(Version dated: November 2024 – The Privacy Policy is updated regularly. The current version is always available online at https://consent.vwgroup.io/consent/v1/texts/WeConnect/cy/en/dataprivacy/latest/html).
This Privacy Policy provides information on the processing of personal data when using Volkswagen AG's “We Connect, VW Connect” mobile online services (in the following combined under “VW Connect”) in vehicles of the “ID. family”. The Privacy Policy for the use of vehicles of the “ID. family” is available under “Legal” or online at https://consent.vwgroup.io/consent/v1/texts/WeConnect/cy/en/dataprivacycar/latest/html.
As a German company, Volkswagen AG is bound to German law and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”). This also applies when Volkswagen AG processes personal data of persons with a permanent residence outside of Germany. Part I of this Privacy Policy contains information on the processing of relevant data as required by German law and the GDPR.
To some extent, Volkswagen AG may also be bound by national legislation of other countries. Persons with a permanent residence in one of the countries specified in Part II of this Privacy Policy can find further information in that section.
Content:
Part I
A. Person responsible for processing the data
B. Data Protection Officer, contact person
C. Your rights
I. Right to information
II. Right to rectification
III. Right to erasure
IV. Right to restriction of processing
V. RIGHT TO OBJECT
VI. Right to data portability
VII. Right to withdraw consent
VIII. Right to lodge a complaint
D. Description of data processing
I. Purposes of the data processing
II. Data recipients
III. Erasure and rectification of personal data
E. Data processing in detail
I. Volkswagen ID
II. Volkswagen Ident
F. “VW Connect” service portfolio in vehicles of the “ID. family”
Part II
The responsible office for the processing of personal data is Volkswagen AG (hereafter also referred to as “we” or “us”).
Volkswagen AG can be reached at:
Volkswagen AG
Berliner Ring 2
38440 Wolfsburg
Germany
Tel.: +49-5361-9-0
connect-support@volkswagen.de
Register of companies number HRB 100484 (Braunschweig district court)
Our data protection officer available as the contact person for all matters relating to data protection and for the exercising of data subject rights (see Section C. “Your rights”).
Please address requests to:
Datenschutzbeauftragter der Volkswagen AG
Berliner Ring 2
38440 Wolfsburg
Germany
dataprivacy@volkswagen.de
Data subject rights can also be exercised by using the email address info-datenschutz@volkswagen.de (Germany) and privacy@volkswagen.de (outside of Germany) or our Volkswagen Privacy Portal https://www.datenschutz.volkswagen.de.
You can exercise the following rights with respect to Volkswagen AG at any time and free of charge.
Please note that we do not identify the respective vehicle user if there is no user concept (only available depending on model and equipment) or if you use the vehicle as an anonymous guest. As a result, in the case of multiple vehicle users, we are unable to identify which driver's personal data relates to which driver. If you assert data subject rights, we will have to check your identity and may ask you to provide additional information or clarification where necessary (in particular, information relating to the period or other circumstances of vehicle use). We can request this additional information so that we can identify the personal data relating to you and make it available to you. We must also ensure when we provide personal data that we do not infringe the rights of other vehicle users.
More information on asserting your rights can be found at: https://datenschutz.volkswagen.de/.
You have the right to request confirmation from us as to whether or not personal data concerning you is being processed and – if it is – to be informed what personal data concerning you is being processed, and also which third parties within and outside the EU have had your data forwarded to them. You also have the right to obtain a copy of the personal data concerning you that is being processed by us.
You have the right to have incorrect or incomplete personal data concerning you rectified by us.
You have the right to demand erasure of your data if the requirements stated in Article 17 GDPR are met. According to this, you can request, for example, that your data be erased if it is no longer necessary for the purposes for which it was collected. In addition, you can request erasure if we process your data on the basis of your consent and you withdraw this consent.
You have the right to request restricted processing of your data if the requirements stated in Article 18 GDPR are met. This is the case, for example, if you dispute the accuracy of your data. You can demand that processing be restricted while the accuracy of the personal data is being checked.
If processing takes place for direct marketing purposes (including profiling for direct marketing purposes).
If processing (including profiling) takes place on one of the following legal bases:
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Article 6(1)(e) GDPR).
Processing is necessary for the protection of our legitimate interests and those of a third party (Article 6(1)(f) GDPR). If you do raise any objection of this kind, we kindly request that you inform us of the reasons why you are objecting to data processing. If you object, we will no longer process your data unless we can prove compelling reasons for processing that outweigh your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.
If data processing is based on consent or contract performance and processing takes place using automated means, you have the right to obtain your data in a structured, commonly used and machine-readable format and to transmit this data to another controller. In addition, you have the right to have the personal data transmitted directly by us to another controller.
Where data processing is based on consent, you have the right to withdraw your consent, free of charge, at any time with effect for the future by sending an email to info-datenschutz@volkswagen.de (Germany), privacy@volkswagen.de (outside of Germany), at our Volkswagen Privacy Portal https://www.datenschutz.volkswagen.de or through the contact details in the site notice.
You also have the right to lodge a complaint with a supervisory authority or another competent data protection authority about our processing of your data. This can, for example, be the data protection authority in your country of residence. A list of all data protection authorities in the European Union and the European Economic Area can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en#member-cy.
This section contains the description of the data processing procedures relating to the activation and use of the “VW Connect” mobile online services in vehicles of the “ID. Family”. When using the vehicle, the Privacy Policy for vehicles of the “ID. family” must be observed and can be viewed in the vehicle under “Legal” or online at https://consent.vwgroup.io/consent/v1/texts/WeConnect/cy/en/dataprivacycar/latest/html.
a) Activation of “VW Connect” for a vehicle
In order for the “VW Connect” services to be available in the vehicle, the vehicle must be connected to “VW Connect” in the settings (“activation”). This requires the creation of a central user account – the “Volkswagen ID” – as well as the “Volkswagen” app mobile application (“app”).
The respective Privacy Policies for the “Volkswagen ID” and the app must be observed and can be viewed online at https://consent.vwgroup.io/consent/v1/texts/identitykit/de/en/volkswagen-dataprivacy/latest/html and https://consent.vwgroup.io/consent/v1/texts/WeConnectID/cy/en-cy/dataPrivacy/latest/html.
In addition, the following data is processed when the services are activated:
name, first name, email address, password, vehicle identification number (VIN), nickname, S-PIN, permanent residence, preferred language, User ID, time of order (Start Timer 72 hours), time of activation, date of birth (for VW Ident), IT usage data.
Once the services for the vehicle have been activated, the “VW Connect” customer is the primary user and can use the services both directly in the vehicle and in the app; alternatively, they can use the personal login area in their web browser at www.myvolkswagen.de. Every time a primary user logs in at the vehicle, the following data is also processed:
Vehicle identification number (VIN), International Mobile Equipment Identity (“IMEI”) number, email address, username, password, S-PIN, profile picture.
The legal basis for data processing is the fulfilment of the “VW Connect” contract (Article 6(1)(b) GDPR).
(b) Becoming a guest user
Depending on the model and equipment, the “Guest User” user role is also available when using “VW Connect” if the vehicle already has a primary user. While the “primary user” role is intended for the primary user of the vehicle and can only be used by one person, a vehicle can be used by several guest users. The respective guest user can log into the vehicle themselves with their "Volkswagen ID" for this purpose. To do this, they press the “Plus” symbol in the User Overview in the vehicle's infotainment system and create a “VW Connect” profile (“Profile”). Settings such as privacy settings are then saved in the profile of the respective guest user and are not required to be entered again each time the vehicle is used.
The following data is processed during registration and each time you log in to the vehicle as a guest user:
Vehicle identification number (VIN), International Mobile Equipment Identity ("IMEI") number, email address, username, password, S-PIN, profile picture, user role.
The primary user can view the nicknames and profile photos of the guest users registered in the vehicle in their personal login area in the web browser.
The legal basis for data processing is the fulfilment of the “VW Connect” contract (Article 6(1)(b) GDPR).
In addition, the Privacy Policy for the “Volkswagen ID” must be observed and is available online at https://consent.vwgroup.io/consent/v1/texts/identitykit/de/en/volkswagen-dataprivacy/latest/html.
Only certain mobile online services are available to guest users (see Part I F. Service portfolio).
The following services are expected to be available to the guest user as of CW 4 2025: departure times, air conditioning, charging, vehicle health report, vehicle status including doors and light, parking position, and locking and unlocking. Volkswagen Customer Service will notify the customer of the exact time of activation via email.
There is a differentiation between the guest user and the so-called “anonymous guest”, which refers a vehicle user who is not known to Volkswagen AG. Vehicle users who do not wish to create a personal profile in the vehicle can use the “Guest” profile user selection in the infotainment system (available for certain models and equipment). This is not a personalised profile. It is not necessary to create a Volkswagen ID or conclude a “VW Connect” contract. If an anonymous guest uses the vehicle in online mode, only a few selected online services are available to them. At the end of the journey, the privacy settings in this profile are reset, and the vehicle is set back to the offline mode.
a) Use of the services
When using “VW Connect”, only data (vehicle usage data in particular) that is required for the provision of the respective services is processed. For primary and guest users, data processing is carried out for the fulfilment of the contract (Article 6(1)(b) GDPR). For all other vehicle users, including an anonymous guest, the data is processed on the basis of our legitimate interest in providing the services in accordance with the “VW Connect” contract concluded for the vehicle itself (Article 6(1)(f) GDPR) when the vehicle is used online. A description of the user roles is provided under D.I.1.
