We process personal data we receive from our customers in the course of our business relationship. In addition and insofar as is required for us to deliver our service, we process personal data we have permissibly received from other companies in the Volkswagen Group, especially Volkswagen AG, or other third parties (e.g. Volkswagen Group dealerships, travel operators, sales partners from the tourist industry), for example, for execution of orders, fulfilment of contracts or within the scope of consent given by you. We also process personal data which we have permissibly acquired from publicly accessible sources (e.g. press, media, internet, debtors’ lists, commercial register and register of associations) and which we are allowed to process.

Relevant personal data when negotiating contracts can include:

• Private contact and identification data (name, first name, gender, address, e-mail address, telephone number, mobile telephone number, date and place of birth, identification numbers, nationality, etc.)
• Credit-rating and bank data (payment history, balance sheets, data from credit agencies, credit scores, financial situation, bank account details, credit card numbers, etc.)
• Professional contact and (work) organisation data (name, first name, gender, address, e-mail address, telephone number, mobile telephone number, company, division, department, cost centre, personnel numbers, responsibilities, positions, presence [yes/no], etc.)
• Data regarding personal/professional circumstances (details regarding spouses or children, marital status, portrait photo, honorary post, job description, professional record, years of service, tasks, activities, entry and leaving dates, qualifications, evaluations/appraisals, etc.)
• Remuneration and attendance time data (wage bracket, payroll statement, special payments, seizure, daily attendance times, reasons for absence, etc.)
• Contract data (products purchased, services, date of sales contract, purchase price, special equipment, guarantees, etc.).
• Data regarding personal/professional circumstances and attributes (details regarding spouses or children, marital status, portrait photo, honorary post, job description, professional record, years of service, tasks, activities, entry and leaving dates, qualifications, evaluations/appraisals, etc.)
• Especially sensitive personal data (Article 9 of the GDPR: “racial and ethnic background, political opinions, religious* or philosophical beliefs, or trade union membership as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, and data concerning a person’s health, sex life or sexual orientation”)
• Criminal offences/misdemeanours (data that relate to criminal offences or the suspicion of such, special requirements pursuant to Article 10 of the GDPR)
• IT usage data (user ID, roles, authorisations, login times, computer name, IP address, GID, Legic number, etc.).
• Motor vehicle usage data with VIN/motor vehicle number guarantee, warranty, product liability, safe vehicle operation (for motor vehicle usage: data that are linked to VIN/motor vehicle numbers and connected with workshop repairs, guarantees and warranties or are of significance in the context of product liability or whose availability is necessary for safe vehicle operation.)
• Motor vehicle usage data with VIN/motor vehicle number convenience settings, multimedia, navigation (for motor vehicle usage, data that are linked to VIN/motor vehicle numbers and relate to convenience settings, such as seat adjustment, preferred radio station, climate control, navigation data, e-mail/SMS contact details, etc.)
• Motor vehicle usage data with VIN/motor vehicle number assistance systems, driving performance, etc. (for motor vehicle usage: data that are linked to VIN/motor vehicle numbers and relate to driving performance or the use of assistance systems and their specific operational data, etc.)
• Geodata (GPS, wireless LAN, motion profile, WLAN hotspot, etc.)

Other potential data can include order data (e.g. payment order), data from fulfilling our contractual obligations (e.g. sales revenue data in payment transactions), information on your financial situation (e.g. credit rating data, scoring/rating data), advertising and sales data, documentation data and other data similar to the categories outlined here

Personal data over and above that described may be collected, processed and saved when purchasing and using products/services arising from the business transactions listed below. These data essentially include the following:

 

Visit to the Autostadt

• Private contact and identification data
• Credit-rating and bank data
• Professional contact and (work) organisation data
• Contract data
• Particularly sensitive personal data

We also receive data from:

• Event organisers

• Clubs, associations and private individuals who book stays

• Vehicle dealers

• Service providers with whom the Autostadt collaborates (e.g. Mövenpick)
• Sales partners
• External photographers

