Volkswagen ID Privacy Policy

This Privacy Policy contains important information about your rights in connection with processing your personal data, as well as the legal bases on which the personal data that we collect as part of your use of Volkswagen ID or that you provide to us are processed. We do not intend to collect data from children.

Please note that - as a German company - we are bound by German law, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR"), even though we process personal data belonging to individuals who are permanently resident outside Germany. The information required by German law and the GDPR about the processing of your personal data can be found in Part I of this Privacy Policy. In addition, we may be bound to a certain extent by the national laws of other countries. If you are a permanent resident of a country listed in Part II of this Privacy Policy, you will find additional information there.

A. Data controller

We are pleased that you are using the Volkswagen ID user account ("Volkswagen ID"). The responsible office for the Volkswagen ID is Volkswagen AG, Berliner Ring 2, 38440 Wolfsburg, Germany, vw@volkswagen.de entered in the register of companies at Braunschweig District Court under no. HRB 100484 ("Volkswagen AG" or "we", "us" or "our").

We inform you below about the collection, processing and use of your personal data when using the Volkswagen ID.

B. Processing your personal data

I. Processing log data on the website

If you merely visit the Volkswagen ID user account without registering or logging in, we will process the following log data from you:

Your IP address
Your operating system
Your web browser and the screen resolution you are using
Date and time of your visit

Volkswagen AG processes this data based on legitimate interest (Article 6(1)(f) GDPR) of Volkswagen AG in being able to display the website to you properly. The log data is stored for a period of one month and then deleted.

II. Cookies

Volkswagen AG uses various cookies on its websites. Cookies are small files containing configuration information which are stored on your device. Cookies can essentially be divided into three categories. There are cookies that are essential for the website’s functionality (“functional cookies”), cookies that make it more convenient to visit the website (“convenience cookies”) and cookies used to create a pseudonymised user profile (“tracking cookies”). The use of functional cookies is required to enable you to visit this website. Processing is carried out based on the performance of the contract (provision of the "Volkswagen ID" service, Article 6(1)(b) GDPR). For more information about our cookies, please see the Cookie Policy.

III. Registration, use and management of the Volkswagen ID

If you register for a Volkswagen ID, you can log in to numerous services, apps and websites of Volkswagen AG and third parties and manage your data at any time in the Volkswagen ID user account. The purposes and nature of processing and the legal basis for it are described in detail below.

1. Registration for a Volkswagen ID

To create a Volkswagen ID, you must register with an email address and password. To determine the legal texts that apply to you, you will also need to choose a preselected country and region based on your IP address. To verify your registration for the Volkswagen ID, we use the “double opt-in” procedure. This means that we will send an email to the email address you have provided with a request for confirmation. Multi-factor authentication (MFA) may be required to increase the security of your user account. In addition to your login data, further proof of identity will be requested for security purposes. Depending on the available method, this can take the form of a one-time code, confirmation via a device or another second factor, for example. Processing is carried out based on the performance of the contract (provision of the "Volkswagen ID" service, Article 6(1)(b) GDPR). In the Volkswagen ID, you can voluntarily provide further personal data in addition to completing the mandatory email address and password fields. Volkswagen AG stores the entered data in the Volkswagen ID user account:

Names
Salutation and title
Date of birth
Address
Phone numbers
Preferred language
Profile picture

If you do not provide this additional information or provide incorrect information, you may not be able to use other digital services in connection with your Volkswagen ID if the information is required for you to be able to use such other digital service. However, your ability to create a Volkswagen ID will not be affected.

This data is stored in the Volkswagen ID based on the performance of the contract (provision of the "Volkswagen ID" service, Article 6(1)(b) GDPR).

2. Using the Volkswagen ID to log in to services, apps and websites

You can use your Volkswagen ID to log in to various services, apps and websites which may be provided by us or third parties. To log in with your Volkswagen ID, you must log in with the email address and password you specified during registration. Multi-factor authentication (MFA) may be required to increase the security of your user account. In addition to your login data, further proof of identity will be requested for security purposes. Depending on the available method, this can take the form of a one-time code, confirmation via a device or another second factor, for example. For some services, you also have the option of logging in with your Volkswagen ID via your device by scanning a code displayed during the login process.

If you use a Volkswagen AG app with a code scanner, you can read the code with your device’s code scanner and therefore also use the login data you have already input in the app to register another device (e.g. vehicle). After scanning, you must confirm that you are also using the login data to register another device (e.g. vehicle). You are automatically logged in to the other device (e.g. vehicle).

If you do not use a Volkswagen AG app with a code scanner, you can scan the code with your device’s camera function and log in via the browser. After logging in, you must confirm that you will also use the login data to log in to another device (e.g. vehicle). You are automatically logged in to the other device (e.g. vehicle).

The first time you log in to a service, app or website you will be prompted to grant the service, app or website permission to access the Volkswagen ID data required to provide the functionality. If you grant access, Volkswagen AG will transfer the data from your Volkswagen ID to the relevant service, app or website provider.

If Volkswagen AG provides services, apps or websites free of charge without you thereby entering into an ongoing commitment, access by the service, app or website to personal data in your Volkswagen ID is granted based on consent (Article 6(1)(a) GDPR), once you have given your consent to the service to access this data.

