(Version dated: November 2024 – The Privacy Policy is updated regularly. The current version can always be found online at https://consent.vwgroup.io/consent/v1/texts/carnet/cy/en/dataprivacy/latest/html)
This Privacy Policy provides information on the processing of personal data by Volkswagen AG in connection with the use of mobile online services (“Car-Net”, “We Connect” and “VW Connect”). It does not apply to the use of mobile online services in vehicles of the ID. family. The Privacy Policy for the use of mobile online services in vehicles of the ID. family is available at https://consent.vwgroup.io/consent/v1/texts/weconnect/cy/en/dataprivacy/latest/html.
As a German company, Volkswagen AG is bound to German law and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”). This also applies when Volkswagen AG processes personal data of persons with a permanent residence outside of Germany. Part I of this Privacy Policy contains information on the processing of relevant data as required by German law and the GDPR.
To some extent, Volkswagen AG may also be bound by national legislation of other countries. Persons with a permanent residence in one of the countries specified in Part II of this Privacy Policy, can find further information in that section.
A. General information on the processing of personal data
I. Controller for data processing
II. Data protection officer
III. Purposes for which data is processed when you use the mobile online services
IV. Evaluation for reporting purposes within Volkswagen AG
V. Creating evaluations for corporate management
VI. Data processing for the purpose of business reporting
VII. Processing for marketing purposes
VIII. Erasure and rectification of data
IX. Data recipients
B. Your rights
I. Right to information
II. Right to rectification
III. Right to erasure
IV. Right to restriction of processing
V. RIGHT TO OBJECT
VI. Right to data portability
VII. Right to withdraw consent
VIII. Right to lodge a complaint
C. Data processing in detail
I. Volkswagen ID
II. Volkswagen Ident
III. Data processing with the use of mobile online services
IV. Service portfolio
The responsible office for the processing of personal data is Volkswagen AG (hereafter also referred to as “we” or “us”).
Volkswagen AG can be reached at:
Volkswagen AG
Berliner Ring 2
38440 Wolfsburg
Germany
Tel.: +49 - 5361 - 9 - 0
connect-support@volkswagen.de
Register of companies number HRB 100484 (Braunschweig district court)
Our data protection officer is the contact person for all matters relating to data protection and for exercising data subject rights (see Section B. “Your rights”).
Please address requests to:
Datenschutzbeauftragter der Volkswagen AG
Berliner Ring 2
38440 Wolfsburg
Germany
dataprivacy@volkswagen.de
For exercising data subject rights, you can also use the email addresses info-datenschutz@volkswagen.de (Germany) and privacy@volkswagen.de (outside of Germany) or our Volkswagen Privacy Portal https://www.datenschutz.volkswagen.de.
• Contract conclusion
We will process personal data of our customers that our customers have provided to us while registering for the mobile online services, such as email address, password, S-PIN, name, address, User ID, vehicle identification number, vehicle brand, nickname, preferred language, time the order was placed (Start Timer 14 Days), time of activation, date of birth (VW Ident) and IT usage data, for the purposes of concluding and fulfilling the contract for mobile online services (Article 6(1)(b) GDPR).
With a view to improving user friendliness, ensuring smooth functionality and enhancing the process of activating the mobile online services for a vehicle, we will analyse the following data:
• A pseudonymised user ID that is generated by means of a pseudonymisation algorithm, combining the user ID and vehicle identification number.
• IT usage data that is generated in the context of the activation process and allows information to be inferred about the running and status of the activation process.
The data processing described above is based on our legitimate interest to offer our customers and potential customers newly developed as well as improved products and services (Article 6(1)(f) GDPR).
• Data processed when you use the mobile online services
If the vehicle is used with the mobile online services activated, we will process personal data from the vehicle, to the extent that this is necessary, for the purpose of providing said services.
If a vehicle user is logged in at the vehicle as the primary user, a secondary user or a guest user, we will process their personal data for the purpose of meeting our contractual obligations (Article 6(1)(b) GDPR). The use of mobile online services does not require logging in at the vehicle with an account. This requires that the settings in the vehicle are set to the Online mode. After that, the personal data of the vehicle user will be processed according to the selected privacy settings. This data processing is based on our legitimate interest to make the mobile online services available on the vehicle accordance with the contract (Article 6(1)(f) GDPR). Information on the privacy settings and the user concept is provided in Section “C. Data processing in detail” under “III. 1. Restrict data processing and manage services” and “III. 2. User concept”.
The following will always be processed when using the services: vehicle identification number (VIN), vehicle IP address, SIM data and an internal Volkswagen customer identification number (if available). The additional data that will be processed and information on the privacy settings, user concept and individual user roles, is available in Section C. “Data processing in detail” under “III. 1. Data processing when using mobile online services”.
Customers who have registered for mobile online services using their Volkswagen ID are also able to log into any Volkswagen AG Internet-enabled vehicle (as a “guest user”) for the purpose of transferring across their personalised settings (such as seat adjustment settings). Guest users can also log in at vehicles without activated mobile online services to load their personalised settings in the vehicle. In this case, we will process the vehicle identification number (“VIN”) and the IP address of the vehicle. This processing is necessary to ensure the functionality of the mobile online services. It is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest to perform the contract for mobile online services with the guest user.
The eCall Emergency System service is available on the vehicle even if no mobile online services have been purchased for the vehicle. Data is processed for the purpose of providing this service because of our legal obligation in this regard and to protect vital interests (Article 6(1)(c) GDPR in conjunction with Article 5(1) of Regulation (EU) 2015/758 of the European Parliament and of the Council of 29 April 2015 concerning type-approval requirements for the deployment of the eCall in-vehicle system based on the 112 service and amending Directive 2007/46/EC; Article 6(1)(d) GDPR).
The registration in the vehicle and user identification by us do not apply to Up and eUp vehicles. Only the registered primary user for the vehicle is viewed as the data subject of the data processing, unless the person provides proof that the person has used the vehicle at a specific point in time.
The vehicle normally connects once to the Volkswagen data server before it is handed over to the vehicle purchaser or user at the dealership (but certainly no later than when the vehicle has reached an initial odometer reading of 25 km) so that the software certificates can be updated and the vehicle registered on the Volkswagen data server. The vehicle odometer reading and the vehicle identification number (VIN) are processed for this purpose. This update process is necessary so that the mobile online services can be made available ready for activation and so that the services already available on the vehicle without concluding a contract for mobile online services and the legally required “eCall Emergency System” are able to function. If the vehicle was set to “Maximum privacy” in the privacy settings immediately before the start of the update process, it will automatically return to this privacy level on completion of the update process. Data processing is carried out for the purpose of performing the sales contract for the Internet-enabled vehicle between the vehicle purchaser and the dealership, and on the basis of our legal obligation to provide the eCall Emergency System (Article 6(1)(b) and Article 6(1)(c) GDPR).
To enable technical provision of the services following their activation (particularly in order to authenticate the vehicle and establish a secure connection between the vehicle, the user and the Volkswagen data server), the VIN, IP address, SIM data of the vehicle and the internal Volkswagen customer identification number will be processed. This internal customer identification number will be used to uniquely identify the vehicle user and to check that the vehicle user is authorised to use a particular service in the vehicle. The aim of this is to prevent unauthorised persons from gaining access to the services. This data processing is carried out for the purpose of providing the services (Article 6(1)(b) GDPR) and is necessary for authenticating the vehicle and establishing secure communication between the vehicle and the respective vehicle user and the data server.
In addition, when the vehicle is started, the time of the vehicle systems is synchronised with that of the data server. This data is processed to ensure the IT security for the mobile online services. The vehicle must have the correct time in order to check the validity of the certificates transmitted from the vehicle for secure communication. This is a necessary prerequisite to ensure secure communication with the data server and combat cyber attacks by third parties. Data processing is carried out for the purpose of fulfilling the sales contract for the Internet-enabled vehicle between the vehicle purchaser and the dealership and, if applicable, for initiating the contract or fulfilling the contract for mobile online services (Article 6(1)(b) GDPR).
In addition, log files containing the VIN, IP address, time stamp and, where applicable, fault information are created and evaluated so that faults, technical malfunctions and security threats can be detected and eliminated early on. Data processing is based on the overriding legitimate interest to warrant the integrity, availability and capacity of the vehicle systems and thereby vehicle security (Article 6(1)(f) GDPR). In the event of a fault being detected, we may process the contact details we hold on file for you if we need to contact you.
Data processing is carried out for the purpose of fulfilling the sales contract for the Internet-enabled vehicle between the vehicle purchaser and the dealership and, if applicable, for initiating the contract or fulfilling the “VW Connect” contract (Article 6(1)(b) GDPR).
Certain mobile online services enable access to the vehicle and/or control the vehicle’s warning signals, e.g. the Lock & Unlock function. Before these are used for the first time, a one-off identity verification process must be performed. As part of this, personal data provided by the customer to us will be compared with the details on the relevant identification document. Notification of this process occurs in advance. The data will not be processed until the customer has given explicit consent according to (Article 6(1)(a) GDPR) and (Article 9(2)(A) GDPR), if special categories of personal data is processed and for the purpose of enabling the corresponding mobile online services.
Related details are available in Section C. “Data processing in detail” under “II. Volkswagen Ident”.
Information on consultation for customer care can be found online in the “Privacy Policy for use of the Customer Interaction Centre (CIC)”. You can access this at https://cic-legal.volkswagen.com.
The Customer Interaction Center may contact individual customers to the extent necessary for the performance of the “Car-Net”, “We Connect” or “VW Connect” contract. In doing so, the contact details on file with us will be processed for the purpose of contract performance (Article 6(1)(b) GDPR).
Applies to customers in Germany only:
Contact your authorised Volkswagen repairer (authorised workshop and/or dealership) for customer-focused support for our mobile online services, who handles the customer care for Volkswagen AG. The following data is included in the transmission to the authorised Volkswagen repairer and processed by same as a processor: contract data, name, first name, Volkswagen ID user account (email), VIN and vehicle data, verification status, user status (primary user yes/no), Service scheduling (service active / not active), preferred authorised workshop (service selected / not selected) and further data that you provide to use as part of your request. We will process this data in accordance with Article 6(1)(b) GDPR for the purpose of performing the contract for mobile online services or – if you are not already a customer – in order to initiate a contract for the use of the mobile online services.
We process data relating to the vehicle and the digital products purchased, as well as data concerning the use of the services on the vehicle.
