Data Privacy Policy

1. General information on data processing when using the website

When you visit this website, the respective controller processes your data that it collects in the course of using the website or that you provide to it in the process (hereinafter: "your data"). In order to provide the website and services of the controller, your data is shared with processors and other contractors (e.g. from the industries: Logistics, Telecommunications, Receivables Management, Marketing, Printing, Market and Opinion Research). In addition, the data controller exchanges your data in each case with the companies of the Volkswagen Financial Services Group (e.g. companies from the sectors: Banking, Leasing, Insurance, Mobility and Fuel/Service Cards - hereinafter: "VW Financial Services Group"). There is also an exchange with public authorities, publicly accessible sources and, where applicable, with insurers, credit institutions, payment service providers and cooperation partners. The processing and exchange of your data takes place in particular insofar as

• this is necessary for the performance of a contract that you have concluded or for the implementation of pre-contractual measures that take place at your request (Art. 6 para. 1 sentence 1 (b) GDPR). In particular, data processing is necessary to ensure the completeness and accuracy of the data as well as its digitisation and, if necessary, to perform the contract or its initiation;
• this is necessary for the fulfilment of a legal obligation (Art. 6 para. 1 sentence 1 (c) GDPR). In particular, the data processing is necessary for the fulfilment of the legal obligation of the controller in the area of data security;
• this is necessary to protect the legitimate interests of the controller or those of a third party (Art. 6 para. 1 sentence 1 (f) GDPR). In particular, data processing is necessary to ensure the provision and functionality of the website and to be able to provide you with the portals and services, to ensure and optimise informed decisions by the parties involved, also in your interest, and to ensure a permanently high quality and uniformity of customer advice by the person responsible and the VW Financial Services Group. In addition, data processing is necessary to protect the assets of the controller, the VW Financial Services Group or its customers and to fulfil internal group administration and accounting purposes. Furthermore, the data processing is necessary to analyse and evaluate the interests and preferences of the customers and to create general evaluations for internal purposes (e.g. for business monitoring and optimisation of the products);
• this is covered by your voluntarily given consent (Art. 6 para. 1 sentence 1 (a) GDPR).
• this is covered by your voluntarily given consent (Art. 9 para. 2 (a) GDPR) or another legal basis (Art. 9 para. 2 (b) to (j) GDPR), if your data also contains special categories of personal data pursuant to Art. 9 para. 1 GDPR (e.g. health data).
   

2. Third country transfer

The controller may also transfer your data to a country outside the European Economic Area (EEA). This transfer takes place in compliance with the special requirements of Art. 44 - 49 GDPR, whereby the adequate level of protection is guaranteed in particular either by an adequacy decision of the European Commission pursuant to Art. 45 GDPR, concluded EU standard contractual clauses pursuant to Art. 46 para. 2 (c) and (d) GDPR or binding internal data protection regulations pursuant to Art. 47 GDPR. You may access and view the EU standard contractual clauses on the website of the European Commission or ask the controller directly and receive a copy.
 

3. General storage periods

The general duration of the storage of your data depends on a possible conclusion of a contract via the website and on the termination of the contract.

If you have enquired about products/services of the controller but have not initiated a contract, your data will be stored for a maximum of 6 months after the last contact between you and the controller.

Otherwise, the storage period begins at the end of the calendar year of the last event within the scope of this business relationship and the following periods apply:

• If a contract has been initiated but not concluded, your data will be stored for a maximum of 3 years.

• Your personal data relevant to a contract, in particular data relevant under tax law, will be deleted after expiry of the statutory retention periods, at the latest 10 years after termination of the contract. The general storage period of your personal data may exceptionally be up to 30 years, insofar as this is necessary for the assertion, exercise or defence of legal claims.

You will be informed of different storage periods for individual data categories within this data protection information at the end of the respective section. The storage periods may be extended in exceptional cases if further storage is legally permissible (e.g. for the protection of assets or to safeguard and, if necessary, enforce the rights of the data controller) or necessary (e.g. retention period for advertising consent or in the context of tax audits).
 

4. Customer profiles

The controller creates your individual customer profile on the basis of your data and other data relevant to advertising and assigns this to specific customer segments. The controller uses these results for the target group-specific control of the type, content and frequency of advertising measures. In particular, this may result in you receiving or not receiving certain advertising in contrast to other customers. This happens insofar as

• this is necessary to protect the legitimate interests of the controller or those of a third party (Art. 6 para. 1 sentence 1 (f) GDPR). In particular, data processing is necessary to better tailor offers to you based on simple evaluations of usage data and obvious preferences and to avoid unwanted or inappropriate offers (limited evaluations); 
• this is covered by your voluntarily given consent (Art. 6 para. 1 sentence 1 (a) GDPR) (extensive evaluations).
   

