voice Assist” can be activated with the push-to-talk button on the steering wheel or with the activation word to then formulate a request. Other vehicle occupants can also use “Voice Control / Voice Assist” by means of the activation word. A background service runs on the vehicle’s infotainment system to enable use of the activation word. This service detects when the activation word is spoken. Every now and then, this background service may falsely detect the activation word.
As soon as “Voice Control” / “Voice Assist” has been activated with the push-to-talk button or activation word, this is indicated by a graphic symbol on the infotainment system screen.
The advantage of the Online Voice Control / Online Voice Assist compared to offline voice control / voice assist without online connection is that it offers better speech recognition in general and allows online content to be controlled via voice control commands, e.g. streaming services and POIs for navigation. If the customer additionally consents to processing of position data for the Online Voice Control / Online Voice Assist, the customer will receive navigation results enriched with additional information (e.g. charging station information) even faster. For example, customers can call up information on weather, news, knowledge, sports, flight status, stock market and their surrounding area (available depending on model and equipment and depending on the system language setting). The Online Voice Control / Online Voice Assistant function will remain covered by the contractually guaranteed scope even if consent is withdrawn.
The Online Voice Assistant is enhanced with the connection to ChatGPT (for the languages: German, English (GB, US), Spanish and Czech), whereby requests that the Online Voice Assistant cannot answer are forwarded to ChatGPT. For this, the service provider Cerence GmbH checks if the voice request can be answered. If this is not the case, the voice request is forwarded in text format to ChatGPT. ChatGPT sends a reply in text format to the service provider Cerence GmbH and from there back to the vehicle. When the reply is output in the vehicle, it is made clear that the result was generated by ChatGPT. When the voice request is processed via ChatGPT, the location data is not forwarded to ChatGPT.
With an existing online connection, your voice inputs will also be analysed to continuously improve the voice control and voice recognition for all customers. They are thereby always analysed anonymised with automated processes and are only made accessible to trained employees of our service provider, Cerence GmbH for purposes of analysis for the optimisation of voice recognition.
If the vehicle is used in offline mode, the voice data will be processed solely in the vehicle (offline voice control / voice assist), and no position data will be processed. The online function can be deactivated in the personal login area in the web browser or via the app. In addition, the recognition of the activation word can be deactivated in the infotainment system so that voice control / voice assist can only be used via the push-to-talk button.
“Online Voice Control” / “Online Voice Assist” is not available to anonymous guests. Data will be processed solely in the vehicle.
Personal data: vehicle identification number (VIN), country stored in the system or current vehicle position (if consent was also given for the processing of position data for Online Voice Control / Online Voice Assist), selected infotainment language, brand of the vehicle, user ID of the primary user of the vehicle, regional code and version number of the infotainment software, voice input and voice output (only for the languages EN-US, EN-GB, DE, FR, ES, IT, CZ, NL, PL, PT, SE, DK, NO)
Legal basis: Section 6(1)(b) GDPR for primary and guest users (for contract performance); for the optional processing of the current vehicle position: Section 6(1)(a) GDPR (consent); for further occupants of the vehicle without contract for the mobile online services: Section 6(1)(f) GDPR (legitimate interest: performance of the “VW Connect” contract toward the primary user); the analysis of the voice inputs by Volkswagen AG and the service provider and the anonymisation of the voice inputs for further analysis occurs according to Section 6(1)(f) GDPR (legitimate interest: improvement of voice control and voice recognition for all customers).
Other data recipients: e.solutions GmbH, Despag-Straße 4a, 85055 Ingolstadt, Germany; Cerence GmbH, Jülicher Straße 376, 52070 Aachen, Germany (this recipient processes personal data only on our behalf and in accordance with our instructions.)
With the “VW Connect Basic” mobile online services, the Online Voice Control is also available to primary and secondary users of the vehicle in addition to the offline voice control in the vehicle. Online Voice Control is available in the following countries and the corresponding languages: Austria, Belgium, Switzerland, Czech Republic, Germany, Denmark, Spain, Finland, France, England, Greece, Hungary, Ireland, Italy, Luxembourg, Netherlands, Norway, Poland, Portugal, Romania and Sweden. To ensure the functionality of the Online Voice Control as defined in the contract, the position of the vehicle is sent as soon as you have activated the mobile online services in your Volkswagen app. The respective position date is erased immediately after use.
