Volkswagen ID Privacy Policy

This Privacy Policy contains important information on your rights in conjunction with the processing of your personal data and the legal grounds on which basis the processing of the personal data we collect in the context of use of the Volkswagen ID, or which you provide to us, takes place. We do not intend to collect data from children.

Please note that we – as a German company – are bound by German law including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ('GDPR'), including when we process personal data concerning people whose permanent residence is outside of Germany. The information required in accordance with German law and the GDPR regarding the processing of your personal data can be found in Part I of this Privacy Policy. We may also be bound by national laws from other countries to a certain degree. If you have your permanent residence in a country named in Part II of this Privacy Policy, you will find more information therein.

Part I

A. Controller

Thank you for using the Volkswagen ID user account ("Volkswagen ID"). The responsible office for the Volkswagen ID is Volkswagen AG, Berliner Ring 2, 38440 Wolfsburg, Germany, vw@volkswagen.de, entered in the register of companies at Braunschweig District Court under no. HRB 100484 ("Volkswagen AG" or "we", "us" or "our").

Please find below information on how your personal data is collected, processed and used in conjunction with use of the Volkswagen ID.

B. Processing of your personal data

I. Processing of log data on the website

If you only visit the Volkswagen ID landing page without registering or logging in, we process the following log data concerning you:

-Your IP address
-The operating system you use
-Your web browser and the screen resolution you are using
-Date and time of your visit

Volkswagen AG processes this data on the basis of the legitimate interest (Article 6, paragraph 1, letter f GDPR) of Volkswagen AG in properly displaying the website to you. The log data is stored for a month and then erased.

II. Cookies

Volkswagen AG uses various cookies on its websites. Cookies are small files containing configuration information which are stored on your device. Cookies can essentially be divided into three categories. Some cookies are essential for website functionality (known as functional cookies), some cookies make the website easier to use (known as convenience cookies) and some cookies are used to create a pseudonymised usage profile (known as tracking cookies). The use of functional cookies is required to allow you to visit this website. Data is processed on the basis of contract fulfilment (providing the "Volkswagen ID" service, Article 6, paragraph 1, letter b GDPR). More information on our cookies is available in the Cookie Policy.

III. Registration, use and management of Volkswagen ID

If you register for a Volkswagen ID, you can log into numerous services, apps and websites from Volkswagen AG and third parties and manage your data at any time in the Volkswagen ID user account. The purposes and nature of processing and the legal basis thereof are described in detail below.

1. Registering for a Volkswagen ID

To create a Volkswagen ID, you need to register with an email address and password. To determine which legal texts apply to you, you must also select a country preselected based on your IP address and a region. To verify your registration for the Volkswagen ID, we use what is known as the "double opt-in" procedure. We will send you an email at the email address provided requesting confirmation. Data is processed on the basis of contract fulfilment (providing the "Volkswagen ID" service, Article 6, paragraph 1, letter b GDPR).

In the Volkswagen ID, you can also voluntarily give further personal data in addition to the obligatory email address and password fields. Volkswagen AG saves the data entered in the Volkswagen ID user account:

-Name
-Salutation and title
-Date of birth
-Address
-Telephone numbers
-Preferred language
-Profile picture

If you do not provide this additional information or you supply inaccurate information, it may not be possible for you to use other digital services in conjunction with your Volkswagen ID, if the information is required to use another such digital service. However, your ability to set up a Volkswagen ID will not be affected.

This data is saved in the Volkswagen ID on the basis of contract fulfilment (providing the "Volkswagen ID" service, Article 6, paragraph 1, letter b GDPR).

2. Using the Volkswagen ID to log into services, apps and websites

You may use your Volkswagen ID to log into various services, apps and websites, which may be provided by us or also by third parties. To log in with your Volkswagen ID, you must log in using the email address you set during registration and your password. For some services, you can also log in with your Volkswagen ID by scanning a code displayed during the login process using your device.

If you use a Volkswagen AG app with a code scanner, you can scan the code with your device's code scanner. This also allows you to use the app login data you have already entered to log in on another device (e.g. vehicle). After scanning, you must confirm that you are also using the login details to log in on another device (e.g. vehicle). You will be logged in on the additional device (e.g. vehicle) automatically.

If you are not using a Volkswagen AG app with a code scanner, you can scan the code using your device's camera and complete the login process in your browser. Following login, you must confirm that you are also using the login details to log in on an additional device (e.g. vehicle). You will be logged in on the additional device (e.g. vehicle) automatically.

The first time you log into a service, app or website you will be asked to grant the service, app or website access to the data required for the provisions of services from the Volkswagen ID. If you grant access, Volkswagen AG transfers the data from your Volkswagen ID to the provider of the service, app or website in question.

If Volkswagen AG provides services, apps or websites free of charge and you thereby do not enter into an ongoing commitment, the access of the service, app or website to personal data in your Volkswagen ID is based on consent (Article 6, paragraph 1, letter a GDPR), once you have given your consent to the service accessing this data.

If Volkswagen AG provides services, apps or websites on an ongoing basis in exchange for payment of remuneration and you thereby enter into an ongoing commitment, the access of the service, app or website to personal data in your Volkswagen ID is based on a contract (Article 6, paragraph 1, letter b GDPR), after you have authorised the service to access this data.

3. Managing the Volkswagen ID

You may edit your data at any time in the Volkswagen ID user account. To do this, you must log in with the email address you set during registration and your password.

You may also withdraw authorisation to access your personal data for individual or all services you have logged into with your Volkswagen ID. If Volkswagen AG provides services on an ongoing basis in exchange for payment of remuneration, the withdrawal of authorisation of data access may be made conditional upon the contract for the provision of services being terminated first; for services provided by third parties, this limitation does not exist. Withdrawal of authorisation of data access shall only have effect for the future. The relevant service shall be notified of the withdrawal of consent. However, data which has already been transferred may continue to be processed by the relevant service where applicable. You can find information on this in the Privacy Policy for the relevant service you use. You will find an overview of the services you have logged into with your Volkswagen ID in your Volkswagen ID user account. You can also manage your authorisations there.

