A. Scope of the privacy policy
This privacy notice explains how we, AUDI AG, Auto-Union-Str. 1, 85057 Ingolstadt, Deutschland / Germany (”We” or ”Audi”) process your personal data in connection with the purchase and subsequent use of Audi brand vehicles. Information about data processing in connection with the use of other products and services, such as myAudi and Audi connect services, is provided in separate privacy notices. Your Audi partner will also inform you separately about how they process your data.

Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

B. General Information
I. Who is responsible for data processing?
The controller for the processing within the meaning of Art. 4 (7) GDPR responsible for the processing of your personal data is:
AUDI AG, Auto-Union-Str. 1, 85057 Ingolstadt, Deutschland / Germany.

II. Who can I contact?
If you want to assert your data protection rights, please use the contact options on
https://gdpr.audi.com

On this page, you will find further information on how you can assert your data protection rights. You can also contact us by post at the following address:
AUDI AG, DSGVO-Betroffenenrechte / GDPR Data Protection Rights, Auto-Union-Straße 1, 85057 Ingolstadt,
Deutschland / Germany.

III. Contact details of the data protection officer
If you have any concerns about data protection, you can also contact our company’s Data Protection Officer:
AUDI AG Data Protection Officer, Auto-Union-Strasse 1, 85045 Ingolstadt, Germany
E-mail: datenschutz@audi.de

IV. Which rights do I have?
Depending on your jurisdiction, as a data subject, you have the following rights in relation to your personal data:

Information: You have the right to request information about the personal data pertaining to you that is stored by AUDI AG as well as about the scope of data processing and data transfer performed by AUDI AG and to obtain a copy of your stored personal data.

Rectification: You have the right to request immediate correction of information pertaining to you that is incorrect as well as completion of any incomplete personal data that AUDI AG has on file for you.

Erasure: You have the right to request immediate deletion of the personal data on file for you at AUDI AG if the statutory requirements for doing so have been met.
This is the case, in particular, if:
• Your personal data are no longer necessary in relation to the purposes for which
they were collected or otherwise processed.
• The sole legal basis for processing such data was your consent, and you have
withdrawn such consent.
• You have objected to the processing for personal reasons on the legal basis of a
balancing of interests and we cannot prove that there are overriding legitimate
interests in favour of the processing.
• Your personal data was processed unlawfully.
• Your personal data must be erased in order to comply with legal requirements.

If we have transmitted your data to third parties, we will inform them about the erasure
to the extent required by law.

Please note that your right to erasure is subject to certain limitations. For example, we
may not and/or must not erase data that we are still required to retain in line with
statutory retention obligations. In addition, your right of erasure does not extend to data that we need in order to assert, exercise or defend against legal claims.
if there are no reasons for further storage.

Restriction of processing: Under certain conditions, you have the right to request that processing be restricted (i.e. the marking of stored personal data with the aim of restricting its processing in the future). The requirements are:
• The accuracy of your personal data is contested by you and AUDI AG must verify
the accuracy of the personal data.
• The processing is unlawful, and you reject the deletion of the personal data and
instead request the restriction of its use.
• AUDI AG no longer needs the personal data for the purposes of processing, but
you require the data to establish, exercise or defend your legal claims.
• You have objected to processing pending the verification of whether the
legitimate grounds of AUDI AG override your legitimate grounds.

Where processing has been restricted, such data will be marked accordingly and, with the exception of storage, will be processed only with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the EU or an EU Member State.

Data portability: To the extent that we automatically process your personal data that you have provided to us based on your consent or any contract with you (including your employment contract), you have the right to receive such data in a structured, commonly used and machinereadable format and have the right to transmit that data to another controller without hindrance from AUDI AG. You also have the right to have the personal data transmitted directly from AUDI AG to another controller where technically feasible, provided that such transmission does not adversely affect the rights and freedoms of others.

Right to object: If we process your personal data on grounds of legitimate interests or in the public interest, you have the right to object to the processing of your personal data on grounds relating to your particular situation. In addition, you have an unrestricted right to object if we process your data for our direct marketing purposes. Please see our separate note in the section titled “Information about your right to object”.
In certain cases, we also grant you an additional unrestricted right to object when
balancing interests. We also inform you about this in the Section “Information about your right to object”.