You can activate voice control via the push-to-talk button on the steering wheel or via the activation word to then formulate your request. Other vehicle occupants can also use Online Voice Control by means of the activation word. A background service runs on the vehicle’s infotainment system to enable use of the activation word. This service detects when the activation word is spoken. Every now and then, this background service may falsely detect the activation word.
As soon as voice control has been activated by the push-to-talk button or activation word, this is indicated by a graphic symbol on the infotainment system screen. The advantage of “Online Voice Control” compared to offline voice control is that it offers better speech recognition in general and allows online content to be controlled via voice control, e.g. POIs for navigation.
When you use Online Voice Control, Cerence B.V. uses automated processes to analyse the voice control commands on our behalf for reporting purposes and makes the analysis results available to us (excluding the voice and audio files). You can deactivate the online connection for Online Voice Control at any time in the infotainment system. In this case, the voice data will be processed solely in the vehicle. In addition, you can deactivate recognition of the activation word in the infotainment system so that voice control can only be used via the push-to-talk button. If you use the vehicle in offline mode, the voice data will be processed solely in the vehicle (offline voice control).
If you are an anonymous guest or guest user, Online Voice Control is not available to you. Data will be processed solely in the vehicle.
Personal data with an online connection: Vehicle identification number (VIN), country stored in the system and current vehicle position, selected infotainment language, country code of the vehicle, User ID, regional code and version number of the infotainment software, your voice input and voice output)
Legal basis: For primary and secondary users: Article 6(1)(b) GDPR (for contract performance); for other vehicle users and occupants without a contract for mobile online services: Article 6(1)(f) GDPR (legitimate interest: performance of the contract for mobile online services)
Other data recipients: Cerence B.V., CBS-weg 11, 6412 Ex Heerlen, Netherlands (These recipients will process data on our behalf and in accordance with our instructions only.)
As part of the “Internet Radio” function, the infotainment system makes available an up-to-date and language-specific catalogue of stations and podcasts. This provides the option to listen to thousands of stations and podcast episodes of different kinds via online streaming.
Personal data: Vehicle identification number (VIN), IP address
Legal basis: Section 6(1)(b) GDPR (contract performance)
Other data recipients: e.solutions GmbH, Despag-Straße 4a, 85055 Ingolstadt, Germany. (Both recipients will process personal data on our behalf and in accordance with our instructions only.)
The “Temperature Alerts” service sends recommendations to the primary user, via the app, to set a departure time or charge the vehicle when the ambient temperature is low in order to avoid a limited battery performance due to cold weather. This service is available to the primary user if they were the last user logged into the vehicle. This allows the battery to be preheated ahead of time and thereby prepared for operation at low outside temperatures.
To receive temperature alerts via push notifications, permission to send push notifications must be given in the app in advance.
Personal data: Vehicle identification number (VIN), user ID, battery charge status, battery size, battery temperature, charging connector status, time stamp of journey and status of drive system (ignition “off”/”on”), vehicle position, expected ambient temperature at vehicle position (the volume of processed personal data may be reduced depending on the software version.)
Legal basis: Article 6(1)(b) GDPR for the primary user (for contract performance)
Other data recipients: none
“Plug & Charge” offers vehicle users the option to charge at public charging stations via an automated authentication process by plugging in the charging cable.
For this, the identification number of the charging contract is processed during charging at a public charging station, which enables billing for the charging process by the traction current provider. The primary user can manage their “Plug & Charge” contract via the app; for example, they can uninstall the contract.
For the authentication of a private wall box, the serial number of the vehicle certificate will be transmitted to the private wall box.
Personal data: vehicle identification number (VIN), e-mobility account identifier (EMAID), serial number of the vehicle certificate
Legal basis: Section 6(1)(b) GDPR (contract performance)
Other data recipients: Hubject GmbH, EUREF-Campus 22, 10829 Berlin, Germany
With regard to data processing by the traction current provider and the wall box provider, their data protection notices must be observed.
The Breakdown Call function can be triggered both by breakdown events (with or without a warning lamp lighting up) and by minor accidental damage below the level required to trigger the restraint systems (such as the airbag and belt tensioner). If the airbag control unit has detected such an impact, the infotainment system will provide the vehicle user with an audio connection for the breakdown call. The “VW Connect” services also automatically transfer certain data, such as the vehicle's equipment, to help the breakdown call staff and, if necessary, the towing company to provide help quickly and effectively.