You have the option (with the exception of your email address and password) to also erase all or individual items of personal data from the Volkswagen ID, without erasing the entire Volkswagen ID. However, this does not affect the processing of personal data for the purposes of a service if you have granted it authorisation for access and personal data has therefore already been transferred to the service. The processing of your data in conjunction with the specific service is governed by the Privacy Policy for the service in question.

You also have the option to erase the Volkswagen ID as a whole in the "Account settings" menu option. If you do this, we shall erase your personal data, if and insofar as we are not obliged to save the data for other reasons (particularly for commercial or fiscal reasons). In that event, the data will be erased as soon as these grounds cease to exist. If the data is still required to settle claims arising from contracts with us, it shall not be erased until these claims have been settled.

IV. Dialogue Centre (customer services)

Through the CIC, you have the option to consult the Customer Interaction Center (CIC) with queries regarding apps, services and websites from Volkswagen AG (e.g. by post, email, contact form or telephone). In this context, Volkswagen AG processes the personal data required to process your query and for the purposes of customer care (e.g. name, email address, address, telephone number, country and language). More information on data protection in the context of using the CIC can be found in the CIC Privacy Policy.

If the Customer Interaction Center (CIC) cannot resolve a query directly, it shall consult the Volkswagen ID team for processing and resolution purposes. The Volkswagen ID team processes the necessary personal data to handle your query.

V. Processing for the purposes of advertising from Volkswagen AG

If you wish to receive advertising personally tailored to you from Volkswagen AG, you must consent to the processing of your data for this purpose (Article 6, paragraph 1, letter a GDPR). If you give your consent, Volkswagen AG processes personal data from the Volkswagen ID user account and associated services. The following data is processed once you have given your consent:

-private contact and identification data (e.g. surname, first name, email address, telephone number)
-personal details (such as preferred partners)
-transaction data (e.g. parking sessions completed)
-vehicle data (e.g. built-in navigation system in stored vehicles)
-vehicle usage data (e.g. logbook, fill levels)
-contract data (e.g. ongoing contracts with associated services)
-IT usage data (e.g. last logins to services, use of functions)
-campaign data (e.g. time and content of recent campaign delivery)

For individuals who are permanently resident in Germany, Volkswagen AG also processes location data (e.g. GPS data).

This data is processed for the following purposes:

Surveys and personally tailored advertising such as information, offers, discounts on new and existing products from Volkswagen AG (e.g. We services, vehicles and vehicle-related products), products from Volkswagen Group Charging GmbH (e.g. the Elli charging card) and products from national subsidiaries of Volkswagen Financial Services AG (e.g. leasing) and information on and invitations to service and loyalty programmes, delivery of customer magazines, customer and product events (e.g. test drives, product launches, product demonstrations), trade fairs and events.

The Volkswagen AG will contact you for these purposes using the contact information available via message (email, SMS, in-app, push) and by telephone. For individuals who are permanently resident in Belgium and Poland, Volkswagen AG will contact you via your selected channels.

In order to improve its advertising, Volkswagen AG pseudonymises and segments the personal data stored in your Volkswagen ID user account and associated services. If you have consented to advertising (Article 6, paragraph 1, letter a GDPR), Volkswagen AG uses the results of segmentation and makes a direct personal link with the data mentioned above. For more information on the pseudonymisation and segmentation of your data, please see the section "Segmentation for the purposes of advertising optimisation" in the Privacy Policy for the service you are using. You can find services you use and which are linked to the Volkswagen ID user account at any time in the Volkswagen ID Portal under the menu option "Connected apps".

To tailor advertising to you personally, Volkswagen AG processes data regarding your usage behaviour in the context of advertising delivery (e.g. opening emails and links within emails). Volkswagen AG uses this information to work out which topics are of more interest to you. This is used as a basis to ensure you receive advertising better suited to your needs in future (e.g. if you click on links/advertising in a particular section of an email, you will receive more emails on this topic).

You may of course withdraw your consent to advertising (Article 6, paragraph 1, letter a GDPR) with respect to Volkswagen AG at any time, without giving reasons, with immediate effect for the future, e.g. by sending an email to info-datenschutz@volkswagen.de, via the withdrawal link contained in the messages, via the contact details stated in the site notice or in the Volkswagen ID user account. If you withdraw your consent, Volkswagen AG will no longer process your personal data for advertising purposes. However, said withdrawal does not affect the lawfulness of data processing prior to withdrawal.

Volkswagen AG will also no longer process your personal data for advertising purposes if you have not been contacted for advertising purposes for three years. Volkswagen AG erases your data after five years.

VI. Processing for the purposes of advertising from Volkswagen AG

-private contact and identification data (e.g. surname, first name, email address, telephone number)
-personal details (such as preferred partners)
-transaction data (e.g. parking sessions completed)
-vehicle data (e.g. built-in navigation system in stored vehicles)
-vehicle usage data (e.g. logbook, fill levels)
-contract data (e.g. ongoing contracts with associated services, leasing contract duration)
-IT usage data (e.g. last logins to services, use of functions)
-campaign data (e.g. time and content of recent campaign delivery)

In the case of persons permanently residing in Germany, Volkswagen AG also processes location data (e.g. GPS data).

This data is processed for the following purposes:

You also have the option of merging your usage data generated in the digital services with your data in the Volkswagen ID. This combination serves to personalise the digital services and advertising (e.g. personalised advertising campaigns). This processing only takes place if you have given us your consent ( Art. 6 para. 1 lit. a DSGVO).

Details on the collection of usage data in the digital services can be found in the privacy policy of the respective service.