The data is processed for the following purposes:
• Improving customer care
• Sales management
• Ensuring correct accounting
• Product monitoring, fault analysis, implementing fault rectification measures and paying compensation to customers as a goodwill gesture
• Improving products
• Derivation of marketing measures
• Commissioning payments to importers and dealerships
• Remunerating the service providers that we use for the mobile online services
Once it has been analysed, the data is made available to the responsible departments within Volkswagen AG only to the extent required for the respective purpose (and, where possible, in anonymised form).
Personal data:
• Vehicle identification number (VIN)
• User ID
• Information concerning purchased products (article number, activation status, activation date, contract duration, country selected during registration, payment method)
• Log file information on service calls
• Information on vehicle equipment
• Type of customer (private or commercial customer)
• Status of the marketing consent declaration
• Information concerning whether a preferred authorised workshop has been specified
Legal basis: Article 6(1)(f) GDPR (legitimate interest: managing the business model for the mobile online services and improving the customer experience within the context of the aforementioned purposes)
Other data recipients: CARIAD SE, Berliner Ring 2, 38440 Wolfsburg, Germany
Volkswagen AG is constantly striving to improve business processes as part of company management and to optimise the associated costs. This requires a well-founded analysis of web analysis, offer, sale and order data. For this reason, Volkswagen AG processes data from web analysis, offer, sale and ordering systems as well as data from services that are linked to the Volkswagen ID. Details on processing this data (e.g. exactly what data is processed and how) are provided in the Volkswagen ID Privacy Policy at https://vwid.vwgroup.io/data-privacy.
As part of internal company reporting (business reporting), data is processed to manage the business model of mobile online services and to enhance the customer experience. In doing so, we process data that is used in the vehicle in relation to the digital products and services purchased. Once it has been analysed, the data is made available to the responsible departments within Volkswagen AG only to the extent required for the respective purpose.
The following personal data will thereby be processed:
• Personal contact and identification data (e.g.: User ID)
• Vehicle data (e.g. vehicle identification number (VIN), vehicle equipment, country of delivery (importer))
• Contract data (e.g. customer type (private or business customer), customer ID, contract date, customer history (e.g. interest without conclusion of a contract, conclusions, payments, reimbursements, bonuses, reminders, terminations), customer complaints, information on products purchased (article number, activation status, activation date, duration, country selected on registration, payment method), status of marketing consent declaration, licence data (for example, licences purchased, expiration date))
• IT usage data (e.g. User ID, log file information for service calls, IP addresses)
• Vehicle usage data with VIN/registration number that is of importance in relation to guarantee, warranty, product liability, safe vehicle operation (e.g. country of delivery, chassis number, delivery data, equipment)
The data is processed for the following purposes:
• Analysis for sales control and product improvement
We process data to manage distribution, develop new products and services, and to improve existing ones, by analysing acceptance rates and important performance indicators (KPIs). The corresponding analyses include the tracking of the number of produced, delivered and registered vehicles and the corresponding product licenses as well as the calculation of enrolment and extension rates. For the above stated purpose, your personal data is processed on the basis of our legitimate interest in accordance with Article (6)(1)(f) GDPR. Our legitimate interest is in the estimation of acceptance rates of new products/services, and in the evaluation of the acceptance rates of existing products/services.
• Accounting
For accounting purposes, fault recognition and risk management, we compare shop offers with actual purchases and invoices from payment service providers. Additionally, as measures for quality control, license information and E-Commerce transactions are analysed to correct errors and minimise incorrect offers in the Volkswagen Connect Shop. For the above stated purpose, your personal data is processed on the basis of our legitimate interest in accordance with Article (6)(1)(f) GDPR. Our legitimate interest is in ensuring that accounting processes are error-free and financial documents match the actual transactions, as well as recognising and mitigating risks in relation to incorrect offers or purchases.
• Payment of commissions and compensations to the dealership and importer
For the calculation and payments of commission and compensation to dealerships and importers, we prepare reports by market and dealership with information on purchased products, product life, purchase date, price and commission value. The relevant data is then provided to the importers to derive the sales commissions. For the above stated purpose, your personal data is processed on the basis of our legitimate interest in accordance with Article (6)(1)(f) GDPR. We have a legitimate interest in the precise calculation and payment of commissions, provide the required data to importers and dealerships, and to manage the data specific to the market to ensure operational efficiency.
• Product monitoring, error analysis and implementation of fault rectification measures
We process data on the contract status, including the VIN, to identify and rectify product faults, and to determine if an affected customer is considered for receiving compensation, or to take other measures for fault rectification. For the above stated purpose, your personal data is processed on the basis of our legitimate interest in accordance with Article (6)(1)(f) GDPR. Our legitimate interest is in the monitoring of the product behaviour, analyse and rectify faults as well as determining if affected customers are entitled to compensation.
• Remunerating the service providers that we use for the Mobile Online Services
We internally compare the licenses obtained in the Volkswagen Connect Shop with the license information stored in our systems to settle services utilised by us and process the payments to the service providers. For the above stated purpose, your personal data is processed on the basis of our legitimate interest in accordance with Article (6)(1)(f) GDPR. Our legitimate interest is in ensuring a correct settlement and payment to our service providers by checking and calculating the remuneration on the basis of the purchased licenses and the provided services.
The following data recipients are used as processors:
• Amazon Web Services Inc. (USA) – To provide an analysis and data platform
• Amazon Web Services EMEA SARL (Luxembourg) – To provide an analysis and data platform
• ADASTRA GmbH (Germany) – As a developer of dashboards and reports
• CARIAD SE (Germany) – As a developer of dashboards and reports
• P3 Automotive GmbH (Germany) – To support internal colleagues in communicating with importers
• SCREEN GmbH Training-Beratung (Germany) – To support internal colleagues in training importers to handle dashboards and reports
• Volkswagen Group Services GmbH (Germany) – To support internal colleagues in communicating with importers
Other third parties:
• Importers (as responsible parties) – For remuneration of dealers and importers within the scope of the contractually stipulated profit sharing for sales revenue of digital products
Recipients domiciled in third countries:
• Your personal data will be processed in an Amazon Web Services Cloud operated by Amazon Web Services EMEA SARL (“Amazon”) (as processor) in the European Union for the purpose of internal company reporting. Access to personal data by Amazon Web Services, Inc. (as processor), based in the USA, cannot be excluded, thus the relevant EU standard contractual clauses (a set of contractual clauses approved by the European Commission that accords the same protection to personal data that it has in the EU during data processing in non-EU countries) have been concluded.
• You can access the EU standard contractual clauses used at https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32021D0914. Volkswagen AG erases your personal data after 10 years or in accordance with the legal requirements, e.g., as soon as the purpose for which the data was collected no longer applies and provided that there are no other retention obligations.
Applies to customers in Germany:
Volkswagen AG always strives to send information to its customers that is personally tailored to them as much as possible and thus improve advertising for the marketing of its products and services. This requires an in-depth analysis of products and services. If the customer has given consent, Volkswagen AG will therefore process data from the Volkswagen ID user account and from the mobile online services. Details on processing this data (e.g. exactly what data is processed and how) are provided in the Volkswagen ID Privacy Policy at https://vwid.vwgroup.io/data-privacy.
Applies to customers in additional countries, who are using mobile online services, with the exception of Germany:
Volkswagen AG always strives to send information to its customers that is personally tailored to them as much as possible and thus improve advertising for the marketing of its products and services. An in-depth analysis of products and services (analytics) is required to accomplish this goal. For this reason, Volkswagen AG processes data from the Volkswagen ID user account and from the mobile online services, for example:
• Identification data (e.g. name, email, telephone number, vehicle identification number, if applicable)
• User account data (e.g. preferred partners)
• Transaction data (e.g. completed agreements)
• Vehicle usage data (e.g. logbook, fluid levels, mileage (km))
• Contract data (e.g. vehicle equipment, ongoing contracts with related services)
• IT usage data (e.g. last login to services, use of functions)
• Location data (e.g. truncated GPS data)
In the event that vehicles are recorded, Volkswagen AG will also process the vehicle identification number and add additional equipment data of the vehicle to the information listed above and build segments. Volkswagen AG transmits these segments as well as the raw data to the competent national sales company (importer) for the respective country for the improvement of advertising.
The described processing of the data is based on the consent given by the customer (Article 6(1)(A) GDPR) in personalised advertising by Volkswagen AG. If the customer does not consent to same, the customer's data will not be processed for the named purpose.
Volkswagen AG deletes the personalised data after five years or in accordance with the legal requirements, e.g. as soon as the purpose for which the data was collected no longer applies and provided that there are no other retention obligations.
Further information on the analysis of customer data to improve marketing and on consenting to receiving marketing communications from Volkswagen AG and from the national sales company (importer) responsible for the respective country is provided in the comprehensive Volkswagen ID Privacy Policy. This information is available at https://vwid.vwgroup.io/data-privacy.
If the personal data is no longer needed for the purpose or purposes for which it was collected, it will be erased by us if there are no statutory archiving obligations that prevent erasure.
Furthermore, our customers can rectify the data they have entered at any time in the settings of their Volkswagen ID – if they have created such an ID.
1. Data servers
The data may be processed – depending on the model and equipment – on servers of the following service providers on our behalf and in accordance with our instructions:
CARIAD SE
Berliner Ring 2
38440 Wolfsburg
Germany
Audi AG
Auto-Union-Straße 1
85057 Ingolstadt
Germany
Amazon Web Services, Inc. (“AWS”)
410 Terry Ave. North
Seattle WA 98109
USA
Amazon Web Services EMEA SARL
Avenue John F. Kennedy 38
1855 Luxemburg
Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
D18 P521
Ireland
2. IT support service providers
In addition, we use various IT service providers both within and outside the EU. These assist us with the maintenance of our IT systems and with technical support, for example. Insofar as the service providers have access to personal data, they will process this data on our behalf and in accordance with our instructions only.
IT support is provided in particular by the following service provider:
CARIAD SE
Berliner Ring 2
38440 Wolfsburg
Germany
Volkswagen Infotainment GmbH
Rensingstraße 15
44807 Bochum
Germany
3. Other mobile online services users of the vehicle
Some services may allow vehicle users who have been assigned the primary and secondary user roles to view certain vehicle usage data (where applicable: including vehicle position data) via their personal login area in the web browser and/or via the “Volkswagen” app. To prevent access, vehicle users can deactivate relevant services in the settings. In addition, each vehicle user can restrict this data processing in the privacy settings. Detailed information on the privacy settings is provided in Section “C. Data processing in detail, III. Data processing when using mobile online services” under number “1. Restricting data processing and managing services” and number “2. User concept”. Detailed information on data processing as part of the individual services is also available in Section “IV. Service portfolio”.