If Volkswagen AG provides services, apps or websites on an ongoing basis against payment of remuneration, thereby entering into an ongoing commitment, access by the service, app or website to the personal data in your Volkswagen ID is granted based on a contract (Article 6(1)(b) GDPR) once you have given the service permission to access this data.

3. Managing the Volkswagen ID

You can edit your data at any time in the Volkswagen ID user account. To do this, you must log in with the email address and password you specified during registration.

In addition, you can revoke permission to access your personal data for some or all the services which you have logged in to with your Volkswagen ID. If Volkswagen AG provides services on an ongoing basis against payment of remuneration, withdrawing permission to access data may be made dependent first on terminating the contract for providing the services. This restriction does not apply to services provided by third parties, as you have a direct contractual relationship with the relevant third party. Withdrawing permission to access data only applies for the future. The relevant service provider will be notified that you have withdrawn your consent for automatically linking the Volkswagen ID and the associated services provided by this service provider. However, data that has already been transferred before the withdrawal of consent will sometimes still be processed by the relevant service provider if this is required to deliver the related services to you. You can find information on this in the privacy policy of the relevant service you are using. A list of the services which you have logged into with your Volkswagen ID can be found in your Volkswagen ID user account. You can also manage your granted permissions there.

You also have the option to delete (apart from your email address and password) all or individual personal data from the Volkswagen ID without deleting the entire Volkswagen ID. However, this does not affect the processing of personal data for the purposes of a service if you had granted permission to access personal data and therefore it has already been transmitted to the service provider. The processing of your data in connection with the specific service is governed by this service’s privacy policy.

You also have the option of deleting the Volkswagen ID in its entirety under the "Account settings" menu option. If you do this, we will delete your personal data if and as far as we are not required to store the data for other reasons (in particular for commercial or tax reasons). In this case, the data will be deleted no later than after this reason has ceased to exist. If the data is still required for processing claims arising from contracts with us, it will be deleted no later than after these claims have been settled.

IV. Dialogue Centre (Customer Service)

You have the option of contacting us via the Customer Interaction Centre (CIC) with concerns you may have about Volkswagen AG apps, services and websites (e.g. by post, email, contact form or telephone). This involves Volkswagen AG processing the personal data required to deal with your query and provide customer care (e.g. name, email address, address, telephone number, country and language). We will also send you an email in response to your query, requesting your explicit consent to collect and process your personal data. For more information on data protection when using the CIC, please refer to the CIC's Privacy Policy.

If the Customer Interaction Centre (CIC) is unable to resolve a query immediately, it will get the Volkswagen ID team involved in handling the query and finding a solution. The Volkswagen ID team will process the personal data required to deal with your query.

V. Processing for the purpose of contractual COMMUNICATIONS

With a view to identifying you as a potential recipient of contractual communications, your data will be checked to determine whether consent has been given. The processing of this data is legally based on the legitimate interest in ensuring lawful customer communication (Article 6(1)(f) GDPR). If we determine that we are permitted to write to you for contractual reasons, we will use the data from the Volkswagen ID and the associated services to inform you, for example, about expiring licences (Article 6(1)(b) GDPR).

For this purpose, some of the following data is processed:

Private contact and identification data (e.g. surname, first name, email address, telephone number)
Personal information (e.g. preferred partners)
Transaction data (e.g. parking sessions completed)
Vehicle data (e.g. navigation system installed in stored vehicles)
Vehicle usage data (e.g. logbook, fill levels)
Contract data (e.g. ongoing contracts with associated services)
IT usage data (e.g. last logins to the services, use of functions)
Campaign data (e.g. time and content of recent campaign delivery)

All of the above data is also used for further analysis to ensure and monitor data quality as well as error-free technical communication (e.g. identification of missing or corrupt data). The processing of this data is legally based on the legitimate interest in contractual communication in order to ensure error-free communication (Article 6(1)(f) GDPR).

To ensure technically error-free data transfer to customer data management systems, IT usage data is stored for a maximum period of 1 year from collection. The data processed for the above-mentioned purpose of the contractual communication (e.g. notification about expiring licences) will be stored for a period of 24 hours.

VI. Processing for the purpose of advertising from Volkswagen AG*

*This section does not apply to individuals permanently resident in Germany

With a view to identifying you as a potential recipient of advertising content, your data will be checked to determine whether consent has been given. The processing of this data is legally based on the legitimate interest in ensuring lawful customer communication (Article 6(1)(f) GDPR).

If you wish to receive personalised advertising from Volkswagen AG, you must consent to your data being processed for this purpose (Article 6(1)(a) GDPR). If you give your consent, Volkswagen AG will process personal data from Volkswagen ID user account and the associated services. The following data will be processed after you have given your consent:

Private contact and identification data (e.g. surname, first name, email address, telephone number)
Personal information (e.g. preferred partners)
Transaction data (e.g. parking sessions completed)
Vehicle data (e.g. navigation system installed in stored vehicles)
Vehicle usage data (e.g. logbook, fill levels)
Contract data (e.g. ongoing contracts with associated services)
IT usage data (e.g. last logins to the services, use of functions)
Campaign data (e.g. time and content of recent campaign delivery)

For individuals who are permanently resident in Germany, Volkswagen AG also processes location data (e.g. GPS data).