VII. Processing for the purposes of advertising by the national sales company (importer) responsible for your country*

*This section does not apply to people permanently resident in Germany

If you wish to receive advertising personally tailored to you from the national sales company (importer) responsible for your country, you must consent to the processing of your data for this purpose (Article 6, paragraph 1, letter a GDPR). If you give your consent, Volkswagen AG processes personal data from your Volkswagen ID user account and associated services. The following data is processed once you have given your consent:

This data is processed for the following purposes:

Surveys and personally tailored advertising such as information, offers, discounts on new and existing products from the national sales company (importer) responsible for your country (e.g. vehicles and vehicle-related products), products from Volkswagen Group Charging GmbH (e.g. the Elli charging card) and products from national subsidiaries of Volkswagen Financial Services AG (e.g. leasing) and information on and invitations to service and loyalty programmes, delivery of customer magazines, customer and product events (e.g. test drives, product launches, product demonstrations), trade fairs and events.

For the purposes of approaches by the national sales company (importer) responsible for your country, Volkswagen AG transfers relevant data (e.g. contact information) and results of relevant segmentation to the national sales company (importer) responsible for your country. The national sales company (importer) responsible for your country processes this data and results of segmentation at its own responsibility. The national sales company (importer) responsible for your country will contact you using the contact information available via message (email, SMS, in-app, push) and by telephone. For individuals who are permanently resident in Belgium, the UK, Ireland and Poland, the national sales company which is responsible for your country will contact you via your selected channels.

You can view the national sales company (importer) responsible for your country at the following link: https://connect.volkswagen-we.com/connectivity.html.

To tailor advertising to you personally, Volkswagen AG and the national sales company (importer) responsible for your country process data regarding your usage behaviour in the context of advertising delivery (e.g. opening emails and links within emails). Volkswagen AG processes this data to ensure that segmentation is highly relevant. The national sales company (importer) responsible for your country processes this data to ensure content is highly relevant. This is used as a basis to ensure you receive advertising better suited to your needs in future (e.g. if you click on links/advertising in a particular section of an email, you will receive more emails on this topic). You may of course withdraw your consent to advertising (Article 6, paragraph 1, letter a GDPR) with respect to the national sales company (importer) responsible for your country at any time, without giving reasons, with immediate effect for the future, e.g. by sending an email to the email address in the consent declaration, via the withdrawal link contained in the messages or by contacting Volkswagen AG, e.g. by email to info-datenschutz@volkswagen.de, via the contact details stated in the site notice or in the Volkswagen ID user account. If you withdraw your consent, Volkswagen AG and the national sales company (importer) responsible for your country will no longer process your personal data for advertising purposes. However, said withdrawal does not affect the lawfulness of data processing prior to withdrawal.

Volkswagen AG will also no longer process your personal data for advertising purposes if you have not been contacted for advertising purposes for a year. Volkswagen AG erases your data after three years or in accordance with legal requirements, for instance, once the purpose for which it was collected becomes invalid and if erasure is not contrary to any other retention obligations.

VIII. Data from affiliated services of Volkswagen Leasing GmbH or Euro Leasing GmbH for the purpose of advertising*

*This section only applies to persons with permanent residence in Germany

Based on your consent (Art. 6 Para. 1 lit. a DSGVO), Volkswagen AG receives your stored personal data (e.g. concluded leasing contracts and contract status) from associated services of Volkswagen Leasing GmbH (e.g. the VW FS customer portal), which is merged with your Volkswagen ID user account for the purpose of improving products and advertising. From this information we generate personalised advertising based on your currently existing contract(s).

The following data will be transferred and processed after you have consented:

-Private contact and identification data (e.g. surname, first name, email address, telephone number).
-Personal details (e.g. preferred partners)
-Contractual data (e.g. current contracts with associated services)
-IT usage data (e.g. VW ID, log-in information).

You can, of course, revoke your consent at any time without giving reasons to Volkswagen AG, e.g. by e-mail to info-datenschutz@volkswagen.de, via the contact details given in the imprint as well as in the Volkswagen ID user account with immediate effect for the future. Volkswagen AG deletes your data after 49 months or in accordance with legal requirements, for example as soon as the purpose for which it was collected no longer applies and provided that there are no other retention obligations that prevent deletion.

IX. General information on the analysis of data from Volkswagen ID*

*This section does not apply to people permanently resident in Argentina, India and Ukraine.

Volkswagen AG is constantly striving to develop new products and services, improve the products and services it provides and optimise advertising for the purposes of marketing said products and services. Sound evaluation of the use of current products and services (analytics) is required for this purpose. Accordingly, Volkswagen AG processes data from the Volkswagen ID user account and associated services, such as

-pseudonymous identification data (e.g. a randomly generated pseudonymous user ID)
-user account data (such as preferred partners)
-transaction data (e.g. completed appointment scheduling)
-vehicle usage data (e.g. logbook, fill levels)
-contract data (e.g. vehicle equipment, ongoing contracts with associated services)
-IT usage data (e.g. last logins to services, use of functions)
-location data (e.g. truncated GPS data)

The purposes and nature of processing and the legal basis thereof are described in detail below.

1. Analysis for the purposes of developing and improving products

Volkswagen AG processes data from Volkswagen ID user account for the purposes of developing new products and services (by estimating adoption rates for new products, for example) and improving existing ones (such as by evaluating adoption rates for existing products). For stored vehicles, Volkswagen AG processes the vehicle identification number and adds further equipment data for your vehicle to the above data. Your personal data is pseudonymised as part of processing. Pseudonymisation involves the removal of all direct personal identifiers (e.g. name, email, telephone number, vehicle identification number). Indirectly traceable identifiers (pseudonyms) are retained. Data is only analysed in Volkswagen AG's analytics systems once this pseudonymisation has taken place. The direct personal link is not restored at any time. The results of the analytics (particularly metrics and figures) are completely anonymous. Processing of pseudonymous data is required as there are interactions between the Volkswagen ID user account and the relevant services. In these circumstances, the use of the pseudonym is absolutely essential in establishing a connection between the data underpinning the analysis from the Volkswagen ID user account and from the associated services.