4. Other recipients
Personal and/or vehicle-related data will also be forwarded to third parties where this is necessary for improving our online presence or performing the contract, particularly for providing the mobile online services. See Section C. “Data processing in detail” for information about how data is forwarded to third parties in the context of providing specific mobile online services.
5. Recipients domiciled in third countries
For the purposes outlined in this Privacy Policy, Volkswagen AG also transfers personal data to recipients and processors domiciled outside the EU. Volkswagen AG agrees to EU standard contractual clauses with recipients in unsafe third countries to ensure that personal data is adequately protected. The EU standard contractual clauses can be accessed in the EU languages under the following URL https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32021D0914y.
If required by the applicable data protection legislation, other protective measures (such as encryption and additional contractual provisions) are also put in place to ensure that personal data is adequately protected.
6. Legal requirements for the disclosure of data
Insofar as legal regulations apply, we are obliged to hand over data stored by us to the necessary extent at the request of government agencies (e.g., in the investigation of a criminal offence). The legal basis for the transfer of data to the respective government agency is provided by the respective legal obligation (Article 6(1)(c) GDPR in conjunction with the respective legal obligation).
You can exercise the following rights with respect to Volkswagen AG at any time and free of charge.
If a primary user has activated mobile online services for a vehicle that you then use without logging in with your own Volkswagen ID, we will not be able to identify you while you are using it. If you assert data subject rights, we will have to check your identity and may ask you to provide additional information or clarification where necessary (in particular, information relating to the period or other circumstances of vehicle use). We can request this additional information so that we can identify the relevant personal data and make it available to you. We must also ensure when we provide personal data that we do not infringe the rights of other vehicle users.
More information on asserting your rights can be found at: https://datenschutz.volkswagen.de/.
You have the right to request confirmation from us as to whether or not personal data concerning you is being processed and – if it is – to be informed what personal data concerning you is being processed, and also which third parties within and outside the EU have had your data forwarded to them. You also have the right to obtain a copy of the personal data concerning you that is being processed by us.
You have the right to have incorrect or incomplete personal data concerning you rectified by us.
You have the right to demand erasure of your data if the requirements stated in Article 17 GDPR are met. According to this, you can request, for example, that your data be erased if it is no longer necessary for the purposes for which it was collected. In addition, you can request erasure if we process your data on the basis of your consent and you withdraw this consent.
You have the right to request restricted processing of your data if the requirements stated in Article 18 GDPR are met. This is the case, for example, if you dispute the accuracy of your data. You can request that processing is restricted for the period during which the accuracy of the data is being checked.
If processing takes place for direct marketing purposes (including profiling for direct marketing purposes).
If processing (including profiling) takes place on the following legal bases:
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Article 6(1)(e) GDPR).
Processing is necessary for the protection of our legitimate interests and those of a third party (Article 6(1)(f) GDPR). If you do raise any objection of this kind, we kindly request that you inform us of the reasons why you are objecting to data processing. If you object, we will no longer process your data unless we can prove compelling reasons for processing that outweigh your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.
If data processing is based on consent or contract performance and processing takes place using automated means, you have the right to obtain your data in a structured, commonly used and machine-readable format and to transmit this data to another controller. In addition, you have the right to have the personal data transmitted directly by us to another controller.
Where data processing is based on consent, you have the right to withdraw your consent, free of charge, at any time with effect for the future by sending an email to info-datenschutz@volkswagen.de (Germany); privacy@volkswagen.de (outside of Germany), at our Volkswagen Privacy Portal https://www.datenschutz.volkswagen.de or through the contact details in the site notice.
You also have the right to lodge a complaint with a data protection supervisory authority or another competent data protection authority about our processing of your data. This can, for example, be the data protection authority in your country of residence. A list of all data protection authorities in the European Union and the European Economic Area can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en#member-cy.
The Volkswagen ID provides our customers with the option to log in at various online services of Volkswagen AG or third parties. The data processing necessary for this is carried out for the performance of a contract (Article 6(1)(b) GDPR). The Volkswagen ID acts as a central user account where our customers can centrally manage their personal data. In order to use a mobile online service, it is necessary to create a Volkswagen ID or to log in with an existing one. The mobile online service selected by the customer is linked with the Volkswagen ID of the customer. This linking will only take place if the customer has given consent for this (Article 6(1)(a) GDPR). Information on data processing in relation to the Volkswagen ID is available in the Privacy Policy, which can be accessed online under https://consent.vwgroup.io/consent/v1/texts/IdentityKit/de/en/volkswagen-dataPrivacy/latest/html.
An identity check (Volkswagen Ident) is required before using mobile online services that allow access to the vehicle (such as by “Lock & Unlock”).
AutoIdent by IDnow is an identification solution that enables customers to identify themselves online and in real time. The customer uploads a machine-readable identification document, such as an identity card, passport or driving licence (depending on the applicable requirements in the country of the customer) and records a short selfie-video. The AutoIdent software then automatically checks the authenticity of the document and compares it with the video to ensure that this is the actual person who wants to identify themselves. As soon as the identity has been checked successfully, customers can verify their identity online and use mobile online services, such as those permitting access to the vehicle (e.g. “Lock & Unlock”).
The Volkswagen ID (internal identification number enabling the unique assignment of customer data) will be sent to the commissioned service provider.
This identification number will be enriched with further data (e.g. portrait image) by the commissioned service provider during the identification process. The customer will be notified of this separately in advance and must expressly consent before we are allowed to process the data in this way. In this case, the data will be processed by virtue of the customer’s consent on the basis of Article 6(1)(a) GDPR and Article 9(2)(a) GDPR solely for the purpose of identifying the customer in order to activate mobile online services for which unique identification is required. The data will be transmitted exclusively in encrypted format.
On conclusion of the identification process, the service provider will send the customer's surname, first name, date of birth and Volkswagen ID, as well as the time of identification, back to us for the purpose of documenting the result and enabling the mobile online services. In addition, the following will be sent for the purpose of documenting which identification document was used to identify the customer: type of document, the document number, country of issue, date of issue and date of expiry.
We analyse whether the Volkswagen Ident processes have been completed successfully or aborted. This is why we store the status of the verification process of a customer.
The front and back of the document, recorded security features of the identification documents and photos of the face are stored by IDnow for evidence purposes and erased after a maximum of thirty (30) days.
Volkswagen will store the personal data until the customer deletes the Volkswagen ID user account.
Third-party provider information:
IDnow GmbH
Auenstraße 100
80469 München
Germany
This recipient will process the personal data only on our behalf and in accordance with our instructions.
As an alternative, the Volkswagen Ident process can be carried out on site at any Volkswagen authorised workshop if it offers this service. The customer must first complete the registration process in the customer’s personal login area in the web browser by providing the customer's surname, first name and date of birth.
On site at the Volkswagen authorised workshop, the data provided will then be compared with the details on the customer's driving licence. In this case, the data will be processed by virtue of the customer’s consent on the basis of Article 6(1)(a) GDPR and Article 9(2)(a) GDPR solely for the purpose of identification in order to activate mobile online services for which unique identification is required. The recorded data (driving licence number, date of issue, where applicable: country of issue, validity period) will be sent to us. The data will be transmitted exclusively in encrypted format. The Volkswagen authorised workshop does not store any data. The Volkswagen authorised workshop will process the data only on our behalf and in accordance with our instructions.
Where stipulated by law, the eCall (“eCall Emergency System”) will be available to vehicle users even if they have not concluded a contract for mobile online services.
To activate further mobile online services on the vehicle, a Volkswagen ID, a contract for mobile online services and a registration as the primary user of the vehicle are required.
When using mobile online services, the vehicle communicates with the Volkswagen AG data server. In the course of this, personal data (such as the vehicle identification number (VIN)) and technical data will be processed.
Privacy settings allow you to restrict the connection and, in turn, the processing of personal data. However, it may not be possible for mobile online services to be provided in full while data processing remains restricted.
Privacy settings control the data transfer between the vehicle and the Volkswagen data server. In addition, other vehicle users who have been assigned the primary and secondary user roles may be able to view certain vehicle usage data (where applicable: including vehicle position data), depending on which services are available and have been activated on the vehicle. This, particularly the sharing of vehicle position data, can also be restricted with the privacy settings in the vehicle.
One of the following settings can be selected:
• Maximum privacy
All mobile online services are deactivated, except the “eCall Emergency System” and/or “Emergency Call Service” insofar that the statutory “eCall Emergency System” is not available.
The SIM card will only log in at the mobile communications network if an emergency call is triggered by an accident or made manually (for details of how data is processed in this case, see number “IV. “Service portfolio”, under “Emergency Call Service, eCall Emergency System”.
• No position data
This prevents the processing of location data. Processing of other data, such as the vehicle identification number (VIN), is permitted.
• Use my position
The mobile online services are permitted to use the vehicle position but not to divulge it to any other vehicle user (see next setting “Share my position”).
• Share my position
All mobile online services are activated. The vehicle position may be visible to other vehicle users within their personal login area in the web browser or in the “Volkswagen” app, insofar as this is permitted by the services. Information on the user concept is provided in the following section.
• Manage services
The services can also be activated and deactivated individually by each user. For instance, even before switching to another privacy level, services to be activated and deactivated for that level can be selected.
Users of the mobile online services can (depending on the model and equipment) assume different roles (user roles). Based on the user role, different authorisations are granted for using the mobile online services and the vehicle:
The “primary user” role is intended for the vehicle keeper or someone who is authorised to use the vehicle more than just temporarily (lessee, company car driver, etc.). The primary user is always granted all authorisations. There is only one primary user per vehicle. If a new primary user authenticates themselves for the vehicle, the primary user role is automatically removed from the previous primary user. In the vehicle, each user is shown who the current primary user is and how long they have had that role. This information is displayed in order to fulfil the contract for mobile online services (Article 6(1)(b) GDPR).
The “secondary user” role is intended for users who regularly share use of the vehicle, e.g. as a family member, partner or friend of the primary user. Secondary users obtain their status from the primary user: secondary users have to be approved for the vehicle by the primary user; the primary user can delete the secondary user at any time. If the primary user who granted authorisation to the secondary user loses their primary user status, the secondary user will lose their status as well.
