Privacy policy

In the following, we inform you about the processing of your personal data ("data") by us and the claims and rights to which you are entitled under the data protection regulations.

Version: December 2025

Volkswagen AG
Berliner Ring 2
38440 Wolfsburg
vw@volkswagen.de
registered in the commercial register of the Braunschweig District Court under the number HRB 100484 (hereinafter "Volkswagen AG or VW AG")

We process data that we generally receive from you. Relevant personal data is regularly the following:

• Private contact and master data
  • Name, address, e-mail
• Professional work and organizational data
  • Contact details (professional): name, address, e-mail, telephone number, company
  • Work Organization Assignment: Area, Department, Personnel Numbers, Responsibilities
• IT usage data
  • User and login data: username, roles, permissions
  • Logging data: Technical logs, login times
  • Software and hardware data: IP address, MAC address, computer name

In addition, to the extent necessary for the performance of obligations imposed by law or the authorities, we process data that we have lawfully received from authorities (e.g. on the basis of legal authority, to execute orders, to fulfil contracts or on the basis of consent given by you).

Furthermore, we process data that we have lawfully collected from publicly accessible sources (e.g. commercial and association registers, company directories, credit agencies, credit bureau, press, publications, Internet) as well as from other sources (e.g. municipalities, other persons commissioned by you, authorities) and are allowed to process.

You only have to provide the data that is necessary for the initiation, establishment, implementation and termination of a business relationship or that we are legally obliged to collect. Without this data, we will usually have to refuse to conclude a contract or execute an order, or we will not be able to perform an existing contract or service.

If we are asking you for your consent to the processing of your personal data, such consent will always be voluntary. However, if you do not give your consent, we might not be able to provide a particular service, if the relevant service cannot be provided without such data.

3.1. General

In principle, the processing of your data can be carried out on the basis of the following legal bases:

• If you have given us your consent in accordance with Art. 6 para. 1 lit. a) GDPR for certain purposes (e.g. advertising, market or opinion research, or the recording and publication of recordings), the lawfulness of the processing on the basis of consent is given.
  A given consent can be withdrawn at any time. A withdrawal is only effective for the future. Processing that took place before the withdrawal remains unaffected.
• The processing is necessary for the initiation and/or performance of a contract to which you are a party or to which you represent a contracting party, or for the implementation of pre-contractual measures that are taken upon request, Art. 6 (1) (b) GDPR.
• The processing is necessary for compliance with a legal obligation under EU law or the law of an EU member state to which Volkswagen AG is subject, Art. 6 (1) (c) GDPR.
• The processing is necessary to protect your vital interests or those of another natural person, Art. 6 para. 1 lit. d) GDPR.
• The processing is necessary for the performance of a task that is in the public interest or is carried out in the exercise of official authority vested in Volkswagen AG, Art. 6 (1) (e) GDPR.
• The processing is necessary to safeguard the legitimate interests of Volkswagen AG or a third party, unless your interests or fundamental rights and freedoms, which require the protection of personal data, prevail over Art. 6 (1) (f) GDPR.

If special categories of personal data are processed, this may be done differently on the following legal bases:

• You have given your explicit consent, Art. 9 para. 2 lit. a) GDPR.
• The processing is necessary to protect your vital interests or those of another natural person and the data subject is unable to give his or her consent for physical or legal reasons, Art. 9 para. 2 lit. c) GDPR.
• The processing refers to data that you have obviously made public, Art. 9 para. 2 lit. e) GDPR.
• The processing is necessary for the establishment, exercise or defence of legal claims, Art. 9 para. 2 lit. f) GDPR.
• The processing is necessary for reasons of substantial public interest, Art. 9 para. 2 lit. g) GDPR,
• The processing is necessary for the purposes of preventive health care or occupational medicine, e.g. for the assessment of the ability to work, Art. 9 para. 2 lit. h) GDPR.

3.2. Data processing

Within Volkswagen AG, only those departments will have access to your data that need it to fulfil the above-mentioned purposes.