Your data is processed as described on the basis of the legitimate interest of Volkswagen AG in offering you new and improved products and services (Article 6, paragraph 1, letter f GDPR). Volkswagen AG erases your pseudonymised data after five years or in accordance with legal requirements, for instance, once the purpose for which it was collected becomes invalid and if erasure is not contrary to any other retention obligations. For more information on the pseudonymisation and analysis of your data, please see the section "Analysis for the purposes of developing and improving products" in the Privacy Policy for the service you are using. You can find services you use and which are linked to the Volkswagen ID user account at any time in the Volkswagen ID user account under the menu option "Connected apps".

2. Segmentation for the purposes of advertising optimisation

Volkswagen AG processes data from the Volkswagen ID user account for the purposes of advertising optimisation (e.g. evaluating relevance for a campaign). For stored vehicles, Volkswagen AG processes the vehicle identification number and adds further equipment data for your vehicle to the above data. Your personal data is pseudonymised as part of processing. Pseudonymisation involves the removal of all direct personal identifiers (e.g. name, email, telephone number, vehicle identification number). Indirectly traceable identifiers (pseudonyms) are retained. Data is only segmented in Volkswagen AG's analytics systems once this pseudonymisation has taken place. Your data is processed as described based on Volkswagen AG's legitimate interest in providing optimised advertising tailored to the user (Article 6, paragraph 1, letter f GDPR).

Volkswagen AG erases your pseudonymised data after three years or in accordance with legal requirements, for instance, once the purpose for which it was collected becomes invalid and if erasure is not contrary to any other retention obligations.

Volkswagen AG does not use the results to restore a direct personal link if you have not given appropriate consent to advertising (Article 6, paragraph 1, letter a GDPR). For more information on consenting to advertising from Volkswagen AG, please see the passage "Processing for the purposes of advertising". For more information on consenting to advertising from the national sales company (importer) responsible for your country, please see the passage "Processing for the purposes of advertising by the national sales company (importer) responsible for your country". For more information on the pseudonymisation and segmentation of your data, please see the section "Segmentation for the purposes of advertising optimisation" in the Privacy Policy for the service you are using. You can find services you use and which are linked to the Volkswagen ID user account at any time in the Volkswagen ID user account under the menu option "Connected apps".

3. Processing for the purposes of analysing sales activities

Volkswagen AG is also constantly striving to optimise sales activity workflows and business processes, reduce associated costs and create bases for decision-making for sales policy-related activities.

To achieve this aim, Volkswagen AG processes the following data from the Volkswagen ID in order to obtain information on sales activities:

-Private contact and identification data (e.g. title, street address, postcode)

On the basis of this data, Volkswagen AG conducts in-depth analyses and generates reports and forecasts regarding incoming orders, sales and inventories. Volkswagen AG uses these reports as a medium- and long-term planning tool for better management of client structure.

For the above-mentioned purpose, your personal data collected by Volkswagen AG and by third parties will be processed by Volkswagen AG. For this purpose, the respective third parties (e.g. Volkswagen Partner, Volkswagen Financial Services AG) transmit your data to Volkswagen AG. In the case of deposited vehicles, Volkswagen AG processes the vehicle identification number and enriches the above data with further equipment data of your vehicle. In the course of processing, your personal data is pseudonymised. Pseudonymisation involves the removal of all direct personal identifiers (e.g. name, e-mail, telephone number, vehicle identification number). Indirectly traceable identifiers (pseudonyms) are retained. Only after this pseudonymisation is the data analysed and processed in Volkswagen AG's analytics systems. The analysis result is anonymous.

For more information on the above processing, please note the Privacy Policy for the relevant third party.

Your data is processed as described based on Volkswagen AG's legitimate interest in conducting analyses of sales activities (Article 6, paragraph 1, letter f GDPR).

Volkswagen AG erases your data after no more than 10 years or in accordance with legal requirements, for instance, once the purpose for which it was collected becomes invalid and if erasure is not contrary to any other retention obligations.

4. Preparation of analyses for corporate management purposes

Volkswagen AG is constantly striving to improve business processes as part of corporate management and to optimise the associated costs. In order to achieve this goal, it is necessary to analyse quotation, sales and order data. For this reason, Volkswagen AG processes data from quotation, sales and order systems as well as data from services connected to the Volkswagen ID, such as
- Private contact and identification data (address)
- Contract data (e.g. vehicle equipment, order data, logistics data)
- Vehicle usage data (e.g. vehicle data)
- IT usage data (e.g. last logins to the services, use of functions)

For the purpose of preparing analyses for corporate management purposes, Volkswagen AG carries out analyses of sales and order data by model, order status, and reports on key business figures using an identification number. In addition, Volkswagen AG carries out analyses of the number of vehicles sold with and without the use of Volkswagen AG's digital services for the purpose of preparing evaluations for corporate management. In this context, in addition to the sales figures, the number of consents to advertising and registrations for the digital services are measured at model level.
In the course of processing, your personal data is pseudonymised. Pseudonymisation involves the removal of all direct personal identifiers (e.g. name, email, telephone number, vehicle identification number). Indirectly traceable identification features (pseudonyms) are retained. Only after this pseudonymisation is the data analysed in the analytics systems of Volkswagen AG. At no time is the direct personal reference restored. The results resulting from the analysis (in particular metrics and key figures) are completely anonymous. For further processing (e.g. calculation of segments, metrics and key figures), the data is anonymised in advance.

The described processing of your data is based on the legitimate interest of Volkswagen AG to carry out analyses for corporate management purposes (Art. 6 para. 1 lit. f GDPR).

Volkswagen AG deletes your pseudonymised data after 5 years or in accordance with legal requirements, for example as soon as the purpose for which it was collected no longer applies and provided that there are no other retention obligations to the contrary.