We process the data of their service scheduling request to improve our products and business processes, customer functionality of service scheduling, optimise customer benefit and to eliminate product defects.
We will analyse your previously indicated data for the purpose of product improvement and quality assurance of the service scheduling request and to prevent interruptions or delays in the process sequence of processing requests. For example, we check for faults in the transmission of data to your authorised workshop (such as incomplete data or delays within the data transmission) for early detection and elimination. This allows us to respond to the customer request for a service appointment in the best possible way and improve customer satisfaction with the digital services.
Furthermore, the indicated data is forwarded to the responsible importer for their country for process management and improvement, such as by way of quality audits. The provided data will be erased after five years.
Personal data: vehicle identification number (VIN), phone number of the SIM card integrated into the vehicle, title, form of address, name, date of birth, address, country, phone number, email address, number plate, vehicle data (brand, mileage (km), remaining range, model name, model year, colour, gearbox, drive type, year of manufacture, vehicle type, equipment features), insurance details (name of insurance provider of the party reporting the accident, insurance policy number of the party reporting the accident, nature of damage, name of the other party's insurance provider), case details (impact zone, severity of impact, date of accident, time of accident, cause, warning lamps, entries in event memory, vehicle position, accuracy of GPS data, direction of travel, nature of damage, date of damage assessment, preliminary damage costing, service schedule, most recent service) and any other personal data the vehicle users shares during the call. For data processing as part of the analysis:
Vehicle identification number, service requirement category, send date of the service appointment request, your selected authorised workshop and information on the agreed service appointment. In addition, the respective authorised workshop transmits the following data to us: vehicle identification number, time of lead initiation, time of contact initiation and time of lead closing.
Legal basis: Section 6(1)(b) GDPR for the primary and guest user (for contract performance); Section 6(1)(f) GDPR for each additional vehicle user including the anonymous guest (legitimate interests: performance of the “VW Connect” contract towards the primary user). For data processing as part of the analysis: Section 6(1)(f) GDPR (legitimate interests: improvement of the products, business processes, customer functionality of service appointment scheduling; optimisation of the customer benefit; elimination of product faults; process control and improvement in trade; increase of customer satisfaction with the services).
Other data recipients: ARC Europe S.A., Avenue des Olympiades 2, 1140 Brussels, Belgium and its authorised local service provider; where applicable, a Volkswagen authorised workshop or a towing company.
If the vehicle is used offline or if the service has been deactivated via the app, the breakdown call is still available offline without “VW Connect” services; however, the vehicle will not automatically send any data to the call centre.
The “Vehicle Health Report” informs the primary user about the current condition of the vehicle. This allows primary users to have selected driver messages relating to the vehicle and/or any servicing requirements additionally displayed in their personal login area in the web browser and the app. The driver messages (warning and fault messages) indicated directly in the vehicle remain the sole source of authoritative information in this regard.
Personal data: vehicle identification number (VIN), mileage (km), time remaining until next service, driver messages
Legal basis: for the primary user: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-car service for the primary and secondary users in accordance with the contract)
Other data recipients: none
The “Vehicle Status” function allows the primary user to display various items of status data for the vehicle in the app.
Personal data: vehicle identification number (VIN), window, door and tailgate status, central locking status, parking light, timestamp
Legal basis: Section 6(1)(b) GDPR (performance of a contract)
Other data recipients: none
“Parking position” allows the primary user to retrieve the last known vehicle location if they were the last user logged into the vehicle.
Personal data: vehicle identification number (VIN), most recent parking position when vehicle was switched off (removal of key, activation of Start/Stop button)
Legal basis: Section 6(1)(b) GDPR (contract performance)
Other data recipients: none
The “Media Streaming” function allows the use of various music streaming services directly within the infotainment system in the vehicle without having to connect a smartphone or some other device. To do this, the respective streaming app must first be downloaded and installed by the primary user via the In-Car Shop.
Personal data: Vehicle identification number (VIN), authentication token with the streaming provider, IP address
Legal basis: Section 6(1)(b) GDPR (performance of a contract)
Other data recipients: the respective streaming provider The data privacy statements of the respective streaming service are the authoritative source of information for the processing of data within this context.
