A. Controller

We are pleased that you are visiting a website of Volkswagen AG, Berliner Ring 2, 38440 Wolfsburg, Germany, registered in the Commercial Register of the Amtsgericht Braunschweig (Braunschweig District Court) under No. HRB 100484 ("Volkswagen AG"). This document explains how we collect, process, and use your data.

B. General Information, Protocol Data

You are in general able to visit the websites of Volkswagen AG without telling us who you are. In this case we will only receive the following protocol data:

1. the operating system and browser that you are using and your screen resolution setting and
2. the date and time of your visit.

Insofar as the following sections do not contain opposing information, the data processing shall be undertaken exclusively by Volkswagen AG.

C. Collection, Processing, and Use of Your Personal Data

I. Use of the Web Form for Information Requests

On this website you can request information about your personal data processed by Volkswagen AG in accordance with Article 15 GDPR via web form. The data provided in this context (surname, forename, date of birth, address and optionally Volkswagen ID or e-mail address, vehicle identification number, beginning and end of ownership as well as corresponding ownership documentation) shall be used by us exclusively for the purposes of providing information, identification and legitimisation subject to your information request (Article 6 paragraph 1 Clause 1 letter c GDPR). For confirmation of your request and e-mail address, Volkswagen AG uses the so-called double opt-in procedure. In this procedure, you will receive an email to the provided e-mail address asking you to confirm. We document the following data in connection with the double opt-in procedure:

• IP address, date and time of sending the web form
• IP address, date and time of confirmation of double opt-in email

You may withdraw your information request vis-à-vis Volkswagen AG, using the e-mail address privacy@volkswagen.de at any time.

When using the web form, an encrypted connection is created between your end device and our server. Our security measures correspond to the state-of-the-art standards and are continuously improved based upon the technological developments.

II. Processed Data

In the following, it is discussed in detail for what purpose the input fields on the web form are required:

Name: Your full name shall be used for the collection of the personal data processed within Volkswagen AG. Moreover, your name shall also be used for the identification of your person and, as required, for the legitimisation of your vehicle ownership(s).

Birthdate: Your birthdate shall be used only for the identification of your person and the collection your personal data processed within Volkswagen AG. Surname, forename and date of birth in combination ensures a correct identification as these information are available on all international identification cards. That is how we make sure that personal data are not forwarded to unauthorised third parties. Thus, we can ensure that no personal data is disclosed to unauthorized third parties.

Address: Your address (with the obligatory data: Street, house number, postal code, city, country) shall be used for the collection of the personal data processed within the Volkswagen AG. Moreover, we shall require your address (with the aforementioned obligatory data) for the identification of your person and, as required, for the legitimisation of your vehicle ownership(s). Additionally your address is needed in order to send you the information report via post.

Volkswagen ID / e-mail Address: If you would like to receive information about the personal data stored in the central Volkswagen ID user account including the linked digital services, we shall require the e-mail address which you provided as an Volkswagen ID. If you should have no central Volkswagen ID user account, you may provide your e-mail address. Your Volkswagen ID and/or e-mail address shall be used for the collection of the data processed within the Volkswagen AG and for the double opt-in procedure and for communication with you, e.g. for queries regarding your request. If you want to provide multiple Volkswagen ID / e-mail addresses, please submit an additional information request.

Vehicle Identification Number: If you would like to likewise receive information regarding your personal data associated with a Vehicle Identification Number (VIN), we shall require that you provide the corresponding vehicle identification numbers and in addition, the timeframe (beginning and end of ownership) for which you are entitled to receive information. In order to verify whether you are entitled to receive information, we shall require that you provide vehicle ownership documentation and/or a consent/permission from the respective vehicle owner (legitimisation). On the corresponding documents which provide proof of the vehicle ownership, any data which are not required should be redacted by you, see Information Sheet on the Redaction of Unrequired Data on Verification Documents.

III. Legitimation in Case of Vehicle Usage by Third Parties

In order to grant you personal data concerning the provided vehicle, which you are not the owner of, the consent/permission of the respective vehicle owner for the time of granting is required.

Therefore, we use the declaration of consent (Article 6 paragraph 1 letter a GDPR, Article 6 paragraph 1 letter c GDPR), which is deposited from the vehicle owner at datenschutz.volkswagen.de to clearly associate the personal data from the vehicle to their corresponding person. In the context of obtaining the consent, the following data from the vehicle owner are collected for the purpose of legitimation or contact establishment due to the processing of your request: name, forename, address of the vehicle owner, vehicle identification number (VIN) as well as a telephone number or an e-mail address optionally.

In order to associate the vehicle to the associated owner the following data are collected from the requesting person: name, birthday and the usage duration of the vehicle.