The vehicle identification number (VIN) and the IP address are always processed during use. In addition, the user ID of the primary user and the current user, their role as well as information on the vehicle model and its equipment are processed in order to check which products of “VW Connect” have been activated by a primary user for the vehicle and can be used by the respective driver. Part E “Service portfolio” provides information on other personal data that is processed.
b) Troubleshooting and security
In addition to the VIN and User ID of the primary user, we will also log the time and type of any service used in order to identify and analyse faults and security threats. This takes place in order to protect our legitimate interest of improving the mobile online services so that we can provide the IT security for the mobile online services without faults to all our customers to the maximum possible extent (Article 6(1)(f) GDPR).
If a malfunction is detected, Volkswagen AG will process the contact details provided by the user to contact the user should it be necessary. Data processing is carried out for the purpose of the performance of a contract (Article 6(1)(b) GDPR).
c) Restrict data processing (privacy settings)
Various privacy settings are available in the vehicle (see “Privacy Policy for vehicles of the Volkswagen ID. family”). Depending on the setting, certain user-independent mobile online services may no longer be usable.
The mobile online services can also be activated and deactivated individually by the primary and guest users via their personal login area in the web browser or in their app (“Service management”). This service management is user based and is exclusively adapted in the respective user's app/web view.
d) Locking of the S-PIN due to incorrect entry
The user profile in the vehicle is protected with an S-PIN to protect your data, for example, the personal settings or access to additional services. If the S-PIN is entered incorrectly multiple times, the entry will temporarily be locked. The temporary S-PIN lock can be dynamic in some cases. This means the current duration of the lock cannot be derived from the previous lock.
e) Inactivity of use of services
If the primary user and the guest user do not use mobile online services via their personal login area in the web browser or the app within 30 days, the so-called “Data Saving Mode” will be activated. The vehicle identification number (VIN) and the last request to the vehicle will thereby be processed. The vehicle will then no longer transmit data concerning the remaining range and charging processes in the personal login area in the web browser or in the app. As soon as the primary user or the guest user is active in the personal login area in the web browser or in the app, the data will be transmitted again. This takes place to protect our legitimate interests in saving unnecessary data transfers to provide mobile online services without faults to all our customers to the maximum possible extent (Article 6(1)(f) GDPR). After the login, the data concerning the last use is overwritten in the personal login area in the web browser or in the app and will be erased no later than after 30 days.
There is an option to contact the Customer Interaction Center (“CIC”) with concerns about Volkswagen AG apps, services and websites (e.g., by post, email, contact form or telephone). In doing so, Volkswagen AG processes the personal data (e.g. name, email address, address, telephone number, country and language) that is required to respond to requests and provide customer care. Additional information on data protection when using the CIC is provided in the CIC Privacy Policy at https://cic-legal.volkswagen.com.
The CIC may contact individual customers to the extent necessary for the performance of the “VW Connect” contract. In doing so, the contact details on file with us will be processed for the purpose of contract performance (Article 6(1)(b) GDPR).
Applies to customers in Germany only:
Contact your authorised Volkswagen repairer (authorised workshop and/or dealership) for customer-focused support for our mobile online services, who handles the customer care for Volkswagen AG. The following data is included in the transmission to the authorised Volkswagen repairer and processed by same as a processor: contract data, name, first name, Volkswagen ID user account (email), VIN and vehicle data, verification status, user status (primary user yes/no), Service scheduling (service active / not active), preferred authorised workshop (service selected / not selected) and further data that you provide to use as part of your request. We will process this data in accordance with Article 6(1)(b) GDPR for the purpose of performing the contract for mobile online services or – if you are not already a customer – in order to initiate a contract for the use of the mobile online services.
Other recipients: Audi AG, Auto-Union-Straße 1, 85057 Ingolstadt, Germany, as technical service provider (This recipient processes personal data only on our behalf and in accordance with our instructions.)
We process data relating to the vehicle and the digital products purchased, as well as data concerning the use of the services on the vehicle.
The data is processed for the following purposes:
• Improving customer care
• Sales management
• Ensuring correct accounting
• Product monitoring, fault analysis, implementing fault rectification measures and paying compensation to customers as a goodwill gesture
• Improving products
• Derivation of marketing measures
• Commissioning payments to importers and dealerships
• Remunerating the service providers that we use for the mobile online services
Once it has been analysed, the data is made available to the responsible departments within Volkswagen AG only to the extent required for the respective purpose (and, where possible, in anonymised form).
The following personal data will be processed:
• Vehicle identification number (VIN)
• User ID
• Information on products purchased (item number, activation status, activation date, duration, selected country when registering, payment method).
• Log file information on service calls
• Information on vehicle equipment
• Type of customer (private or commercial customer)
• Status of the marketing consent declaration
• Information concerning whether a preferred authorised workshop has been specified
The legal basis for the processing is Article 6(1)(f) GDPR (legitimate interest: management of the business model of the mobile online services, as well as enhancement of the customer experience in the context of the above-mentioned purposes).
The data will be processed by CARIAD SE, Berliner Ring 2, 38440 Wolfsburg, Germany.
This recipient will process personal data on our behalf and in accordance with our instructions only.
Volkswagen AG is constantly striving to improve business processes as part of company management and to optimise the associated costs. This requires a well-founded analysis of web analysis, offer, sale and order data. For this reason, Volkswagen AG processes data from web analysis, offer, sale and ordering systems as well as data from services that are linked to the Volkswagen ID. Details on processing this data (e.g. exactly what data is processed and how) are provided in the Volkswagen ID Privacy Policy at https://vwid.vwgroup.io/data-privacy.
Applies to customers in Germany:
Volkswagen AG always strives to send information to its customers that is personally tailored to them as much as possible and thus improve advertising for the marketing of its products and services. This requires a well-founded analysis of their use of our products and services. If the user has given consent, Volkswagen AG will therefore process data from the Volkswagen ID user account and from “VW Connect”. Details concerning this data processing (e.g. which data exactly will be processed) is available in the Volkswagen ID Privacy Policy under https://vwid.vwgroup.io/data-privacy.
Applies to customers in other VW Connect countries with the exception of Germany:
Volkswagen AG always strives to send information to its customers that is personally tailored to them as much as possible and thus improve advertising for the marketing of its products and services. An in-depth analysis of products and services (analytics) is required to accomplish this goal. For this reason, Volkswagen AG processes data from the Volkswagen ID user account and from “VW Connect”, for example:
• Identification data (e.g. name, email, telephone number, vehicle identification number, if applicable)
• User account data (e.g. preferred partners)
• Transaction data (e.g. completed agreements)
• Vehicle usage data (e.g. logbook, fluid levels, mileage (km))
• Contract data (e.g. vehicle equipment, ongoing contracts with related services)
• IT usage data (e.g. last login to services, use of functions)
• Location data (e.g. truncated GPS data)
In the event that vehicles are recorded, Volkswagen AG will also process the vehicle identification number and add additional equipment data of the vehicle to the information listed above and builds segments. Volkswagen AG transmits these segments as well as the raw data to the competent national sales company (importer) for the respective country for the improvement of advertising. In the course of processing, the personal data is treated personalised.
The described processing of the data is based on the consent given by the user (Article 6(1)(A) GDPR) in personalised advertising by Volkswagen AG. If the user does not consent, the user's data will not be processed for the named purpose.
Volkswagen AG deletes the personalised data after five years or in accordance with the legal requirements, e.g. as soon as the purpose for which the data was collected no longer applies and provided that there are no other retention obligations.
Further information on the analysis of personalised data to improve advertising and on consenting to receiving advertising communications from Volkswagen AG and from the national sales company (importer) responsible for the respective country is provided in the comprehensive Volkswagen ID Privacy Policy. This information is available under https://vwid.vwgroup.io/data-privacy.
Note: the Section “Analysis for the improvement of products” only applies to customers in Germany, Austria, Denmark, France, Spain, Italy, Ireland, United Kingdom (incl. Northern Ireland), Switzerland, Netherlands, Belgium, Norway and Sweden.
Volkswagen AG continually strives to develop new products and services and improve existing products and services. An in-depth analysis of products and services (analytics) is required to accomplish this goal. For this reason, Volkswagen AG processes data from the Volkswagen ID user account and from “VW Connect”, for example:
In case of vehicles that are stored in the Volkswagen ID user account, Volkswagen AG processes the vehicle identification number and enhances the data listed above with further equipment data of the respective vehicle. In the course of processing, the personal data is pseudonymised. Pseudonymisation involves removing all direct personal identification features (e.g. vehicle identification number). Indirectly traceable identification features (pseudonyms) are retained. In addition, we also truncate the GPS data. The data is only analysed in the Volkswagen AG analytics systems once this pseudonymisation and reduction has been completed. The direct reference to a specific person is not restored at any time. The results of the analysis (especially metrics and key figures) are completely anonymous.