Withdrawal of consent: If you have given consent to the processing of your personal data, then you can withdraw such consent at any time. Please note that the withdrawal applies prospectively only. Processing that occurred before the withdrawal of consent is unaffected.

Complaint: Furthermore, you have a right to file a complaint with a data protection authority (Datenschutzaufsichtsbehörde) if you believe that the processing of your personal data is unlawful. The right to file a complaint is without prejudice to any other administrative or judicial remedies. The address of the data protection supervisory authority responsible
for AUDI AG is:
Bayerisches Landesamt für Datenschutzaufsicht
Promenade 18
91522 Ansbach
Germany

Information about your right to object

Right to object for personal reasons
You have the right to object to the processing of your personal data on grounds relating to your particular situation. The prerequisite for this is that the data processing takes place in the public interest or on the basis of a balancing of interests. This also applies to profiling.

Insofar as we base the processing of your personal data on a balancing of interests, we generally assume that we can demonstrate compelling legitimate grounds but will, of course, examine each individual case.

In the event of an objection, we will no longer process your personal data unless either of the following conditions apply:
• We can demonstrate compelling legitimate grounds for the processing of this data that override your interests, rights and freedoms.
• Your personal data serves the establishment, exercise or defence of legal claims.

Object to the processing of your data for our direct advertising
If we process your personal data for direct advertising purposes, you have the right to object to the processing of your personal data for such purposes at any time; this also applies to profiling if the profiling is connected with such direct advertising.

If you object to the processing of your personal data for the purpose of direct advertising, we will no longer process your personal data for this purpose.

Objection to the processing of your personal data to make product improvements and perform general customer analyses
In the balancing of interests, we grant you a separate right to object with regard to processing your personal data to make product improvements and perform general customer analyses.

If you object to processing for the purpose of product improvements and/or general customer analyses, we will no longer process any data pertaining to your person for these purposes. Purely statistical analyses of aggregated data or data anonymised in another manner shall not be affected by this.

Exercise of the right of objection
Objection can be made without form and should preferably be made to the contact data listed in this privacy notice.

C. What data does my vehicle process?

I. Electronic control units

1. General

Electronic control units have been installed in your vehicle. Control units process data that they receive, for example, from vehicle sensors, that they generate themselves or that they share among one another. Some control units are required to ensure that your vehicle functions safely, others help you while driving (driver assistance systems), and others provide comfort or infotainment features.

Below you will find some general information about data processing in your vehicle. Specific information concerning the privacy notices for individual features is provided in the operating manual for your vehicle, which is available online and may also, if applicable, be provided digitally in your vehicle.

2. Personally identifiable data

Each vehicle is identified with a unique vehicle identification number. In Germany, this vehicle identification number (“VIN”) can be used to obtain information about the current and previous owners of the vehicle from the Federal Motor Transport Authority (“Kraftfahrtbundesamt”). There are other ways to use the data collected from the vehicle to learn about the owner or driver of the vehicle; for example, with the number plate.

The data generated or processed by the control units may, therefore, be personally identifiable or may, under certain circumstances, become personally identifiable. Depending on the vehicle data that are available, if may be possible, for example, to make inferences about your driving behaviour, your location or route or user behaviour.

3. Statutory data disclosure requirements

Where there are statutory requirements, manufacturers have a duty, in individual cases, to comply with government agency requests to provide data stored at the manufacturer to the extent necessary (for example, to assist with the investigation of a criminal offence).

Within the scope of the applicable law, government agencies are also authorised to read data from vehicles themselves in individual cases. For example, if there is an accident, data can be read from the airbag control unit to help with investigation of the accident.

II. Operating data in the vehicle

Control units process data in order to operate the vehicle. This includes, for example:
− Vehicle status information (for example, speed, deceleration, lateral acceleration, wheel revolution speed, whether the seat belts are fastened),
− Environmental conditions (for example, temperature, rain sensor, distance sensor).

These data are generally temporary; they are not stored after the vehicle is no longer in operation and are only processed in the vehicle itself. Control units often have data storage units (including the vehicle keys). These are used to temporarily or permanently document information about the vehicle status, component stress, maintenance requirements and technical events and errors.