 

Click & Meet

• Private contact and identification data

 

Using Autostadt vouchers

• Private contact and identification data
• Credit-rating and bank data
• Professional contact and (work) organisation data
• Contract data
• In the case of employees of Volkswagen AG, the Autostadt or external Autostadt employees: remuneration and attendance time data

In the context of executing transactions, we also receive data from

• Restaurants in the Autostadt (e.g. Mövenpick)
• Hotels,
• Volkswagen Zubehörshop GmbH
• Regiondo GmbH

 

Vehicle collection in the Autostadt

• Private contact and identification data (also for the person collecting the vehicle and other guests)
• Motor vehicle usage data with VIN/motor vehicle number (for motor vehicle usage, data that are linked to VIN/motor vehicle numbers and relate to convenience settings, such as seat adjustment, preferred radio station, climate control, navigation data, e-mail/SMS contact details, etc.)
• Credit-rating and bank data
• Professional contact and (work) organisation data
• Contract data (e.g. collection voucher)
• Vehicle registration documents (e.g. front of the registration certificate part 1 (vehicle registration))
• Particularly sensitive personal data

We also receive data from:

• Volkswagen AG
• The dealerships who take the vehicle order

 

Booking hotel rooms through the Autostadt

• Private contact and identification data (also for the person collecting the vehicle and other guests)
• Credit-rating and bank data
• Professional contact and (work) organisation data
• Contract data
• Particularly sensitive personal data

 

Purchasing merchandise in the Autostadt shops

• Private contact and identification data
• Credit-rating and bank data
• Contract data

 

We also receive data from:

• Agencies that order from us on behalf of third parties
• External service providers

 

Participating in Autostadt events

• Private contact and identification data
• Credit-rating and bank data
• Professional contact and (work) organisation data
• Booking requests
• Contract data
• Particularly sensitive personal data
• In the case of vintage or rally cars: motor vehicle usage data
   

We also receive data from:

• Third-party event organisers

• Travel agencies

• Hotels, agencies

• Companies and third-party service providers who organise events in the Autostadt

• Societies, associations and private individuals who book stays

• Vehicle dealers

• Service providers with whom the Autostadt collaborates (e.g. Mövenpick)

• Sales partners

• External photographers

• In the case of vintage or rally cars: those who provide advice like journalists or automobile clubs, rally organisers, insurance companies and hotels

 

Participating in Autostadt workshops

• Private contact and identification data
• Professional contact and (work) organisation data
• Contract data
• Particularly sensitive personal data
   

We also receive data from

• Schools/teachers of participating classes

• Event organisers

• Regiondo GmbH

 

Booking and delivery of tickets for football matches through the Autostadt

• Private contact and identification data
• Credit-rating and bank data
• Contract data

 
We receive data from:

• Sales partners with whom orders are placed

• VfL Wolfsburg Fußball GmbH

 

Parking in the Autostadt

• Private contact and identification data
• Contract data

 

We also receive data from:

• Regiondo GmbH (when parking a camper van)

 

When subscribing to a newsletter

• Private contact and identification data
• Contract data

 

In the event of material damage and personal injury

• Private contact and identification data for customers, employees, witnesses
• Professional contact and (work) organisation data
• Credit-rating and bank data
• Contract data
• Data regarding personal/professional circumstances and attributes
• Particularly sensitive personal data

 

We receive data from:

• Customers

• Employees

• Witnesses

 

When participating in prize competitions

• Private contact and identification data

 

When completing a market research questionnaire:

• Data concerning personal/professional circumstances and attributes, including private contact and identification data

 

When reserving a table online

• Private contact and identification data
• Contract data

 

Customer contact information

Additional personal data, such as information on contact channel, date, motive and result, (electronic) copies of the correspondence and information on the participation in direct marketing measures, are created in the context of the business-relationship initiation phase and on an ongoing basis during the business relationship, especially through personal, telephone or written contacts initiated by you or by the bank.