The processing of pseudonymous data (e.g. User ID, pseudonymised vehicle identification number) is necessary to be able to detect longer term interactions between our customers’ use of the vehicle and services and the vehicle condition (e.g. battery functionality). This is the only way for us to determine suitable new and enhancement measures and offer new and improved products and services to our customers.
Only the personal data of the last primary user logged in at the vehicle will be processed and only to the extent that the primary user has activated and uses the corresponding services from the service portfolio. (see Section E. “VW Connect” service portfolio in vehicles of the “ID. family”). Vehicle users can also enter individual privacy settings and thereby control the data that can leave the vehicle (see Section D.I.2.c) “Restricting data processing (privacy settings)”).
The data processing described above is based on the legitimate interest of Volkswagen AG to offer its customers newly developed as well as improved products and services (Article 6(1)(f) GDPR).
Volkswagen AG erases any pseudonymous data no later than after seven years or in accordance with the legal requirements, e.g. as soon as the purpose for which the data was collected no longer applies and provided that there are no other retention obligations.
The “Charging Stations data service” function is used to display detailed information on public charging stations: the exact location and number of available charging points, their current occupation status and capacity utilisation as well as expected availability, currently existing defects or incompatibilities with the vehicle, available plug types and expected charging capacities as well as charging times and opening hours and access times. This information can be read in the vehicle and in the Volkswagen app.
To provide the function, the data that is collected as part of the “Charging”, “Parking Position” and “Departure Times” services is processed and anonymised for the “Charging Stations data service” function prior to analysis.
If the vehicle is used in offline mode, no data will be collected and forwarded to the backend. The offline mode can be set in the vehicle.
Personal data: vehicle identification number (VIN); parking position; timestamp; actual charging station capacity; current type (AC or DC); status of the charging connector; connector type used; set charging limit; timer charging; state of charge (SOC); information on the section of the charging process; reason for end of charging
Legal basis: Art. 6(1)(f) GDPR for the anonymisation of data: the legitimate interest of Volkswagen AG lies in the implementation of the principle of data minimisation (Art. 5(1)(c) GDPR).
Other data recipients: CARIAD SE, Berliner Ring 2, 38440 Wolfsburg, Germany (This recipient processes personal data only on our behalf and in accordance with the specifications of Volkswagen AG).
Applies to customers in countries that are using mobile online services, with the exception of Hungary, San Marino and Switzerland:
As part of business reporting, data is processed to manage the business model of mobile online services and to enhance the customer experience. In doing so, we process data that is used in the vehicle in relation to the digital products and services purchased.
Once it has been analysed, the data is made available to the responsible departments within Volkswagen AG only to the extent required for the respective purpose. The following personal data will be processed:
The data is processed for the following purposes:
The following data recipients are used as processors:
Other third parties:
Importers (recipients) – For remuneration of dealers and importers within the scope of the contractually stipulated profit sharing for sales revenue of digital products
Your personal data will be processed in an Amazon Web Services Cloud operated by Amazon Web Services EMEA SARL (“Amazon”) (processor) in the European Union for the purpose of internal company reporting. Access to personal data by Amazon Web Services, Inc. (processor), based in the USA, cannot be excluded, thus the relevant EU standard contractual clauses (a set of contractual clauses approved by the European Commission that accords the same protection to personal data that it has in the EU during data processing in non-EU countries) have been concluded.
You can access the EU standard contractual clauses used via the URL https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32021D0914.
Legal basis: the legal basis for the processing is Article 6(1)(f) GDPR (legitimate interest: management of the business model of the mobile online services, as well as enhancement of the customer experience in the context of the above-mentioned purposes).
Volkswagen AG erases your personal data after 10 years or in accordance with the legal requirements, e.g., as soon as the purpose for which the data was collected no longer applies and provided that there are no other retention obligations.
The personal data is stored on servers of the following service providers only on our behalf and in accordance with our instructions:
CARIAD SE
Berliner Ring 2
38440 Wolfsburg
Germany
WirelessCar Sweden AB
Vädursgatan 6
412 50 Gothenburg
Sweden
Amazon Web Services, Inc. (“AWS”)
410 Terry Ave. North
Seattle WA 98109
USA
Amazon Web Services EMEA SARL
Avenue John F. Kennedy 38
1855 Luxemburg
Luxembourg
Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
D18 P521
Ireland
Ford Motor Company
One American Road
Dearborn, MI 48126
USA
(Applies only to the Volkswagen Amarok)
In addition, we use various IT service providers both within and outside the EU. These assist us with the maintenance of our IT systems and with technical support, for example. Insofar as the service providers have access to personal data, they will process this data on our behalf and in accordance with our instructions only.
IT support is provided in particular by the following service providers:
CARIAD SE
Berliner Ring 2
38440 Wolfsburg
Germany
Details of other recipients of personal data are provided in the information that has been provided in this Privacy Policy in relation to the specific services and functions concerned.
For the purposes outlined in this Privacy Policy, Volkswagen AG also transfers personal data to recipients and processors domiciled outside the EU. Volkswagen AG agrees to EU standard contractual clauses with recipients in unsafe third countries to ensure that personal data is adequately protected. The EU standard contract clauses used in the EU languages can be accessed via the URL https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32021D0914. If required by the applicable data protection legislation, other protective measures (such as encryption and additional contractual provisions) are also put in place to ensure that personal data is adequately protected.
Insofar as legal regulations apply, we are obliged to hand over data stored by us to the necessary extent at the request of government agencies (e.g., in the investigation of a criminal offence). The legal basis for the transfer of data to the respective government agency is provided by the respective legal obligation (Article 6(1)(c) GDPR in conjunction with the respective legal obligation).
If the personal data is no longer needed for the purpose or purposes for which it was collected, it will be erased by us if there are no statutory archiving obligations that prevent erasure.
If the vehicle is erased from a virtual garage in the app, the user will also be removed from the list of users for the vehicle. Please note that the data will not be erased from the vehicle until the vehicle has been reset to the factory settings via the infotainment system.
Furthermore, our customers can rectify the data they have entered at any time in the settings of the Volkswagen ID, if they have created such an ID.
The Volkswagen ID provides our customers with the option to log in at various online services of Volkswagen AG or third parties. The data processing necessary for this is carried out for the performance of a contract (Article 6(1)(b) GDPR). The Volkswagen ID acts as a central user account where our customers can centrally manage their personal data. In order to use a mobile online service, it is necessary to create a Volkswagen ID or to log in with an existing one. The mobile online service selected by the customer is linked with the Volkswagen ID of the customer. This linking will only take place if the customer has given consent for this (Article 6(1)(a) GDPR). Information on data processing in relation to the Volkswagen ID is available in the Privacy Policy, which can be accessed online under https://consent.vwgroup.io/consent/v1/texts/IdentityKit/de/en/volkswagen-dataPrivacy/latest/html.
An identity check (Volkswagen Ident) is required before using mobile online services that allow access to the vehicle (such as by “Lock & Unlock”).
AutoIdent by IDnow is an identification solution that enables customers to identify themselves online and in real time. The customer uploads a machine-readable identification document, such as an identity card, passport or driving licence (depending on the applicable requirements in the country of the customer) and records a short selfie-video. The AutoIdent software then automatically checks the authenticity of the document and compares it with the video to ensure that this is the actual person who wants to identify themselves. As soon as the identity has been checked successfully, customers can verify their identity online and use mobile online services, such as those permitting access to the vehicle (e.g. “Lock & Unlock”).
The Volkswagen ID (internal identification number enabling the unique assignment of customer data) will be sent to the commissioned service provider.
This identification number will be enriched with further data (e.g. portrait image) by the commissioned service provider during the identification process. The customer will be notified of this separately in advance and must expressly consent before we are allowed to process the data in this way. In this case, the data will be processed by virtue of the customer’s consent on the basis of Article 6(1)(a) GDPR and Article 9(2)(a) GDPR solely for the purpose of identifying the customer in order to activate mobile online services for which unique identification is required. The data will be transmitted exclusively in encrypted format.
On conclusion of the identification process, the service provider will send the customer's surname, first name, date of birth and Volkswagen ID, as well as the time of identification, back to us for the purpose of documenting the result and enabling the mobile online services. In addition, the following will be sent for the purpose of documenting which identification document was used to identify the customer: type of document, the document number, country of issue, date of issue and date of expiry.
We analyse whether the Volkswagen Ident processes have been completed successfully or aborted. This is why we store the status of the verification process of a customer. The front and back of the document, recorded security features of the identification documents and photos of the face are stored by IDnow for evidence purposes and erased after a maximum of thirty (30) days.
Volkswagen will store the personal data until the customer deletes the Volkswagen ID user account.
Third-party provider information:
IDnow GmbH
Auenstraße 100
80469 München
Germany
This recipient will process the personal data only on our behalf and in accordance with our instructions.
As an alternative, the Volkswagen Ident process can be carried out on site at any Volkswagen authorised workshop if it offers this service. The customer must first complete the registration process in the customer’s personal login area in the web browser by providing the customer's surname, first name and date of birth.