IV. Retention Timeframe for Your Issue

Protocols of the communication with you will be retained by Volkswagen AG for three years including the personal data you transmitted to Volkswagen AG. The documented communication also contains, among other things, the information report which you receive from Volkswagen AG. The processing is based on a balance of interests in accordance with Article 6 paragraph 1 letter f GDPR. Volkswagen AG represents the following interests: During the retention period, the documentation of your issue will enable the Volkswagen AG to review queries and complaints which you submit and will also enable the Volkswagen AG to process your issue quicker. If you already passed the identification and legitimisation process the results can thus be re-used for exercising additional rights, avoiding you to have to repeat your identification and legitimisation.

V. Digital Data Delivery

In order to make the information report or the copy of the data available to you electronically, you have the option of using our download portal provided on this website. Access is granted by entering your request ID and a one-time password, which we will send to you by post. If you wish to log in a second time, you must request a new one-time password for security reasons. The data will be available for download for 30 days and then automatically deleted.

VI. Using your Volkswagen ID

For a number of functions on the website, you have the option of using a Volkswagen ID user account provided by Volkswagen AG, Berliner Ring 2, 38440 Wolfsburg, Germany, entered in the register of companies of the Braunschweig district court under the number HRB 100484 (“Volkswagen AG”). You can use the Volkswagen ID to log into numerous services (e.g. websites or applications) of Volkswagen AG or third parties. The Volkswagen ID acts as a central user account where you can centrally manage your data. The data processing activities required for this will be carried out within the context of fulfilling the contract (see Article 6 paragraph 1 letter b GDPR). Your email address and a password chosen by you personally are required for registration. Please take note of the comprehensive Privacy Policy that applies to the Volkswagen ID. This can be found under https://vwid.vwgroup.io/data-privacy.

If information from your Volkswagen ID user account is required for the use of an individual function on the website, we will advise you as to which information in your Volkswagen ID you must approve for the relevant function or service the first time you log into the website. This authorisation will be cancelled automatically after three years.

VII. Use of Data Processing Companies

In order to fulfil legal obligations as well as to make use of our own justified interests we engage data processing companies. Your data provided is just processed within European Economic Area (EEA).

The following data processing companies are engaged to work on your request:

• Volkswagen Group Services GmbH
• Salesforce.com EMEA Limited

The following data processor is used for identification service:

• Deutsche Post AG

For the support of our IT system the following data processors are used:

• Reply AG
• COMbridge IT Consulting GmbH
• NTT DATA Deutschland GmbH

VIII. Processing of Additional Data during the Identification Process via the POSTIDENT Procedure

Insofar as we cannot clearly identify you in the Volkswagen AG’s systems, additional identification measures shall be required in order to ensure that no personal data are disclosed to unauthorised third parties. For this, Volkswagen AG shall use the POSTIDENT procedure of the Deutsche Post AG, which enables you to make identification via video-chat or at a post office branch within 4 weeks after our notification. After completing the procedure, the Deutsche Post AG will send us your identification data, which we shall use exclusively for verifying your identity. After successful identification has been made, we shall erase your personal data that have been processed during the POSTIDENT procedure. Information on how our identity provider, Deutsche Post AG, processes personal data is accessible on: https://www.deutschepost.de/en/p/postident/postident-datenschutzhinweise.html

D. Use of the Data-Breach-Hotline

You can use the Data-Breach-Hotline to report indications of possible personal data breaches by Volkswagen AG. We process the data which you provide to us by telephone or electronically when you contact us to report possible personal data breaches. This includes the following data in particular:

• your name,
• your address (business or private),
• other contact details, in particular telephone numbers and email addresses,
• any relevant data about your client or employer,
• possibly the customer or supplier number and other identification features,
• other data you have given us in connection with the personal data breaches.

When you report breaches we also process certain other data that we need in order to meet our obligations related to the reporting of personal data breaches, or which you provide to us in this context. In particular, this data includes:

• data from (postal and electronic) correspondence between you and us,
• data from other electronic communication (e.g. input screens) or telephone communication,
• personal data relating to you or your client that we have saved from data already available at Volkswagen AG.

We only process this data to the extent that processing is necessary for compliance with a legal obligation to which the controller is subject; processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, or to pursue legitimate interests, or where you have consented to the processing of your personal data.

We only process personal data from publicly accessible sources (e.g. authorities, Internet) to the extent that this is legally permissible, for example because it is necessary in order for us to fulfil our obligations.

I. Purpose

We use the data provided in this context solely for the purpose of processing your claim of a possible personal data breach and for identifying and legitimizing it (Article 6 paragraph 1 Clause 1 GDPR). As the data controller within the meaning of the GDPR, we are subject to extensive obligations for inspection, and notification and communication pursuant to Article 33 and Article 34 GDPR.

II. Disclosure of Data

We will not disclose your personal data to third parties, unless

• you have consented to the transfer of personal data,
• or we are entitled or obliged to transfer data as a result of legal requirements and/or governmental or judicial orders,
• or if transferring the data is necessary in order to fulfil a contract.