Depending on selected equipment, the following information is stored:
− Operating conditions of system components (for example, fill levels, tyre pressure, battery status),
− Disruptions and defects in key system components (for example, lights, brakes),
− System responses in special driving situations (for example, deployment of airbags, use of stability control systems),
− Information about vehicle-damaging events,
− For electric vehicles, the state of charge of the high-voltage battery, estimated range.

In special cases (for example, when the vehicle has detected a malfunction), it may be necessary to store data that would otherwise only be temporary.

When you use services (for example, repair services, maintenance work), it may, where required, be necessary to read and use the stored operating data together with the vehicle identification number. The data may be read from the vehicle by an employee of the service network (for example, mechanics, manufacturer) or third parties (for example, breakdown service centres). The same applies for warranty cases and quality assurance measures. The data are generally read out via the statutorily prescribed connection for on-board diagnostics (OBD) in the vehicle. The operating data that are read out document the technical conditions of the vehicle or individual components and help with error diagnosis, compliance with maintenance obligations and with quality improvement. These data, especially information about component stress, technical events, operating errors and other errors are sent together with the vehicle identification number to the manufacturer, if necessary. The manufacturer is also subject to product liability. The manufacturer also uses operating data from the vehicle for recalls. These data may also be used to review warranty and guarantee claims by customers.
Error storage units in the vehicle can be reset by a service centre as part of repair or service work or at your request.

III. Comfort and infotainment features

You can save comfort settings and customisations in the vehicle and modify or reset them at any time. Depending on the vehicle equipment, these include for example:
− Seat and steering wheel position settings,
− Chassis and climate control settings,
− Customisations such as interior lighting.

Within the scope of the selected equipment, you can add data to the vehicle infotainment features yourself. Depending on the vehicle equipment, these include for example:
− Multimedia data, such as music, videos or photos for replay in an integrated multimedia system,
− Address book data for use in conjunction with an integrated speaker phone system or an integrated navigation system,
− Entered navigation destinations,
− Data about the use of internet services.

These comfort and infotainment features can be stored locally in the vehicle or they can be located on a device that you have linked with the vehicle (for example, smartphone, USB stick or MP3 player). If you have entered the data yourself, you can delete it at any time.

These data are only transmitted from the vehicle at your request, particularly as part of the use of online services in line with the settings selected by you. Further information about online services can be found in Section 2 of the MMI privacy notice.

IV. Smartphone integration, for example, Android Auto or Apple CarPlay

If your vehicle has the necessary equipment, you can link your smartphone or other mobile device to the vehicle to control the control elements integrated in the vehicle. If you do, you can stream video and sound from your smartphone over the multimedia system. At the same time, certain information will be transmitted to your smartphone. Depending on the type of integration, this includes for example, location data, day/night mode and other general vehicle information. More information can be found in the operating manual for the vehicle/infotainment system.

The integration enables the use of selected smartphone apps, such as navigation or music replay. There is no further interaction between the smartphone and the vehicle; in particular, there is no active access to vehicle data. The type of other data processing is determined by the provider of the app used. Whether and which settings you can adjust depends on the relevant app and your smartphone’s operating system.

V. Online services

If your vehicle has a wireless internet connection, this will enable you to share data between your vehicle and other systems (the data servers of AUDI AG or the data servers of service providers). In certain countries, the wireless internet connection is enabled by an on-board transmitting and receiving unit (installed by us) or a mobile device provided by you (for example, a smartphone). This wireless internet connection enables the use of online features (information and control services for your vehicle). These include online services and apps that are provided by us or other providers (“Audi connect services” or “services”).

Information about the individual services can be found in Section 2 of the MMI privacy notice.

Please note that the services listed here may not all be available in your vehicle or country.

1. Manufacturer services

For AUDI AG online services, the relevant functions are described at a suitable location (for example, MMI, AUDI AG website) together with the associated data protection information. Personal data may be required for the provision of online services. These data will be exchanged over a secure connection, for example, by the manufacturer's IT systems provided for this purpose. Personal data are only collected, processed and used beyond the scope of the provision of the services on the basis of a statutory authorisation, for example, as part of a statutorily required emergency call system, if there is a contractual agreement or if consent has been obtained.

You can have the services and features (some of which are subject to charges) and – depending on the vehicle – in some cases the entire wireless internet connection activated or deactivated. This does not include statutorily required features and services, such as an emergency call system.