On site at the Volkswagen authorised workshop, the data provided will then be compared with the details on the customer's driving licence. In this case, the data will be processed by virtue of the customer’s consent on the basis of Article 6(1)(a) GDPR and Article 9(2)(a) GDPR solely for the purpose of identification in order to activate mobile online services for which unique identification is required. The recorded data (driving licence number, date of issue, where applicable: country of issue, validity period) will be sent to us. The data will be transmitted exclusively in encrypted format. The Volkswagen authorised workshop does not store any data. The Volkswagen authorised workshop will process the data only on our behalf and in accordance with our instructions.
The services from the “VW Connect” portfolio listed below are available in the vehicle depending on the model year and equipment of the vehicle, the software version of the mobile online services installed in the vehicle and depending on the country. The primary user and, if applicable, guest users of the vehicle can deactivate individual services of the service portfolio in the “Volkswagen” app (“App”) and reactivate them if required (see Section C.I.2.c) “Restricting data processing (privacy settings)”.
An overview is provided below of the data processed in the context of the respective service, the legal bases for processing and the respective data recipients. Information on data recipients who receive personal data across services is provided in Section C.II. “Data recipients”.
Services that process position data are identified with an *.
Via “Departure times”, the primary user has the option of using the app to configure charging profile settings (minimum charge level, maximum charge level, charging current limit, automatic release of the charging connector, preferred charging times, name of the charging profile) as well as to determine the time at which the ID.vehicle battery should be charged at a charging location. There is also an option to set whether the vehicle should be air-conditioned (stationary air conditioning) at the desired departure time.
Personal data: vehicle identification number (VIN), desired time for the “Charging” and “Air Conditioning” services, (current) status of the charging profile setting
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
“Air Conditioning” gives the primary user the ability to control the temperature in the vehicle interior before entering it using the air conditioning system (stationary air conditioning) and to activate (or deactivate) the window heating without having to be physically near the vehicle.
Personal data: vehicle identification number (VIN), air conditioning status and settings, window heater status, (current) status of stationary air conditioning
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
Via “Charging”, the primary user has the option of using the app to control the charging of the vehicle battery (start/stop), configure the charging process and check the charging status (battery charge level, remaining range, status of the charging connector, remaining charging time).
Personal data: vehicle identification number (VIN), charging settings, (current) charge level
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
The following passages apply to the “We Charge” In-Car App with software version 2.7.0.
The “Search and find charging stations on the map” function provided by “We Charge” makes it possible to display charging stations while using the navigation system of your vehicle. It shows you which charging stations are available and which ones are not. Additionally, you can see the charging speed in the detail view of a charging station.
The “Search and find charging stations on the map” function can only be used if we can access the location of the vehicle (geoposition) or an address you entered, and if we can process this data. The geoposition data will only be processed if you have consented to this prior to using the service. Of course, you can withdraw your consent with respect to Volkswagen AG at any time, without stating reasons and with effect for the future, e.g. by sending an email to info-datenschutz@volkswagen.de and via the contact details provided in the site notice, as well as, depending on the front end, in the settings or by restarting the Electric Vehicle Route Planner. However, this function will no longer be available to you in this case.
Personal data: Geoposition or address (freely selectable), storage category: Data will not be stored permanently
Legal basis: Article 6(1)(a) GDPR (consent) for the use of the geoposition, Article 6(1)(b) GDPR (contract performance) for the use of the selected address
Other data recipients: Volkswagen Software Asset Management GmbH, Berliner Ring 2, 38440 Wolfsburg, Germany
Furthermore, we are using service providers who process personal data under their own responsibility. In this case, we are using Google Ireland Limited (Gordon House, Barrow Street, DUBLIN 4, Ireland). You can find more detailed information on data processing at Google at https://policies.google.com/privacy?hl=de.
“Charging Stations” searches for suitable charging stations in the surrounding area of the current vehicle position. The application shows the total number and free spaces of the charging station and provides information on distances.
Personal data: IP address of the vehicle; TileID of the region in the vicinity of the vehicle
Legal basis: Article 6(1)(b) GDPR for the primary and guest user (for contract performance); Article 6(1)(f) GDPR for each additional vehicle user including the anonymous guest (legitimate interests: performance of the “VW Connect” contract towards the primary user)
Other data recipients: Joynext GmbH, Gewerbepark Merbitz Nr. 5, 01156 Dresden, Germany. (This recipient processes personal data only on our behalf and in accordance with our instructions.)
The Online Map Update service allows the map material to be updated online directly in the vehicle. For this purpose, the vehicle analyses which regions in a country are relevant for the vehicle and travelled most frequently.
Personal data: IP address of the vehicle, TileID of the regions travelled most frequently (only in the case of an automatic update); version number of the currently stored map data
Legal basis: Article 6(1)(b) GDPR for the primary and guest user (for contract performance); Article 6(1)(f) GDPR for each additional vehicle user including the anonymous guest (legitimate interests: performance of the “VW Connect” contract towards the primary user)
Other data recipients: HERE Europe B.V., Kennedyplein 222 – 226, 5611 ZT Eindhoven, Netherlands. (This recipient processes personal data only on our behalf and in accordance with our instructions.)
“Parking Spaces” can be used to search for suitable parking spaces in the surrounding area of the actual vehicle position, if they are available. The application provides information on prices, opening hours, distances and telephone numbers.
Personal data: IP address of the vehicle; TileID of the region in the vicinity of the vehicle
Legal basis: Article 6(1)(b) GDPR for the primary and guest user (for contract performance); Article 6(1)(f) GDPR for each additional vehicle user including the anonymous guest (legitimate interests: performance of the “VW Connect” contract towards the primary user)
Other data recipients: Parkopedia Ltd. 232 Sladepool Farm Road, Birmingham, B14 5EE, United Kingdom; Joynext GmbH, Gewerbepark Merbitz Nr. 5, 01156 Dresden, Germany. (These recipients process personal data only on our behalf and in accordance with our instructions.)
“Route Calculation” calculates the best route for the vehicle taking into account the current traffic situation.
Personal data: IP address of the vehicle, position of the vehicle, start/destination, direction of travel, route settings
Legal basis: Article 6(1)(b) GDPR for the primary and guest user (for contract performance); Article 6(1)(f) GDPR for each additional vehicle user including the anonymous guest (legitimate interests: performance of the “VW Connect Plus” contract towards the primary user)
Other data recipients: Joynext GmbH, Gewerbepark Merbitz Nr. 5, 01156 Dresden, Germany. (This recipient processes personal data only on our behalf and in accordance with our instructions.)
The “Online Destination Import / Online Route Import” service allows the primary user or the guest user to send individual points of interest (POI) and created routes stored in the app to the vehicle's navigation system before the start of a journey. The destination or route sent is displayed in the navigation system for the current user of the vehicle as soon as the vehicle is used online.
Personal data: vehicle identification number (VIN), search term, coordinates of the map section, IP address, sent destinations (points of interest), user created routes, availability status of the function in the vehicle (to send destinations)
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland
The “Over-the-air update/system update” service updates the vehicle software (infotainment system, control unit firmware), e.g. to obtain new functions, rectify faults or get the systems ready for the latest changes relating to road traffic.
Personal data: Vehicle identification number (VIN), software and hardware versions and hardware serial numbers, charge quantity consumed for the service from the vehicle battery for the present calendar year, language set in the infotainment system
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: CARIAD SE, Berliner Ring 2, 38440 Wolfsburg, Germany; Harman Connected Services Inc., 636 Ellis Street, 94043 Mountain View, USA; HERE Europe B.V., Kennedyplein 222 - 226, 5611 ZT Eindhoven, Netherlands
“Online Traffic Information” provides information on current traffic events and shows the traffic flow on the map and along the route of the navigation system.
Personal data: IP address; TileID of the requested region in the vicinity and/or along the route.
Legal basis: Article 6(1)(b) GDPR for the primary and guest user (for contract performance); Article 6(1)(f) GDPR for each additional vehicle user including the anonymous guest (legitimate interests: performance of the “VW Connect” contract towards the primary user)
Other data recipients: Joynext GmbH, Gewerbepark Merbitz Nr. 5, 01156 Dresden, Germany, and NIRA Dynamics AB, Wallenbergs gata 4, 58330 Linköping, Sweden. (This data recipient processes personal data only on our behalf and in accordance with our instructions.)
The “Online Voice Control” / “Online Voice Assistant” service allows primary and guest users to intuitively control vehicle functions using their voice and is available in addition to offline voice control / the voice assistant in the vehicle (only available in the following languages: English (UK), English (US), German, French, Italian, Spanish, Czech, Dutch, Polish, Portuguese, Swedish, Danish, Norwegian).
“Voice Control” / “Voice Assist” can be activated with the push-to-talk button on the steering wheel or with the activation word to then formulate a request. Other vehicle occupants can also use “Voice Control / Voice Assist” by means of the activation word. A background service runs on the vehicle’s infotainment system to enable use of the activation word. This service detects when the activation word is spoken. Every now and then, this background service may falsely detect the activation word.
As soon as “Voice Control” / “Voice Assist” has been activated with the push-to-talk button or activation word, this is indicated by a graphic symbol on the infotainment system screen.