With this function, the primary and guest users can save their respective individual vehicle settings and “transfer” them to other Volkswagen vehicles that are equipped with “VW Connect” mobile online services. The vehicle settings for numerous systems are saved automatically and depending on the equipment, from seat and mirror positions to lights, air conditioning and driver assistance.
Personal data: Vehicle identification number (VIN), current personal vehicle settings (including seat, mirrors, lights, climate, driver assistance settings), last used radio stations/apps, necessary metadata for transferring setting values (e.g., parameter ID, change information, version numbers and timestamps)
Legal basis: Section 6(1)(b) GDPR (performance of a contract)
Other data recipients: none
Via the "In-Car Shop/Webshop", the primary user can purchase products, such as mobile online services, or extend the duration of mobile online services.
Personal data: vehicle identification number (VIN), contact details, contract data, credit card details/PayPal payment details
Legal basis: Section 6(1)(b) GDPR (contract performance)
Additional data recipients: arvato distribution GmbH, Gottlieb-Daimler-Strasse 1, 33428 Harsewinkel, Germany; J.P. Morgan Mobility Payments Solutions S.A., 161, Rue du Kiem L-8030 Strassen, Luxembourg; Markovski Solutions, Borovo Distr., bl. 10, 1680 Sofia, Bulgaria
Credit card details/PayPal payment details will be sent to the following recipients by J.P. Morgan Mobility Payments Solutions S.A.: Concardis GmbH, Helfmann-Park 7, 65760 Eschborn, Taunus, Germany (for payment with credit card); PayPal (Europe) S.à.r.l. et Cie, 2224 Boulevard Royal, 2449 Luxembourg, Luxembourg (for payment with PayPal)
The Manage Services function allows the primary user and guest users to activate and deactivate the mobile online services and the vehicle functions available in the vehicle, and to obtain detailed information about current service plans and the duration of the associated contracts.
In addition, individual privacy settings can be entered (if available in the respective vehicle). This allows control of the data that can leave the vehicle. Furthermore, the purchased and enabled “Upgrades” functions and the in-car apps are displayed in the respective personal login area in the web browser. Additionally, the vehicle user receives a notification in the app if the vehicle user does not have a “VW Connect” licence.
Personal data: vehicle identification number (VIN), activation status of services, privacy level (depending on model)
Legal basis: Section 6(1)(b) GDPR (contract performance or initiation of a contract); Section 6(1)(f) GDPR for the alert when a “VW Connect” licence is not available (legitimate interests: advertising alert for the customers).
Other data recipients: none
The “Online POI Search” function allows searching for any destination within Europe or North America via the infotainment system. A database with millions of entries and an optimised search engine are available for this purpose. In addition, daily updated information such as opening hours or prices are provided for these destinations.
Personal data: Vehicle Identification Number (VIN), location, selected infotainment language, POI search query (category, search text and search range), destination route guidance, route geometry, POI category filter.
Legal basis: For primary and guest users: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service in accordance with the contract)
Other data recipients: HERE Europe B.V., Kennedyplein 222–226, 5611 ZT Eindhoven, Netherlands; Joynext GmbH, Gewerbepark Merbitz Nr. 5, 01156 Dresden, Germany. (These recipients process personal data only on our behalf and in accordance with our instructions.)
If the “Service Scheduling” service has been activated by the primary user, the Volkswagen authorised workshop (or where applicable: a national sales company appointed by the Volkswagen authorised workshop or a call centre) will contact the primary user via their selected communication channel (email or telephone) in the event of any necessary service work (oil changes, inspections and specific driver messages as selected by Volkswagen AG) for the purpose of scheduling an appointment.
If the authorised workshop specified by the primary user ceases trading or stops operating a Volkswagen authorised workshop as part of its business activities and the primary user has not yet selected any other Volkswagen authorised workshop, the national sales company with responsibility for the respective country will contact the primary user if any service work becomes necessary to offer an appointment with a suitable Volkswagen authorised workshop. Data is transferred to the respective national sales company on the basis of our legitimate interest (Article 6(1)(f) GDPR) in providing a service appointment in accordance with the primary user's wishes and thereby helping to ensure customer satisfaction.
We process the data of their service scheduling request to improve our products and business processes, customer functionality of service scheduling, optimise customer benefit and to eliminate product defects.