This data will be processed for the following purposes:

Surveys and personalised advertising such as information, offers, discounts on new and existing products from Volkswagen AG (e.g. We services, vehicles and vehicle-related products), products from Elli Mobility GmbH (formerly Volkswagen Group Charging GmbH) (e.g. the Elli charging card) and products from national subsidiaries of Volkswagen Financial Services AG (e.g. leasing) and information on and invitations to service and loyalty programmes, delivery of customer magazines, customer and product events (e.g. road tests, product launches, product demonstrations), trade fairs and events.

Volkswagen AG will contact you by message (email, text message, in-app notification, push notification) and by telephone using the contact details available. If national regulations require you to select specific contact options, Volkswagen AG will contact you using the channels you have selected.

In order to improve advertising, Volkswagen AG pseudonymises and segments the personal data stored in your Volkswagen ID user account and in the associated services. If you give your consent to advertising (Article 6(1)(a) GDPR), Volkswagen AG will use the results of segmentation and establish a direct personal reference with the data listed above. For more information on pseudonymisation and segmentation of your data, please refer to the section "Segmentation to improve advertising" in the privacy policy of the relevant service you are using. You can find the services you are using, which are connected to the Volkswagen ID user account, at any time in the Volkswagen ID Portal under the "Connected Apps" menu option.

In order to personalise advertising, Volkswagen AG processes data about your usage behaviour in the course of sending advertising (e.g. opening the email and links in the email). Volkswagen AG uses this information to work out which topics you are more interested in. This is used as a basis to ensure you receive advertising better suited to your needs in future (e.g. if you click on links/advertising in a particular section of an email, you will preferably receive emails on this topic).

In the case of stored vehicles, Volkswagen AG processes the vehicle identification number, supplements the above (raw) data with further equipment data for your vehicle, and forms segments. Segments are used to identify and analyse your individual interests and needs and to contact you where appropriate.

The described processing of your data is carried out on the basis of the consent you have given to personalised advertising (Article 6(1)(a) GDPR) by Volkswagen AG.

You can obviously withdraw your consent to advertising (Article 6(1)(a) GDPR) at any time without giving reasons to Volkswagen AG, e.g. by email to info-datenschutz@volkswagen.de, via the revocation link contained in the messages, via the contact details given in the legal notice and in the Volkswagen ID user account with immediate effect for the future. If you withdraw your consent, Volkswagen AG will no longer process your personal data for advertising purposes. However, revocation does not affect the lawfulness of the data processing prior to revocation.

VII. Processing for the purpose of advertising from Volkswagen AG*

*This section only applies to individuals permanently resident in Germany

Private contact and identification data (e.g. surname, first name, email address, telephone number)
Personal information (e.g. preferred partners)
Transaction data (e.g. parking sessions completed)
Vehicle data (e.g. navigation system installed in stored vehicles)
Vehicle usage data (e.g. logbook, fill levels)
Contract data (e.g. ongoing contracts with associated services)
IT usage data (e.g. last logins to the services, use of functions)
Campaign data (e.g. time and content of recent campaign delivery)

For individuals who are permanently resident in Germany, Volkswagen AG also processes location data (e.g. GPS data).

This data will be processed for the following purposes:Surveys and personalised advertising such as information, offers, discounts on new and existing products from Volkswagen AG (e.g. We services, vehicles and vehicle-related products), products from Elli Mobility GmbH (e.g. the Elli charging card) and products from national subsidiaries of Volkswagen Financial Services AG (e.g. leasing) and information on and invitations to service and loyalty programmes, delivery of customer magazines, customer and product events (e.g. road tests, product launches, product demonstrations), trade fairs and events.

Volkswagen AG will contact you by message (email, text message, in-app notification, push notification) and by telephone using the contact details available.

You also have the option of merging your usage data generated in the digital services with your data in the Volkswagen ID. Merging this data is carried out for the purpose of personalising digital services and advertising (e.g. personalised advertising campaigns). This processing will only take place if you have given us your consent (Article 6(1)(a) GDPR).

Details on collecting usage data in the digital services can be found in the privacy policy for the relevant service.

You can obviously withdraw your consent to advertising (Article 6(1)(a) GDPR) at any time without giving reasons t

Volkswagen AG, e.g. by email to info-datenschutz@volkswagen.de, via the revocation link contained in the messages, via the contact details given in the legal notice and in the Volkswagen ID user account with immediate effect for the future. If you withdraw your consent, Volkswagen AG will no longer process your personal data for advertising purposes. However, revocation does not affect the lawfulness of the data processing prior to revocation.

Volkswagen AG will no longer process your personal data for advertising purposes if you have not been contacted for advertising purposes for three years. To prove consent, we keep your data for 5 years. Data on selection and personalised advertising will be stored for up to 3 years. To ensure technically error-free data transfer to customer data management systems, the IT usage data listed above is stored for a maximum period of 1 year from collection. The campaign data (e.g. data on messages sent and received) will also be stored in accordance with these deletion periods if you withdraw your consent to advertising and market research in the meantime. Volkswagen AG has a legitimate interest in continuing to store the data in order to be able to check any legal claims or customer enquiries (Article 6(1)(f) GDPR).