The processing of your personal data for the purpose of creating analyses for corporate management purposes takes place in an Amazon Web Services Cloud operated by Amazon Web Services EMEA SARL (‘Amazon’) in the European Union. Access to the personal data by Amazon Web Services, Inc. based in the USA cannot be ruled out, so that corresponding EU standard contractual clauses (a set of contracts approved by the European Commission that grants personal data the same protection it has in the EU for data processing in non-EU countries) have been concluded. Amazon processes your personal data exclusively on our behalf and according to our instructions within the framework of an order processing agreement.

In addition, Volkswagen AG uses Volkswagen Deutschland GmbH & Co. KG and CARIAD SE, both based in Germany, as processors to ensure the operation and further development of the website. You can view the EU standard contractual clauses used via the following link:

EUR-Lex - 32021D0914 - EN - EUR-Lex (europa.eu)

X. Compliance with legal and regulatory requirements

For direct sales and the provision of digital services, we will process your personal data (first name, surname, address, country) for the purposes of preventing fraud and money laundering, for the prevention, combating and investigation of the financing of terrorism and asset endangering crimes as well as to check against European and international anti-terrorism lists. The requirements for Volkswagen AG result in particular from legal obligations (such as the money laundering act or the European embargo and terrorism regulations). Volkswagen AG may have a legitimate interest in the compliance and observance of requirements imposed by public and other competent governmental authorities - inside or outside your country of residence - so as not to expose Volkswagen AG and its representatives to criminal or civil sanctions.

The legal basis for the processing of your personal data for the purposes set out above is, in the case of legal obligations, Article 6, paragraph 1, letter c GDPR or, in the case of a legitimate interest, Article 6, paragraph 1, letter f GDPR.

For reasons of our legal and taxation obligations to retain data, we generally retain the personal data you provide for seven years after fulfilling the contract, but – if legally required – we will retain your personal data for up to 30 years after collecting the data to comply with our legal obligations.

XI. Recipients of your personal data and transfer to third countries

If you use your Volkswagen ID to log into a service which is not provided by us, but by a third party, this third party will only be transferred the personal data from your Volkswagen ID to whose transfer you consented when you first logged into this service. We commission service providers to facilitate use of Volkswagen ID and associated services. These service providers are contractually obliged to comply with provisions of data protection law and are not considered third parties as defined by data protection law. Personal data is only passed on to third parties if this is required for contract processing, particularly for providing services.

Volkswagen AG uses CARIAD SE, based in Germany, and Microsoft Ireland Operations Ltd, based in Ireland, as processors for the processing of your personal data in connection with the use of the Volkswagen ID. CARIAD SE also uses Microsoft Ireland Operations Ltd. based in Ireland as a processor for its data processing.

For the purposes of processing your personal data in the context of use of the Volkswagen ID, Volkswagen AG uses CARIAD SE, with headquarters in Germany, and Microsoft Ireland Operations Ltd, based in Ireland, as a processor. CARIAD SE also uses Microsoft Ireland Operations Ltd. based in Ireland as a processor for its data processing. It is not possible to rule out Microsoft Corporation or subsidiaries with headquarters in a state outside of the EU/EEA having access to the personal data, so CARIAD SE and Volkswagen AG have concluded corresponding EU standard contractual clauses (a contractual arrangement approved by the European Commission according to personal data the same protection for data processing in non-EU countries as in the EU). CARIAD SE processes your personal data exclusively on our behalf and in accordance with our instructions as part of a contract data processing agreement. We also use Capgemini Deutschland GmbH, Volkswagen Group Services GmbH and Arlanis Reply AG as processors for development.

Volkswagen AG uses Adobe Systems Software Ireland Ltd (Adobe), based in Ireland, as a processor via Volkswagen Software Asset Management GmbH for the processing of your personal data in the context of communication. Adobe processes your data in a cloud operated by Microsoft Ireland Operations Ltd. in the European Union. Access to personal data by Adobe or subsidiaries based in a country outside the EU/EEA cannot be ruled out, so Volkswagen AG has concluded corresponding EU standard contractual clauses (a set of contracts approved by the European Commission that grants personal data the same protection it has in the EU for data processing in non-EU countries). You can view the EU standard contractual clauses used via the following link: https://eur-lex.europa.eu/legal-content/de/TXT/?uri=CELEX%3A32021D0914

The processing of your personal data (e.g. for the purpose of improving advertising and for the purpose of improving products) may also take place in an Amazon Web Services Cloud operated by Amazon Web Services EMEA SARL ("Amazon") in the European Union. It is not possible to rule out Amazon Web Services, Inc. with headquarters in the USA, having access to the personal data, so corresponding EU standard contractual clauses (a contractual arrangement approved by the European Commission according personal data the same protection for data processing in non-EU countries as in the EU) have been concluded. Amazon processes your personal data exclusively on our behalf and in accordance with our instructions as part of a contract data processing agreement. For the purposes of ensuring smooth operation and enhancement, Volkswagen AG also uses CARIAD SE, with headquarters in Germany, as a processor. For individuals permanently resident in Germany, Volkswagen AG uses Volkswagen Deutschland GmbH & Co. KG and Volkswagen Software Asset Management GmbH, with headquarters in Germany, as a processor.

In the context of the Customer Interaction Center (Customer Care), marketing and campaign management, as well as the communication, your personal data is processed in a cloud operated by Salesforce.com Deutschland GmbH ("Salesforce") in the European Union. Salesforce is used as a processor via Volkswagen Software Asset Management GmbH. It is not possible to rule out Salesforce.com, Inc. with headquarters in the US, having access to the information, so corresponding EU standard contractual clauses (a contractual arrangement approved by the European Commission according personal data the same protection for data processing in non-EU countries as in the EU) have been concluded. The data processed is also protected by BCR (Binding Corporate Rules) of Salesforce. Salesforce processes your data exclusively on our behalf and in accordance with our instructions as part of a contract data processing agreement. For the purposes of ensuring smooth operation and enhancement, Volkswagen AG also uses CARIAD SE, with headquarters in Germany, as a processor. For individuals permanently resident in Germany, Volkswagen AG uses Volkswagen Deutschland GmbH & Co. KG, with headquarters in Germany, as a processor.