We will analyse your previously indicated data for the purpose of product improvement and quality assurance of the service scheduling request and to prevent interruptions or delays in the process sequence of processing requests. For example, we check for faults in the transmission of data to your authorised workshop (such as incomplete data or delays within the data transmission) for early detection and elimination. This allows us to respond to the customer request for a service appointment in the best possible way and improve customer satisfaction with the digital services.
Furthermore, the indicated data is forwarded to the responsible importer for their country for process management and improvement, such as by way of quality audits. The provided data will be erased after five years.
The primary user can deactivate the “Service Scheduling” service and the associated data transfer of servicing requirements at any time in the primary user's personal login area in the web browser or in the settings of the app. Here, the primary user can also select, change or delete the primary user's desired communication channel or preferred Volkswagen authorised workshop.
Personal data: Vehicle identification number (VIN), user ID, ID of the request, trigger of the data transfer (e.g. a specific service requirement), mileage (km), make, model, model year, engine code, gearbox code, inspection service interval, oil change service interval, driver messages, time stamp, time of the driver message by the warning lamp, form of address, title, first name/surname, desired communication channel (telephone/email); for data processing in the context of the analysis: Vehicle identification number, service requirement category, date the service appointment request was sent, the selected authorised workshop, agreed service appointment. In addition, the respective authorised workshop transmits the following data to us: vehicle identification number, time of lead initiation, time of contact initiation and time of lead closing.
Legal basis: For the primary user: Section 6(1)(b) GDPR (for contract performance) and, where applicable, Section 6(1)(f) GDPR (if the selected authorised workshop has ceased trading or stops operating a Volkswagen authorised workshop as part of its business activities; see above); for every other vehicle user: Section 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service in accordance with the contract); when data is processed in the context of analysis: Section 6(1)(f) GDPR (legitimate interests: improvement of business processes, functionality of service scheduling; optimisation of customer benefit; elimination of product defects; process control and improvement in trade; increase customer satisfaction with the services)
Other data recipients: we will transmit the servicing requirements to the primary user's selected Volkswagen authorised workshop or to a national sales company with responsibility for the respective country and, where applicable, to a call centre appointed by the Volkswagen authorised workshop or a national sales company appointed by the Volkswagen authorised workshop (in the event of being appointed by the Volkswagen authorised workshop, the respective call centre or respective national sales company will process the data on behalf of and in accordance with the instructions of the Volkswagen authorised workshop only); in the context of analysis, the data will be sent to CARIAD SE, Berliner Ring 2 Brieffach 1080/2, 38440 Wolfsburg, Germany (CARIAD SE will process the data on our behalf and in accordance with our instructions only).
If the primary user has chosen a preferred authorised workshop located in Germany, Great Britain, Italy, France, Japan, Ireland, the Czech Republic, Spain (and the Canary Islands), Belgium, Switzerland, Sweden, Poland, Hungary, Ukraine, Serbia, Denmark, Finland, Estonia, Latvia, Lithuania, Slovenia, Romania, Bulgaria, Slovakia, Greece, Portugal, Norway, Luxembourg, Austria, Netherlands, Montenegro, Bosnia and Herzegovina, Croatia, Albania, North Macedonia or Iceland, the personal data processed for the purposes of service scheduling will be stored by salesforce.com Germany GmbH (Erika-Mann-Straße 31, 80636 München, Germany) as a processor for Volkswagen AG.
The function notifies the primary user of the app when certain remote services are unusable due to an excessively low 12 V battery charge. In addition, the function offers the primary user the option of activating high-voltage battery support for the vehicle. Activation would allow remote services to operate with the support of the high-voltage battery.
Personal data: Vehicle identification number (VIN), IP address, 12V battery status
Legal basis: Section 6(1)(b) GDPR (performance of a contract)
Other data recipients: none
Battery Care Mode is a function for optimisation of the ageing behaviour of the high-voltage battery by setting the upper charging limit. The primary user can switch the function on and off via the app. The setting option via the app is only available if the primary user was the last person logged into the vehicle.
Personal data: vehicle identification number (VIN)
Legal basis: Article 6(1)(b) GDPR
Other data recipients: none
The vehicle user can display the vehicle software version currently installed via the “ID. Software” tile in the vehicle’s Infotainment system.