A transfer to third parties will only take place if this is necessary for the aforementioned purposes and a legal basis exists or if you have given your prior consent. If Volkswagen AG has commissioned service providers for the processing of data or the associated provision of services, the transfer is usually carried out on the basis of a data processing agreement in accordance with Art. 28 GDPR or there are professional obligations that ensure a sufficient level of data protection.

The following categories of recipients may receive data:

• Service providers/suppliers
  • Vehicle/component manufacturers/suppliers
  • Hosting service providers
  • Technical support service providers
  • Consulting companies/service providers
• Media companies/press

As a rule, your data will be processed within the EEA (European Economic Area), to which the GDPR applies without restriction. As a globally active company, it is necessary in exceptional cases to store and process data outside the EU. In individual cases, data may also be passed on to authorities and courts in third countries.
Please note that not all third countries have an adequate level of data protection recognised by the European Commission. Unless an adequacy decision has been made by the European Commission, Volkswagen AG will only transfer your data to third countries if this is permissible under Art. 44 – 49 GDPR. To the extent that Volkswagen AG relies on appropriate safeguards in accordance with Article 46 para. 2 GDPR for the transfer to third countries (e.g. standard contractual clauses or binding corporate rules), Volkswagen AG will take additional technical and/or organizational measures if this is necessary to maintain adequate protection of your data. The agreements with processors regularly provide for the conclusion of standard contractual clauses of the European Commission to ensure an adequate level of data protection. You can obtain a copy of the specifically applicable or agreed regulations to ensure the appropriate level of data protection from us. Please use the information in section B. VII for this purpose.

Where necessary, we process and store your data for the purposes mentioned. If the purpose has been fulfilled and there are no retention obligations, the data will be deleted regularly. It should be noted that a business relationship is usually a permanent relationship, which is usually designed for years.

You can independently change the topics and the subscription settings for your E-Mail Services at any time for the future by entering your email address, either via the Subscription Services page or by clicking the “Change Subscription” button included in every email sent through the service. You may also cancel your subscription to all mailings from the E-Mail Service at any time by contacting Volkswagen AG, for example, by using the “Delete Email Subscription” button included in every email or by sending an E-mail to: vw@volkswagen.de.

In addition, we are subject to various retention and documentation obligations, which result from the German Commercial Code and the German Fiscal Code, among others. The retention and documentation periods specified there are up to 15 years for VW AG.

Finally, the storage period is also assessed according to the statutory limitation periods, which, for example, according to §§ 195 et seq. of the German Civil Code, can usually be three years, in exceptional cases up to thirty years.

If you have general questions about this privacy policy or the processing of your data by Volkswagen AG, you can contact our Data Protection Officer Dr. Oliver Draf, using your own language via:

• Post: Volkswagen AG, Data Protection Officer, Berliner Ring 2, 38440 Wolfsburg, Germany
• E-mail: privacy@volkswagen.de
  
• Phone: 00800-8932836724889 (00800-VWDATENSCHUTZ)

What rights do you have?

You have the following rights vis-à-vis us, subject to the respective legal requirements:

• Right to information (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure or "right to be forgotten" (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR).

Furthermore, you have the right to contact a data protection supervisory authority at any time in accordance with Art. 77 GDPR if you believe that the processing of the data concerning you violates applicable law. The address of the data protection supervisory authority responsible for VOLKSWAGEN is:

Der Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover
Deutschland / Germany

However, you can also lodge a complaint with any other data protection supervisory authority competent for you within or outside the EU, in particular with the one in the Member state of your habitual residence, place of work or place of the alleged infringement. Please find hereinafter a link where you can find all contact details of the national authorities in all member states: https://edpb.europa.eu/about-edpb/board/members_en.

Right to object

You have the right to object to the processing of your data,

• if the processing is carried out for direct marketing purposes (including profiling for direct marketing purposes) or

• if the processing (including profiling) is necessary to protect the legitimate interests of us or a third party (Art. 6 para. 1 lit. f GDPR). In the event of such an objection, we ask you to inform us of your reasons for objecting to the data processing. We will no longer process your data in the event of your objection, unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Please send your objection and, if necessary, the reasons for it to Volkswagen AG, Berliner Ring 2, 38440 Wolfsburg, by e-mail to privacy@volkswagen.de or via our data protection portal https://datenschutz.volkswagen.de/.