5. Individual advertising measures

On this website, the data controller processes your data for direct advertising, both for its own offers and for offers from the VW Financial Services Group, your trading partner and the manufacturer, importer or sales company of your vehicle or from other authorised third parties (e.g. companies from the sectors: Banking, Leasing, Insurance and Mobility), and exchanges your data with the aforementioned recipients for this purpose. In addition, the data controller uses online marketing services to display interest-based advertising content to certain target groups when they use online services. For this purpose, the controller transmits your data (e.g. e-mail address) in encrypted form (hash value) to the online marketing services. These match the hash value of the transmitted data with the hash values of their own user data for identification. This happens in each case insofar as

• this is necessary to protect the legitimate interests of the controller or a third party (Art. 6 para. 1 sentence 1 (f) GDPR). In particular, data processing is necessary in order to be able to send you offers tailored to you in a timely and reliable manner and to display online advertising tailored to you;
• this is covered by your voluntarily given consent (Art. 6 para. 1 sentence 1 (a) GDPR).

An exchange with other recipients only takes place insofar as this is covered by your voluntarily given consent (Art. 6 para. 1 sentence 1 (a) GDPR).
 

6. YouTube

The controller uses components (videos) of YouTube, LLC 901 Cherry Ave., 94066 San Bruno, USA (hereinafter: "YouTube"), a Google LLC company, on the website. In order to send the video to your browser and to play the video, the transmission of your IP address to YouTube is necessary. The processing is carried out insofar as it is necessary to protect the legitimate interests of the controller or those of a third party (Art. 6 para. 1 sentence 1 (f) GDPR). The processing is necessary in particular for the attractive and interesting design of the online offer.

The controller uses the "enhanced privacy mode" option provided by YouTube.

If you call up a page that has an embedded video, a connection is established to the YouTube servers and the content is displayed on the website by informing your browser. According to the information provided by YouTube, in "extended data protection mode", your data, in particular which of the pages of the controller you have visited as well as device-specific information including the IP address, is only transmitted to the YouTube server in the USA when you watch the video. By clicking on the video, you consent to this transmission. If you are logged in to YouTube at the same time, this information will be assigned to your YouTube member account. You can prevent this by logging out of your member account before visiting the website.

For more information on data protection in connection with YouTube, please refer to Google's privacy policy.
 

7. Cookies

The controller uses cookies on the website. These are small files that your browser automatically creates and that are stored on your device when you visit the website. Cookies do not cause any damage to your device and do not contain any viruses, Trojans or other malware.

Information is stored in the cookie that arises in each case in connection with the specific device used. This does not mean, however, that the controller will gain direct knowledge of your identity.

Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or a notice always appears before a new cookie is created. However, the complete deactivation of cookies may have the result that you cannot use all the functions of the website. Cookies are used to statistically record the use of the offer and to make it more user-friendly and effective for you. For example, the controller uses so-called session cookies to recognise that you have already visited individual pages of the website.

The data stored in them (e.g. session ID, time of page view) are automatically deleted at the end of your visit. Some cookies, on the other hand, remain stored on your device until you delete them or the validity period defined for the cookie expires.

Furthermore, the controller uses tracking measures on this website in order to ensure a needs-based design and ongoing optimisation of the website as well as to statistically record its use. In addition, the controller, as well as other companies of the Volkswagen Financial Services Group, e.g. Euro Leasing GmbH, use the data for the optimal playout of advertising content.

The use of cookies takes place insofar as

• this is absolutely necessary for technical reasons or for the functionality or optimisation of the website or the service you have requested (§ 25 para. 2 no. 2 German Telecommunications Telemedia Data Protection Act).
• this is covered by your voluntarily given consent (§ 25 para. 1 German Telecommunications Telemedia Data Protection Act; Art. 6 para. 1 sentence 1 (a) GDPR);
• this is covered by your voluntarily given consent ((§ 25 para. 1 German Telecommunications Telemedia Data Protection Act; Art. 9 para. 2 (a) GDPR) if your data also contains special categories of personal data according to Art. 9 para. 1 GDPR (e.g. health data).

You can revoke your consent once given at any time with effect for the future, either via the Cookie Consent Tool and/or via the link to the third-party provider listed at the end of each individual analysis cookie. In both cases, an opt-out cookie will be set that prevents the future collection of your data when visiting this website. If you revoke the processing of your data via the Cookie Consent Tool, this will only apply in this browser and only for the website of the controller and will be stored on your device.
 

a. Adobe Analytics

The controller uses Adobe Analytics on the website, a web analytics service provided by Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland (hereinafter: "Adobe"). In this context, pseudonymised usage profiles are created and cookies are used.