Personal data: Vehicle identification number (VIN), software status
Legal basis: Section 6(1)(b) GDPR (performance of a contract)
Other data recipients: none
The “Charging Alerts” service makes recommendations to the primary user via app on the use of the Battery Care Mode based on battery usage and charging behaviour and optimised settings for the configuration of charging processes to preserve the high-voltage battery.
This service is available to the primary user if they were the last user logged into the vehicle. This allows the primary user to receive personalised alerts for the optimisation of the ageing behaviour of the high-voltage battery by using the charging settings.
Personal data: vehicle identification number (VIN), user ID, battery charge status, battery size, battery temperature, charging connector status, time stamp of journey and status of drive system (ignition “off”/“on”) (the volume of processed personal data may be reduced depending on the software version.)
Legal basis: Article 6(1)(b) GDPR for the primary user (for contract performance)
Other data recipients: none
The service starts the Infotainment system proactively for the logged in primary user at the expected time of departure, either based on the settings for the Air Conditioning and Departure Times mobile online services in the Volkswagen app or during the automatic Quick Start of the Infotainment system based on the usual vehicle use.
This service is available to the primary user if they were the last user logged into the vehicle. This provides the primary user with faster access to the contents of the infotainment system after entering the vehicle.
The “Optimised Battery Use” function must be activated in the app for the high-voltage battery support to be able to use the “(Automatic) Quick Start Infotainment system” service.
The data used to teach in routines for the automatic Quick Start Infotainment will be erased after three months.
Personal data: vehicle identification number (VIN), User ID, timestamp of the journey and the status of the vehicle’s drive system (ignition “off”/”on”), departure times, time of Start Infotainment system, time of Cancel Infotainment system, number of operating hours (for observance of the maximum limit of vehicle operating hours) For the automatic service only: forecasted time for the start of a journey, status of routine model, status of consent to the collection of location data, location data (last parking position of the vehicle (exact to the metre))
Legal basis: Section 6(1)(b) GDPR for the primary user (contract performance) For the automatic service: Section 6(1)(a) GDPR for the primary user (consent)
Other data recipients: none
“Lock & Unlock” allows primary users to operate the vehicle’s central locking system even if they are not in the immediate vicinity of the vehicle. To do this, the user can display and change the locking status of the doors and the luggage compartment of the vehicle in the app. For their own security, primary users must define an S-PIN, which must then be entered prior to each lock or unlock operation. Before this function can be used, the Volkswagen Ident process must first be performed by the primary user.
We will store the details of all the lock and unlock operations performed using this service, along with the date and time, odometer reading at the time of the operation and the user ID and vehicle identification number, for three (3) years. This data is stored on the basis of our legitimate interest of meeting the obligations to provide evidence under the product liability legislation (Article 6(1)(f) GDPR).
Personal data: vehicle identification number (VIN); user ID; information concerning whether electric windows, doors, bonnet and boot lid are open or closed and whether the vehicle is locked or unlocked; date and time of unlocking and locking; mileage (km)
Legal basis: Section 6(1)(b) GDPR (for contract performance); as regards the unlocking and locking history: Article 6(1)(f) GDPR (legitimate interests)
Other data recipients: none
The relevant current legal texts, such as the Privacy Policy, can be viewed under “Legal” in the Infotainment system.
Personal data: vehicle identification number (VIN), IP address, country code and language
Legal basis: Section 6(1)(b) GDPR (contract performance)
Other data recipients: none
The vehicle remote diagnosis provides a recommended action to the user for support in a possible case of failure as well as further information on event messages in the vehicle. The function thereby analyses diagnostic data that was transmitted from the vehicle using a wireless connection. The customer can select a contact (Customer Interaction Centre, Breakdown Service, Authorised Repairer) and request information on the recommended action as well as further information on event messages by phone. This contact informs the customer of the result and agrees further steps with the customer, if necessary.
Personal data: vehicle identification number (VIN), User ID of the customer (Volkswagen ID user account); UUID for the User ID of the customer; vehicle diagnostic data (mainly control unit identification data, event memory data)
Legal basis: Section 6(1)(b) GDPR for the primary user (contract performance)
Other data recipients: Audi AG, Auto-Union-Straße 1, 85057 Ingolstadt, Germany; Lufthansa Industry Solutions AS GmbH, Schützenwall 1, 22844 Norderstedt, Germany (These recipients process personal data only on our behalf and in accordance with our instructions.)