Asserting your rights

If you want to assert your rights as a data subject, please use the data protection portal or the other contact options provided.

• https://datenschutz.volkswagen.de/
• via mail: Volkswagen AG, Privacy Team, Berliner Ring 2, 38440 Wolfsburg, Germany
• via e-mail: privacy@volkswagen.de
  
• via telephone: 00800-8932836724889 (00800-VWDATENSCHUTZ)

Please note that the data protection level of GDPR, as described above, displays the baseline requirements. If country-specific data subject rights apply or further information on processing or contact persons are required, you will find these in the following country-specific supplements.

Albania
Besides, from the legal bases described in Part I the legal bases for processing personal data under Albania law is a consent given by the data subjects. The consent of the data subjects is given either by registering for the mobile online services, after they have confirmed that they have read and accepted the Privacy Policy, or by using the vehicle in knowledge of the data processing.

In addition or rather supplementary to your rights listed above under B. VII. the following applies

You have the right to file a complaint regarding the processing of your personal data to the Information and Data Protection Commissioner (https://www.idp.al/?lang=en) as the competent data protection authority.

Contact person for exercising your rights:
If you wish to exercise your rights in relation to the processing of your personal data, you can contact us using the contact details above or via the authorized local contact person using the contact details below.

Data controller representative in Albania:
Porsche Albania Sh.p.k
Autostrada Tirane-Durres
Km. 3, Tirane,1051
dataprotection@porsche.al

Andorra
In addition or rather supplementary to your rights listed above under B. VII. the following applies

You have the right to file a complaint regarding the processing of your personal data at the Andorran Data Protection Agency (https://www.apda.ad).

Argentina
Personal data means any information relating to an identified or identifiable natural or, if intended under local law, legal“ person, including, as the case may be, sensitive personal data as defined under the laws of the country where you are located at the relevant time (‘data subject’); a data subject is one that can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

In addition or rather supplementary to your rights listed above under B. VII. the following applies

You have the right to file a complaint regarding the processing of your personal data at THE PUBLIC INFORMATION ACCESS AGENCY, which, depending on the facts of the individual case, in its capacity as the Control Entity of Law No. 25,326, has the power to attend complaints and claims filed by those whose rights are affected due to breaches with applicable regulations on personal data protection.

Australia
In addition or rather supplementary to your rights listed above under B. VII. the following applies.

You have the right to lodge a complaint at the Office of the Australian Information Commissioner (“OAIC”) or any other dispute recognition scheme recognised by the OAIC which can be found on the OAIC website www.oaic.gov.au.

If you are concerned with the way we have handled your personal data, you may lodge a privacy complaint with the Office of the Australian Information Commissioner (“OAIC”). However, it is a requirement of the OAIC that prior to lodging a complaint, you have raised your complaint with us. If you are not satisfied with our response or we fail to provide a response within 30 days of receipt, you can lodge a complaint with the OAIC. The contact details for the OAIC are set out below:

Phone: 1300 363 992
Fax: (02) 9284 966
Website: https://www.oaic.gov.au/
Post: GPO Box 5288, Sydney NSW 2001, Austalia

Bosnia and Herzegovina
In deviation from the legal bases described in Part B the legal bases for processing personal data under the law of Bosnia and Herzegovina is a consent given by the data subjects. The consent of the data subjects is given either by registering for the mobile online services, after they have confirmed that they have read and accepted the Privacy Policy, or by using the vehicle in knowledge of the data processing.

Contact person for exercising your rights:
If you wish to exercise your rights in relation to the processing of your personal data, you can contact us using the contact details above or via the authorized local contact person using the contact details below.