The information generated by the cookie about your use of our website will be transmitted to and stored by Adobe on servers in the United Kingdom. This information may also be transferred to third parties if this is required by law or if third parties process this data on our behalf. Under no circumstances will your IP address be merged with other Adobe data. The IP addresses are anonymised so that an allocation is not possible (IP masking).

If you log in to the website with access data, the controller combines the information collected via Adobe Analytics about your use of our website with other data relating to you that the controller has stored in its customer systems in order to be able to serve you optimised advertising content tailored to your needs, which is also in the legitimate interests of the controller.

You can allow the collection of the data generated by the cookie and related to your use of the website (incl. your IP address) as well as the processing of this data by Adobe by consenting to the collection by Adobe Analytics (opt-in cookie). You can revoke your consent once given at any time under the following link: https://www.adobe.com/de/privacy/opt-out.html

Further information on data protection in connection with Adobe Analytics can be found here.
 

b. Adobe Target

The controller uses Adobe Target on the website, a web analytics service provided by Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland (hereinafter: "Adobe"). In this context, pseudonymised usage profiles are created and cookies are used to enable tests of our site and to be able to offer you the appropriate content when you visit our website again.

The information generated by the cookie about your use of our website will be transmitted to and stored by Adobe on servers in London, England. This information may also be transferred to third parties if this is required by law or if third parties process this data on our behalf. Under no circumstances will your IP address be merged with other Adobe data.

You can allow the collection of data generated by the cookie and related to your use of the website by consenting to the collection by Adobe Target. Once you have given your consent, you can revoke it at any time using the following link: https://www.adobe.com/de/privacy/opt-out.html

Further information on data protection in connection with Adobe Target can be found here.
 

c. Google Ads Remarketing

The controller uses Google Ads Remarketing by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter "Google") on the website to serve advertisements.

With the remarketing function, the controller can present individualised advertisements to the users of the website on other websites within the Google advertising network (e.g. "Google Search" or YouTube). For this purpose, the interaction of the users on our website is analysed, e.g. which offers the user was interested in, in order to be able to display targeted advertising to the users on other sites even after they have visited our website.

For this purpose, Google stores the cookie on your device. Your IP address may be transmitted to Google. The processing of your personal data (IP address) associated with the use of Google Remarketing as well as the analysis and documentation of your usage behaviour is carried out for the purpose of gaining additional information about the visitors to our website in order to enable an individualised advertising approach, also on third-party websites.

According to Google, all data used for tracking (in particular cookies) are deleted after 540 days at the latest.

You can allow the collection of data generated by the cookie and related to your use of the website (including your IP address) as well as the processing of this data by Google by consenting to the collection by Google Ads Remarketing (opt-in cookie). You can revoke your consent once given in various ways:

• By adjusting your browser software accordingly.
• By deactivating cookies or device recognition in Google's advertising settings at the following link: http://www.google.com/settings/ads).
• By installing the plug-in provided by Google at the following link: https://www.google.com/settings/ads/plugin.
• By accessing the Network Advertising Initiative deactivation page (https://optout.networkadvertising.org/?c=1) or managing the use of device identifiers via the device settings.

Please note that you may have to repeat the above steps after deleting an opt-out cookie on your terminal device.

Additional data processing will only take place if you have consented to Google linking your web and app browsing history to your Google account and using information from your Google account to personalise ads. In this case, if you are logged into Google while visiting the website, Google will use your data to create and define target group lists for cross-device remarketing.

Our website also uses Google’s Enhanced Conversions Tracking as part of Google Advertising. This feature enables improved attribution of conversions (e.g. product purchases) to ad clicks on the Google network. Certain personal data that you provide to us as part of an application process (e.g. your email address) is processed locally and transmitted to Google in a hashed form (using SHA256 encryption). Google can match this hashed data with its own user information to better understand your interaction with our ads and measure conversions more accurately. For more information on how Enhanced Conversions work, please visit: https://support.google.com/google-ads/answer/9888656.

Further information on data processing by Google can be found here.
 

d.    Google Marketing Platform Services

On the website, the controller uses various analysis, marketing and remarketing services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter: "Google") or its subsidiaries on the basis of your consent (Art. 6 para. 1 sentence 1 (a) GDPR), which collect and process the data described in more detail in the sections on the individual services (e.g. online identifiers such as cookie IDs) by means of cookies. The collection and evaluation is carried out exclusively on a pseudonymous basis, so that a direct conclusion to your identity is generally not possible.