2. Third-party services

If you use the online services of other providers (third parties), these services are the responsibility of and subject to the data protection terms and terms and conditions of use of the relevant provider. We generally have no influence over the information that is shared.

You can learn more about the type, scope and purpose of the personal data that is collected and used during the use of third-party services from the relevant service provider.

VI. What other data do we process and what sources does such data come from?

We process personal data that we receive from you in the course of our business relationship, i.e. during the initiation, implementation and handling (including processing of any warranty or guarantee cases) of your vehicle purchase or the purchase of other products or services, i.e. for the vehicle purchased by you. In addition, we process – if required in connection with the vehicle purchase (for example, vehicle production, vehicle delivery, provision of acquired services) – personal data that we have legitimately obtained from other companies within the Audi or VW Group or from other third parties (for example, Audi dealers, workshops, and also credit agencies, such as SCHUFA; for example, to execute orders, fulfil contracts or on the basis of your consent). We also process personal data that we have legitimately obtained from publicly accessible sources (for example, Federal Motor Transport Authority) and are permitted to process.

As a rule, relevant personal data includes personal details (name, address and other contact details (for example, telephone number, e-mail address), date and place of birth and nationality). Additional personal data may also be processed depending on the type of vehicle.

In addition, the VIN of your vehicle is used as the unique identifier of your vehicle during the production and delivery process, for any warranty and guarantee cases, for our internal quality monitoring and in the case of theft of your vehicle.

1. Data that we receive from you in the course of our business relationship
• Master data (title, gender, name, customer number, address, date of notification and, if applicable, previous addresses, date of birth, place of birth, country of birth and, if applicable, name at birth, nationality, marital status, telephone numbers and e-mail address)
• Professional contact details (for example, work address, e-mail and telephone number, company, department)
• Account data (IBAN, BIC, account number, bank sort code, credit institution, account holder)
• Contract details (contract ID, details of the contract history (for example, details of payment history, contract transfer, termination), details of loan requests (for example, amount, period, outstanding debt) and other information about your contracts for our products and services)
• Vehicle identification number (VIN)
• In the context of vehicle services vehicle-specific data and services provided (vehicle history, customer history)
• Technical details from vehicle operation
• Health data (including when ordering special vehicles)

2. Data that we receive from Audi partners
• Details that the Audi partner forwards to AUDI AG in connection with repair and service support
• Details that are required to validate legal or contractual claims/questions from the customer (in particular relating to warranty/guarantee)
• Details that the Audi partner forwards to AUDI AG in order to check and handle the claims
• Details that are needed for the direct collection of the customer vehicle from AUDI AG
• Details that are required for the Audi partner's participation in AUDI AG compensation and/or bonus programmes
• Details that are required for claiming special conditions, for example, special customer groups (for example, driving schools, etc.)
• Details that are required to fulfil legal obligations (including product observation) to AUDI AG
• Details that are needed by AUDI AG for quality assurance or quality improvement and for product optimisation and further development

These details may in particular include the details listed under Section C. I., II. and VI.1.

VII. For what purposes do we process your data and on which legal basis?

We process your personal data for various purposes in accordance with the provisions of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz [“BDSG”]).

The processing of your personal data must be supported by one of the following legal bases:
• You have provided your consent (Art. 6(1a) GDPR).
• Processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract (Art. 6(1b) GDPR).
• Processing is necessary for compliance with a legal obligation pursuant to EU law or the law of an EU member state to which we are subject (Art. 6 (1c) GDPR).
• Processing is necessary in order to protect your vital interests or the vital interests of another natural person (Art. 6(1d) GDPR).
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Art. 6(1e) GDPR).
• Processing is necessary for the purposes of the legitimate interests pursued by AUDI AG or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (Art. 6(1f) GDPR).

If, in exceptional cases, we process special categories of personal data (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation) pertaining to you, one of the following legal bases must also apply:
• You have provided your express consent (Art. 9(2a) GDPR).
• Processing is necessary to protect your vital interests or the vital interests of another natural person, and the data subject is physically or legally incapable of giving consent (Art. 9(2c) GDPR).
• Processing relates to personal data that you have made publicly available (Art. 9(2e) GDPR).
• Processing is essential for the purpose of establishing, exercising or defending legal claims (Art. 9(2f) GDPR).
• Processing is necessary for reasons of substantial public interest, on the basis of EU law or the law of an EU member state which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject (Art. 9(2g) GDPR).