PORSCHE BOSNA I HERCEGOVINA
Porsche BH d.o.o. Sarajevo
Porsche Inter Auto BH d.o.o. Sarajevo
BIH-71000 SARAJEVO | Bulevar Meše Selimovića 16
Bosnia and Herzigovina
zastita.podataka@porschebh.ba

Brazil
In addition or rather supplementary to your rights listed above under B. VII. the following applies.

You have the right to lodge a complaint before ANPD (Autoridade Nacional de Proteção de Dados) against the data controller.

Colombia
In addition or rather supplementary to your rights listed above under B. VII. the following applies.

You have the right to file a complaint to the Superintendence of Industry and Commerce complaints for infractions to the provisions of Law 1581 of 2012 as amended, added to or supplemented from time to time.

Faroe Islands
In addition or rather supplementary to your rights listed above under B. VII. the following applies.

You have the right to file a complaint regarding the processing of your personal data at the Data Protection Authority in the Faroe Islands, Dátueftirlitið. You can find the Data Protection Authority’s contact information here: www.dat.fo.

France
To the extent the access to the data and the data processing fall within the scope of the data protection laws of France, you also have the right to define directives concerning the fate of your personal data after your death (post-mortem right).

India
In addition or rather supplementary to your rights listed above under B. VII. the following applies.

You have the right to nominate (this right allows individuals to choose another person who can act on their behalf and exercise their rights under the DPDP Act in case they are unable to do so themselves due to death or incapacity).

The Data Protection Officer is the Grievance Officer for VOLKSWAGEN AG. For the contact details please see above.

Israel
The data subject rights listed above under the GDPR apply mutatis mutandis to the Protection of Privacy Law, 5741-1981 and the regulations enacted therefrom.

Japan
Personal information obtained from residents in Japan (“Personal Data”) shall be handled in accordance with the following rules in addition to the rules set forth in Part B of this Privacy Policy.

1. Purpose: We will handle the Personal Data in accordance with the Purposes set forth in Part B of this Privacy Policy (“Purposes”), and not use Personal Data for any purpose other than such Purposes. We shall promptly notify the relevant data subjects, or disclose to the public of the Purposes (and any subsequent changes thereof), unless the Purposes have already been disclosed to the public;
2. Collection: We will not obtain any Personal Data through any deceptive, fraudulent, or other wrongful means;
3. Accuracy: We will make reasonable efforts to ensure that Personal Data handled by us is accurate and up to date and within the scope necessary to achieve the Purposes;
4. Retention: We will retain Personal Data in accordance with Section A.IV of Part I, and cease retention as soon as it is reasonable to assume that the Purposes are no longer being served by retention of Personal Data;
5. Protection: We will protect Personal Data in its possession or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal, damage, loss or similar risks. We will adequately supervise processing of Personal Data by our officers, employees, third party vendors and any other parties who process Personal Data on our behalf;
6. Transfer: Without obtaining the prior consent of the relevant data subjects, we will not transfer or provide any part of Personal Data to any individual or entity unless an exception under the APPI applies.
7. Extraterritorial Transfer: Without obtaining the prior consent of the relevant data subjects, we will not transfer or provide any part of Personal Data to any individual or entity located outside Japan, European Union or the United Kingdom unless (a) a transferee is located in a country or area certified by the Personal Information Protection Commission of Japan ("PPC") as having data protection standards equivalent to those of Japan or (b) the transferee has data protection standards equivalent to the standards specified by the PPC; and,
8. Data Subject's Right: If a data subject requests pursuant to the APPI disclosure of Purposes, access to, correction, or deletion of any of Personal Data relevant to such data subject, or lodge a complaint, we will respond to such request or complaint promptly and in accordance with the APPI. Any fee charged to data subjects shall be reasonable.