VIII. Data processing for personalised advertising and communication by Volkswagen AG

*This section applies irrespective of the permanent residence of individuals who grant their consent from 31/10/2024

If you wish to stay up to date and obtain personally relevant information from Volkswagen on current products and services from the world of Volkswagen via your contact options, you can consent to personalised advertising/communications from Volkswagen AG (Article 6(1)(a) GDPR). Volkswagen AG processes your data from using Volkswagen World, generates an individual customer profile and personalises and optimises advertising/communication for you:

Volkswagen World comprises all products and services of Volkswagen AG and companies associated with it (e.g. Volkswagen Financial Services AG, Elli Mobility GmbH (Elli)), as well as their dealerships and service partners.
Your data includes all data from products and services that you use with your central Volkswagen user account (Volkswagen ID) or that are connected to it, as well as data on and from vehicles ordered or purchased by you. This includes, but is not limited to, all of your
- Contact details (e.g. name, address, contact options)
- Contract data (e.g. related leasing or charging plan agreements)
- Vehicle master data (e.g. production and equipment data)
- Vehicle usage data (e.g. driving and usage behaviour as well as functional use of all your stored vehicles, such as infotainment system, software and function updates, driver assistance systems, sensor data)
- Location data (e.g. GPS positioning data, saved routes, visited locations)
- Online use and usage behaviour (e.g. use of our apps or mailings and clicking behaviour, campaign data, saved vehicle configurations, preferred partners, website use).
In processing your data, Volkswagen AG generates an individual customer profile about you. As part of this, your data can be merged, segmented and statistically evaluated with socio-economic data (e.g. education, occupation, social class) and publicly available information (e.g. weather data), also in order to evaluate and improve the success of advertising and campaigns. Volkswagen AG also uses artificial intelligence (AI) for this purpose. In this context, AI refers to the use of suitable advanced technologies that enable us to efficiently analyse and use customer interactions and data. AI systems can process large quantities of data, recognise our customers’ patterns of behaviour and probabilities, and use these analyses, for instance, to give you personalised recommendations.
Personalised advertising/communication for you includes, in particular, information and offers relating to new and existing products including genuine accessories and services, as well as notifications about technical innovations, Connect services, (connection) offers relating to leasing and financing options and insurance products, charging and mobility services products, as well as maintenance and service packages, road tests, competitions, surveys, invitations to service and loyalty schemes and events from the world of Volkswagen (e.g. Volkswagen AG, Volkswagen Financial Services AG, Elli Mobility GmbH (Elli)). For this purpose, Volkswagen AG may contact you via your contact options (e.g. by telephone, email, text message, push notification (in-app/in-car)). If national regulations require you to select specific contact options, Volkswagen AG will contact you using the channels you have selected.

All of the above data is also used for further analysis to ensure and monitor data quality (e.g. identification of missing or corrupt data) as well as error-free technical communication. The processing of this data is legally based on the legitimate interest in contractual communication in order to ensure error-free communication (Article 6(1)(f) GDPR).

Volkswagen AG may also anonymise your data based on a legitimate interest (Article 6(1)(f) GDPR) in order to develop machine pattern recognition methods. These methods help us gain a better understanding of, for example, decision-making patterns and therefore of our customers’ interests. The anonymised data is not traceable and data from the pattern recognition methods is not allocated at any time to the data of your Volkswagen ID. The patterns created in this way help us send you recommendations and personalised advertising if you have given us the appropriate consent (Article 6(1)(a) GDPR).

You can find the services you are using, which are connected to the Volkswagen ID user account, at any time in the Volkswagen ID Portal under the "Connected Apps" menu option. Please note that apps and applications whose permissions you cannot revoke will not be displayed.

Your consent is voluntary. You can easily change your consent at any time or revoke it without giving any reasons with immediate effect for the future (e.g. via a revocation link in each personalised advertising message, in the Volkswagen ID user account or by sending an email to info-datenschutz@volkswagen.de). Volkswagen ID will then stop processing your data for personalised advertising/communication.

To ensure technically error-free data transfer to customer data management systems, the IT usage data listed above is stored for a maximum period of 1 year from collection. The campaign data (e.g. data on messages sent and received) will also be stored in accordance with these deletion periods if you withdraw your consent to advertising and market research in the meantime. Volkswagen AG has a legitimate interest in continuing to store the data in order to be able to check any legal claims or customer enquiries (Article 6(1)(f) GDPR).

IX Processing for the purpose of advertising by the sales company (importer) responsible for your country*

*This section does not apply to individuals permanently resident in Germany

If you wish to receive advertising personally tailored to you from the sales company (importer) responsible for your country, you must consent to having your data processed for this purpose (Article 6(1)(a) GDPR). If you give your consent, Volkswagen AG will process personal data from Volkswagen ID user account and the associated services. With a view to identifying you as a potential recipient of contractual communications, your data will be checked to determine whether consent has been given. The processing of this data is legally based on the legitimate interest in ensuring lawful customer communication (Article 6(1)(f) GDPR).

The following data will be processed after you have given your consent:

Private contact and identification data (e.g. surname, first name, email address, telephone number)
Personal information (e.g. preferred partners)
Transaction data (e.g. parking sessions completed)
Vehicle data (e.g. navigation system installed in stored vehicles)
Vehicle usage data (e.g. logbook, fill levels)
Contract data (e.g. ongoing contracts with associated services)
IT usage data (e.g. last logins to the services, use of functions)
Campaign data (e.g. time and content of recent campaign delivery)

This data will be processed for the following purposes:

Surveys and personally tailored advertising such as information, offers, discount campaigns on existing and new products of the sales company (importer) responsible for your country (e.g. vehicles and vehicle-related products), on the products of Elli Mobility GmbH (e.g. Elli charging card) as well as on products of the national subsidiaries of Volkswagen Financial Services AG (e.g. leasing) and information and invitations to service and loyalty programmes, to the dispatch of customer magazines, to customer and product events (e.g. road tests, product launches, product presentations), trade fairs and events.