Following on from the above, we process your personal data based on the following legal principles and for the following purposes:

Please observe your rights of objection when processing data for the purpose of direct marketing or for personal reasons, and your right to withdraw consent (see the section “What rights do you have?” and the section “Information about your rights of objection”).

VIII. Am I obliged to provide data?

Within the scope of our business relationship, you are only required to provide us with personal data that is necessary to commence and conduct a business relationship, or which we are legally obliged to collect. Without this data, we would generally have to refuse to conclude the contract or perform the order, or we would no longer be able to carry out an existing contract and it may have to be terminated.

IX. Who receives my data?

Due to the volume and complexity of data processing undertaken by AUDI AG, it is not possible to list every recipient of your personal data individually in this privacy notice. As a general rule, therefore, we specify only categories of recipients.

Recipients within AUDI AG are those entities which require your data in order to fulfil our contractual and legal obligations as well as to pursue our legitimate interests.
Service providers (‘processors’) employed and commissioned by us may also receive data for these purposes. Your IP address, for example, may be forwarded to a service provider to enable them to send you a newsletter you have requested. Service providers may also be asked to make server capacities available.

We will disclose your personal data to third parties only to the extent necessary for fulfilment of the contract, if we or the third party have a legitimate interest in the disclosure, or if you have given your consent to this. This is the case, for example, if we engage a transport service provider to deliver your vehicle or other products. In addition, data may be transferred to third parties to comply with statutory provisions or an enforceable regulatory or judicial order.

Third parties to whom we may forward your personal data where there is a legal basis, irrespective of our service provision, include
• Your Audi dealer
• Audi Bank
• External consultants of AUDI AG (for example, lawyers, tax advisers and auditors)
• Insurers,
• Authorities as part of their responsibilities (for example, tax office, police, public prosecutor’s office),
• Courts
• Other third parties, insofar as you instruct us to pass on data or give your consent.

In the context of quality monitoring, quality assurance as well as error analysis we may transfer the vehicle identification number and relevant technical data related to the vehicle to other companies of the Volkswagen group, manufacturing plants and/or suppliers of vehicle parts.

X. Is data transmitted to a third country?

Data may be transmitted to third countries (that is, countries that are not members of the European Union or the European Economic Area) if doing so is required for the provision of services to you, if it is required by law or you have given us your consent. In addition, we may also forward your personal data to processors in third countries.

Please note that not all third countries have a data protection level recognised as adequate by the European Commission. For data transfers to third countries where there is no adequate level of data protection, we will ensure before we share data that the recipient either has an adequate level of data protection (for example, by agreement containing so-called “EU standard contractual clauses” of the European Union with the recipient) or has express consent from our users.

You can obtain from us a copy of the specific applicable or agreed provisions to ensure an adequate level of data protection. Please use the information in the Contact section for this purpose.

As part of the manufacturing process, we will transfer the vehicle identification number of your future vehicle, if required, to the manufacturing plant in a third country (Hungary, Belgium, Mexico, Slovakia, Spain, Russia, Brazil, India and China). In addition, in the context of quality monitoring, quality assurance as well as error analysis we may transfer the vehicle identification number and relevant technical data related to the vehicle to other companies of the Volkswagen group, manufacturing plants and/or suppliers of vehicle parts.

XI. How long will my data be stored?

We store your data for as long as this is necessary to provide our services to you or we have a legitimate interest in continued storage.

In addition, we are subject to various retention and documentation requirements pursuant to, inter alia, the German Commercial Code (Handelsgesetzbuch – HGB) and the Tax Code (Abgabenordnung – AO). The retention and documentation periods specified therein last up to 10 years. Finally, the storage period is also governed by statute of limitation periods, which can be up to 30 years, for example, pursuant to Sections 195 et seq. of the German Civil Code (Bürgerliches Gesetzbuch – BGB), whereby the general limitation period is 3 years.

In certain circumstances, your data may need to be kept for longer, for example, if a legal hold or litigation hold (that is, a ban on deleting data for the duration of the proceedings) is ordered in connection with official or judicial proceedings.