In addition or rather supplementary to your rights listed above under B. VII. the following applies

You have the right to file a complaint regarding the processing of your personal data at the Japanese authority, PPC as below:

Personal Information Protection Commission, Government of Japan (PPC),
Kasumigaseki Common Gate West Tower 32nd Floor, 3-2-1, Kasumigaseki, Chiyoda-ku,
Tokyo, 100-0013, Japan
TEL: +81-3-6457-9680

In addition to our information regarding potential recipients above under B. IV., the following applies:

1. Processors

Third-party service providers engaged by us and working on our order to support data processing on behalf of VOLKSWAGEN AG and not for any of its own purposes (so-called “processors”) may also receive data for these purposes. This includes:

2. Third parties

Beyond this, we do not disclose your personal data to recipients or categories of recipients who are acting as controllers.

3. Third country transfers

The Information on the transfer to third countries above under B. V. apply mutatis mutandis to the Japanese Act on the Protection of Personal Information.

As a rule, all recipients are located in Japan and/or EU Member States and the Japanese government has recognized the adequacy of EU standards for the protection of personal data.

A transfer of data to third countries (i.e. countries that are neither members of the European Union nor of the European Economic Area) may take place to the extent this is required for the provision of services to you, is required by law, or you have given us your consent (in the absence of any other appropriate safeguarding mechanism under applicable law). In these cases, Volkswagen AG will take additional technical and/or organizational measures if this is necessary to ensure adequate protection of your data. The agreements with recipients or processors regularly provide for the conclusion of standard contractual clauses of the European Commission in order to ensure an adequate level of data protection.

Liechtenstein
To the extent the access to the data and the data processing fall within the scope of the data protection laws of Liechtenstein, references to the European Union (EU) are to be interpreted as references to the European Economic Area (EEA).

Malaysia
In addition or rather supplementary to your rights listed above under B. VII. the following applies.

Upon exercising your rights stated above in written form addressed to the contact details listed in this section above, if you are dissatisfied with our response or we fail to provide a response within 21 days of receipt, you have the right to submit an application to the Personal Data Commissioner to require us to comply with your request. The application to the Personal Data Commissioner can be made to the following address:

Commissioner of Personal Data Protection, 6th Floor, KKMM Complex Lot 4G9, Persiaran Perdana, Presint 4 Federal Government Administrative Centre 62100 Putrajaya.

In the event of any inconsistencies between the English version and the Bahasa Malaysia version of this privacy notice, the English version shall prevail.

Mexico
In addition or rather supplementary to your rights listed above under B. VII. the following applies.

You have the right to:

• oppose;
• file data protection measures with the Federal Institute for Access to Information and Data Protection;
• request a reconsideration of a decision made via automated decision making in case you are of the opinion that the data processed in this context is (partly) incomplete or incorrect.

Monaco
In addition or rather supplementary to your rights listed above under B. VII. the following applies.

You have the right to file a complaint regarding the processing of your personal data at the Commission de Contrôle des Informations Nominatives (CCIN), located at 11 rue du Gabian, 98000 Monaco.

Montenegro
Contact person for exercising your rights:

If you wish to exercise your rights in relation to the processing of your personal data, you can contact us using the contact details above or via the authorized local contact person using the contact details below.

Porsche Leasing doo
Member of Porsche Bank Group
Josipa Broza Tita 67
81000 Podgorica, Montenegro
info@porscheleasing.me

New Zealand
In addition or rather supplementary to your rights listed above under B. VII. the following applies.

You have the right to:

• a response to your request within 20 working days, if you make a request for access to or rectification of your personal information. In limited circumstances, VOLKSWAGEN may extend this 20 working day time limit, but we must tell you the period of the extension and the reasons for the extension.
• lodge a complaint with both VOLKSWAGEN and the Privacy Commissioner. However, it is a requirement that before you can complain to the Privacy Commissioner you must first raise your complaint with VOLKSWAGEN. If you are not satisfied with VOLKSWAGEN’s response or you do not receive a response, you can lodge a complaint to the Privacy Commissioner. In general, you should wait at least 30 working days for a response before contacting the Privacy Commissioner to lodge a complaint.

North Macedonia
In addition or rather supplementary to your rights listed above under B. VII. the following applies.

You have the right to file a complaint regarding the processing of your personal data at the Agency for Personal Data Protection of North Macedonia (https://azlp.mk/).