The advantage of Online Voice Control / Online Voice Assist compared to Offline Voice Control / Voice Assist without online connection is better voice recognition in general and the option to control online contents using voice inputs, for example, streaming services (Internet Radio), points of interest for navigation as well as the option to call up information on weather, news, knowledge, sports, flight status and the stock market. If the customer additionally consents to processing of location data for the Online Voice Control / Online Voice Assist, the customer will receive navigation results enriched with additional information (e.g. charging station information) even faster and can call up information on their surrounding area (available depending on model and equipment and depending on the system language setting). The Online Voice Control / Online Voice Assistant function will remain covered by the contractually guaranteed scope even if consent is withdrawn.
The Online Voice Assistant is enhanced with the connection to ChatGPT 3.5 Turbo, whereby requests that the Online Voice Assistant cannot answer are forwarded to ChatGPT. For this, the service provider Cerence GmbH checks if the voice request can be answered. If this is not the case, the voice request is forwarded in text format to ChatGPT. ChatGPT sends a reply in text format to the service provider Cerence GmbH and from there back to the vehicle. When the reply is output in the vehicle, it is made clear that the result was generated by ChatGPT. When the voice request is processed via ChatGPT, the location data is not forwarded to ChatGPT.
With an existing online connection, their voice inputs will also be analysed to continuously improve the voice control and voice recognition for all customers. They are thereby always analysed anonymised with automated processes and are only made accessible to trained employees of our service provider, Cerence GmbH for purposes of analysis for the optimisation of voice recognition.
If the vehicle is used in offline mode, the voice data will be processed solely in the vehicle. No location data is processed (offline voice control / offline voice assistant). The online function can be deactivated in the personal login area in the web browser or via the app. In addition, the recognition of the activation word can be deactivated in the infotainment system so that voice control / voice assist can only be used via the push-to-talk button.
“Online Voice Control” / “Online Voice Assist” is not available to anonymous guests. Data will be processed solely in the vehicle.
Personal data: vehicle identification number (VIN), country stored in the system or current vehicle location (if consent was also given for the processing of location data for Online Voice Control / Online Voice Assist), selected Infotainment language, brand of the vehicle, user ID of the primary user of the vehicle, regional code and version number of the infotainment software, voice input and voice output (only for the languages EN-US, EN-GB, DE, FR, ES, IT, CZ, NL, PL, PT, SE, DK, NO)
Legal basis: Article 6(1)(b) GDPR for primary and guest users (for contract performance); for the optional processing of the current vehicle position: Article 6(1)(a) GDPR (consent); for further occupants of the vehicle without contract for the mobile online services: Article 6(1)(f) GDPR (legitimate interest: performance of the “VW Connect” contract in relation to the primary user); the analysis of the voice inputs by Volkswagen AG and the service provider, and the anonymisation of the voice inputs for further analysis occurs according to Article 6(1)(f) GDPR (legitimate interest: improvement of voice control and voice recognition for all customers).
Other data recipients: e.solutions GmbH, Despag-Straße 4a, 85055 Ingolstadt, Germany; Cerence GmbH, Jülicher Straße 376, 52070 Aachen, Germany (these recipients process personal data only on our behalf and in accordance with our instructions.)
With the “VW Connect Basic” mobile online services, the Online Voice Control is also available in the AMAROK to primary users of the vehicle in addition to the offline voice control in the vehicle. Online Voice Control is available in the following countries and the corresponding languages: Austria, Belgium, Switzerland, Czech Republic, Germany, Denmark, Spain, Finland, France, England, Greece, Hungary, Ireland, Italy, Luxembourg, Netherlands, Norway, Poland, Portugal, Romania and Sweden. To ensure the functionality of the Online Voice Control as defined in the contract, the position of the vehicle is sent as soon as you have activated the mobile online services in your Volkswagen app. The respective position date is erased immediately after use.
You can activate voice control via the push-to-talk button on the steering wheel or via the activation word to then formulate your request. Other vehicle occupants can also use Online Voice Control by means of the activation word. A background service runs on the vehicle’s infotainment system to enable use of the activation word. This service detects when the activation word is spoken. Every now and then, this background service may falsely detect the activation word.
As soon as voice control has been activated by the push-to-talk button or activation word, this is indicated by a graphic symbol on the infotainment system screen. The advantage of “Online Voice Control” compared to offline voice control is that it offers better speech recognition in general and allows online content to be controlled via voice control, e.g. POIs for navigation.
When you use Online Voice Control, Cerence B.V. uses automated processes to analyse the voice control commands on our behalf for reporting purposes and makes the analysis results available to us (excluding the voice and audio files). You can deactivate the online connection for Online Voice Control at any time in the infotainment system. In this case, the voice data will be processed solely in the vehicle. In addition, you can deactivate recognition of the activation word in the infotainment system so that voice control can only be used via the push-to-talk button. If you use the vehicle in offline mode, the voice data will be processed solely in the vehicle (offline voice control).
If you are an anonymous guest or guest user, Online Voice Control is not available to you. Data will be processed solely in the vehicle.
Personal data with an online connection: vehicle identification number (VIN), country stored in the system and current vehicle position, selected infotainment language, country code of the vehicle, User ID, regional code and version number of the infotainment software, your voice control and the voice output
Legal basis: for primary users: Article 6(1)(b) GDPR (for contract performance); for other vehicle users and occupants without a contract for mobile online services: Article 6(1)(f) GDPR (legitimate interest: performance of the contract for mobile online services)
Other data recipients: Cerence B.V., CBS-weg 11, 6412 Ex Heerlen, Netherlands (These recipients will process data on our behalf and in accordance with our instructions only.)
As part of the “Internet Radio” function, the infotainment system makes available an up-to-date and language-specific catalogue of stations and podcasts. This provides the option to listen to thousands of stations and podcast episodes of different kinds via online streaming.
Personal data: Vehicle identification number (VIN), IP address
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: e.solutions GmbH, Despag-Straße 4a, 85055 Ingolstadt, Germany. (Both recipients will process personal data on our behalf and in accordance with our instructions only.)
The “Temperature Alerts” service sends recommendations to the primary user, via the app, to set a departure time or charge the vehicle when the ambient temperature is low in order to avoid a limited battery performance due to cold weather. This service is available to the primary user if they were the last user logged into the vehicle. This allows the battery to be preheated ahead of time and thereby prepared for operation at low outside temperatures.
To receive temperature alerts via push notifications, permission to send push notifications must be given in the app in advance.
Personal data: Vehicle identification number (VIN), user ID, battery charge status, battery size, battery temperature, charging connector status, time stamp of journey and status of drive system (ignition “off”/”on”), vehicle position, expected ambient temperature at vehicle position (the volume of processed personal data may be reduced depending on the software version.)
Legal basis: Article 6(1)(b) GDPR for the primary user (for contract performance)
Other data recipients: none
“Plug & Charge” offers vehicle users the option to charge at public charging stations via an automated authentication process by plugging in the charging cable.
In the course of the installation and deinstallation of the vehicle and contract certificate, further IT usage data (e.g. storage index of the contract certificate or transaction data) is processed in addition to the vehicle identification number (VIN).
During the authentication at public charging stations, additional contract data (e.g. identification number of the contract certificate) is processed, which enables the traction current provider to bill the charging process.
For the authentication at a private wall box, IT usage data (e.g. serial number of the vehicle certificate) is also transmitted to the private wall box.
Personal data: vehicle identification number (VIN), IT usage data (e.g. serial number of the vehicle certificate, storage index of the contract certificate, transaction data), contract data (e.g. identification number of the charging current contract (EMAID))
Legal basis: Article 6(1)(b) GDPR (contract performance)
Other data recipients: Hubject GmbH, EUREF-Campus 22, 10829 Berlin, Germany
With regard to data processing by the traction current provider and the wall box provider, their data protection notices must be observed.
The Breakdown Call function can be triggered both by breakdown events (with or without a warning lamp lighting up) and by minor accidental damage below the level required to trigger the restraint systems (such as the airbag and belt tensioner). Once the airbag control unit has detected an impact of this kind, the function offers the vehicle user to establish an audio connection with the Emergency Call Service or Breakdown Call via the infotainment system. As part of this, certain data will be transmitted automatically, such as details of the vehicle equipment, to help the Breakdown Call employees and, where applicable, those of the towing company to provide rapid and effective assistance.
We process your data to improve our products and business processes, customer functionality of the breakdown call, optimise customer benefit and to eliminate product faults. We will analyse your data for the purpose of product improvement and quality assurance of the breakdown call and to prevent interruptions or delays in the process sequence of processing requests. For example, we check for faults in the transmission of data to your authorised workshop (such as incomplete data or delays within the data transmission) for early detection and elimination. This allows us to offer the best possible customised service and increase customer satisfaction with digital services. Furthermore, the indicated data is forwarded to the responsible importer for their country for process management and improvement, such as by way of quality audits. The provided data will be erased after five years (the service is not supported in the following countries where only a recorded message will be played: Albania, Malta, Ukraine, Macedonia, Serbia, Cyprus).