To facilitate contact by the sales company (importer) responsible for your country, Volkswagen AG transmits relevant data (e.g. contact details) as well as the results of relevant segmentations to the sales company (importer) responsible for your country. The sales company (importer) responsible for your country will process this data and the results of the segmentations at its own responsibility. The sales company (importer) responsible for your country will contact you by message (email, text message, in-app notification, push notification) and by phone using the contact details available. For individuals who are permanently resident in Belgium, the UK, Ireland and Poland, the national sales company which is responsible for your country will contact you via your selected channels. You can view the sales company (importer) responsible for your country via the following link: https://connect.volkswagen-we.com/connectivity.html.

To tailor advertising to you personally, Volkswagen AG and the sales company (importer) responsible for your country will process data regarding your usage behaviour in the context of advertising delivery (e.g. opening emails and links within emails). Volkswagen AG processes this data to ensure that segmentations are highly relevant. The sales company (importer) responsible for your country processes this data to ensure the content is highly relevant. This is used as a basis to ensure you receive advertising better suited to your needs in future (e.g. if you click on links/advertising in a particular section of an email, you will preferably receive emails on this topic). You can obviously revoke your consent to advertising (Article 6(1)(a) GDPR) at any time without giving reasons to the sales company (importer) responsible for your country, e.g. by sending an email to the email address specified in the declaration of consent, via the revocation link contained in the messages or t

Volkswagen AG, e.g. by sending an email to info-datenschutz@volkswagen.de, via the contact details given in the legal notice, as well as in the Volkswagen ID user account with immediate effect for the future. If you withdraw your consent, Volkswagen AG and the sales company (importer) responsible for your country will no longer process your personal data for advertising purposes. However, revocation does not affect the lawfulness of the data processing prior to revocation.

Volkswagen AG will no longer process your personal data for advertising purposes if you have not been contacted for advertising purposes for three years. Volkswagen AG will delete your data after five years or in accordance with legal requirements, for example as soon as the purpose for which it was collected no longer applies and provided that deletion does not conflict with any other retention obligations.

X. Data processing in the case of personalised advertising and communication by the sales company (importer) responsible for your country

*This section applies irrespective of the permanent residence of individuals who grant their consent from 31/10/2024

If you want to stay up to date and receive personally relevant information from the importer about current products and services from Volkswagen World via your contact options, you can consent to personalised advertising/communication from the importer (Article 6(1)(a) GDPR).

By granting consent, you allow the importer to process your data from using Volkswagen World, generate an individual customer profile and personalise advertising for you. For this purpose, Volkswagen AG, Berliner Ring 2, 38440 Wolfsburg, analyses, segments and transmits the data specified under section VIII above “Data processing for personalised advertising and communication by Volkswagen AG”, as well as an individual customer profile generated by Volkswagen AG for the importer, who can process and merge this information with its personal data about you as its own controller. Furthermore, the importer can make part of your data (e.g. opening of emails and links contained in them) available t

Volkswagen AG again in order to continuously improve the personalisation of advertising at its own responsibility.

Further information on data processing by the importer, your rights and revocation options (e.g. via the Volkswagen user account (Volkswagen ID), revocation link in each personalised advertising message) can be found in the privacy policy of the importer responsible for you.

XI. Processing for the purpose of customer segment-specific advertising by Volkswagen AG on platforms of advertising partners

Volkswagen AG uses third-party advertising platforms, so-called publishers ("advertising partners"), in order to display interest-based advertising content to certain target groups while they use these platforms. In doing so, Volkswagen AG acts together with the respective advertising partners as joint controllers within the meaning of Art. 26 GDPR. For this purpose, a data matching process takes place in pseudonymized form in a so-called data bunker. The advertising partners match certain pseudonymized data from the Volkswagen ID (e.g. email address) with the pseudonymized data of their own users for the purpose of target group formation. The information obtained from the matching process is used to form target group segments. Volkswagen AG can consequently deliver advertising campaigns on the advertising platforms in a target-group-specific manner. Identification of individual users is not possible at any time. This takes place insofar as it is covered by your voluntarily given consent (Art. 6 (1) sentence 1 lit. a GDPR). Volkswagen AG generally displays advertising on the websites of its advertising partners – even if you do not have a Volkswagen ID or do not give us your consent. With your consent, this advertising can be more strongly tailored to the interests of users with a Volkswagen ID. For the matching process, pseudonymized data from Volkswagen is processed together with the data of the participating publishers. The following personal data will only be used once consent has been given. Volkswagen AG obtains this data through the purchase of a Volkswagen-brand vehicle from a Volkswagen partner or through direct customer business. For the matching process in the data bunker, we use a processor who acts solely on our instructions, in accordance with Art. 28 GDPR. Within the data bunker, which is used for the secure matching of data without any exchange of data between the parties, the pseudonymized data is automatically deleted by the platform after a maximum of 30 days. Information on the specific allocation of responsibilities between Volkswagen AG and its advertising partners within the scope of joint processing pursuant to Art. 26 GDPR can be found in the respective current list of advertising partners.