We process the data outlined above pursuant to the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG):

a) For fulfilling contractual obligations (Article 6, Section 1b of the GDPR)

Data are processed for performing services in relation to the operation of a theme and adventure park in addition to organising tourist, artistic, entertainment and other public events of various types as well as delivering vehicles for Volkswagen AG in the context of performing our contracts with our customers or taking pre-contractual steps on request. The purpose for which data are processed is determined primarily by the service question (e.g. admission to the Autostadt, events, processing vehicle collections) and may include:

• Preparing, organising and processing visitor services in the Autostadt that guests can use when purchasing admission tickets through an online portal or from the Autostadt Customer Care Centre or locally
• Preparing, organising and processing tourist services in the Autostadt that guests can book through different input channels, such as an online shop, the Customer Care Centre or personally on site
• Preparing, organising and processing driving attraction services on the Autostadt premises that guests can book through an online portal or the Autostadt Customer Care Centre or on site
• Preparing, organising and processing guided tours through the Autostadt premises that guests can book through the Customer Care Centre or on site
• Preparing, organising and processing voucher services Purchasing a voucher gives customers a cashless payment option within the Autostadt
• Preparing, organising and processing hotel services Guests can book overnight stays in different hotels through the Autostadt when taking delivery of a vehicle or as tourist guests
• Preparing, organising and processing services when booking an annual pass Purchasing an annual pass gives guests free admission to the Autostadt for 12 months as well as further discounts on Autostadt attractions
• Preparing, organising and processing services in the context of presenting different Volkswagen Group brands in the Autostadt
• Preparing, organising and processing services in the framework of car park administration The Autostadt allows guests to park cars/camper vans on the Autostadt premises for a specific period of time
• Preparing, organising and processing the sale of merchandise to customers in the shops operated by the Autostadt (Zeitreise shop, Metropol shop and Zeitreise online shop) as well as in The Ritz-Carlton Wolfsburg Boutique
• Preparing, organising and processing events at the Autostadt As an event organisation platform, the Autostadt offers events to suit all age groups and interests Whether involving workshops, presentations, concerts or the dance and cultural festival Movimentos, the platform allows guests to explore and book the diverse range of offers as part of efforts to encourage them to choose the Autostadt in future as an excursion destination
• Preparing, organising and processing distribution of admission tickets to customers and Autostadt employees for football matches in the Volkswagen Arena  Guests can purchase tickets for football matches in the Volkswagen Arena from the Customer Care Centre, or Autostadt employees can take part in an internal draw for such tickets
• Preparing, organising and processing workshops at the Autostadt As an extracurricular learning centre, the Autostadt offers workshops for children, schools, universities and teachers so as to offer training materials in cooperation with the Ministry of Culture of Lower Saxony that are in line with the mobility curriculum.
• Preparing, organising and processing services relating to personal injury or material damage for customers and employees.
• Preparing, organising and processing services in the context of the entire vehicle collection end-to-end vehicle-collection process at the Autostadt Volkswagen dealerships in Germany or Austria can offer the Autostadt as a delivery location for their customers. The Autostadt consigns the new vehicle to the customer on the agreed handover date and, if applicable, with booked add-on services as part of a “collector package”.
• Communicating and interacting with vehicle collectors to more efficiently deliver services in the framework of preparing, organising and processing the entire vehicle collection process at the Autostadt Both in advance of and during their visit, Volkswagen collectors receive electronic information about the Autostadt itself and the delivery process
• Preparing, organising and processing services in the context of communication with Volkswagen dealerships The Volkswagen partners can use customer retention measures to purchase admission tickets and guided tours for their customers and to arrange a daily programme to give customers an idea about the concept of the Autostadt as a delivery platform.
• Needs analysis
• Execution of transactions
• Quality control
• Asserting legal claims and providing defence in legal disputes, ensuring IT security (including system and plausibility check) as well as general security, such as building and plant security
• Processing information concerning integrity, authenticity and availability of data
• Monitoring supervisory bodies or supervisory authorities (e.g. Internal Audit)
• Traceability of orders and other agreements as well as quality control using relevant documentation and, if appropriate, recording telephone calls
• Recording of contact and identification data for scheduling and processing of appointments for shopping or personal visits (Click & Meet)

Further details are available in the relevant contractual documentation and general terms and conditions of business.