Personal data is only disclosed to the national sales company (importer) responsible for your country if you consent to the processing of your data for this purpose. In principle, your personal data is only transferred from Volkswagen AG to the national sales company (importer) responsible for your country in encrypted form. If the national sales company (importer) responsible for your country is in a country outside the European Union and the European Economic Area, we transfer your data to what are known as “third countries” under the GDPR. There may therefore be a lower level of protection for your personal data. To protect your data, Volkswagen AG and the national sales company (importer) have concluded EU standard agreements. You can view the national sales company (importer) responsible for your country at the following link: https://connect.volkswagen-we.com/connectivity.html

You can view the EU standard contractual clauses used at the following link: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32010D0087

XII. Data retention

As a rule, we shall only retain your personal data for as long as is reasonably necessary to fulfil the purposes for which we collected it, including the fulfilment of legal, official, fiscal, accounting or reporting requirements. In the event of a complaint, or if we reasonably assume that there is the prospect of a legal dispute with regard to our relationship with you, we may retain your data for a longer period.

To determine the appropriate retention period for personal data, we take into account the quantity, nature and sensitivity of personal data, the potential risk of harm due to unauthorised use or disclosure of your personal data, the purposes for which we process your personal data, and whether we may achieve these purposes by other means, and the applicable statutory, official, fiscal or accounting requirements. Specific information regarding data storage in conjunction with the specific individual purposes of data processing may be found in the relevant sections above.

C. Your rights

You can assert your following rights towards Volkswagen AG free of charge at any time. Additional information on exercising your rights can be found in section D.

Right to information: You have the right to receive information from us regarding the processing of your personal data (Article 15 GDPR).

Right to rectification: You have the right to request that we rectify any of your personal data that is incorrect or incomplete (Article 16 GDPR).

Right to erasure: If the requirements specified in Article 17 GDPR have been met, you have the right to request the erasure of your data. Accordingly, you may request the erasure of your data, for instance, if it is no longer necessary for the purposes for which it was collected. In addition, you may request erasure if we process your data on the basis of your consent and you withdraw this consent.

Right to restriction of processing: You have the right to request the restriction of the processing of your personal data if the requirements specified under Article 18 GDPR have been met. This is the case, for example, if you dispute the accuracy of your data. You may then request the restriction of processing of your data while the accuracy of your data is being verified.

Right to object: Insofar as the processing is based on an overriding legitimate interest, you have the right to object to the processing of your data. An objection shall be permissible if the processing either is carried out in the public interest or in the exercising of official authority or owing to a legitimate interest of Volkswagen AG or of a third party. If you object, we ask you to inform us of the reasons why you are objecting to data processing. In addition, you have the right to object to data processing for the purposes of direct marketing. This also applies to profiling where this is connected to direct marketing.

Right to data portability: Provided that the data processing is based on consent or on the fulfilment of a contract and that it is also carried out using automated processing, you have the right to receive your data in a structured, commonly used and machine-readable format and to forward it to another data processor.

Right to withdraw consent: Insofar as the data processing is undertaken based upon consent, you have the right to revoke your consent for the data processing, with future effect at any time, free of charge.

Right to lodge a complaint: You also have the right to lodge a complaint with a supervisory authority (e.g. with the Data Protection Officer for the State of Lower Saxony) regarding our processing of your data.

D. Your points of contact

Points of contact for the exercise of your rights

For information on points of contact for the exercise of your rights and for further information, please visit the following link https://datenschutz.volkswagen.de](https://datenschutz.volkswagen.de.

Data protection officer

Our data protection officer is your point of contact for issues related to data protection:
Datenschutzbeauftragter der Volkswagen AG
Berliner Ring 2, 38440 Wolfsburg, Germany
Email: mailto: dataprivacy@volkswagen.de

Version dated: October 2022

Part II

A. Argentina

1. Applicable law

The processing of the personal data of users of Volkswagen ID from Argentina is subject to the provisions of the Argentinian Personal Data Protection Law No. 25.326 and supplementary regulations ("PDPL").

2. Processing your personal data

The legal basis for processing personal data of Volkswagen ID users from Argentina in accordance with Argentinian law is prior, express and informed consent. You grant your consent by expressly confirming acknowledgement of the Privacy Policy during registration. If you do not agree to the processing described in the Privacy Policy, please leave the Volkswagen ID website and do not register for the Volkswagen ID.

3. Recipients of your personal data and transfer to third countries

We commission service providers to facilitate use of Volkswagen ID and associated services. These service providers are contractually obliged to comply with provisions of data protection law and are not considered third parties as defined by data protection law. Personal data is only passed on to third parties if this is required for contract processing, particularly for providing services.

For the purposes of processing your personal data in the context of use of the Volkswagen ID, Volkswagen AG uses CARIAD SE, with headquarters in Germany, as a processor. CARIAD SE processes your data in a cloud operated by Microsoft Ireland Operations Ltd. in the European Union. It is not possible to rule out Microsoft Corporation or subsidiaries with headquarters in a state outside of the EU/EEA having access to the personal data, so CARIAD SE has concluded corresponding EU standard contractual clauses (a contractual arrangement approved by the European Commission according personal data the same protection for data processing in non-EU countries as in the EU). CARIAD SE processes your personal data exclusively on our behalf and in accordance with our instructions as part of a contract data processing agreement.

B. Bosnia and Herzegovina

The legal basis for the processing of personal data of Volkswagen ID users from Bosnia and Herzegovina in accordance with the law of Bosnia and Herzegovina is the consent granted. You grant your consent by expressly confirming acknowledgement of the Privacy Policy during registration.