The “guest user” role is intended for users who use a vehicle occasionally or only once. Guest users can log into any Volkswagen AG Internet-enabled vehicle themselves for this purpose. Guest users have only limited access to certain mobile online services.
The primary user can view the nicknames and profile photos of the secondary and guest users registered in the vehicle in their personal log-in area in the web browser.
Primary users have the option to invite a guest user to their personal login area in the web browser for the role of a secondary user. The guest user can either accept or reject the invitation as a secondary user in the personal login area in the web browser or in the “Volkswagen” app. The information is processed to fulfil the contract for the mobile online services (Article (6)(1)(b) GDPR).
The “guest user” role is not the same as “anonymous guest”. which is the role assumed by anyone who uses the vehicle without logging into it with their Volkswagen ID. The anonymous guest starts every journey with the most recent privacy settings that were entered by the anonymous guest (“No position data”, “Use my position” or “Share my position”). Services are available to the anonymous guest depending on the privacy settings.
Depending on what privacy level has been set by the current vehicle user, some services (such as the vehicle status service) allow the primary and/or secondary user to view certain data via their “Volkswagen” app or their personal login area in the web browser. In the case of logged-in users, the data is shared with other users for the purpose of performing a contract (Article 6(1)(b) GDPR) and in the case of anonymous guests, it is shared with other users on the basis of our legitimate interest to make the services available on the vehicle in accordance with the contract (Article 6(1)(f) GDPR).
Details regarding the services are provided under number “IV. Service portfolio”.
The mobile online services listed below may be available in the vehicle depending on the model and model year of the vehicle, the equipment, the country and the service plans which may or may not have been subscribed.
An overview is provided below of the data processed in the context of the respective service, the legal bases for processing and the respective data recipients. Details of the data recipients who receive data across multiple services are provided in Section “A. General information on the processing of personal data” under “VIII. Data recipients”.
We are providing information about the services and which ones are associated with a particular service package under the following link: http://connect.volkswagen-we.com.
Services that process the current location of the vehicle user are identified with an *.
This service offers a detailed model view of specific cities. Some cities are pre-installed on the navigation system of the vehicle while others can be downloaded subsequently or updated online depending on what section of the map is being displayed.
Personal data: Vehicle identification number (VIN), map tile ID, map layer ID, map tile version, map layer version
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
The “Departure Times” function allows vehicle users to specify when the battery of an electric or hybrid vehicle will be charged and whether this vehicle should be air-conditioned at the desired departure time. The data can be set and accessed by primary users and secondary users via the “Volkswagen” app.
Personal data: vehicle identification number (VIN), departure timer with settings for charging, air conditioning and off-peak electricity
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
The “Amazon Alexa” In-Car App allows vehicle users to use the Amazon Alexa Voice Assistant securely and conveniently while inside the vehicle. Alexa is a service provided by Amazon EU SARL, 5 Rue Plaetis, 2338 Luxembourg, Luxembourg (Amazon); the voice control commands will not be processed by Volkswagen AG. Volkswagen AG merely provides an interface with Amazon via the Amazon Alexa in-car app inside the vehicle. All data (such as voice control commands, geoposition, IP address, device ID, vehicle model, access token) is sent to Amazon directly from the vehicle. Amazon is responsible for the processing of this personal data and the Amazon Privacy Policy applies.
If you have a traffic accident or a medical emergency is detected – regardless of the selected privacy settings – an automatic emergency call will be made. The vehicle detects when an accident has occurred by means of sensors and activates the legally required “eCall Emergency System” in such an event. Using the control located in the roof console (or in the infotainment system) of your vehicle, you can also manually report an emergency involving your own vehicle at any time via the “eCall Emergency System” or request assistance for other road users who are in an emergency situation. In the event of activation of the emergency call system, a voice connection will be established with the emergency services control centre, via which – depending on the individual case – additional personal data may also be requested and transmitted (e.g., in relation to the type and severity of injury).
Emergency Call Service:
Personal data: Vehicle identification number (VIN), vehicle type, time, location, direction of travel, number of people inside the vehicle, selected infotainment system language, severity of accident, direction in which accident occurred (e.g. frontal or side collision), triggering event, drive type
Legal basis: Art. 6(1)(d) GDPR (protection of interests that are essential for life), Art. 6(1)(f) GDPR (protection of legitimate interests)
Other data recipients: Bosch Service Solutions GmbH, Mainzer Landstraße 193, 60326 Frankfurt am Main, Germany. (This recipient will process data only on our behalf and in accordance with our instructions.)
The “Emergency Call Service” function can be switched off using the Manage Services function (depending on model and equipment; see Section C.III.1. “Restricting data processing and managing services (privacy settings; available depending on model and equipment)” under “Managing services”). If “Manage services” is not available in the vehicle, the service can be deactivated by any participating authorised Volkswagen workshop. Further information is provided in the vehicle wallet.
eCall Emergency System (legally required emergency call system):
In the event of an accident, a voice connection will be established with the emergency services control centre, via which – depending on the individual case – additional data may also be requested and transmitted (e.g. in relation to the type and severity of injuries). In addition, the following data will be sent directly from the vehicle to the emergency services control centre using an automated process and without the involvement of the Volkswagen data server: vehicle identification number (VIN), type of activation, vehicle type, drive type, time of emergency call, location, direction of travel, number of people inside the vehicle, speed reduction in case of an accident in longitudinal direction and speed reduction in case of an accident in cross direction (model-dependent). Data is automatically transmitted to the emergency services control centre on the basis of a legal obligation and to protect vital interests (Article 6(1)(c) GDPR in conjunction with Regulation (EU) 2015/758 of the European Parliament and of the Council of 29 April 2015 concerning type-approval requirements for the deployment of the eCall in-vehicle system based on the 112 service and amending Directive 2007/46/EC; Article 6(1)(d) GDPR).
If the vehicle is in offline mode (maximum privacy setting), the compulsory “eCall Emergency System” will be activated, which will make an emergency call via the 2G/3G mobile network. If, due to switched off mobile networks, the compulsory “eCall Emergency System” is not available, an emergency call will be made via the “Emergency Call Service”, regardless of the privacy setting. A complete deactivation of the manufacturer “Emergency Call Service” requires the deactivation of the individual service.
Customers can purchase data plans from one of our mobile service provider partners for the use of the Wi-Fi hotspots and certain streaming services and use them in the vehicle. The prerequisite for this is that they will need to register with the mobile service provider that we have appointed for the vehicle. Any data processing connected with the purchase and use of a data plan is carried out under the mobile service provider’s own responsibility.
Personal data: Vehicle identification number (VIN), SIM card details
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: The mobile service provider used for the vehicle
This service allows primary or secondary users of the vehicle to have certain driving data displayed in their personal login area in the web browser and in the “Volkswagen” app. At the end of the journey, the aforementioned vehicle data will be sent to Volkswagen AG and will then be available for retrieval in their personal login area in the web browser and via the “Volkswagen” app.
Personal data: vehicle identification number (VIN), average speed, duration of journey, distance covered (not the actual route), average overall consumption
Legal basis: For the primary and secondary users: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the service for the primary and secondary users in accordance with the contract)
Other data recipients: none
The “Vehicle Status” function allows the primary or secondary user to display various items of status data for the vehicle in the “Volkswagen” app.
Personal data: vehicle identification number (VIN), drive type, state of charge, tank levels, remaining range, mileage (km), window, door and gate status, central locking system status, light status, time stamp
Legal basis: For the primary and secondary users: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the service for the primary and secondary users in accordance with the contract)
Other data recipients: none
The “Vehicle Health Report” informs primary users or secondary users about the current condition of the vehicle. This allows users to have current driver messages relating to the vehicle and/or any servicing requirements additionally displayed in their personal login area in the web browser and the “Volkswagen” app. This service only displays a limited selection of all warning lamps from the vehicle. The driver messages (warning and fault messages) indicated directly in the vehicle remain the sole source of authoritative information.
Personal data: vehicle identification number (VIN), mileage (km), time and distance remaining until next service, driver messages
Legal basis: For primary and secondary users: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service for the primary and secondary users in accordance with the contract)
Other data recipients: none
With the “Area Alert”, the primary user can request a notification if the primary user himself/herself, the secondary user or the guest user (with the exception of the anonymous guest) travels into or out of an area specified by the primary user. Every registered user of the vehicle can deactivate “Area Alert” at any time via the in-vehicle settings, thereby preventing that the primary user receives an area alert. The primary user can view the activity log for this service in the personal login area in the web browser. This service is also available via the “Volkswagen” app.
Personal data: vehicle identification number (VIN), the defined area as well as time period, geoposition of the vehicle during the journey (The geoposition remains in the vehicle and is not forwarded.)
Legal basis: for the primary user: Art. 6(1)(b) GDPR (for contract performance); for the secondary user and the guest user: Art. 6(1)(a) GDPR (consent)
Other data recipients: none (with the exception of the primary user)
With the “Speed Alert”, the primary user can request a notification if the primary user himself/herself, the secondary user or the guest user (with the exception of the anonymous guest) exceeds a vehicle speed specified by the primary user. Every registered user can deactivate “Speed Alert” at any time via the in-vehicle settings, thereby preventing the primary user from receiving a speed alert. The primary user can view the activity log for this service in the personal login area in the web browser. This service is also available via the “Volkswagen” app
Personal data: vehicle identification number (VIN), speed specified by the primary user
Legal basis: for the primary user: Art. 6(1)(b) GDPR (for contract performance); for the secondary user and the guest user: Art. 6(1)(a) GDPR (consent)
Other data recipients: none (with the exception of the primary user)
“Google Earth™” allows vehicle users to discover a large number of new places and, thanks to the realistic display of the surroundings, to experience a new navigation format.
Personal data: Vehicle identification number (VIN), location, IP address, selected navigation system language
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland
“Horn & Turn Signals” allows the primary user and secondary user to control the hazard warning lights and the horn of the vehicle remotely via the “Volkswagen” app if the user is within visual range (approx. 100 metres) of the vehicle, and also to display the current turn signal and horn status. The primary user and each secondary user can view the activity log for this service in their personal login area in the web browser.
Personal data: vehicle identification number (VIN), position of the vehicle and of your mobile device
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
With “In-Car Shop/Webshop”, the primary user can purchase mobile online services or extend the duration of mobile online services.