 

b) In the context of balancing interests (Article 6, Section 1f of the GDPR)

To the degree necessary, we process your data at a level exceeding the extent needed to comply with contractual obligations in order to protect our legitimate interests or the legitimate interests of third parties. Examples include:

• Preparing, organising and processing marketing and market research activities across various channels for looking after the existing customer base, acquiring new customers and continually improving the overall Autostadt service portfolio
• Organising, executing and processing trade fairs and classic events for visitors and interested parties as important contact points so as to provide information on the wide range of offers available from the Autostadt
• Advertising or market and opinion polling, unless you have rejected use of your data
• Consulting and exchanging information with credit agencies (e.g. SCHUFA)
• Verifying and optimising needs-analysis processes for the purpose of direct customer notification
• Asserting legal claims and providing defence in legal disputes
• Enriching our data, for example, by using or browsing publicly accessible data
• Performing statistical evaluations or market analyses
• Ensuring IT security and IT operation of the Autostadt
• Preventing and investigating criminal offences, insofar as to not exclusively fulfil legal regulations
• Measures for ensuring building and plant safety (e.g. access control)
• Measures for safeguarding domiciliary rights
• Measures for managing the business and enhancing services and products
• Enhanced development of existing systems and processes
• Monitoring and recording telephone calls for quality-control and training purposes, if applicable
• Building and plant security (e.g. through access control and video surveillance), insofar as over and above general due diligence obligations
• Risk response within the Volkswagen Group

 

c)        Based on your consent (Article 6, Section 1(a of the GDPR)

Insofar as you have given your consent to the processing of personal data for specific purposes (e.g. distribution of data in the Group, evaluation of data for marketing purposes), the processing of such data is deemed lawful based on your consent. Any declaration of consent issued can be withdrawn at any time. This also applies to revoking declarations of consent that were issued to us before the General Data Protection Regulation took effect, in other words, before 25 May 2018. The revocation of consent does not impact the lawfulness of the data processed prior to revocation.

 

d)        Based on legal specifications (Article 6, Section 1c of the GDPR) or in the public interest (Article 6, Section 1e of the GDPR)

As a company we are also subject to various legal obligations, in other words, legal requirements (e.g. German Commercial Code [HGB), Money Laundering Act, tax laws). The purposes of processing include identity and age checks, fraud and money-laundering prevention, combating and investigating terrorism financing and crimes endangering property, fulfilling monitoring and reporting obligations related to tax laws, and evaluating and managing risks in Autostadt GmbH and within the Volkswagen Group. Moreover, disclosure of personal data may be required within the scope of official or judicial proceedings for the purposes of obtaining evidence, carrying out prosecution or enforcing civil law claims.

If official regulations require tracing of infection chains related to the coronavirus pandemic, we process the data required for this purpose in accordance with Article 6 (1) p. 1a or c GDPR in conjunction with the corresponding Lower Saxony government regulation.

Access to your data is provided within the Autostadt to those parties who require them to fulfil our contractual and legal obligations. Service providers and agents deployed by us can also receive data for these purposes if they comply with the data protection obligations. These include companies in categories such as hotels, credit services, IT services and logistics.