Please note that the data may be transferred to the USA, Taiwan, Singapore, Chile and other countries that do not currently offer an adequate level of data protection, and in particular there is a risk that the data may be processed by US authorities for control and monitoring purposes without you possibly having any legal remedy.

Insofar as the following services use cookies, the following applies: Session cookies are generally stored for 30 minutes (session time). Cookies for measuring conversion rates are generally stored for 90 days. Cookies for personalised advertising (if users have activated personalised ads in their Google account) are generally stored for 13 months in the European Economic Area (EEA), Switzerland and the United Kingdom (UK), and for 24 months in all other countries.

In addition to revoking your consent in the cookie settings, you can prevent the collection and transmission of data relating to the use of this website to Google and the processing of this data by Google by following the instructions available at the bottom of the following link, which provides information on how to deactivate data collection by Google on your computer or your mobile device: https://support.google.com/ads/answer/7395996.

General information on data processing by Google can be found here: https://policies.google.com/privacy?hl=de and https://support.google.com/google-ads/answer/9028179

Supplementary descriptions of the listed services can be found at: https://support.google.com/displayvideo/answer/9015629.
 

i. Google Campaign Manager

For analytics or marketing/advertising purposes, the Controller uses the Google Campaign Manager tool, a web-based ad management system for advertisers and agencies, from Google Ireland Ltd, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (hereinafter: "Google Ireland") to present you with relevant personalised and non-personalised ads, to optimise campaign performance or to ensure that a user does not see the same ads more than once.

With the help of cookies placed in the browser, the service collects the following pseudonymous data for the aforementioned purposes: Online Identifiers, Cookie ID, Geographic Location, IP Address, Device Identifier and Customer ID. 

 

ii. Google Search Ads 360

On the website, the controller uses the "Search Ads 360" service from Google Ireland, which assists in the creation, management and optimisation of cross-search engine campaigns. The use of Google 360 Search Ads enables Google and its partner sites to serve personalised and non-personalised ads.

With the help of cookies placed in the browser, the service collects the following pseudonymous data for the aforementioned purposes: Online identifiers, cookie ID, IP address, device identifier and customer ID.

 

 iii.  Google Display & Video 360

On the website, the controller also uses the Display & Video 360 tool from Google Ireland, which collects data for analysis, marketing and optimisation purposes and thereby helps the controller to improve both marketing measures and the website. The data collected is used by Display & Video 360 to link advertising contacts and clicks on advertisements with a resulting use of our website. In this way, the controller can determine whether Internet users who have seen our ads visit our website or which products they are interested in. The data collected may also be used by the controller to deliver advertisements based on your interests (e.g. products viewed) and to prevent you from seeing the same ads more than once.

With the help of cookies placed in the browser, the service collects the following pseudonymous data for the aforementioned purposes: Online Identifiers, Cookie ID, Geographic Location, IP Address, Device Identifier and Customer ID.

 

iv.  Google Analytics

With the help of the Google Analytics tool from the provider Google Ireland, the controller collects analytical and statistical data on the use of the website and on visitor action evaluations (e.g. conversion tracking) in order to optimise the design and content of the website and marketing activities on this basis. 

Using cookies, the service collects the following pseudonymous data: Online identifiers, cookie ID, geographical location, IP address, device identifier and customer ID, browser type/version, operating system used, referrer URL (the previously visited page), time of server request, visit actions (clicks on website).
 

e. Facebook Custom Audience via Pixel

The controller uses Facebook Custom Audiences of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (hereinafter: "Meta") on the website. This is a marketing service provided by Meta. It enables us to display individually tailored and interest-based advertising on Facebook to certain groups of pseudonymised visitors to our website who also use Facebook.

A Facebook Custom Audience pixel tag is integrated on the website. This is a Java script code that stores personal data about the use of the website. This includes your IP address, the browser used and the source and target pages. This information is transferred to Meta servers in the USA. It is automatically checked whether you have saved a Facebook cookie. The Facebook cookie is used to automatically determine whether you belong to the target group relevant to the person responsible. If you belong to the target group, you will be shown corresponding ads on Facebook by the controller. During this process, you will not be personally identified either by the VW Financial Services Group or by Facebook through the matching of data.

You can consent to the use of the Facebook Custom Audiences service. You can revoke your consent once given on the Facebook website. After logging in to your Facebook account, you will be taken to the Facebook Ads settings.

For more information about Facebook privacy, please see Facebook's privacy policy."
 

f. LinkedIn Insight Tag

The controller uses the so-called Insight Tag of LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA (hereinafter: "LinkedIn"), integrated on the website. This enables the controller to track conversions, retarget website visitors and gain additional information about LinkedIn members who view the controller's advertisements.