XII. Data from associated services of VOLKSWAGEN LEASING GMBH or EURO LEASING GMBH for the purpose of advertising*

*This section only applies to individuals permanently resident in Germany

On the basis of your consent (Article 6(1)(a) GDPR), Volkswagen AG receives your stored personal data (e.g. concluded leasing contracts and contract status) from associated services of Volkswagen Leasing GmbH (e.g. the VW FS customer portal), which are merged with your Volkswagen ID user account for the purpose of improving products and advertising. We use this information to generate personalised advertising based on your current existing contract(s).

The following data will be transferred and processed after you have given your consent:

Private contact and identification data (e.g. surname, first name, email address, telephone number)
Personal information (e.g. preferred partners)
Vehicle usage data (e.g. logbook, fill levels)
Contract data (e.g. ongoing contracts with associated services)
IT usage data (e.g. VW ID, login information)

You can obviously revoke your consent at any time without giving reasons t

Volkswagen AG, e.g. by sending an email to info-datenschutz@volkswagen.de, via the contact details given in the legal notice and in the Volkswagen ID user account with immediate effect for the future.

Volkswagen AG will delete your data after 49 months or in accordance with legal requirements, for example as soon as the purpose for which it was collected ceases to apply and provided that deletion does not conflict with other retention obligations.

XIII. General information on the analysis of Volkswagen ID data*

*This section does not apply to permanent residents of Argentina, India and Ukraine

Volkswagen AG is constantly striving to develop new products and services, improve the products and services it provides and optimise advertising for the purposes of marketing these products and services. To achieve these goals, sound analysis of how products and services are used (analytics) is required. For this reason, Volkswagen AG processes data from Volkswagen ID user account and the associated services, such as:

Pseudonymous identification data (e.g. a randomly generated pseudonymous user ID)
User account data (e.g. preferred partners)- Transaction data (e.g. completed scheduling appointments)
Vehicle usage data (e.g. logbook, fill levels)
Contract data (e.g. vehicle equipment, ongoing contracts with associated services)
IT usage data (e.g. last logins to the services, use of functions)
Location data (e.g. truncated GPS data)

The purposes and nature of processing and the legal basis for it are described in detail below.

1. Analysis for the development and improvement of products

For the purpose of developing new (e.g. estimating adoption rates of new products) and improving existing (e.g. evaluating the adoption rate of existing products) products and services, Volkswagen AG processes data from Volkswagen ID user account. In the case of stored vehicles, Volkswagen AG processes the vehicle identification number and supplements the above data with further equipment data for your vehicle. Your personal data is pseudonymised as part of processing. Pseudonymisation involves the removal of all direct personal identifiers (e.g. name, email, telephone number, vehicle identification number). Indirectly traceable identification features (pseudonyms) are retained. Data is only analysed in Volkswagen AG’s analytics systems once this pseudonymisation has taken place. The direct personal link is not restored at any time. The results of the analytics (particularly metrics and figures) are completely anonymous. Processing of pseudonymous data is required as there are interactions between Volkswagen ID user account and the relevant services. In these cases, the use of the pseudonym is absolutely essential in establishing a connection between the data underpinning the analysis from Volkswagen ID user account and from the associated services.

The processing of your data described above is based on Volkswagen AG's legitimate interest in offering you newly developed and improved products and services (Article 6(1)(f) GDPR). Volkswagen AG will delete your pseudonymous data after five years or in accordance with legal requirements, for example as soon as the purpose for which it was collected no longer applies and provided that deletion does not conflict with any other retention obligations. For more information on pseudonymisation and analysis of your data, please refer to the section "Analysis for the development and improvement of products and services" in the privacy policy of the relevant service you are using. You can find the services you are using, which are connected to the Volkswagen ID user account, at any time in the Volkswagen ID user account under the "Connected apps" menu option.

2. Processing for the purpose of analysing sales activities

Volkswagen AG is also constantly striving to optimise the procedures and business processes involved in its sales activities, to reduce associated costs and create a decision-making basis for sales policy activities.

To achieve this aim, Volkswagen AG processes the following data from the Volkswagen ID in order to obtain information on sales activities:

Private contact and identification data (e.g. title, street address, postcode)

On the basis of this data, Volkswagen AG conducts in-depth analyses and generates reports and forecasts regarding incoming orders, sales and inventories. Volkswagen AG uses these reports as a medium- and long-term planning tool to help manage the client structure better.

Your personal data collected by Volkswagen AG and by third parties is processed by Volkswagen AG for the above-mentioned purpose. The relevant third parties (e.g. Volkswagen service partners, Volkswagen Financial Services AG) transfer your data t

Volkswagen AG for this purpose. In the case of stored vehicles, Volkswagen AG processes the vehicle identification number and supplements the above data with further equipment data for your vehicle. Your personal data is pseudonymised as part of processing. Pseudonymisation involves the removal of all direct personal identifiers (e.g. name, email, telephone number, vehicle identification number). Indirectly traceable identification features (pseudonyms) are retained. Data is only analysed in Volkswagen AG’s analytics systems once this pseudonymisation has taken place. The analysis result is anonymous.