Personal data: vehicle identification number (VIN), phone number of the integrated SIM card in the vehicle, title, form of address, name, date of birth, address, country, phone number, email address, number plate, vehicle data (brand, mileage (km), remaining range, model name, model year, colour, gearbox, powertrain, year of manufacture, vehicle type, equipment features), insurance details (name of insurance provider of the party reporting the accident, insurance policy number of the party reporting the accident, nature of damage, name of the other party's insurance provider), case details (impact zone, severity of impact, date of accident, time of accident, cause, warning lamps, event memory entries, vehicle position, accuracy of GPS data, direction of travel, nature of damage, date of damage assessment, preliminary damage costing, service schedule, most recent service) and any other personal data shared by the vehicle user during the call; for data processing as part of the analysis:
Vehicle identification number, service requirement category, date the breakdown call data was sent, the selected authorised workshop and information on the agreed appointment. In addition, the respective authorised workshop transmits the following data: vehicle identification number, time of lead initiation, time of contact initiation and time of lead closing.
Legal basis: Art. 6(1)(b) GDPR for the primary and guest user (for contract performance); Art. 6(1)(f) GDPR for each additional vehicle user including the anonymous guest (legitimate interests: performance of the “VW Connect” contract towards the primary user); for data processing as part of the analysis: Art. (6)(1)(f) GDPR (legitimate interests: improvement of the products and business processes, customer functionality of the breakdown call; optimisation of the customer benefit; elimination of product faults; process management and improvement in the trade; improvement of customer satisfaction with the services).
Other data recipients: ARC Europe S.A., Avenue des Olympiades 2, 1140 Brussels, Belgium and its authorised local service provider; where applicable, a Volkswagen authorised workshop or a towing company, as well your insurance company, after you have given your consent. As part of the analysis, the data is transmitted to CARIAD SE, Berliner Ring 2 Brieffach 1080/2, 38440 Wolfsburg, Germany (CARIAD SE will process the data on our behalf and in accordance with our instructions only).
If the vehicle is used offline or if the service has been deactivated via the app, the breakdown call is still available offline without “VW Connect” services; however, the vehicle will not automatically send any data to the call centre.
Availability depends on the software version
The “Vehicle Health Report” informs the primary user about the current condition of the vehicle. This allows primary users to have selected driver messages relating to the vehicle and/or any servicing requirements additionally displayed in their personal login area in the web browser and the app. The driver messages (warning and fault messages) indicated directly in the vehicle remain the sole source of authoritative information.
Personal data: vehicle identification number (VIN), mileage (km), time remaining until next service, driver messages
Legal basis: for the primary user: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-car service for the primary user in accordance with the contract)
Other data recipients: none
The “Vehicle Status” function allows the primary user and the guest user to display various items of status data for the vehicle in the app.
Personal data: vehicle identification number (VIN), window, door and tailgate status, central locking status, parking light, timestamp
Legal basis: for the primary user and the guest user: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service for the primary user and guest users in accordance with the contract)
Other data recipients: none
“Parking position” allows the primary user to retrieve the last known vehicle location if they were the last user logged into the vehicle.
Personal data: vehicle identification number (VIN), most recent parking position when vehicle was switched off (removal of key, activation of Start/Stop button)
Legal basis: for the primary user: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
The “Media Streaming” function allows the use of various music streaming services directly within the infotainment system in the vehicle without having to connect a smartphone or some other device. To do this, the respective streaming app must first be downloaded and installed by the primary user via the In-Car Shop.
Personal data: Vehicle identification number (VIN), authentication token with the streaming provider, IP address
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: the respective streaming provider The data privacy statements of the respective streaming service are the authoritative source of information for the processing of data within this context.
With this function, the primary and guest users can save their respective individual vehicle settings and “transfer” them to other Volkswagen vehicles that are equipped with “VW Connect” mobile online services. The vehicle settings for numerous systems are saved automatically and depending on the equipment, from seat and mirror positions to lights, air conditioning and driver assistance.
Personal data: Vehicle identification number (VIN), current personal vehicle settings (including seat, mirrors, lights, climate, driver assistance settings), last used radio stations/apps, necessary metadata for transferring setting values (e.g., parameter ID, change information, version numbers and timestamps)
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
Via the "In-Car Shop/Webshop", the primary user can purchase products, such as mobile online services, or extend the duration of mobile online services.
Personal data: vehicle identification number (VIN), contact details, contract data, credit card details/PayPal payment details
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Additional data recipients: arvato distribution GmbH, Gottlieb-Daimler-Strasse 1, 33428 Harsewinkel, Germany; J.P. Morgan Mobility Payments Solutions S.A., 161, Rue du Kiem L-8030 Strassen, Luxembourg; Markovski Solutions, Borovo Distr., bl. 10, 1680 Sofia, Bulgaria
Credit card details/PayPal payment details will be sent to the following recipients by J.P. Morgan Mobility Payments Solutions S.A.: Concardis GmbH, Helfmann-Park 7, 65760 Eschborn, Taunus, Germany (for payment with credit card); PayPal (Europe) S.à.r.l. et Cie, 2224 Boulevard Royal, 2449 Luxemburg, Luxembourg (for payment with PayPal)
The Manage Services function allows the primary user and guest users to activate and deactivate the mobile online services and the vehicle functions available in the vehicle, and to obtain detailed information about current service plans and the duration of the associated contracts.
In addition, individual privacy settings can be entered (if available in the respective vehicle). This allows control of the data that can leave the vehicle. Furthermore, the purchased and enabled “Upgrades” functions and the in-car apps are displayed in the respective personal login area in the web browser. Additionally, the vehicle user receives a notice in the app if the vehicle user does not have a “VW Connect” licence.
Personal data: vehicle identification number (VIN), activation status of services, privacy level (depending on model)
Legal basis: Article 6(1)(b) GDPR (for contract performance or contract initiation); Article 6(1)(f) GDPR for the alert when a “VW Connect” licence is not available (legitimate interests: advertising alert for the customers).
Other data recipients: none
The “Online POI Search” function allows searching for any destination within Europe or North America via the infotainment system. A database with millions of entries and an optimised search engine are available for this purpose. In addition, daily updated information such as opening hours or prices are provided for these destinations.
Personal data: IP address of the vehicle, location of the vehicle, TileID of the region in the vicinity of the vehicle, POI search (category, search text and search area)
Legal basis: For primary and guest users: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service in accordance with the contract)
Other data recipients: HERE Europe B.V., Kennedyplein 222–226, 5611 ZT Eindhoven, Netherlands; Joynext GmbH, Gewerbepark Merbitz Nr. 5, 01156 Dresden, Germany. (These recipients process personal data only on our behalf and in accordance with our instructions.)
If the “Service Scheduling” service has been activated by the primary user, the Volkswagen authorised workshop (or where applicable: a national sales company appointed by the Volkswagen authorised workshop or a call centre) will contact the primary user via their selected communication channel (email or telephone) in the event of any necessary service work (oil changes, inspections and specific driver messages as selected by Volkswagen AG) for the purpose of scheduling an appointment.
Additionally, the status of the service scheduling requests will be transmitted back to the initiating service to identify and rectify product faults. This return transmission enables Volkswagen AG to identify process faults and their related causes early on.
If the authorised workshop specified by the primary user ceases trading or stops operating a Volkswagen authorised workshop as part of its business activities and the primary user has not yet selected any other Volkswagen authorised workshop, the national sales company with responsibility for the respective country will contact the primary user if any service work becomes necessary to offer an appointment with a suitable Volkswagen authorised workshop.
We process the data of their service scheduling request to improve our products and business processes, customer functionality of service scheduling, optimise customer benefit and to eliminate product defects.
We will analyse your previously indicated data for the purpose of product improvement and quality assurance of the service scheduling request and to prevent interruptions or delays in the process sequence of processing requests. For example, we check for faults in the transmission of data to your authorised workshop (such as incomplete data or delays within the data transmission) for early detection and elimination. This allows us to respond to the customer request for a service appointment in the best possible way and improve customer satisfaction with the digital services.
Furthermore, the indicated data is forwarded to the responsible importer for their country for process management and improvement, such as by way of quality audits. The provided data will be erased after five years.
The primary user can deactivate the “Service Scheduling” service and the associated data transfer of servicing requirements at any time in the primary user's personal login area in the web browser or in the settings of the app. Here, the primary user can also select, change or delete the primary user's desired communication channel or preferred Volkswagen authorised workshop.
Personal data: vehicle identification number (VIN), user ID, ID of the request, trigger of the data transfer (e.g. a specific service requirement), mileage (km), make, model, model year, engine code, gearbox code, inspection service interval, oil change service interval, driver messages, time stamp, time of the driver message by the warning lamp, form of address, title, first name/surname, desired communication channel (telephone/email); for data processing in the context of the analysis: Vehicle identification number, service requirement category, date the service appointment request was sent, the selected authorised workshop, agreed service appointment. In addition, the respective authorised workshop transmits the following data to us: vehicle identification number, time of lead initiation, time of contact initiation and time of lead closing.