Personal data: vehicle identification number (VIN), contact details, contract data, credit card details/PayPal payment details
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: arvato distribution GmbH, Gottlieb-Daimler-Straße 1, 33428 Harsewinkel, Germany; J.P. Morgan Mobility Payments Solutions S.A.,. 161, Rue du Kiem L-8030 Strassen, Luxembourg; Markovski Solutions, Borovo Distr., bl. 10, 1680 Sofia, Bulgaria
Credit card details/PayPal payment details will be sent to the following recipients by J.P. Morgan Mobility Payments Solutions S.A.:
Concardis GmbH, Helfmann-Park 7, 65760 Eschborn, Taunus, Germany (for payment with credit card); PayPal (Europe) S.à.r.l. et Cie, 2224 Boulevard Royal, 2449 Luxemburg, Luxembourg (for payment with PayPal)
Using the control located in the roof console of the vehicle, the vehicle user can initiate the information call and contact customer service for vehicles of Volkswagen AG. This service is not available in the following countries where only a recorded message will be played: Albania, Malta, Ukraine, Belgium, Bosnia and Herzegovina, Bulgaria, Estonia, Finland, Ireland, Latvia, Lithuania, Luxembourg, Macedonia.
Personal data: Telephone number of the SIM card integrated into the vehicle and other personal data that the vehicle user shares during the call
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: in Germany, Volkswagen Group Services GmbH, Major-Hirst-Str. 11, 38442 Wolfsburg, Germany; outside Germany, the national sales company (importer) responsible for the respective country (the recipients process data only on our behalf and in accordance with our instructions).
“Air Conditioning” gives primary users and secondary users the ability to control the temperature inside of the electric or hybrid vehicle before they enter it using the air conditioning system (stationary air conditioning) and to activate (or deactivate) the window heating without having to be physically near the vehicle. The data can be set and accessed via the “Volkswagen” app.
Personal data: vehicle identification number (VIN), air conditioning status and settings, window heating status
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
“Charging” allows primary users and secondary users to control charging of the electric or hybrid vehicle’s battery, configure the charging process and check the charge level. The data can then be set and accessed via the “Volkswagen” app.
Personal data: vehicle identification number (VIN), charging status and settings
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
This service enables primary users to install a digital vehicle key on their smartphone or send one to other mobile online services customers via the “Volkswagen” app. Mobile online services customers can view existing mobile keys for the vehicle via the personal login area in the web browser, and also delete or rename mobile keys.
Personal data: vehicle identification number (VIN), user ID, email address (for assigning a key to other users), only if the key is changed on the vehicle: key type, key ID, mileage (km), service card status, status of the “Mobile Key” function on the vehicle (activated or deactivated); IDs of the secure environments on the device
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: Thales DIS Deutschland GmbH, Werinherstraße 81, 81541 München, Germany (This recipient will process data only on our behalf and in accordance with our instructions.)
This service allows customers to set their own news station (Newsfeed) and import it from their personal log-in area in the web browser to the vehicle.
Personal data: Vehicle identification number (VIN), favourites list of desired news channels (news feeds)
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
This service allows the map material to be updated online directly on the vehicle. For this purpose, the vehicle analyses which regions in a country are relevant for the vehicle / travelled most frequently.
Personal data: Vehicle identification number (VIN), the most frequented regions (only in the case of an automatic update); version number of the currently stored map data
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Additional data recipients: HERE Europe B.V., Kennedyplein 222 – 226, 5611 ZT Eindhoven, Netherlands; for Japanese customers instead of HERE Europe B.V.: Alibaba Group AutoNavi Software Co. Ltd., 7/F Shou Kai Square, NO. 10 Fu Rong Street, Wangjing, Chaoyang District, Beijing, China. (These recipients will process data on our behalf and in accordance with our instructions only.)
This service calculates the best route for the vehicle taking into account the current traffic situation.
Personal data: Vehicle identification number (VIN), location, destination entered, navigation data version, time stamp, route criteria settings
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: Joynext GmbH, Gewerbepark Merbitz Nr. 5, 01156 Dresden, Germany. (This recipient will process data only on our behalf and in accordance with our instructions.)
“Parking Spaces” searches for suitable parking spaces in the vicinity of the current vehicle position. The application provides information about price, opening hours, distances and telephone numbers.
Personal data: Vehicle identification number (VIN), location
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: Parkopedia Ltd. 232 Sladepool Farm Road, Birmingham, B14 5EE, United Kingdom; Joynext GmbH, Gewerbepark Merbitz Nr. 5, 01156 Dresden, Germany. (These recipients will process data on our behalf and in accordance with our instructions only.)
This service searches for suitable filling stations and charging stations in the vicinity of the current vehicle location. The application also shows the total number of charging stations and which ones are available. The application also provides information about the price, opening hours, distances and telephone numbers.
Personal data: Vehicle identification number (VIN), location
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: Joynext GmbH, Gewerbepark Merbitz Nr. 5, 01156 Dresden, Germany. (This recipient will process data only on our behalf and in accordance with our instructions.)
“Online Anti-Theft Alarm” allows primary users and secondary users to select the means of communication (push notification and/or email) and thus activate the service in their personal login area in a web browser or in the “Volkswagen” app. After activating the service, they will be informed with a push notification from the Volkswagen app whenever the anti-theft alarm system is triggered. The primary user and each secondary user can view the activity log for this service in their personal login area in the web browser.
Personal data: vehicle identification number (VIN), User ID, reason why and time when system was triggered
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
This service updates the vehicle software and the data of the infotainment system, e.g. to obtain new functions or get the systems ready for the latest changes relating to road traffic.
Personal data: Vehicle identification number (VIN), software versions and hardware versions, as well as the hardware serial numbers and the selected infotainment system language
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: Arvato Supply Chain Solutions SE, Reinhard-Mohn-Str. 22, 33333 Gütersloh, Germany; CARIAD SE, Berliner Ring 2, 38440 Wolfsburg, Germany (These recipients will process data on our behalf and in accordance with our instructions only.)
The “Online POI Search” function (text/voice) allows the vehicle user to search for specific points of interest according to personal favourites.
Personal data: vehicle identification number (VIN), location, search radius, selected infotainment system language
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (This recipient will process data only on our behalf and in accordance with our instructions.)
“Online Auxiliary Heater” allows primary users and secondary users to control the auxiliary heater via the “Volkswagen” app.
Personal data: Vehicle identification number (VIN), departure times, air conditioning status and settings
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
“Remote Ventilation Control” allows primary users and secondary users to control the auxiliary ventilation via the “Volkswagen” app.
Personal data: vehicle identification number (VIN), departure times, ventilation status and settings
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
The “Online Traffic Information” service provides information about current traffic events and shows the traffic flow on the map and along the route of the navigation system.
Personal data: vehicle identification number (VIN), location, position accuracy, direction of travel, speed, gradient, desired destination, traffic information settings, detected event type, time stamp, app version
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
This service allows primary users and secondary users to send individual points of interest (POI) that have been stored in the “Volkswagen” app, as well as routes that have been created, to the vehicle’s navigation system even before the start of a journey. The destination or route sent is displayed in the navigation system for the current user of the vehicle as soon as the vehicle is used online.
Personal data: vehicle identification number (VIN), search term, map section coordinates, created routes, POI/destinations sent, selected infotainment system language, IP address, User ID
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (This recipient will process data only on our behalf and in accordance with our instructions.)
The Breakdown Call function can be triggered both by breakdown events (with or without a warning lamp lighting up) and by minor accidental damage below the level required to trigger the restraint systems (such as the airbag and belt tensioner). Once the airbag control unit has detected an impact of this kind, the function offers the vehicle user to establish an audio connection with the Emergency Call Service or Breakdown Call via the infotainment system. As part of this, certain data will be transmitted automatically, such as details of the vehicle equipment, to help the Breakdown Call employees and, where applicable, those of the towing company to provide rapid and effective assistance.
We process your data to improve our products and business processes, customer functionality of the breakdown call, optimise customer benefit and to eliminate product faults. We will analyse your data for the purpose of product improvement and quality assurance of the breakdown call and to prevent interruptions or delays in the process sequence of processing requests. For example, we check for faults in the transmission of data to your authorised workshop (such as incomplete data or delays within the data transmission) for early detection and elimination. This allows us to offer the best possible customised service and increase customer satisfaction with digital services. Furthermore, the indicated data is forwarded to the responsible importer for their country for process management and improvement, such as by way of quality audits. The provided data will be erased after five years (the service is not supported in the following countries where only a recorded message will be played: Albania, Malta, Ukraine).
Personal data: vehicle identification number (VIN), phone number of the integrated SIM card in the vehicle, title, form of address, name, date of birth, address, country, phone number, email address, number plate, vehicle data (brand, mileage (km), remaining range, model name, model year, colour, gearbox, powertrain, year of manufacture, vehicle type, equipment features), insurance details (name of insurance provider of the party reporting the accident, insurance policy number of the party reporting the accident, nature of damage, name of the other party's insurance provider), case details (impact zone, severity of impact, date of accident, time of accident, cause, warning lamps, event memory entries, vehicle position, accuracy of GPS data, direction of travel, nature of damage, date of damage assessment, preliminary damage costing, service schedule, most recent service) and any other personal data shared by the vehicle user during the call; for data processing as part of the analysis: vehicle identification number (VIN), service requirement category, send date of the breakdown call data, the selected authorised workshop and information on the agreed appointment. Additionally, the relevant authorised workshop transmits the following data: vehicle identification number, time of lead acceptance, time of contact and time of lead closing.
Legal basis: for primary users, secondary users and guest users: Article 6(1)(b) GDPR (for contract performance); with regard to data of an anonymous guest Article (6)(1)(f) GDPR (legitimate interests: provision of the in-vehicle service in accordance with the contract); for data processing as part of the analysis: Article 6(1)(f) (legitimate interests: improvement of the products and business processes, customer functionality of the breakdown call, optimisation of customer use; elimination of product faults; process control and improvement in trade; increase of customer satisfaction with the services)
Other data recipients: A call centre appointed by the national sales company with responsibility for the respective country (importer), where applicable: a Volkswagen authorised workshop or a towing company as well as your insurance company after you have given your consent. As part of the analysis, the data is transmitted to CARIAD SE, Berliner Ring 2 Brieffach 1080/2, 38440 Wolfsburg, Germany (CARIAD SE will process the data on our behalf and in accordance with our instructions only).
If the service has been deactivated, the Breakdown Call is still available offline; however, in this case, automatic transmission of data from the vehicle to the call centre does not take place.
“Parking Position” allows the primary and secondary users to retrieve the last known vehicle location. This service is also available via the “Volkswagen” app.