Contact person for exercising your rights:
If you wish to exercise your rights in relation to the processing of your personal data, you can contact us using the contact details above or via the authorized local contact person using the contact details below.:

Porsche Macedonia DOOEL, Skopje
Blvd. Bosnia and Herzegovina 4
1000 Skopje
North Macedonia
Email: valentina.jovanovska@porsche.com.mk

San Marino
In addition or rather supplementary to your rights listed above under B. VII. the following applies.

To the extent the access to the data and the data processing fall within the scope of the data protection laws of San Marino, pursuant to Article 13(1)(f) of Law n. 171 of 2018, we specify that, considering the data controller’s intention to transfer personal data to third countries or international organizations, the following means by which to obtain a copy of them or information on where they have been made available are provided:

• You can contact us for exercising your rights, including the right to access your data and to obtain a copy of them, via the contact details provided above.
• The EU standard contractual clauses used can be accessed in EU languages at https://eur-lex.europa.eu/legal-content/it/TXT/?uri=CELEX%3A32021D0914.

You have the right to file a complaint regarding the processing of your personal data at at the Data Protection Authority of San Marino (https://www.garanteprivacy.sm/).

Serbia
In addition or rather supplementary to your rights listed above under B. VII. the following applies.

• You have the right to be informed about appropriate safeguards in case of a data transfer to countries or international organizations outside Serbia that do not provide an adequate level of data protection recognized by a Serbian Government Decision. All EU / EEA Member states provide an adequate level of data protection recognized by a Serbian Government Decision.
• You have the right to file a complaint regarding the processing of your personal data at the Commissioner for Information of Public Importance and Personal Data Protection (https://www.poverenik.rs/sr-yu/kontakt.html), as the supervisory authority for personal data protection in the Republic of Serbia.

Contact person for exercising your rights:
If you wish to exercise your rights in relation to the processing of your personal data, you can contact us using the contact details above or via the authorized local contact person using the contact details below.:

PORSCHE SCG DOO BEOGRAD
Zrenjaninski put 11
11210 Beograd
Serbia
Email: zastita.podataka@porschescg.rs

Singapore
The data subject rights listed above under the GDPR apply mutatis mutandis to the Singapore's Personal Data Protection Act 2012.

South Africa
Personal data means any information relating to an identified or identifiable natural or, if foreseen under local law, legal“ person, including, as the case may be, sensitive personal data as defined under the laws of the country where you are located at the relevant time (‘data subject’); a data subject is one that can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

In addition or rather supplementary to your rights listed above under B. VII. the following applies.

You have the right to

• not have your personal data processed for the purposes of direct marketing by unsolicited electronic communication;
• initiate civil proceedings;
• be informed if your personal information has been compromised;
• be informed, free of charge and before the information is included in a directory, should you be a subscriber to a printed or electronic directory;
• lodge a complaint to the Information Regulator of South Africa by completing this form and sending it to POPIAComplaints@inforegulator.org.za.

For further information about your South African data privacy rights, please click https://inforegulator.org.za/ which will take you to the website of the Information Regulator.

South Korea
Personal data means any information relating to an identified or identifiable natural person, including, as the case may be, sensitive personal data as defined under the laws of the country where you are located at the relevant time (‘data subject’); a data subject is one that can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

In addition to our information regarding potential recipients above under B. IV., the following applies:

1. Processors

Third-party service providers engaged by us and working on our order to support data processing on behalf of VOLKSWAGEN AG and not for any of its own purposes (so-called “processors”) may also receive data for these purposes. This includes:

2. Third parties

Beyond this, we do not disclose your personal data to recipients or categories of recipients who are acting as controllers.

In addition or rather supplementary to your rights listed above under B. VII. the following applies:

The data subject rights listed above under the GDPR apply mutatis mutandis to the Korean Personal Information Protection Act.

You (or your legal representative) can exercise such rights by contacting us or our data protection officer using the contact details set out in this Section above.