For more information on the processing described above, please refer to the privacy policy of the relevant third party. Your data is processed as described based on Volkswagen AG’s legitimate interest in conducting analyses of sales activities (Article 6(1)(f) GDPR).

Volkswagen AG will delete your data no later than after ten years or in accordance with legal requirements, for example as soon as the purpose for which it was collected no longer applies and provided that deletion does not conflict with any other retention obligations.

XIV. COMPLIANCE WITH LEGAL AND REGULATORY REQUIREMENTS

In the case of direct sales and the provision of digital services, we will process your personal data (first name, surname, address, country) for the purposes of preventing fraud and money laundering, for the prevention, combating and investigation of the financing of terrorism and other financial offences, as well as to check against European and international anti-terrorism lists, where this is legally permitted. For Volkswagen AG, the requirements for this arise in particular from legal obligations (such as the German Anti

Money Laundering Act or the European embargo and terrorism regulations). In some circumstances, Volkswagen AG may have a legitimate interest in complying with and observing requirements imposed by public and other competent governmental authorities - inside or outside your country of residence - so as not to expose Volkswagen AG and its representatives to criminal or civil sanctions.

The legal basis for processing your personal data for the purposes set out in the event of legal obligations is Article 6(1)(c) GDPR or, in the case of a legitimate interest, Article 6(1)(f) GDPR.

For reasons of our legal and fiscal obligations to retain data, we generally store the personal data you provide for seven years after performance of the contract, but – if legally required – we will store your personal data for up to 30 years after collecting the data to comply with our legal obligations.

XV. Recipients of your personal data and transfer to third countries

If you use your Volkswagen ID to log into a service which is not provided by us, but by a third party, including, in some cases, providers of associated services that are not directly provided by us, we will only transfer the personal data from your Volkswagen ID to these third parties for which you have given us your consent to transfer when you first logged into this service.

As part of using the Volkswagen ID and the associated services, we commission service providers. These service providers are contractually obliged to comply with provisions of data protection law and are not considered third parties as defined by data protection law. Personal data is only passed on to third parties if this is required for contract processing, particularly for providing services.

Volkswagen AG uses CARIAD SE, established in Germany, as a processor for processing your personal data in connection with using the Volkswagen ID. CARIAD SE processes your data in a cloud operated by Microsoft Ireland Operations Ltd. in the European Union. The possibility of Microsoft Corporation or subsidiaries established in a country outside the EU/EEA having access to personal data cannot be ruled out, as a result of which CARIAD SE and Volkswagen AG have concluded corresponding EU standard contractual clauses (a contract approved by the European Commission that affords personal data the same protection when processed in non

EU countries as in the EU). CARIAD SE processes your personal data exclusively on our behalf and according to our instructions within the framework of a data processing agreement.

The processing of your personal data (e.g. for the purpose of improving advertising and improving products) may also take place in an Amazon Web Services Cloud operated by Amazon Web Services EMEA SARL ("Amazon") in the European Union. The possibility of Amazon Web Services, Inc., established in the United States, having access to personal data cannot be ruled out, as a result of which corresponding EU standard contractual clauses (a contract approved by the European Commission that affords personal data the same protection when processed in non

EU countries as in the EU) have been concluded. Amazon processes your personal data exclusively on our behalf and according to our instructions within the framework of a data processing agreement. For the purposes of ensuring smooth operation and enhancement, Volkswagen AG also uses CARIAD SE and dx.one GmbH, established in Germany, as a processor. For individuals permanently resident in Germany, Volkswagen AG uses Volkswagen Deutschland GmbH & Co. KG, established in Germany, as a processor.

The processing of your personal data in the context of the Customer Interaction Centre and communication takes place in a cloud operated by Salesforce.com EMEA Limited ("Salesforce") in the European Union. The possibility of Salesforce.com, Inc., established in the United States, having access to the data cannot be ruled out, as a result of which corresponding EU standard contractual clauses (a contract approved by the European Commission that affords personal data the same protection when processed in non

EU countries as in the EU) have been concluded. The processed data is also secured by BCR (Binding Corporate Rules) from Salesforce. Salesforce processes your personal data exclusively on our behalf and according to our instructions within the framework of a data processing agreement.

The processing of your personal data as part of contractual communications is partly carried out by Škoda Auto a.s. (Address: tř. Václava Klementa 869, Mladá Boleslav II, 293 01 Mladá Boleslav). Škoda Auto a.s. processes your personal data exclusively on our behalf and according to our instructions within the framework of a data processing agreement.

In addition, Volkswagen AG uses dx.one GmbH, established in Germany, as a processor to ensure operation and enhancement. For individuals permanently resident in Germany, Volkswagen AG uses Volkswagen Deutschland GmbH & Co. KG, established in Germany, as a processor. Personal data will only be passed on to the sales company (importer) responsible for your country if you consent to your data being processed for this purpose. In principle, your personal data is only transferred from Volkswagen AG to the national sales company (importer) responsible for your country in encrypted form. If the sales company (importer) responsible for your country is located in a country outside the European Union and the European Economic Area, we will transfer your data to “third countries” within the meaning of the GDPR. Therefore, your personal data may be subject to a lower level of protection. In order to protect your data, Volkswagen AG and the sales company (importer) responsible for your country have concluded EU standard contracts. You can view the sales company (importer) responsible for your country via the following link: https://connect.volkswagen-we.com/connectivity.html

You can view the EU standard contractual clauses used via the following link: https://eur-lex.europa.eu/legal-content/de/TXT/?uri=CELEX%3A32021D0914

XVI. DATA RETENTION

As a rule, we will only retain your personal data for as long as is reasonably necessary to fulfil the purposes for which we collected it, including the fulfilment of legal, official, fiscal, accounting or reporting requirements. We may retain your personal data for a longer period of time in the event of a complaint or if we reasonably assume that there is a prospect of litigation in relation to our relationship with you.