Besides, from the legal bases described in Part I the legal bases for processing personal data under Albania law is a consent given by the data subjects. The consent of the data subjects is given either by registering for the mobile online services, after they have confirmed that they have read and accepted the Privacy Policy, or by using the vehicle in knowledge of the data processing.
Data controller representative in Albania:
Porsche Albania Sh.p.k
Autostrada Tirane-Durres
Km. 3, Tirane,1051
dataprotection@porsche.al
We are legally obliged to publish mileages (km) of networked vehicles at regular intervals (usually once every quarter) on request from Car-Pass vzw. The data is retained by Car-Pass vzw in a “Car-Pass” so that relevant information about a vehicle can be provided to potential purchasers when buying and selling used cars.
Personal data processed: Vehicle identification number (VIN), mileage (km), time of data collection in the vehicle
Legal basis: Article (6)(1)(c) GDPR in conjunction with Art. 6 Act of 11 June 2004 and Article 3/1, § 2 Royal Decree of 26 August 2006
Recipients: Car-Pass vzw, Woluwedal 46/2, 1200 BRUSSELS, BELGIUM; D’Ieteren Automotive SA/NV, Leuvensesteenweg 639, 3071 KORTENBERG, BELGIUM; CARIAD SE, Berliner Ring 2, 38440 WOLFSBURG, GERMANY; Audi AG, Auto-Union-Straße 1, 85057 INGOLSTADT, GERMANY (all recipients with the exception of Car-Pass vzw process data solely on our behalf and in accordance with our instructions)
In deviation from the legal bases described in Part I the legal bases for processing personal data under the law of Bosnia and Herzegovina is a consent given by the data subjects. The consent of the data subjects is given either by registering for the mobile online services, after they have confirmed that they have read and accepted the Privacy Policy, or by using the vehicle in knowledge of the data processing.
Data controller representative in Bosnia and Herzegovina:
PORSCHE BOSNA I HERCEGOVINA
Porsche BH d.o.o. Sarajevo
Porsche Inter Auto BH d.o.o. Sarajevo
BIH-71000 SARAJEVO | Bulevar Meše Selimovića 16
zastita.podataka@porschebh.ba
Personal information obtained from residents in Japan (“Personal Data”) shall be handled in accordance with the following rules in addition to the rules set forth in Part I of this Privacy Policy.
1. Purpose: We will handle the Personal Data in accordance with the Purposes set forth in Part I of this Privacy Policy (“Purposes”), and not use Personal Data for any purpose other than such Purposes. We shall promptly notify the relevant data subjects, or disclose to the public of the Purposes (and any subsequent changes thereof), unless the Purposes have already been disclosed to the public;
2. Collection: We will not obtain any Personal Data through any deceptive, fraudulent, or other wrongful means;
3. Accuracy: We will make reasonable efforts to ensure that Personal Data handled by us is accurate and up to date and within the scope necessary to achieve the Purposes;
4. Retention: We will retain Personal Data in accordance with Section A.IV of Part I, and cease retention as soon as it is reasonable to assume that the Purposes are no longer being served by retention of Personal Data;
5. Protection: We will protect Personal Data in its possession or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal, damage, loss or similar risks. We will adequately supervise processing of Personal Data by our officers, employees, third party vendors and any other parties who process Personal Data on our behalf;
6. Transfer: Without obtaining the prior consent of the relevant data subjects, we will not transfer or provide any part of Personal Data to any individual or entity unless an exception under the APPI applies.
7. Extraterritorial Transfer: Without obtaining the prior consent of the relevant data subjects, we will not transfer or provide any part of Personal Data to any individual or entity located outside Japan, European Union or the United Kingdom unless (a) a transferee is located in a country or area certified by the Personal Information Protection Commission of Japan ("PPC") as having data protection standards equivalent to those of Japan or (b) the transferee has data protection standards equivalent to the standards specified by the PPC; and,
8. Data Subject's Right: If a data subject requests pursuant to the APPI disclosure of Purposes, access to, correction, or deletion of any of Personal Data relevant to such data subject, or lodge a complaint, we will respond to such request or complaint promptly and in accordance with the APPI. Any fee charged to data subjects shall be reasonable.
To the extent data processing falls within the scope of the Swiss Federal Act on Data Protection (FADP), (a) the scope of "personal data" shall be determined in accordance with the FADP, and (b) references to the GDPR shall be understood as references to the FADP.