Representative for the data controller responsible for data processing in Bosnia and Herzegovina:

Porsche BH d.o.o. Sarajevo
BIH-71000 Sarajevo
Bulevar Meše Selimovića br 16

C. Brazil

1. Applicable law

The Brazilian General Data Protection Law No. 13.709/18 (LGPD) applies to its full extent, and irrespective of the country in which the data controller responsible for processing has its headquarters, to any processing of personal data performed under the following circumstances:

-If the performance of processing takes place on Brazilian territory
-If the purpose of the processing is offering or providing products and services or the processing of personal data encompasses persons who are on Brazilian territory
-If the collection of personal data takes place on Brazilian territory

The LGPD interprets personal data collected on Brazilian territory as personal data whose subjects are on Brazilian territory at the point in time of collection.

1. Recipients of your personal data and transfer to third countries

Service providers who are appointed in conjunction with the processing of your queries and your use of the Volkswagen ID and associated services shall be deemed third parties as defined by the LGPD. This means that the data controller responsible for processing is obliged to disclose the method of processing and responsibilities of all parties who perform processing if a data subject requests information on the method of processing their data.

2. Deviating arrangements for data subjects' rights

In addition to the general right to object described under D. in the Privacy Policy, the LGPD stipulates that the data subject also has the right to oppose the processing of their data if the processing is not in accordance with the provisions of the LGPD and the processing has a legal basis other than consent.

According to the LGPD, the right to data portability means the following: Portability of data to other service providers or product suppliers, expressly by request and safeguarding business and trade secrets, in accordance with the regulation of the supervisory body.

3. Deviating arrangements for data storage

The personal data is erased after processing comes to an end, within the framework of the scope and technical limitations of the activities, and its retention is approved for the following purposes:

-Fulfilment of a legal or official obligation by the controller responsible for processing
-Studies for a research institution whereby the anonymisation of personal data, insofar as is possible, is guaranteed
-Disclosure to third parties, providing the data protection requirements set out in this act are met
-Exclusive use by the owner of the data processing, providing the data is anonymised, whereby access to the data by third parties is prohibited

D. Chile

1. Processing your personal data

The legal basis for processing personal data of Volkswagen ID users from Chile is prior, express and informed consent. You grant your consent by expressly confirming acknowledgement of the Privacy Policy during registration.

2. Deviating arrangements for data subjects' rights

Right to erasure: You have the right to request the erasure of your personal data if the conditions stated in Article 17 GDPR are fulfilled, if your personal data is out-of-date or obsolete, if you supplied your data voluntarily or if you supplied your personal data exclusively for the purposes of obtaining commercial communications and you no longer wish to be listed in a register of this nature. Accordingly, you may request the erasure of your data if it is no longer required for the purposes for which it was collected. You may also request erasure if we process your data on the basis of your consent and you revoke this consent. You may also request the erasure of your data by third parties to whom we have passed on this data.

Right to restriction of processing: You have the right to obtain the restriction of processing of your data if the prerequisites in Article 18 GDPR are met, if you supplied your data voluntarily and if it was supplied exclusively for commercial communications and you no longer wish to be listed in a register of this nature. This is the case, for instance, if you dispute the accuracy of your data. You may then obtain the restriction of processing for as long as it takes to examine the accuracy of your data.

E. India

Complaints officer:

Our complaints officer is available to assist you with any queries and complaints you may have in conjunction with this Privacy Policy. Please address your requests and complaints to:
Volkswagen complaints officer / Volkswagen data protection officer
AG Berliner Ring 2, 38440 Wolfsburg, Germany
dataprivacy@volkswagen.de

F. Japan

Personal data collected from residents of Japan is processed by Volkswagen AG also taking into account the following regulations:

Purpose: We process the personal data in accordance with the purposes set out in this Privacy Policy ("purposes") and use the personal data for no purposes other than these purposes. We notify data

subjects immediately of the purposes (and subsequent changes to them) or make these public, if the purposes have not already been made public

Collection: We shall not obtain any personal data by deceptive, fraudulent or other unlawful means

Accuracy: We shall make adequate efforts to ensure that the personal data we process is accurate and up-to-date and remains within the necessary scope to achieve the purposes

Retention: We shall retain personal data in compliance with the details set out in the "Retention of your data" section of this Privacy Policy and end retention as soon as it can be reasonably assumed that the retention of personal data no longer serves the purposes

Protection: We protect personal data which is in our possession or under our control by taking appropriate safety precautions in order to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal, damage, loss or similar risks. We shall adequately supervise the processing of personal data by our staff, employees, third-party providers and all other parties who process personal data on our behalf

Transfer : Without the prior consent of data subjects, we shall not pass on any personal data to other natural or legal persons, unless there is an exemption in accordance with the Act on the Protection of Personal Information ("APPI")

Extraterritorial transfer: Without the prior consent of data subjects, we shall not transfer or supply any personal data to natural or legal persons outside of Japan, the European Union or the United Kingdom, unless (a) the recipient is in a country or region which has been certified by the Japanese Personal Information Protection Commission ("PPC") as a country or region with data protection standards equivalent to those of Japan, or (b) the recipient has data protection standards which are equivalent to the standards set out by the PPC

Rights of data subjects: If, in accordance with the APPI, a data subject requests the disclosure of the purposes, access to, rectification or erasure of personal data of which they are the subject, or lodges a complaint, we shall respond without delay and in compliance with the APPI to any such request or complaint. Any fee charged to the subject must be appropriate.

G. Mexico

1. Legal basis for processing personal data

The legal basis for processing personal data of Volkswagen ID users with Mexican citizenship is prior, express and informed consent. You grant your consent by expressly accepting the Terms of Use and confirming acknowledgement of the Privacy Policy during registration.