The LinkedIn Insight tag, a small JavaScript code snippet, in turn places a cookie in your web browser or uses a pixel, allowing us to collect data about visits to our website, including URL, referrer URL, IP address, device and browser properties, timestamp and page views. This data is encrypted, anonymised within seven days and the anonymised data is deleted within 90 days. LinkedIn does not share any personal data with us but only provides aggregate reports on website audience and ad performance.

You can consent to the use of the LinkedIn Insight Tag. You can revoke your consent once given at any time using the following link: https://www.linkedin.com/mypreferences/g/guest-retargeting-opt-out

If you are a LinkedIn member, click on the field "Reject on LinkedIn". Other visitors click on "Decline".

For more information on LinkedIn privacy, please see the LinkedIn Insight Tag Privacy Policy." 
 

g. Smart Signals

The controller uses Smart Signals, a web analysis service of Smart Digital GmbH, Weilimdorfer Str. 74/1, 70839 Gerlingen, Germany (hereinafter: "Smart Digital") on the website. In this context, pseudonymised usage profiles are created and cookies are used.

The information generated by the cookie about your use of the website is transmitted to a Smart Signals server and stored there. This information may also be transferred to third parties if this is required by law or if third parties process this data on your behalf. Your IP address is not recorded here, but you are assigned a user ID that is independent of the IP address and helps to display personalised information to you.

You can allow the collection of data generated by the cookies and related to your use of the website as well as the processing of this data by Smart Signals by consenting to the collection by Smart Signals (opt-in cookie).

According to Smart Signals, all data used for tracking (especially cookies) are deleted after two years at the latest.

Further information on data protection in connection with Smart Signals can be found here: https://www.smart-digital.de/datenschutz/.

h. NetSlave

In the context of certain sales campaigns, the controller uses the web analytics service of NetSlave GmbH, Simon-Dach-Str. 12, 10245 Berlin (hereinafter: "NetSlave") on the website, which helps it to fulfil the controller’s own obligations vis-à-vis NetSlave arising from certain marketing measures (e.g. remuneration obligations).

Pseudonymous cookies with information (such as transaction ID (order number), turnover, remuneration product) are used for data collection. No unique user-related data such as name or address is stored. All cookies used by the controller only enable the assignment and remuneration of the underlying transaction to a partner company referring to the controller.

You can allow the collection of data generated by the cookie and related to your use of the website by consenting to the collection of a data by NetSlave. You can revoke your consent once given at any time with effect for the future. In this case, an opt-out cookie will be set, which prevents the future collection of your data when visiting this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. Under the following link you will find an explanation of how you can deactivate the data collection on your computer or mobile device: https://partners.pilot.de/cookie_optout.cgi
 

i. Adform

The controller uses the web analytics service of Adform A/S, Wildersgade 10B, 1408 Copenhagen, Denmark (hereinafter: "Adform") on the website. The online identification number (online IDs) such as cookie IDs, IP address, device IDs, advertising ID / IDFA (e.g. on Android or Apple smartphones) of your end device are collected in order to recognise your end device, the internet browser you use or the app you use when you visit again. No unique user-related data such as name or address is stored. All IDs used by the controller only enable the recognition of your end device, your internet browser or the app used.  On the basis of this data, various statistics are made available to the person responsible by Adform. In this way, the controller can determine whether internet users who have seen our ads subsequently visit the website and which products and content they are interested in there. A connection to the individual online IDs is not established in the statistics.

In addition, the controller can recognise the users of the website when they visit again and, in the event of future advertising contact, adapt the advertisements in the content to your interests (e.g. products and information viewed), as well as recognise through which advertisements or intermediaries the users became aware of the controller. The analysis of the advertising contacts, the viewed content of our website and the targeted delivery of advertisements based on your interests help the controller to show you interest-based advertising.

You can allow Adform to collect data by giving your consent.  You can revoke your consent at any time using the following link: https://site.adform.com/privacy-center/platform-privacy/opt-out/.
 

j. AWIN

As part of certain sales campaigns, the controller uses the web analysis service of the marketing network operator AWIN AG, Eichhornstraße 3, 10785 Berlin (hereinafter referred to as "AWIN") on the website to implement advertising measures in the form of so-called "affiliate marketing" and to enable certain usage actions to be assigned to linked content of a partner company. Volkswagen Bank and AWIN are in some cases joint controllers pursuant to Article 26 GDPR (additional information on this can be found here below under C. III.)