As regards transfer of data to recipients outside of the Autostadt, it should first be noted that we are only permitted under GDPR to distribute information about you if we are legally required to do so, if you have given your consent to this or if we are entitled to provide information, for example, on the basis of our legitimate interest or the legitimate interest of a third party. Recipients of personal data in such circumstances can be, for example:

 

Visit to the Autostadt

• Restaurants in the Autostadt, such as Mövenpick, in relation to booking or using services
• Regiondo GmbH, through which bookings of individual offers are handled
• Dealerships, if visits to the Autostadt have been organised through them
• Worker’s compensation and accident insurers for participation in the German Traffic Safety Council’s (DVR) safety training
• Volkswagen AG for internal Group organisation or processing, especially for participation in a plant tour or for purchasing an annual pass
• External service providers the Autostadt uses for delivery of its services

 

Using Autostadt vouchers

• Volkswagen AG, Porsche Leipzig GmbH or AUDI AG, so that the voucher can also be used there

 

Vehicle collection in the Autostadt

• Service providers such as lettershops and technical service providers (e.g. Artegic AG) for the purpose of providing notification of collection
• Europcar Autovermietung GmbH.

 

Booking hotel rooms through the Autostadt

• Partner hotels

 

Purchasing merchandise in the Autostadt shops

• Shipment service provider:
• Volkswagen AG (where costs are absorbed)

 

Participating in Autostadt events

• Regiondo GmbH, through which bookings of individual offers are handled
• Volkswagen AG, travel agencies, hotels or dealerships, if the visit to the event was organised by them
• Restaurants in the Autostadt, such as Mövenpick, in relation to booking or using services
• External service providers the Autostadt uses for delivery of its services
• Vintage cars: TÜV Rheinland, TÜV-Nord, transport service provider
• Rally cars: rally organisers, insurance companies, hotels

 

Participating in Autostadt workshops

• Regiondo GmbH, through which bookings of individual offers are handled
• Event organisers of the respective workshop
• Workshops for teachers: VfL Wolfsburg-Fußball GmbH, Phaeno gGmbH, Planetarium Wolfsburg
• Restaurants in the Autostadt, such as Mövenpick, in relation to booking or using services

 

Booking and delivery of tickets for football matches through the Autostadt

• Shipment service provider
• VfL Wolfsburg Fußball GmbH

 

When subscribing to a newsletter

• Technical service providers responsible for processing the newsletter distribution

 

In case of material damage and personal injury

• City of Wolfsburg
• Medical service providers
• Worker’s compensation
• Insurance companies
• Factory inspectorate
• Volkswagen AG

 

When participating in prize competitions

• Travel agencies
• Sales partners
• Technical service providers (e.g. Netigate)

 

When completing a market research questionnaire:

• Technical service providers (e.g. Netigate)

 

When reserving a table online

• Restaurants in the Autostadt, such as Mövenpick, in relation to booking a table

 

In addition:

• Hotels, restaurants to which we transfer personal data within the framework of conducting a business relationship with you
• Cooperation partners in the area of event management to which we transfer personal data within the framework of conducting a business relationship with you
• Public bodies and institutions (e.g. tax authorities, law enforcement agencies) where a legal or official obligation exists
• Authorities, credit agencies, collection agencies, lawyers, courts, experts and supervisory authorities
• Banks and payment service providers or similar providers to which we transfer personal data within the framework of conducting a business relationship with you
• Other companies within the Volkswagen Group in situations related to risk response arising from a legal or official obligation
  Other data recipients can include those parties for whom you have given us your consent to transfer information

We transfer data to parties in countries outside of the European Union (third countries as they are known) insofar as:

• It is required for performance of a contract with you (e.g. posting payment orders)
• It is legally prescribed (e.g. reporting obligations under tax law)
• It is in our legitimate interest or the legitimate interest of third parties
• You have given us your consent to do so

In such cases, your data may also be processed in a third country in connection with engaging service providers in the framework of commissioned personal data processing. If, for the country in question, no EU Commission resolution exists concerning an adequate level of data protection in that country, we guarantee your rights and freedoms are adequately protected under EU data protection regulations through various contracts. We will be pleased to provide you with the relevant detailed information on request.