Personal Data: vehicle identification number (VIN), most recent parking position when vehicle was switched off (removal of key, operation of Start/Stop button), position of the mobile end device
Legal basis: For primary and secondary users: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service in accordance with the contract)
Other data recipients: none
With this function, the primary and guest users can save their respective individual vehicle settings and “transfer” them to other Volkswagen vehicles that are equipped with mobile online services. The vehicle settings for numerous systems are saved automatically and depending on the equipment, from seat and mirror positions to lights, air conditioning and driver assistance. The user-specific vehicle settings are kept synchronised via the backend in all vehicles in which a user is registered. This requires that the respective vehicle is online (Privacy settings are not set to “Maximum privacy”).
Personal data: vehicle identification number (VIN), user ID, password, S-PIN, current privacy settings on vehicle, first name and surname, email address, user name, user role, current personal vehicle settings (including air conditioning system, seat, lighting, mirrors, driver assist settings), most recently used radio stations/applications, frequent routes, most recent destinations, home address, work address, favourite destinations, preferred POI categories
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
This service allows the vehicle user to display a high-resolution navigation map with satellite images. The necessary data is transmitted to our service provider Google without the service provider being able to associate it with the vehicle user or the vehicle.
Personal data: Vehicle identification number (VIN), time stamp, information about the software versions used, map or map tile versions used, positioning data
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: HERE Europe B.V., Kennedyplein 222 – 226, 5611 ZT Eindhoven, Netherlands. (The recipient processes data solely on our behalf and in accordance with our instructions.) Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (the only data transmitted is positioning data or the requested map tile, including the zoom level)
“Manage Services” allows vehicle users to activate and deactivate the mobile online services and the vehicle functions available on the vehicle, and to obtain detailed information about the service plans that have been subscribed and the duration of the associated contracts.
If available in the vehicle, individual privacy settings can be entered. This allows control of the data that can leave the vehicle. Furthermore, the purchased and enabled “Upgrades” functions and the In-Car Apps are displayed in the personal login area in the web browser. Additionally, the vehicle user receives a notice in the app if the vehicle user does not have a “VW Connect” licence.
Personal data: vehicle identification number (VIN), activation status of services, privacy level (depending on model)
Legal basis: Article 6(1)(b) GDPR (performance of a contract or initiation of a contract); Article 6(1)(f) GDPR for the notice when a VW Connect licence is not available. (legitimate interests: advertising alert for the customers)
Other data recipients: none
If the “Service Scheduling” service has been activated by the primary user, the Volkswagen authorised workshop (or where applicable: a national sales company appointed by the Volkswagen authorised workshop or a call centre) will contact the primary user via their selected communication channel (email or telephone) in the event of any necessary service work (oil changes, inspections and specific driver messages as stipulated by Volkswagen AG) for the purpose of scheduling an appointment.
Additionally, the status of the service scheduling requests will be transmitted back to the initiating service to identify and rectify product faults. This return transmission enables Volkswagen AG to identify process faults and their related causes early on.
If the authorised workshop specified by the primary user ceases trading or stops operating a Volkswagen authorised workshop as part of its business activities and the primary user has not yet selected any other Volkswagen authorised workshop, the national sales company with responsibility for the respective country will contact the primary user if any service work becomes necessary to offer an appointment with a suitable Volkswagen authorised workshop.
We process the data of their service scheduling request to improve our products and business processes, customer functionality of service scheduling, optimise customer benefit and to eliminate product defects.
We will analyse your previously indicated data for the purpose of product improvement and quality assurance of the service scheduling request and to prevent interruptions or delays in the process sequence of processing requests. For example, we check for faults in the transmission of data to your authorised workshop (such as incomplete data or delays within the data transmission) for early detection and elimination. This allows us to respond to the customer request for a service appointment in the best possible way and improve customer satisfaction with the digital services.
Furthermore, the indicated data is forwarded to the responsible importer for their country for process management and improvement, such as by way of quality audits. The provided data will be erased after five years.
The primary user can deactivate the “Service Scheduling” service and the associated data transfer of servicing requirements at any time in the primary user's personal login area in the web browser or in the settings of the “Volkswagen” app. Here, the primary user can also select, change or delete the primary user's desired communication channel or preferred Volkswagen authorised workshop.
Personal data: vehicle identification number (VIN), trigger for data transmission (e.g. specific servicing requirements), mileage (km), brand, model, model year, engine code, gearbox code, inspection service interval, oil service interval, driver messages, form of address, title, first name/surname, desired communication channel (telephone/email); when data is processed in the context of analysis: vehicle identification number, servicing requirements category, date on which service appointment request was sent, the selected authorised workshop and information on the scheduled service appointment. In addition, the respective authorised workshop transmits the following data to us: vehicle identification number, time of lead initiation, time of contact initiation and time of lead closing.
Legal basis: for the primary user: Article 6(1)(b) GDPR (for contract performance) and, where applicable, Article 6(1)(f) GDPR (for the return transmission of the service scheduling request status for the identification, analysis and elimination of product faults / flaws as well as for the transmission of data to the responsible sales company, if the selected authorised workshop has ceased trading or stops operating a Volkswagen authorised workshop as part of its business activities; see above); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service in accordance with the contract); when data is processed in the context of analysis: Article 6(1)(f) GDPR (legitimate interests: improvement of products and business processes, functionality of service scheduling; optimisation of customer benefit; elimination of product defects; process control and improvement in trade; increase customer satisfaction with the services)
Other data recipients: we will transmit the servicing requirements to the primary user's selected Volkswagen authorised workshop or to a national sales company with responsibility for the respective country and, where applicable, to a call centre appointed by the Volkswagen authorised workshop or a national sales company appointed by the Volkswagen authorised workshop (in the event of being appointed by the Volkswagen authorised workshop, the respective call centre or respective national sales company will process your data on behalf of and in accordance with the instructions of the Volkswagen authorised workshop only); in the context of analysis, the data will be sent to CARIAD SE, Berliner Ring 2 Brieffach 1080/2, 38440 Wolfsburg, Germany (CARIAD SE will process the data on our behalf and in accordance with our instructions only).
If the primary user has chosen a preferred authorised workshop located in Germany, Great Britain, Italy, France, Japan, Ireland, the Czech Republic, Spain (and the Canary Islands), Belgium, Switzerland, Sweden, Poland, Denmark, Finland, Norway, Portugal, Norway, Luxembourg, Hungary, Austria, Estonia, Latvia, Lithuania, Slovenia, Romania and Bulgaria, Greece, Slovakia, Netherlands, Ukraine, Serbia, Montenegro, Bosnia and Herzegovina, Croatia, Albania, North Macedonia, Iceland, Malta or Cyprus, Volkswagen AG will use the following processors: Volkswagen Software Asset Management (SAM) GmbH (Berliner Ring 2, 38440 Wolfsburg, Germany) and Salesforce.com Germany GmbH, I(Erika-Mann-Straße 31, 80636 München, Germany). Access to personal data by Salesforce or subsidiaries based in a state outside of the EU/EEA cannot be excluded, so that Volkswagen AG has concluded the relevant EU standard contractual clauses (a set of contractual clauses approved by the European Commission that accords the same protection to personal data that it has in the EU during data processing in non-EU countries). You can view the applied EU standard contractual clauses via the following link: https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32021D0914.
With the mobile online services of “VW Connect Plus / We Connect Plus”, primary or secondary users and guest users as well as anonymous guests of the vehicle also have the online voice control / online voice assistant available in addition to offline voice control in the vehicle (only available in the following languages: English (UK), English (US), German, French, Italian, Spanish, Czech, Dutch, Polish, Portuguese, Swedish, Danish, Norwegian) (model and equipment dependent).
The voice control / voice assistant can be activated via the push-to-talk button on the steering wheel or via the activation word in order to then formulate a request. Other vehicle occupants can also use the voice control / voice assistant by means of the activation word. A background service runs on the vehicle’s infotainment system to enable use of the activation word. This service detects when the activation word is spoken. Every now and then, this background service may falsely detect the activation word.
As soon as the voice control / voice assistant has been activated by the push-to-talk button or activation word, this is indicated by a graphic symbol on the infotainment system screen.
The advantage of Online Voice Control / Online Voice Assist compared to Offline Voice Control is better voice recognition in general and the option to control online contents using voice inputs, for example, streaming services (Internet Radio), points of interest for navigation as well as the option to call up information on weather, news, knowledge, sports, flight status and the stock market. If the customer additionally consents to processing of location data for the Online Voice Control / Online Voice Assist, the customer will receive navigation results even faster and can call up information on their surrounding area (depending on model and equipment and depending on the system language setting). The Online Voice Control / Online Voice Assistant function will remain covered by the contractually guaranteed scope even if consent is withdrawn.
The Online Voice Assistant is enhanced with the connection to ChatGPT 3.5 Turbo, whereby requests that the Online Voice Assistant cannot answer are forwarded to ChatGPT. For this, the service provider Cerence GmbH checks if the voice request can be answered. If this is not the case, the voice request is forwarded in text format to ChatGPT. ChatGPT sends a reply in text format to the service provider Cerence GmbH and from there back to the vehicle. When the reply is output in the vehicle, it is made clear that the result was generated by ChatGPT. When the voice request is processed via ChatGPT, the location data is not forwarded to ChatGPT.
With an existing online connection, the customer's voice inputs will also be analysed to continuously improve the voice control and voice recognition for all customers. They are thereby always analysed anonymised with automated processes and are only made accessible to trained employees of our service provider, Cerence GmbH for purposes of analysis for the optimisation of voice recognition.
If the vehicle is used in offline mode, the voice data will be processed solely in the vehicle. No location data is processed (offline voice control / offline voice assistant). The online functionality can be deactivated in the infotainment system at any time. In addition, the recognition of the activation word can be deactivated in the infotainment system so that voice control / voice assist can only be used via the push-to-talk button.
Personal data for online connection: vehicle identification number (VIN), country or current vehicle position stored in the system (if the respective customer has also given consent to the processing of location data for the Online Voice Control / Online Voice Assistant), selected infotainment system language, vehicle brand, user ID, regional code and version number of the Infotainment software, voice input and the voice output (only for the languages EN-US, EN-GB, DE, FR, ES, IT, CZ, NL, PL, PT, SE, DK, NO)
Legal basis: for primary users, secondary users and guest users: Article 6(1)(b) GDPR (contract performance); for the optional processing of the current vehicle position: Article 6(1)(a) GDPR (consent); for any further vehicle users (e.g. anonymous guest) and further occupants of the vehicle without contract for the mobile online services: Article 6(1)(f) GDPR (legitimate interest: performance of the mobile online services contract); the analysis of the voice inputs by Volkswagen AG, the service provider and the anonymisation of the voice inputs for further analysis occurs according to Article 6(1)(f) GDPR (legitimate interest: improvement of voice control and voice recognition for all customers).