As part of affiliate marketing, the data collected is used by AWIN to link advertising contacts and clicks on adverts placed on pages managed by AWIN with the resulting use of the website. In this way, the controller and AWIN can determine whether internet users who have seen the controller's adverts on the AWIN network visit the controller's website and what products and content they are interested in. This helps the controller to adapt the content of the adverts to the interests of the customers. Pseudonymous online identification numbers (online IDs) such as cookie IDs, IP addresses, device IDs, advertising IDs / IDFA (e.g. on Android or Apple smartphones) are used for data collection. No unique user-related data such as name or address is stored. All IDs used by the controller and AWIN merely enable the recognition of your end device or your Internet browser and thus enable the controller to assign and, if applicable, remunerate the underlying transactions to a partner company referring to the controller.

The processing is based on your consent to the use of the relevant cookies in accordance with Art. 6 para. 1 subpara. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. An opt-out cookie will then be set to prevent the future collection of your data when you visit this website. The opt-out cookie is only valid in this browser and only for this website and is stored on your device. Under the following link you will find an explanation of how you can deactivate data collection on your computer or mobile device: https://www.awin.com/de/rechtliches/cookieoptout

You have the right:

• to request access to and information about your personal data processed by the controller in accordance with Art. 15 GDPR,
  
• demand the rectification of inaccurate or incomplete personal data stored by the controller without delay in accordance with Art. 16 GDPR,
  
• to request the erasure of your personal data stored by the controller in accordance with Art. 17 GDPR, provided that the legal requirements are met;
  
• to request the restriction of the processing of your personal data in accordance with Art. 18 GDPR, provided that the legal requirements are met;
  
• in accordance with Art. 20 GDPR to receive your personal data that you have provided to the controller in a structured, common and machine-readable format or to request the transfer to another controller;
  
•  revoke your consent at any time in accordance with Art. 7 para. 3 GDPR;
  
• complain to a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority of your usual place of residence or our company headquarters.

Right of objection

You have the right to object to the processing of your personal data in accordance with Art. 21 GDPR, insofar as there are grounds for doing so that arise from your particular situation or the objection is directed against general direct marketing or direct marketing tailored to you. In the latter case, you have a general right to object, which we fulfil regardless of your particular situation.

Controller: Volkswagen Financial Services AG:

Postal address of the data controller and the data protection officer:

Volkswagen Financial Services AG

Gifhorner Street 57

38112 Brunswick

Germany

If you wish to exercise your right to object or your data protection rights, simply send an e-mail to betroffenenrechte[at]vwfs.com. Further contact with the data protection officer: dsb[at]vwfs.com

General information on data processing

The data controller processes your data from this business relationship (e.g. from the application and contract pro-cessing) (hereinafter: "your data"). Your data will be processed for the purpose of checking the application, creating the transaction, processing the contract, customer advice and evaluation. Your data will be shared with processors and other contractors (e.g. from the industries: Logistics, telecommunications, receivables management, marketing, printing). In addition, the controller exchanges your data with the companies of the Volkswagen Financial Services Group (e.g. companies from the sectors: Bank, leasing, insurance, mobility and fuel/service cards - hereinafter re-ferred to as: "VW Financial Services Group"); there is a joint responsibility for this processing in some cases (more information on this can be found at www.vwfs.de/datenschutzinformationen). There is also an exchange with public authorities, publicly accessible sources and, if applicable, with insurers, credit institutions, payment service providers and cooperation partners. The processing and exchange of your data for the above-mentioned purposes takes place in particular insofar as

• this is necessary for the fulfillment of a contract that you have concluded or for the implementation of pre-contractual measures (Art. 6 (1) (b) General Data Protection Regulation, GDPR). In particular, data processing is necessary to ensure the completeness and accuracy of the data and its digitization and to perform your contract (e.g. that you have concluded with the customer).;
• this is necessary for the fulfilment of a legal obligation (Art. 6 (1) (c) GDPR). In particular, data processing is necessary to ensure the completeness and accuracy of tax data in accordance with the German Fiscal Code (Abgabenordnung), the German Industrial Code (Gewerbeordnung) and the German Commercial Code (Han-delsgesetzbuch). In addition, data processing is necessary for securing economic transactions or capital mar-kets (e.g. according to the German Banking Act);
• this is necessary to protect the legitimate interests of the controller or a third party (Art. 6 (1) (f) GDPR). In par-ticular, data processing is necessary in order to ensure and optimize informed decisions by the parties in-volved, also in your interest or in the interest of the customer, and in order to guarantee you or the customer a permanently high quality and uniformity of customer advice by the controller and the VW Financial Services Group within the scope of this business relationship. In addition, the data processing is necessary to protect the assets of the controller, the VW Financial Services Group or its customers and to fulfill internal group ad-ministration and accounting purposes. Furthermore, data processing is necessary to analyze and evaluate your interests and preferences or those of the customer and to generate general evaluations for internal purposes (e.g. for business monitoring and product optimization);
• this is covered by your voluntarily given consent (Art. 6 (1) (a) GDPR);
• this is covered by your voluntarily given consent (Art. 9 (2) (a) GDPR) or another legal basis (Art. 9 (2) (b) to (j) GDPR), if your data also contains special categories of personal data pursuant to Art. 9 (1) GDPR (e.g. health data).