Certain personal data may be retained for compliance with local laws and regulations for certain periods where applicable, such as the following:

• All transaction records and relevant documentary evidence as prescribed by applicable tax laws: 5 years (as required under the Framework Act on National Taxes and the Corporate Tax Act)
• Records of logins: 3 months (as required under the Protection of Communications Secrets Act)
• Records on labels and advertisements: 6 months (as required under the Act on Consumer Protection in Electronic Commerce)
• Records on revocation of contracts or cancellation of orders/purchases, payments, provision of products and services: 5 years (as required under the Act on Consumer Protection in Electronic Commerce)
• Records on handling of customer complaints or disputes: 3 years (as required under the Act on Consumer Protection in Electronic Commerce
• The process and method for destroying personal data are set forth below.
  • Process of destruction: We select the relevant personal data to be destroyed and destroy it with the approval of our Data Protection Officer.
  • Method of destruction: We destroy personal data recorded and stored in the form of electronic files by using a technical method (e.g., low level format) to ensure that the records cannot be reproduced, while personal data recorded and stored in the form of paper documents shall be shredded or incinerated

If it is necessary to retain personal data for a period longer than the legal retention periods described herein, to the extent required by the laws of the applicable country, we shall obtain the data subject’s consent for such longer retention of personal data.

Spain
To the extent that access to and processing of data falls within the scope of Spanish data protection law, please note that your personal data will be deleted after the statutory retention period has expired if the legal basis for processing your personal data no longer applies (in particular if you withdraw your consent), if the processing of your personal data is no longer necessary for the respective purpose or if the purpose itself no longer applies.

Switzerland
To the extent data processing falls within the scope of the Swiss Federal Act on Data Protection (FADP), (a) the scope of "personal data" shall be determined in accordance with the FADP, and (b) references to the GDPR shall be understood as references to the FADP.

In addition or rather supplementary to your rights listed above under B. VII. the following applies.

You have the right to file a complaint regarding the processing of your personal data at the Swiss Federal Data Protection and Information Commissioner (FDPIC) https://www.edoeb.admin.ch/edoeb/en/home.html.

Contact person for exercising your rights:

If you wish to exercise your rights in relation to the processing of your personal data, you can contact us using the contact details above or via the authorized local contact person using the contact details below.

AMAG Group AG
Alte Steinhauserstrasse 12
6330 Cham, Switzerland

Turkey
Personal data means any information relating to an identified or identifiable natural person, including, as the case may be, sensitive personal data as defined under the laws of the country where you are located at the relevant time (‘data subject’); a data subject is one that can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

In addition to our information regarding potential recipients above under B. IV., the following applies:

1. Processors

Third-party service providers engaged by us and working on our order to support data processing on behalf of VOLKSWAGEN AG and not for any of its own purposes (so-called “processors”) may also receive data for these purposes. This includes:

2. Third parties

Beyond this, we do not disclose your personal data to recipients or categories of recipients who are acting as controllers.

In addition or rather supplementary to your rights listed above under B. VII. the following applies:

You have statutory rights under Art. 11 of the Turkish Data Protection Law, in particular the right to

• request reporting of the operations carried out which are rectification of the incomplete or inaccurate data, if any and the erasure or destruction of your personal data) to third parties to whom your personal data have been transferred;
• claim compensation for the damage arising from the unlawful processing of your personal data;
• object to the occurrence of a result against yourself by analyzing the data processed solely through automated systems,
• lodge a complaint with the

Turkish Data Protection Authority (Kişisel Verileri Koruma Kurumu)
Nasuh Akar Mahallesi 1407. Sok. No:4, 06520 Çankaya/Ankara/Turkey.

The objection can be exercised in the forms stated in Article 5/1 of the Comminuque On The Principles and Procedures for the Request To Data Controller.

You have the right to also contact the Data controllers representative in case of any query related to the processing of your data and your data subject rights:

Hergüner Bilgen Üçer Attorney Partnership
Büyükdere Caddesi 199
Levent 34394
Istanbul – Turkey
(+90) 212 310 18 00
info@herguner.av.tr