To determine the appropriate retention period for personal data, we take into account the volume, nature and sensitivity of the personal data, the potential risk of loss due to unauthorised use or disclosure of your personal data, the purposes for which we process your personal data, and whether we may achieve these purposes by other means, as well as the applicable statutory, official, fiscal or accounting requirements. Specific information regarding data storage in conjunction with the specific individual purposes of data processing may be found in the relevant sections above.

C. Your rights

You may exercise your following rights against Volkswagen AG at any time free of charge. For more information on how to exercise your rights, please see Section D.

Right of access to personal data: You have the right to receive information from us regarding whether personal data concerning you is being processed or not, and, if so, to find out which personal data concerning you is being processed and to which third parties within and outside the EU your data (including contact details) is being passed on. You are also entitled to obtain a copy of the personal data concerning you that is processed by us (Article 15 GDPR).Right to rectification: You have the right to ask us to rectify any inaccurate or incomplete personal data concerning you (Article 16 GDPR).Right to erasure: You have the right, if the prerequisites specified in Article 17 GDPR are met, to request the erasure of your data. According to this provision, you may request for your data to be erased if, for instance, it is no longer required for the purposes for which it was collected. You can also request erasure if we process your data on the basis of your consent and you withdraw this consent.Right to restriction of processing: You have the right to request the restriction of the processing of your personal data if the prerequisites specified under Article 18 GDPR or if you dispute the completeness of the personal data, for a period of time that enables the controller to check the completeness of the personal data. This is the case, for example, if you dispute the accuracy of your data. You may then request the restriction of processing of the data while the accuracy of the data is being verified.

RIGHT TO OBJECT: IF PROCESSING IS BASED ON AN OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR DATA IN THE FOLLOWING CASES:- IF PROCESSING IS CARRIED OUT FOR DIRECT MARKETING PURPOSES (INCLUDING PROFILING FOR DIRECT MARKETING PURPOSES).-**AN OBJECTION IS ADMISSIBLE IF PROCESSING (INCLUDING PROFILING) IS CARRIED OUT ON THE FOLLOWING LEGAL BASES:**o **PROCESSING IS REQUIRED TO PERFORM A TASK CARRIED OUT IN THE PUBLIC INTEREST OR IN EXERCISING OFFICIAL AUTHORITY VESTED IN US (ARTICLE 6, PARAGRAPH 1(E) GDPR). PROCESSING IS REQUIRED FOR THE PURPOSES OF OUR LEGITIMATE INTERESTS OR THE LEGITIMATE INTERESTS OF A THIRD PARTY (ARTICLE 6 PARAGRAPH 1(F) GDPR), AND WE CANNOT DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING THAT OUTWEIGH YOUR INTERESTS, RIGHTS AND FREEDOMS, OR PROCESSING IS CARRIED OUT FOR THE PURPOSE OF ESTABLISHING, EXERCISING OR DEFENDING LEGAL CLAIMS. IN THE EVENT OF AN OBJECTION, PLEASE INFORM US OF YOUR REASONS FOR OBJECTING TO DATA PROCESSING. YOU ALSO HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSES OF DIRECT MARKETING. THIS ALSO APPLIES TO PROFILING WHERE THIS IS RELATED TO DIRECT MARKETING.**Right to data portability: Provided that data processing is based on consent or on the fulfilment of a contract and that it is also carried out using automated processing, you have the right to receive your data in a structured, commonly used and machine-readable format and to transmit it to another data processor. You also have the right to request that your personal data be transferred directly from us to another controller.Right to withdraw consent: If data processing is based on consent, you have the right to withdraw your consent to data processing at any time free of charge with effect for the future.Right to lodge a complaint: You also have the right to lodge a complaint with a supervisory authority (e.g. with the Data Protection Officer for the State of Lower Saxony) regarding our processing of your data. This can be, for example, the data protection authority in your country of residence. A list of all data protection authorities in the European Union and the European Economic Area can be found here: https://www.edpb.europa.eu/about-edpb/about-edpb/members_de

Right not to be subject to a decision based on automated processing: You have the right not to be subject to a decision based on automated processing (a decision based on automated processing of your personal data that affects your vital interests), unless there are certain limited circumstances.

D. Your points of contact

Points of contact for exercising your rightsDetails of your points of contact for exercising your rights and further information can be found on the following website: Volkswagen AG Data Protection Portal.

Data Protection OfficerOur Data Protection Officer is your point of contact for issues related to data protection:Datenschutzbeauftragter der Volkswagen AG [Volkswagen AG Data Protection Officer]

Berliner Ring 2, 38440 Wolfsburg, GermanyEmail: datenschutz@volkswagen.de

Version dated: September 2026