Third country transfer

The controller may also transfer your data to a country outside the European Economic Area (EEA). This transfer is carried out in compliance with the special requirements of Arts. 44 - 49 GDPR, whereby the appropriate level of pro-tection is guaranteed in particular either by an adequacy decision of the European Commission pursuant to Art. 45 GDPR, concluded EU standard contractual clauses pursuant to Art. 46 (2) (c) and (d) GDPR or binding corporate rules pursuant to Art. 47 GDPR. You can access and view the EU standard contractual clauses on the website of the European Commission or ask the controller directly and receive a copy. 

General retention periods

The storage period begins at the end of the calendar year of the last event within the scope of this business relation-ship:

• If a contract has been initiated but not concluded, your data will be stored for a maximum of 3 years.
• If a contract has been concluded, your data, in particular data relevant to tax law, will be stored until expiry of the statutory retention periods, at the longest for 10 years after termination of the contract. The general storage pe-riod of your data may exceptionally be up to 30 years, insofar as this is necessary for the assertion, exercise or defence of legal claims.

We will inform you of different retention periods for individual data processing within this data protection information at the end of the respective section. The storage periods may be extended in exceptional cases if further storage is legally permissible (e.g. to protect assets or to safeguard and, if necessary, enforce our rights) or necessary (e.g. retention period for advertising consent or in the context of tax audits).

Data exchange with the trading partner

The controller exchanges your data with your trading partner (e.g. delivering or servicing car dealership or work-shop) insofar as

• this is necessary for the fulfillment of a contract that you have concluded or for the implementation of pre-contractual measures (Art. 6 (1) (b) GDPR). In particular, data processing is necessary in order to fulfill the per-formance obligations arising from your contract (e.g., which you have concluded with the customer)
• this is necessary to protect the legitimate interests of the controller or a third party (Art. 6 (1) (f) GDPR). In par-ticular, data processing is necessary to ensure and optimize informed decisions of the parties involved, also in your interest or in the interest of the customer, and to ensure a permanently high quality and consistency of cus-tomer service by the controller and the respective trading partner. In addition, the exchange of data with the re-spective partner may be necessary in order to provide the partner with premiums for the brokerage activity and to correctly determine the amount of the premiums, as well as to provide you or the customer with optimal advice and support in the event of contract disruptions;
• this is covered by your voluntarily given consent (Art. 6 (1) (a) GDPR);
• this is covered by your voluntarily given consent (Art. 9 (2) GDPR) or another legal basis (Art. 9 (2) (b) to (j) GDPR), if your data also contains special categories of personal data pursuant to Art. 9 (1) GDPR (e.g. health data).

Data exchange within the Volkswagen Group

The controller exchanges your data with the manufacturer, the importer or the sales company of your vehicle within the Volkswagen Group, insofar as

• this is necessary for the fulfillment of a contract that you have concluded or for the implementation of pre-contractual measures (Art. 6 (1) (b) GDPR). In particular, data processing is necessary in order to fulfill the per-formance obligations arising from your contract (e.g. that you have concluded with the customer);
• this is necessary to protect the legitimate interests of the controller or a third party (Art. 6 (1) (f) GDPR). In par-ticular, data processing is necessary in order to fulfil the Volkswagen Group’s internal administrative and ac-counting purposes, if necessary also vis-à-vis the trading partner, as well as to optimise the products and pro-cesses and to be able to respond to your interests or the interests of the customer. Furthermore, data pro-cessing is necessary to ensure and optimize informed decisions of the parties involved, also in your interest or in the interest of the customer, as well as to protect assets of the controller, the manufacturer, the importer or the sales company of your vehicle or their customers.
• this is covered by your voluntarily given consent (Art. 6 (1) (a) GDPR);
• this is covered by your voluntarily given consent (Art. 9 (2) (a) GDPR) or another legal basis (Art. 9 (2) (b) to (j) GDPR), if your data also contains special categories of personal data pursuant to Art. 9 (1) GDPR (e.g. health data).