Legal basis: for the primary user: Article 6(1)(b) GDPR (for contract performance) and, where applicable, Article 6(1)(f) GDPR (for the return transmission of the service scheduling request status for the identification, analysis and elimination of product faults / flaws as well as for the transmission of data to the responsible sales company, if the selected authorised workshop has ceased trading or stops operating a Volkswagen authorised workshop as part of its business activities; see above); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service in accordance with the contract); when data is processed in the context of analysis: Article 6(1)(f) GDPR (legitimate interests: improvement of business processes, functionality of service scheduling; optimisation of customer benefit; elimination of product defects; process control and improvement in trade; increase customer satisfaction with the services)
Other data recipients: we will transmit the servicing requirements to the primary user's selected Volkswagen authorised workshop or to a national sales company with responsibility for the respective country and, where applicable, to a call centre appointed by the Volkswagen authorised workshop or a national sales company appointed by the Volkswagen authorised workshop (in the event of being appointed by the Volkswagen authorised workshop, the respective call centre or respective national sales company will process the data on behalf of and in accordance with the instructions of the Volkswagen authorised workshop only); in the context of analysis, the data will be sent to CARIAD SE, Berliner Ring 2 Brieffach 1080/2, 38440 Wolfsburg, Germany (CARIAD SE will process the data on our behalf and in accordance with our instructions only).
If the primary user has chosen a preferred authorised workshop located in Germany, Great Britain, Italy, France, Japan, Ireland, the Czech Republic, Spain (and the Canary Islands), Belgium, Switzerland, Sweden, Poland, Hungary, Ukraine, Serbia, Denmark, Finland, Estonia, Latvia, Lithuania, Slovenia, Romania, Bulgaria, Slovakia, Greece, Portugal, Norway, Luxembourg, Austria, Netherlands, Montenegro, Bosnia and Herzegovina, Croatia, Albania, North Macedonia, Malta, Cyprus or Iceland, Volkswagen AG will use the following processors: Volkswagen Software Asset Management (SAM) GmbH (Berliner Ring 2, 38440 Wolfsburg, Germany) and Salesforce.com Germany GmbH, Erika-Mann-Straße 31, 80636 München, Germany. Access to personal data by Salesforce or subsidiaries based in a state outside of the EU/EEA cannot be excluded, so that Volkswagen AG has concluded the relevant EU standard contractual clauses (a set of contractual clauses approved by the European Commission that accords the same protection to personal data that it has in the EU during data processing in non-EU countries). You can view the applied EU standard contractual clauses via the following link: https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32021D0914.
The function notifies the primary user of the app when certain remote services are unusable due to an excessively low 12 V battery charge. In addition, the function offers the primary user the option of activating high-voltage battery support for the vehicle. Activation would allow remote services to operate with the support of the high-voltage battery.
Personal data: vehicle identification number (VIN), IP address, 12V battery status, activity status of the vehicle
Legal basis: Article 6(1)(b) GDPR (for contract performance), for additional vehicle users without contract for mobile online services: Article 6(1)(f) GDPR (legitimate interest)
Other data recipients: none
Battery Care Mode is a function for optimisation of the ageing behaviour of the high-voltage battery by setting the upper charging limit. The primary user can switch the function on and off via the app. The setting option via the app is only available if the primary user was the last person logged into the vehicle.
Personal data: vehicle identification number (VIN)
Legal basis: Article 6(1)(b) GDPR
Other data recipients: none
The vehicle user can display the installed vehicle software version via the “ID. Software” tile in the infotainment system of the vehicle, as well as via the MyVolkswagen smartphone app, the fleet customer portal or via customer support. This information changes continuously, e.g. in case of workshop updates or over-the-air updates.
Personal data: vehicle identification number (VIN), software version
Legal basis: Article 6(1)(b) GDPR (for contract performance), Article 6(1)(c) GDPR (UN-ECE Reg. 155; performance of a legal obligation)
Other data recipients: none
The “Charging Alerts” service makes recommendations to the primary user via app on the use of the Battery Care Mode based on battery usage and charging behaviour and optimised settings for the configuration of charging processes to preserve the high-voltage battery.
This service is available to the primary user if they were the last user logged into the vehicle. This allows the primary user to receive personalised alerts for the optimisation of the ageing behaviour of the high-voltage battery by using the charging settings.
Personal data: vehicle identification number (VIN), user ID, battery charge status, battery size, battery temperature, charging connector status, time stamp of journey and status of drive system (ignition “off”/“on”) (the volume of processed personal data may be reduced depending on the software version.)
Legal basis: Article 6(1)(b) GDPR for the primary user (for contract performance)
Other data recipients: none
The service starts the Infotainment system proactively for the logged in primary user at the expected time of departure, either based on the settings for the Air Conditioning and Departure Times mobile online services in the Volkswagen app or during the automatic Quick Start of the Infotainment system based on the usual vehicle use.
This service is available to the primary user if they were the last user logged into the vehicle. This provides the primary user with faster access to the contents of the infotainment system after entering the vehicle.
The “Optimised Battery Use” function must be activated in the app for the high-voltage battery support to be able to use the “(Automatic) Quick Start Infotainment system” service.
The data used to teach in routines for the automatic Quick Start Infotainment will be erased after three months.
Personal data: vehicle identification number (VIN), User ID, timestamp of the journey and the status of the vehicle’s drive system (ignition “off”/“on”), departure times, time of Start Infotainment system, time of Cancel Infotainment system, number of operating hours (for observance of the maximum limit of vehicle operating hours) For the automatic service only: forecasted time for the start of a journey, status of routine model, status of consent to the collection of location data, location data (last parking position of the vehicle (exact to the metre))
Legal basis: Article 6(1)(b) GDPR for the primary user (contract performance) For the automatic service: Article 6(1)(a) GDPR for the primary user (consent)
Other data recipients: none
“Lock & Unlock” allows primary users to operate the vehicle’s central locking system even if they are not in the immediate vicinity of the vehicle. To do this, the user can display and change the locking status of the doors and the luggage compartment of the vehicle in the app. For their own security, primary users must define an S-PIN, which must then be entered prior to each lock or unlock operation. Before this function can be used, the Volkswagen Ident process must first be performed by the primary user.
We will store the details of all the lock and unlock operations performed using this service, along with the date and time, odometer reading at the time of the operation and the user ID and vehicle identification number, for three (3) years. This data is stored on the basis of our legitimate interest of meeting the obligations to present evidence under the product liability legislation (Article 6(1)(f) GDPR).
Personal data: vehicle identification number (VIN); user ID; information concerning whether electric windows, doors, bonnet and boot lid are open or closed and whether the vehicle is locked or unlocked; date and time of unlocking and locking; mileage (km)
Legal basis: for the primary user: Article 6(1)(b) GDPR (for contract performance); for every other vehicle user: Article 6(1)(f) GDPR (legitimate interests: provision of the in-vehicle service for the primary user in accordance with the contract)
Other data recipients: none
The relevant current legal texts, such as the Privacy Policy, can be viewed under “Legal” in the Infotainment system.
Personal data: vehicle identification number (VIN), IP address, country code and language
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: none
In the event of a fault, the customer can use the vehicle’s “Remote Diagnostics” service to immediately receive further information on the existing problem as well as an action recommendation. The function thereby analyses diagnostic data that was transmitted from the vehicle using a wireless connection first. The customer can start the diagnosis function of the service via the Volkswagen app. The Volkswagen app also displays the results with further information as well as the action recommendations. The customer independently decides on further steps, such as scheduling an appointment at the authorised workshop. The customer can also request the vehicle remote diagnosis from a self-selected contact partner (Customer Interaction Center, Breakdown Service, Service Partner) by phone. This contact partner informs the customer of the result of the vehicle remote diagnosis and agrees further steps with the customer, if necessary. The most recently performed diagnosis is stored for 30 days and can be accessed during this period not only by the customer via the Volkswagen app but also by the customer-selected contact partner, if necessary.
Personal data: vehicle identification number (VIN), User ID of the customer (Volkswagen ID user account); UUID for the User ID of the customer; vehicle diagnostic data (mainly control unit identification data, event memory data)
Legal basis: Article 6(1)(b) GDPR for the primary user (for contract performance)
Other data recipients: Audi AG, Auto-Union-Straße 1, 85057 Ingolstadt, Germany; Lufthansa Industry Solutions AS GmbH, Schützenwall 1, 22844 Norderstedt, Germany; ARC Europe S.A., Avenue des Olympiades 2, 1140 Brüssel, Belgium; TELEPERFORMANCE EUROPE MIDDLE EAST AND AFRICA , Rue Balzac 21-25, 75008 Paris, France; your selected service partner (These recipients process personal data only on our behalf and in accordance with our instructions.)
“Weather” provides users of the “Volkswagen” app with current weather data. It displays the temperature at the location of your vehicle and/or your mobile telephone.