Other data recipients: e.solutions GmbH, Despag-Straße 4a, 85055 Ingolstadt, Germany; Cerence GmbH, Jülicher Str. 376, 52070 Aachen, Germany. (These recipients will process data on our behalf and in accordance with our instructions only.)
As part of the “Hybrid Radio” function, the infotainment system identifies radio stations that are received via a radio signal (FM and DAB) and checks online to see whether any streams or metadata are available for these stations. This allows vehicle users to listen to relevant stations via online streaming if they are not currently able to receive them via the radio signal.
Personal data: Vehicle identification number (VIN), country in which the vehicle is located; radio stations that can currently be received
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: e.solutions GmbH, Despag-Straße 4a, 85055 Ingolstadt, Germany. (This recipient will process data only on our behalf and in accordance with our instructions.)
The “Media Streaming” function allows the use of various music streaming services directly within the infotainment system in the vehicle without having to connect a smartphone or some other device. To do this, the respective streaming app must first be downloaded and installed by the primary user via the In-Car Shop.
Personal data: Vehicle identification number (VIN), authentication token with the streaming provider, IP address
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: the respective streaming provider
The data privacy statements of the respective streaming service are the authoritative source of information for the processing of data within this context.
As part of the “Internet Radio” function, the infotainment system makes available an up-to-date and language-specific catalogue of stations and podcasts. This gives vehicle users the option of listening to thousands of stations and podcast episodes of different kinds via online streaming.
Personal data: Vehicle identification number (VIN), country of current geoposition, current system language, software version
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: e.solutions GmbH, Despag-Straße 4a, 85055 Ingolstadt, Germany. (This recipient will process data only on our behalf and in accordance with our instructions.)
“Filling Stations” provides the vehicle user with information about filling stations in the immediate vicinity of the vehicle. It shows the prices according to the primary fuel.
Personal data: Vehicle identification number (VIN), location
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: OPISNAVX, 1618 rue du Quatre Septembre, 75002 Paris, France. (This recipient will process data only on our behalf and in accordance with our instructions.)
“Lock & Unlock” allows primary users to operate the vehicle’s central locking system even if they are not in the immediate vicinity of the vehicle. To do this, the user can display and change the locking status of the doors and the luggage compartment of the vehicle in the “Volkswagen” app. For their own security, primary users must define an S-PIN, which must then be entered prior to each lock or unlock operation. Before this function can be used, the Volkswagen Ident process must first be performed by the primary user.
We will store the details of all the lock and unlock operations performed using this service, along with the date and time, odometer reading at the time of the operation and the user ID and vehicle identification number, for three (3) years. This data is stored on the basis of our legitimate interest of meeting the obligations to present evidence under the product liability legislation (Article 6(1)(f) GDPR).
Personal data: vehicle identification number (VIN); user ID; information concerning whether electric windows, doors, bonnet and boot lid are open or closed and whether the vehicle is locked or unlocked; date and time of unlocking and locking; mileage (km)
Legal basis: Article 6(1)(b) GDPR (for contract performance); as regards the unlocking and locking history: Article 6(1)(f) GDPR (legitimate interests)
Other data recipients: none
“Weather” provides vehicle users with up-to-date weather data for their current location, their destination or in relation to predefined places. This function is also available in the “Volkswagen” app. It displays the temperature at the location of the vehicle and/or the mobile telephone.
Personal data: vehicle identification number (VIN), location, destination, places requested by the vehicle user, selected infotainment system language, preferred unit of measurement
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: Vaisala GmbH, Notkestr. 11, 22607 Hamburg, Germany. (This recipient will process data only on our behalf and in accordance with our instructions.)
The route planning function helps customers plan their next destinations based on their current position, the current traffic situation and pending appointments.
Personal data: vehicle identification number (VIN), location, desired destination, navigation data version, route criteria settings, most recent destinations, calendar dates, favourite destinations
Legal basis: Article 6(1)(b) GDPR (performance of a contract)
Other data recipients: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (only positioning data is transmitted) (This recipient will process data only on our behalf and in accordance with our instructions.)
The relevant current legal texts, such as the Privacy Policy, can be viewed under “Legal” in the Infotainment system.
Personal data: vehicle identification number (VIN), IP address, country code and language
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
The “Refuelling Recommendations” feature of the Live Recommendation service recommends a nearby filling station in case of a low remaining range to you. This takes place via a pop-up in the Infotainment display, which also includes an offer of the respective filling station operator (e.g. fuel filling discount, free coffee, etc.) who cooperates with Volkswagen AG. You can save the offer for a later time or navigate it directly to the filling station. In case of the latter, you will be reminded of the offer when you arrive at the destination and can transfer the voucher you may need to your smartphone in the detail view. The “Refuelling Recommendations” feature can only be used when Volkswagen AG can access the location of the vehicle (geoposition) and process this data. In addition, the pseudonymised vehicle identification number (VIN) is used to allocate offers to your vehicle. The pseudonymisation of the VIN includes the distance of all personal identification features. Indirectly traceable identification features (pseudonyms) are retained. Furthermore, your User ID will be processed to be able to store saved offers for you in the backend.
Volkswagen AG deletes the personal data after three months or in accordance with the legal requirements, e.g., as soon as the purpose for which the data was collected no longer applies and provided that there are no other retention obligations.
Personal data: pseudonymised VIN, User ID, vehicle master data, geoposition, click and usage behaviour, timestamp
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: MongoDB Building 2, Number 1 Ballsbridge Shellbourne Road Ballsbridge, D04 Y3X9 Dublin, Ireland; New Relic Germany GmbH, Neuturmstraße 5, 80331 München, Germany (These recipients will process data on our behalf and in accordance with our instructions only.)
Individual data points along the service utilisation are recorded and processed to continuously monitor the availability of the services for the purposes of a stable service provision and for the identification and rectification of possible irregularities of the service functions. This is only possible if the pseudonymised VIN as identifier is also collected. The User ID is additionally recorded to be able to ensure verifiability and fault analysis in case of customer request related to technical faults. In addition, we will process information on the display of ads as well as the user's interaction with the ad to determine if an ad has appealed to the user and to continue to receive marketing ads from advertising partners on this basis to provide the service.
Volkswagen AG deletes the personal data after three months or in accordance with the legal requirements, e.g., as soon as the purpose for which the data was collected no longer applies and provided that there are no other retention obligations.
Personal data: pseudonymised VIN, User ID, vehicle master data, geoposition, click and usage behaviour, timestamp
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: MongoDB Building 2, Number 1 Ballsbridge Shellbourne Road Ballsbridge, D04 Y3X9 Dublin, Ireland; New Relic Germany GmbH, Neuturmstraße 5, 80331 München, Germany (These recipients will process data on our behalf and in accordance with our instructions only.)
On the basis of the data collected to provide the service, various performance analyses are performed as part of monthly reports, which are used by Volkswagen AG for the continuous improvement of the service.
Volkswagen AG deletes the personal data after thirteen months or in accordance with the legal requirements, e.g., as soon as the purpose for which the data was collected no longer applies and provided that there are no other retention obligations.
Personal data: pseudonymised VIN, User ID, vehicle master data, geoposition, click and usage behaviour, timestamp
Legal basis: Article (6)(1)(f) GDPR (Volkswagen AG has a legitimate interest in processing the previously stated personal data to be able to continuously improve the Live Recommendations service.)
Other data recipients: MongoDB Building 2, Number 1 Ballsbridge Shellbourne Road Ballsbridge, D04 Y3X9 Dublin, Ireland; New Relic Germany GmbH, Neuturmstraße 5, 80331 München, Germany (These recipients will process data on our behalf and in accordance with our instructions only.)
Besides, from the legal bases described in Part I the legal bases for processing personal data under Albania law is a consent given by the data subjects. The consent of the data subjects is given either by registering for the mobile online services, after they have confirmed that they have read and accepted the Privacy Policy, or by using the vehicle in knowledge of the data processing.
Data controller representative in Albania:
Porsche Albania Sh.p.k
Autostrada Tirane-Durres
Km. 3, Tirane,1051
dataprotection@porsche.al
We are legally obliged to publish mileages (km) of networked vehicles at regular intervals (usually once every quarter) on request from Car-Pass vzw. The data is retained by Car-Pass vzw in a “Car-Pass” so that relevant information about a vehicle can be provided to potential purchasers when buying and selling used cars.
Personal data processed: Vehicle identification number (VIN), mileage (km), time of data collection in the vehicle
Legal basis: Article (6)(1)(c) GDPR in conjunction with Art. 6 Act of 11 June 2004 and Article 3/1, § 2 Royal Decree of 26 August 2006
Recipients: Car-Pass vzw, Woluwedal 46/2, 1200 BRUSSELS, BELGIUM; D’Ieteren Automotive SA/NV, Leuvensesteenweg 639, 3071 KORTENBERG, BELGIUM; CARIAD SE, Berliner Ring 2, 38440 WOLFSBURG, GERMANY; Audi AG, Auto-Union-Straße 1, 85057 INGOLSTADT, GERMANY (all recipients with the exception of Car-Pass vzw process data solely on our behalf and in accordance with our instructions)
In deviation from the legal bases described in Part I the legal bases for processing personal data under the law of Bosnia and Herzegovina is a consent given by the data subjects. The consent of the data subjects is given either by registering for the mobile online services, after they have confirmed that they have read and accepted the Privacy Policy, or by using the vehicle in knowledge of the data processing.
Data controller representative in Bosnia and Herzegovina:
PORSCHE BOSNA I HERCEGOVINA
Porsche BH d.o.o. Sarajevo
Porsche Inter Auto BH d.o.o. Sarajevo
BIH-71000 SARAJEVO | Bulevar Meše Selimovića 16
zastita.podataka@porschebh.ba
Personal information obtained from residents in Japan (“Personal Data”) shall be handled in accordance with the following rules in addition to the rules set forth in Part I of this Privacy Policy.