Customer Profiles

The controller creates your individual customer profile based on your data and other advertising-related data (e.g. usage data, data on your preferences) and assigns it to specific customer segments. The controller uses these results for target group-specific control of the type, content and frequency of advertising measures. In particular, this may result in you receiving or not receiving certain advertisements, unlike other customers. This happens as far as

• this is necessary to protect the legitimate interests of the controller or a third party (Art. 6 (1) (f) GDPR). The data processing is necessary in particular in order to be able to better tailor offers to you or the customer on the basis of simple evaluations of usage data and obvious preferences and to avoid unwanted or unsuitable offers (limited evaluations);
• this is covered by your voluntarily given consent (Art. 6 (1) (a) GDPR) (comprehensive evaluations).

Individual advertising campaigns

The controller processes your data for direct marketing, both for its own offers and for offers from the Volkswagen Financial Services Group, your trading partner and the manufacturer, importer or sales company of your vehicle or from other authorised third parties (e.g. companies from the sectors: banking, leasing, insurance and mobility), and exchanges your data with the above-named recipients for this purpose. In addition, the controller uses online market-ing services to display interest-based advertising content to certain target groups when they use online services. For this purpose, the controller transfers your data (e.g. email address) in encrypted form (hash value) to the online mar-keting services. These services match the hash value of the transferred data with the hash values of their own user data for identification purposes. This happens in each case insofar as

• this is necessary to protect the legitimate interests of the controller or a third party (Art. 6 (1) (f) GDPR). The data processing is necessary in particular in order to provide you or the customer with customised offers in a timely and reliable manner and to display online advertising tailored to you;
• this is covered by your voluntarily given consent (Art. 6 (1) (a) GDPR).

An exchange with other recipients only takes place insofar as this is covered by your voluntarily given consent (Art. 6 (1) (a) GDPR).

Test data management

The controller and the VW Financial Services Group process your data as part of the maintenance and implementa-tion of IT systems and services, insofar as this is necessary to protect the legitimate interests of the controller or a third party and the data subjects (Art. 6 (1) (f) GDPR). In particular, data processing is necessary to ensure the securi-ty, operability and reliability of new and existing IT systems and services and to protect against disruptions and un-lawful interference that could impair the availability, authenticity, completeness or confidentiality of data. The pro-cessing of this data is also necessary to ensure a permanently high quality and uniformity of the products/services offered and to optimise them continuously

The following retention period applies in addition to the "General retention periods": A copy of the data required for the tests is made. This copy is stored for a maximum of 1 year.

You have the right: 

• to access information about your personal data processed by the controller in accordance with Art. 15 GDPR;
• to demand the rectification of inaccurate or incomplete personal data stored by the controller without delay in accordance with Art. 16 GDPR
• to request the erasure of your personal data stored by the controller in accordance with Art. 17  GDPR, provided that the legal requirements are met
• to demand the restriction of the processing of your personal data in accordance with Art. 18  GDPR, provided that the legal requirements are met;
• in accordance with Art. 20 GDPR to receive your personal data that you have provided to the controller in a structured, common and machine-readable format or to request the transfer to another controller;
• to withdraw your consent at any time in accordance with Art. 7 (3) GDPR;
• to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR. As a rule, you may contact the supervisory authority of your usual place of residence or our company headquarters.

Right to object

You have the right to object to the processing of your personal data on grounds relating to your particular situa-tion (Art. 21 (1) GDPR). Furthermore, you have the right to object without justification to direct marketing and related advertising profiling (Art. 21 (2) GDPR).

Controller Volkswagen Versicherung AG: 

Postal address of the data controller and the data protection officer:

Volkswagen Versicherung AG

Gifhorner Straße 57

38112 Braunschweig

If you wish to exercise your right to object or your data protection rights, simply send an e-mail to betroffenenrech-te.vw-versicherung-ag[at]vwfs.com. Further contact with the data protection officer: dsb.vw-versicherung-ag[at]vwfs.com.

Controller Volkswagen Insurance Brokers GmbH: 

Postal address of the data controller and the data protection officer:

Volkswagen Insurance Brokers GmbH

Gifhorner Straße 57

38112 Braunschweig

If you wish to exercise your right to object or your data protection rights, simply send an e-mail to betroffenenrech-te.VIB[at]vwfs.com. Further contact with the data protection officer: dsb.VIB[at]vwfs.com.

Controller Vehicle Trading International (VTI) GmbH:

Postal address of the data controller and the data protection officer:

Vehicle Trading International (VTI) GmbH

Gifhorner Straße 57

38112 Braunschweig

If you wish to exercise your right to object or your data protection rights, simply send an e-mail to betroffenenrech-te.GWC[at]vwfs.com. Further contact with the data protection officer: dsb.GWC[at]vwfs.com.