Personal data: vehicle identification number (VIN), vehicle or user location, preferred unit of measurement
Legal basis: Article 6(1)(B) GDPR (for contract performance)
Other data recipients: none
The “Charging Recommendations” feature of the Live Recommendation service recommends a nearby charging station in case of a low remaining range to you. This takes place via a pop-up in the Infotainment display, which also includes an offer of the respective charging station operator (e.g. charging discount, free coffee, etc.) who cooperates with Volkswagen AG. You can save the offer for a later time or navigate it directly to the charging station. In case of the latter, you will be reminded of the offer when you arrive at the destination and can transfer the voucher you may need to your smartphone in the detail view. The “Charging Recommendations” feature can only be used when Volkswagen AG can access the location of the vehicle (geoposition) and process this data. In addition, the pseudonymised vehicle identification number (VIN) is used to allocate offers to your vehicle. The pseudonymisation of the VIN includes the distance of all personal identification features. Indirectly traceable identification features (pseudonyms) are retained. Furthermore, your User ID will be processed to be able to store saved offers for you in the backend.
Volkswagen AG deletes the personal data after three months or in accordance with the legal requirements, e.g., as soon as the purpose for which the data was collected no longer applies and provided that there are no other retention obligations.
Personal data: pseudonymised VIN, User ID, vehicle master data, geoposition, click and usage behaviour, timestamp
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: MongoDB Building 2, Number 1 Ballsbridge Shellbourne Road Ballsbridge, D04 Y3X9 Dublin, Ireland; New Relic Germany GmbH, Neuturmstraße 5, 80331 München, Germany (These recipients will process data on our behalf and in accordance with our instructions only.)
Individual data points along the service utilisation are recorded and processed to continuously monitor the availability of the services for the purposes of a stable service provision and for the identification and rectification of possible irregularities of the service functions. This is only possible if the pseudonymised VIN as identifier is also collected. The User ID is additionally recorded to be able to ensure verifiability and fault analysis in case of customer request related to technical faults. In addition, we will process information on the display of ads as well as the user's interaction with the ad to determine if an ad has appealed to the user and to continue to receive marketing ads from advertising partners on this basis to provide the service.
Volkswagen AG deletes the personal data after three months or in accordance with the legal requirements, e.g., as soon as the purpose for which the data was collected no longer applies and provided that there are no other retention obligations.
Personal data: pseudonymised VIN, User ID, vehicle master data, geoposition, click and usage behaviour, timestamp
Legal basis: Article 6(1)(b) GDPR (for contract performance)
Other data recipients: MongoDB Building 2, Number 1 Ballsbridge Shellbourne Road Ballsbridge, D04 Y3X9 Dublin, Ireland; New Relic Germany GmbH, Neuturmstraße 5, 80331 München, Germany (These recipients will process data on our behalf and in accordance with our instructions only.)
On the basis of the data collected to provide the service, various performance analyses are performed as part of monthly reports, which are used by Volkswagen AG for the continuous improvement of the service.
Volkswagen AG deletes the personal data after thirteen months or in accordance with the legal requirements, e.g., as soon as the purpose for which the data was collected no longer applies and provided that there are no other retention obligations.
Personal data: pseudonymised VIN, User ID, vehicle master data, geoposition, click and usage behaviour, timestamp
Legal basis: Article (6)(1)(f) GDPR (Volkswagen AG has a legitimate interest in processing the previously stated personal data to be able to continuously improve the Live Recommendations service.)
Other data recipients: MongoDB Building 2, Number 1 Ballsbridge Shellbourne Road Ballsbridge, D04 Y3X9 Dublin, Ireland; New Relic Germany GmbH, Neuturmstraße 5, 80331 München, Germany (These recipients will process data on our behalf and in accordance with our instructions only.)
Besides, from the legal bases described in Part I the legal bases for processing personal data under Albania law is a consent given by the data subjects. The consent of the data subjects is given either by registering for the mobile online services, after they have confirmed that they have read and accepted the Privacy Policy, or by using the vehicle in knowledge of the data processing.
Data controller representative in Albania:
Porsche Albania Sh.p.k
Autostrada Tirane-Durres
Km. 3, Tirane,1051
dataprotection@porsche.al
We are legally obliged to publish mileages (km) of networked vehicles at regular intervals (usually once every quarter) on request from Car-Pass vzw. The data is retained by Car-Pass vzw in a “Car-Pass” so that relevant information about a vehicle can be provided to potential purchasers when buying and selling used cars.
Personal data processed: Vehicle identification number (VIN), mileage (km), time of data collection in the vehicle
Legal basis: Article (6)(1)(c) GDPR in conjunction with Art. 6 Act of 11 June 2004 and Article 3/1, § 2 Royal Decree of 26 August 2006
Recipients: Car-Pass vzw, Woluwedal 46/2, 1200 BRUSSELS, BELGIUM; D’Ieteren Automotive SA/NV, Leuvensesteenweg 639, 3071 KORTENBERG, BELGIUM; CARIAD SE, Berliner Ring 2, 38440 WOLFSBURG, GERMANY; Audi AG, Auto-Union-Straße 1, 85057 INGOLSTADT, GERMANY (all recipients with the exception of Car-Pass vzw process data solely on our behalf and in accordance with our instructions)
In deviation from the legal bases described in Part I the legal bases for processing personal data under the law of Bosnia and Herzegovina is a consent given by the data subjects. The consent of the data subjects is given either by registering for the mobile online services, after they have confirmed that they have read and accepted the Privacy Policy, or by using the vehicle in knowledge of the data processing.
Data controller representative in Bosnia and Herzegovina:
PORSCHE BOSNA I HERCEGOVINA
Porsche BH d.o.o. Sarajevo
Porsche Inter Auto BH d.o.o. Sarajevo
BIH-71000 SARAJEVO | Bulevar Meše Selimovića 16
zastita.podataka@porschebh.ba
Personal information obtained from residents in Japan (“Personal Data”) shall be handled in accordance with the following rules in addition to the rules set forth in Part I of this Privacy Policy.
1. Purpose: We will handle the Personal Data in accordance with the Purposes set forth in Part I of this Privacy Policy (“Purposes”), and not use Personal Data for any purpose other than such Purposes. We shall promptly notify the relevant data subjects, or disclose to the public of the Purposes (and any subsequent changes thereof), unless the Purposes have already been disclosed to the public;
2. Collection: We will not obtain any Personal Data through any deceptive, fraudulent, or other wrongful means;
3. Accuracy: We will make reasonable efforts to ensure that Personal Data handled by us is accurate and up to date and within the scope necessary to achieve the Purposes;
4. Retention: We will retain Personal Data in accordance with Section A.IV of Part I, and cease retention as soon as it is reasonable to assume that the Purposes are no longer being served by retention of Personal Data;
5. Protection: We will protect Personal Data in its possession or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal, damage, loss or similar risks. We will adequately supervise processing of Personal Data by our officers, employees, third party vendors and any other parties who process Personal Data on our behalf;
6. Transfer: Without obtaining the prior consent of the relevant data subjects, we will not transfer or provide any part of Personal Data to any individual or entity unless an exception under the APPI applies.
7. Extraterritorial Transfer: Without obtaining the prior consent of the relevant data subjects, we will not transfer or provide any part of Personal Data to any individual or entity located outside Japan, European Union or the United Kingdom unless (a) a transferee is located in a country or area certified by the Personal Information Protection Commission of Japan ("PPC") as having data protection standards equivalent to those of Japan or (b) the transferee has data protection standards equivalent to the standards specified by the PPC; and,
8. Data Subject's Right: If a data subject requests pursuant to the APPI disclosure of Purposes, access to, correction, or deletion of any of Personal Data relevant to such data subject, or lodge a complaint, we will respond to such request or complaint promptly and in accordance with the APPI. Any fee charged to data subjects shall be reasonable.
To the extent data processing falls within the scope of the Swiss Federal Act on Data Protection (FADP), (a) the scope of "personal data" shall be determined in accordance with the FADP, and (b) references to the GDPR shall be understood as references to the FADP.
To the extent that the transfer of personal data to recipients outside the EU respectively outside of Switzerland (“third countries”) is safeguarded by the conclusion of standard contractual clauses approved by the European Commission, please note the decision of the Federal Data Protection and Information Commissioner to recognize the EU standard contractual clauses, which is available via the URL https://www.edoeb.admin.ch/edoeb/de/home/datenschutz/arbeit_wirtschaft/datenuebermittlung_ausland.html.
To the extent the data processing falls within the scope of the data protection laws of San Marino, pursuant to Article 13(1)(f) of San Marinese Law n. 171 of 2018, we specify that, considering the data controller’s intention to transfer personal data to third countries or international organisations, the following means by which to obtain a copy of the appropriate or suitable safeguards used or information on where they have been made available are provided:
• You can contact us for exercising your rights, including the right to access your data and to obtain a copy of them, via the contact details provided in Part I (“Data protection officer”).
• The EU standard contractual clauses used can be accessed in EU languages at https://eur-lex.europa.eu/legal-content/it/TXT/?uri=CELEX%3A32021D0914 abrufbar.
To the extent the data processing falls within the scope of the data protection laws of San Marino, pursuant to Article 13(2)(d) of San Marinese Law n. 171 of 2018, we specify that the data subject has the right to report or to lodge a complaint with the Data Protection Authority of San Marino (https://www.garanteprivacy.sm).
In addition to the rights listed in the section “Your rights” you also have the right to define directives concerning the fate of your personal data after your death (post-mortem right).