Information on suitable or adequate guarantees and on how and where you can obtain a copy can be requested from the internal data protection officer.

We process and store your personal data as long as it is necessary to do so for the fulfilment of our contractual and statutory obligations. It should be noted that in the case of subscription annual passes, our business relationship is a continuing obligation lasting years.

Data that are no longer needed for the fulfilment of contractual or statutory obligations are regularly deleted, except when they need – for a limited period – further processing for the following purposes:

• Compliance with the retention requirements stipulated in commercial and tax law: This includes the German Commercial Code (HGB), the German Fiscal Code (AO) and the German Money Laundering Act (GwG). The retention and/or documentation periods specified by them range from two to ten years.
• Preservation of evidence in accordance with statutory limitation periods. According to sections 195 ff. of the German Civil Code (BGB), these limitation periods can last up to 30 years, though the standard limitation period is three years.
• Required to fulfil the purposes listed. In these cases, we may store and, if necessary, use your data for a duration appropriate for the purposes even after our business relationship or our pre-contractual legal relationship ends.
• Unless other purposes require a longer storage period, your data will be deleted immediately after your Click & Meet appointment is assigned. The data is collected via the scheduling form and only used in the application to generate a PDF document and an email. This data will not be stored and no subsequent data output is possible.

In the context of a business relationship, you are obliged to provide the personal data that are required for commencing and conducting a business relationship and for fulfilling the associated legal obligations or in cases we are legally obliged to collect such data. We cannot conclude or perform a contract with you as a general rule unless you provide us with such information.

In particular, we may be obliged to follow money-laundering regulations that call for use of your identification documents to verify your identity before we enter into a business relationship with you, thereby resulting in the collection and recording of your name, date and place of birth, nationality or nationalities, address and identification data. The Money Laundering Act stipulates that you must provide us with the necessary information and documents and notify us without delay of any changes that arise during our business relationship so that we can fulfil this legal obligation. If you do not provide us with the necessary information and documents, we are not permitted to establish or continue the business relationship sought by you.

This may also apply to data needed later in the course of the business relationship. If we request additional data from you, we will notify you separately that providing them is voluntary.

Pursuant to Article 22 of the GDPR, we generally do not use automated decision-making processes to establish and fulfil business relationships. Should we use such processes in isolated cases, we will notify you separately about them if it is required by law to do so.

We process some of your data automatically with the aim of assessing certain personal aspects (profiling). For example, we use profiling in the following cases:

• We are legally required to combat money laundering, the financing of terrorism, and crimes endangering property. This includes the analysis of data, for example, in payment transactions. These measures also serve to protect you.
• We use analytical tools to enable us to inform and advise you about products; these tools enable effective communication and advertising, including market research and polling.
• If you have given us your consent to receive advertising personally customised with the aid of profiling, you will also receive e-mails from us with content that enables the following:
  o   When you open e-mails from us, click on links in them, or send a website form after clicking on a link, these actions will be detected and this information will be stored.
  o   When you open e-mails from us or click on links in them, information about topics of interest to you will be noted and stored.
  o   When you download images from e-mails or click links, the kind of device you are using will be detected and this information will be stored.
  o   When you download images from e-mails or click links, your IP address will be used to determine the location from which you took the action and this information will be stored.
  We use the collected information to learn about which topics are of particular interest to our newsletter recipients so we can tailor the content of future newsletters more effectively.
• We use scoring to assess your creditworthiness. In this process, we calculate the probability that customers will fulfil their contractual payment obligations. The calculation may involve income levels, spending, existing liabilities, profession, employer, duration of employment, experiences from the business relationship thus far, contractual repayment of earlier loans, and information from credit agencies. Scoring is based on an acknowledged and proven mathematical statistical method. The calculated scores help us in making decisions on product sales and are incorporated into our ongoing risk management processes.