2. Sensitive personal data

In the context of processing your personal data, the following sensitive personal data is affected:

-Information from national and international sanctions lists
-Criminal offences

We hereby inform you that the processing of this sensitive personal data only takes place for the following purposes:

-Fulfilment of legal obligations arising from the Anti-Money Laundering Law or European
-embargo and terrorism regulations
-Customer identification
-Creation and management of the Volkswagen ID user account
-Use of the Volkswagen ID user account for services from Volkswagen AG and third parties

Volkswagen AG has access to these national and international sanctions records through public databases which can be viewed by data subjects on the following websites: https://www.bafin.de/DE/Aufsicht/Geldwaeschepraevention/Laender_und_Sanktionslisten/Laender_und_Sanktionslisten_node.html

https://eeas.europa.eu/topics/sanctions-policy/8442/consolidated-list-of-sanctions_en.htm

3. Transfer of personal data

Third-party recipient	Transferred personal data	Purposes for using personal data
Amazon Web Services EMEA SARL	-The processing of personal data for the purposes of product optimization -The processing of personal data for the purposes of advertising optimisation	-Volkswagen ID service provision -Product optimization -Advertising optimisation
Microsoft Ireland Operations Ltd.	-The processing of personal data in connection with the provision of services by Volkswagen ID	-Volkswagen ID service provision
Salesforce.com EMEA Ltd.	-The processing of personal data for the purposes of optimising the Customer Interaction Center (Customer Care) -The processing of personal data for the purposes of advertising optimisation	-Customer Care -Advertising
CARIAD SE	-The processing of personal data in conjunction with Volkswagen ID service provision -The processing of personal data for the purposes of product optimization -The processing of personal data for the purposes of advertising optimization -The processing of personal data for the purposes of optimising the Customer Interaction Center (Customer Care) -The processing of personal data for the purposes of advertising optimisation	- Volkswagen ID service provision -Product optimization -Advertising optimization -Customer Care -Advertising

4. ARCO rights

You have the right to learn which personal data Volkswagen AG processes and for which purposes and under which conditions Volkswagen AG processes said data. You also have the right to request rectification or amendment of your personal data if it is not up-to-date or is inaccurate or incomplete (right to rectification), to erase your personal data from our records and databases if you believe that it is not being processed in accordance with the principles, duties and obligations set out in the Mexican Data Protection Law (right to erasure), and to object to the processing of your personal data for specific purposes (right to object). These rights are commonly known as ARCO rights.

To exercise your ARCO rights, you must send a written document to Volkswagen AG, Berliner Ring 2, 38440 Wolfsburg, Germany or via email to Proteccion.DatosPersonales@volkswagen.de with the following information at a minimum:

-Name, surname and indication of a channel of communication for receiving correspondence
-Copy of your official ID
-Explicit information from Volkswagen on the ARCO right you wish to exercise
-Personal data that is the object of the ARCO right being exercised
-Any other information that helps Volkswagen find your personal data

If the ARCO right is exercised by a legal representative, the legal identity of the signatory must be proven.

Data subjects' requests are processed and answered in accordance with Article 32 of the Mexican Data Protection Law. Once your request has been received, Volkswagen AG shall inform you of its approval or refusal in the subsequent 20 days and make the decision on authorisation within the next 15 days following notification of approval. If your application does not meet all the requirements set out here (with the exceptions of points I or II) within the first five days of receipt of your application, Volkswagen AG is entitled to make a request for information in order to meet all requirements. In that event, you shall be granted a period of 10 days to meet any such requirement, otherwise your application shall be deemed not to have been made.

If you do not receive any answer or response from Volkswagen AG in accordance with the procedure set out above, you have the right to lodge a complaint against Volkswagen with the Mexican data protection authority (INAI). More information can be found at the website www.inai.org.mx. For more information on the procedure for exercising your ARCO rights, please contact our data protection department by sending an email to Proteccion.DatosPersonales@volkswagen.de.

H. South Africa

Obligation to disclose your personal data: You are required to supply us with certain personal data in order to obtain access to certain services. If the provision of personal data is obligatory to obtain or access a service, you may only access the service and/or use it to its full extent if you have supplied us with the personal data.

The definition of data subjects: In conjunction with South Africa, the term "data subject" pertains to any "person" to whom personal data pertains. For South African purposes, a person refers to a natural person or legal entity. Accordingly, all references to data subjects in this data protection policy refer to natural persons and legal entities alike, if the data subject is resident in South Africa.

Transfer of personal data to third parties outside of South Africa: From time to time, we may transfer your personal data to a place of jurisdiction other than the one in which it was collected and/or need to save it there, and we hereby inform you that this place of jurisdiction may not have comparable data protection legislation.

Your right to lodge a complaint: If the Protection of Personal Information Act, 2013 ("POPIA") enters into force, you have the right to lodge a complaint regarding a breach of POPIA with the information regulator inforeg@justice.gov.za.

I. Switzerland

The provisions in Part I apply to you as a Swiss customer – whether a natural or legal person – without restriction, unless otherwise agreed below on the basis of the Federal Data Protection Act (DSG).

If this Privacy Policy makes reference to a "legitimate interest", we are hereby referring to our overriding private interest in processing your data in conjunction with the conclusion or provision of our services as part of the Volkswagen identity (Article 13, paragraph 2, letter a GDPR).

If this Privacy Policy makes reference to your "consent", we are referring to your explicit and voluntary consent that was granted on the basis of adequate information provided by us (Article 4, paragraph 5 DSG).

Certain types of data processing are subject to EU standard contractual clauses or are protected by the EU-US Privacy Shield and BCR (Binding Corporate Rules) of Salesforce, which are both in compliance with Swiss data protection law and also cover the personal data of people with permanent residence in Switzerland through the Swiss-US Privacy Shield.

You are entitled to the rights set out in this Privacy Policy, with the following changes:

Right to erasure: You have the right to obtain the erasure of inaccurate data without specific conditions needing to be fulfilled (Article 5, paragraph 2 DSG); -Right to

object: You have the right to object to the processing of your data at any time and without giving reasons (Article 12, paragraph 2, letter b DSG)

Right to lodge a complaint: You have the right to lodge a complaint with the Federal Data Protection and Information Commissioner regarding the processing of your data if the method of processing is capable of breaching the privacy of a larger number of persons (system errors; Article 29, paragraph 1, letter a DSG)