1. Purpose: We will handle the Personal Data in accordance with the Purposes set forth in Part I of this Privacy Policy (“Purposes”), and not use Personal Data for any purpose other than such Purposes. We shall promptly notify the relevant data subjects, or disclose to the public of the Purposes (and any subsequent changes thereof), unless the Purposes have already been disclosed to the public;
2. Collection: We will not obtain any Personal Data through any deceptive, fraudulent, or other wrongful means;
3. Accuracy: We will make reasonable efforts to ensure that Personal Data handled by us is accurate and up to date and within the scope necessary to achieve the Purposes;
4. Retention: We will retain Personal Data in accordance with Section A.IV of Part I, and cease retention as soon as it is reasonable to assume that the Purposes are no longer being served by retention of Personal Data;
5. Protection: We will protect Personal Data in its possession or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal, damage, loss or similar risks. We will adequately supervise processing of Personal Data by our officers, employees, third party vendors and any other parties who process Personal Data on our behalf;
6. Transfer: Without obtaining the prior consent of the relevant data subjects, we will not transfer or provide any part of Personal Data to any individual or entity unless an exception under the APPI applies.
7. Extraterritorial Transfer: Without obtaining the prior consent of the relevant data subjects, we will not transfer or provide any part of Personal Data to any individual or entity located outside Japan, European Union or the United Kingdom unless (a) a transferee is located in a country or area certified by the Personal Information Protection Commission of Japan ("PPC") as having data protection standards equivalent to those of Japan or (b) the transferee has data protection standards equivalent to the standards specified by the PPC; and,
8. Data Subject's Right: If a data subject requests pursuant to the APPI disclosure of Purposes, access to, correction, or deletion of any of Personal Data relevant to such data subject, or lodge a complaint, we will respond to such request or complaint promptly and in accordance with the APPI. Any fee charged to data subjects shall be reasonable.
To the extent data processing falls within the scope of the Swiss Federal Act on Data Protection (FADP), (a) the scope of "personal data" shall be determined in accordance with the FADP, and (b) references to the GDPR shall be understood as references to the FADP.
To the extent that the transfer of personal data to recipients outside the EU respectively outside of Switzerland (“third countries”) is safeguarded by the conclusion of standard contractual clauses approved by the European Commission, please note the decision of the Federal Data Protection and Information Commissioner to recognize the EU standard contractual clauses, which is available via the URL https://www.edoeb.admin.ch/edoeb/de/home/datenschutz/arbeit_wirtschaft/datenuebermittlung_ausland.html.
To the extent the data processing falls within the scope of the data protection laws of San Marino, pursuant to Article 13(1)(f) of San Marinese Law n. 171 of 2018, we specify that, considering the data controller’s intention to transfer personal data to third countries or international organisations, the following means by which to obtain a copy of the appropriate or suitable safeguards used or information on where they have been made available are provided:
• You can contact us for exercising your rights, including the right to access your data and to obtain a copy of them, via the contact details provided in Part I (“Data protection officer”).
• The EU standard contractual clauses used can be accessed in EU languages at https://eur-lex.europa.eu/legal-content/it/TXT/?uri=CELEX%3A32021D0914 abrufbar.
To the extent the data processing falls within the scope of the data protection laws of San Marino, pursuant to Article 13(2)(d) of San Marinese Law n. 171 of 2018, we specify that the data subject has the right to report or to lodge a complaint with the Data Protection Authority of San Marino (https://www.garanteprivacy.sm).
In addition to the rights listed in the section “Your rights” you also have the right to define directives concerning the fate of your personal data after your death (post-mortem right).
This Privacy Policy provides information on how personal data will be collected, processed and used by
Volkswagen AG
Berliner Ring 2
38440 Wolfsburg
Germany
kundenbetreuung@volkswagen.de
entered in the register of companies of Braunschweig District Court under number HRB 100484 (“Volkswagen AG”), when data transmission is activated for the purpose of establishing an anonymous data pool for the research and development of automated driving.
The upload function is used to collect measurement data captured by vehicle sensors. This measurement data is transferred to a data server (see above, A.VII.1. Data servers), immediately anonymised and used by Volkswagen and its cooperation partners for researching and developing the automated driving system.
The measurement data is made up of two groups of data:
A. Data of relevance for reconstructing the influences on the vehicle:
• Vehicle position and time stamp:
• Data capturing the immediate surroundings as recorded by the following sensors:
• Traffic situations detected:
b. Data of relevance for determining the control action desired by the driver:
• Detected driver behaviour:
As part of this, the only data that will be collected is data required for researching and developing functions for partially and fully automated driving. The anonymised measurement data will also be made available to Volkswagen cooperation partners on the basis of contractual provisions that contain suitable safeguards for data processing. They will likewise use said data for researching and developing the automated driving system.
This data will be used as the basis for creating a simulation environment that will enable future autonomous driving functions to be tested under realistic conditions, in turn, enabling a comparison with the desired behaviour of real drivers. Given that several billion test kilometres will be required in order for autonomous driving to undergo final validation, this database has to be populated with real data. This is the only way of adequately capturing all types of traffic situation to ensure that future autonomous driving functions are safe and robust enough to take the right decisions every time and protect the safety of the vehicle occupants.
Once the data has been collected and transmitted to the data server, the data will be checked for quality and then immediately anonymised on the data server. The data will be stored there for a maximum of twenty-four (24) hours for the purposes of anonymisation and quality assurance. The original data from the vehicle will then be fully deleted. The anonymisation process is continually reviewed and enhanced with regard to its efficiency and effectiveness while taking account of the latest scientific findings and the current state of the art.
Consent to the transmission of data from the vehicle, balancing of interests (Article 6(1)(f) GDPR) for the storage of distributed data to the anonymisation.
The aforementioned objectives of researching, developing and validating autonomous driving functions can only be achieved by having a significant data pool that covers as many different traffic scenarios as possible based on actual journeys. Conventional test drives in the form of endurance runs are no longer sufficient in this context. The data has to encompass as many different driving scenarios as possible, whereby the situation involving the traffic and surroundings can only be captured by the algorithms under real road traffic conditions. Nor is it sufficient to purchase the data from elsewhere in this context because the data is not available in the required quality and very quickly becomes outdated. For these reasons, Volkswagen has a legitimate interest in the processing of the data and the establishment of an anonymous database.
The data transfer is not activated ex factory, instead, it starts with the registration of an active “We Connect” / “VW Connect” primary user in the vehicle, if the primary user has given consent to the transmission of data from the vehicle. The registered user can give and also withdraw this consent in the “MyVolkswagen” portal at a later time, if necessary. The personal data is processed for the purpose of subsequent anonymisation on the legal basis of the balancing of interests (Article 6(1)(f) GDPR). The data collection is only active at the “Use my position” and “Share my position” levels. The “Development automated driving” slider can be used to activate or deactivate the data upload in the vehicle in the area of the Privacy Settings; however, this does not withdraw the consent.
The data is processed on servers of the following service providers only on our behalf and in accordance with our instructions:
CARIAD SE
Berliner Ring 2
38440 Wolfsburg
Germany
Audi AG
Auto-Union-Straße 1
85057 Ingolstadt
Germany
Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
D18 P521
Ireland
At Microsoft, data is encrypted in accordance with agreements concluded with us and processed exclusively on data servers located in the EU. As Microsoft has its head office in the United States, the possibility of (read) access to the data from the USA cannot be ruled out. Appropriate EU standard contractual clauses have been agreed to cover the transfer of personal data to processors in third countries to ensure that your personal data is sufficiently protected. The EU standard contractual clauses used can be accessed on the website of the European Commission under the URL https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32021D0914.
We also use various IT service providers. These assist us with the maintenance of our IT systems and with technical support, for example. Insofar as the service providers have access to personal data, they will process this data on our behalf and in accordance with our instructions only. IT support is provided by the following service providers:
Volkswagen Group Service
Bunsenstraße 5
85053 Ingolstadt
Germany
diconium digital solutions GmbH
Rommelstraße 11
70376 Stuttgart
Germany
Volkswagen Infotainment GmbH
Rensingstraße 15
44807 Bochum
Germany
You can exercise the following rights with respect to Volkswagen AG at any time and free of charge. This also applies in cases where we share joint responsibility for the data processing with other companies. More information on asserting your rights can be found at: https://datenschutz.volkswagen.de/.
You have the right to request confirmation from us as to whether or not personal data concerning you is being processed and – if it is – to be informed what personal data concerning you is being processed, and also which third parties within and outside the EU have had your data forwarded to them. You also have the right to obtain a copy of the personal data concerning you that is being processed by us.
You have the right to have incorrect or incomplete personal data concerning you rectified by us.
You have the right to demand erasure of your data if the requirements stated in Article 17 GDPR are met. According to this, you can request, for example, that your data be erased if it is no longer necessary for the purposes for which it was collected. In addition, you can request erasure if we process your data on the basis of your consent and you withdraw this consent.
You have the right to request restricted processing of your data if the requirements stated in Article 18 GDPR are met. This is the case, for example, if you dispute the accuracy of your data. You can request that processing is restricted for the period during which the accuracy of the data is being checked.
If processing takes place for direct marketing purposes (including profiling for direct marketing purposes).
If processing (including profiling) takes place on the following legal bases:
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Article 6(1)(e) GDPR).
Processing is necessary for the protection of our legitimate interests and those of a third party (Article 6(1)(f) GDPR). If you do raise any objection of this kind, we kindly request that you inform us of the reasons why you are objecting to data processing. If you object, we will no longer process your data unless we can prove compelling reasons for processing that outweigh your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.
If data processing is based on consent or contract performance and processing takes place using automated means, you have the right to obtain your data in a structured, commonly used and machine-readable format and to transmit this data to another controller. In addition, you have the right to have the personal data transmitted directly by us to another controller.
Where data processing is based on consent, you have the right to withdraw your consent, free of charge, at any time with effect for the future by sending an email to info-datenschutz@volkswagen.de (Germany), privacy@volkswagen.de (outside of Germany), at our Volkswagen Privacy Portal https://www.datenschutz.volkswagen.de or through the contact details in the site notice.
Additionally, you can withdraw your consent at any time in your Volkswagen ID user account in “MyVolkswagen”.
You also have the right to lodge a complaint about our processing of your data with a supervisory authority (e.g. the State Commissioner for Data Protection in Lower Saxony or a supervisory authority responsible for your place of residence).
The contact persons for exercising your rights and further information can be found at the following web page: https://datenschutz.volkswagen.de/.
Please contact our data protection officer regarding matters related to data protection:
Datenschutzbeauftragter der Volkswagen AG
Berliner Ring 2
38440 Wolfsburg
Germany
dataprivacy@volkswagen.de