In this respect we also point out the following data transfers:

1. Transfer of data to affiliated companies in order to investigate and prevent personal data breaches
Particularly in order to deal with personal data breaches across the Group, we transmit per-sonal data to companies [in Germany and the European Economic Area] that are associated with Volkswagen AG within the meaning of section 15 of the German Stock Corporation Act (AktG).

2. Transfer of data to suppliers and customers
In individual cases we may also transfer your data to suppliers, customers or partners if this is necessary to eliminate or minimise the risk of personal data breaches or if you have given your consent.

3. Transfer of data to authorities
Insofar as we have to transmit your data to the competent authorities in order to fulfil our obligations under Article 33 and Article 34 GDPR or if the competent authorities request this, we will transmit your data accordingly.

III. Retention Timeframe of Your Notification

Volkswagen AG stores communication with you, including your personal data, regarding claims of possible personal data breaches for a maximum of 11 years from finalising the investigation of the possible personal data breach. The processing is based on a balancing of interests according to Article 6 paragraph 1 letter f GDPR. Volkswagen AG has an interest in asserting and defending against legal claims.

IV. Use of a Data Processor

We use data processors to fulfil our legal obligations and to safeguard our own legitimate interests. Your notification will be processed by Volkswagen Group Services GmbH.

E. Use of Cookies

Volkswagen AG uses various cookies on its websites. Cookies are small files containing configuration information that are stored on your end device. There are basically three categories of cookies.

1. So-called Functional Cookies are essential for the functionality of the website. The processing of the Functional Cookies is necessary to enable your visit to the website (cf. Article 6 paragraph 1 letter b GDPR).
   
   
2. The comfort of a website visit is increased by so-called Comfort Cookies, which save your language settings, for example. The legal basis for Comfort Cookies is a legitimate interest (Article 6 paragraph 1 letter f GDPR). The legitimate interest is providing comfort when visiting the website. You can object to data processing at any time with effect for the future. Further information can be found in section F. Your Rights
   
   
3. So-called Tracking Cookies are used to create a pseudonymised user profile. Tracking Cookies are only set if the website visitor has given their consent (Article 6 paragraph 1 letter a GDPR). Consent is given via the so-called cookie banner, which must be actively clicked on. Further information on the tracking tools used and how you can revoke your consent can be found in section F. Your Rights.

For more information about our cookies, please see the Cookie Policy.

F. Your Rights

You may assert your rights below against Volkswagen AG at any time upon a free-of-charge basis. For further information concerning the exercise of your rights, please see section G.

Right of Access by the Data Subject: You shall have the right to receive information from us regarding the processing of your personal data.

Right to Rectification: You shall have the right to demand that we correct your personal data, which are incorrect and/or incomplete.

Right to Erasure: You shall have the right, in the event that the requirements specified in Article 17 GDPR have been met, to demand the erasure of your data. Thus, in accordance with this Article 17, for example, you may demand the erasure of your data insofar as these data are no longer required for the purposes for which they were collected. Furthermore, you may demand the deletion of these data if we process your data based upon the consent, which you have granted, and you then withdraw this consent.

Right to Restriction of Processing: You shall have the right to demand the restriction of the processing of your data if the requirements specified in Article 18 GDPR have been fulfilled. This is, for example, the case if you dispute the correctness of your data. For the duration of the verification of the correctness of the data, you may demand the restriction of the processing.

Right to Object: Insofar as the processing is undertaken based upon an overriding interest or your data are used for the purposes of direct advertising, you shall have the right to object to the processing of your data. An objection shall be permissible (sic!) if the processing either is carried out in the public interest or in the exercising of official authority or owing to a justified interest of Volkswagen AG or of a third party. In the event that you object, we request that you state your reasons to us regarding why you are objecting to the data processing. In addition, you shall have the right to object to the data processing for the purposes of direct advertising. This shall also be valid for profiling insofar as this is undertaken in conjunction with the direct advertising.

Right to Data Portability: Insofar as the data processing is undertaken based upon a consent or a fulfilment of a contractual agreement and this is also undertaken while using an automated processing system, you shall have the right to receive your data in a structured, commonplace and machine-readable format and to transfer these data to another data processing service provider.

Right to Revocation: Insofar as the data processing is undertaken based upon a consent, you shall have the right to withdraw your consent for the data processing, with effectiveness for the future, at any time and upon a free-of-charge basis.

Right to Lodge a Complaint: You shall also have the right to lodge a complaint to a government supervisory authority (e.g. to the State Data Protection Officer for Lower Saxony, Germany) regarding our processing of your data.

G. Your Contact Persons

Contact Person for Exercise of Your Rights

For further information concerning the exercise of your rights, please see datenschutz.volkswagen.de.

Data Protection Officer

Our Data Protection Officer shall support you as your contact person on all data protection-related matters:

Data Protection Officer of Volkswagen AG
Berliner Ring 2, 38440 Wolfsburg, Germany
datenschutz@volkswagen.de


Status: June, 2020