Data Privacy Policy

A. Data controller

We are delighted that you are visiting a website operated by Autostadt GmbH, Stadtbrücke, 38440 Wolfsburg, registered in the Commercial Register of the Local Court of Braunschweig under number HRB 100419 (“Autostadt GmbH”). Below, we provide information on how Autostadt GmbH processes your personal data in connection with your visit to the website.

B. Processing of personal data

a. Provision of and access to the website

When you visit our website, we process log files, which contain the following information:

• IP address
• URLs containing personal data (e.g. session IDs, user IDs)
• User-agent strings
• Timestamps, access patterns
• Error/access status (e.g. 403 when access is blocked)

We store web server log files, some of which contain personal data, for the purposes of IT security, error analysis and improving technical quality.

It is in our legitimate interest to be able to display the website to you correctly. This data is processed in accordance with (Art. 6 para. 1 lit. f GDPR).

The retention period is 30 days. We require this retention period in order to be able to carry out retrospective analyses and investigate security incidents (e.g. misuse of the website, investigation of criminal offences).

b. Availability and access to the Autostadt online shop

When you visit our website, we process log files, which contain the following information:

• Your IP address,
• the operating system you are using, the web browser you are using and the screen resolution you have set,
• the date and time of your visit,
• the web pages visited on our site and
• the website from which you are visiting us, as well as
• the IP address of the device you are using to access the website.

This data is processed in accordance with Article 6 para. 1 lit. f of the GDPR. It is in our legitimate interest to be able to display the website to you correctly. The data will be deleted after 30 days.

c. Ordering products and services

We process personal data that we receive from our customers in the course of our business relationship. In addition, we process – to the extent necessary for the provision of our services – personal data that we have received from other companies within the Volkswagen Group, in particular Volkswagen AG, or from other third parties (e.g. dealers of the Volkswagen Group, tour operators and sales partners in the tourism sector) on a lawful basis (e.g. for the execution of orders, the fulfilment of contracts or on the basis of consent given by you). Furthermore, we process personal data that we have lawfully obtained from publicly available sources (e.g. the press, media, the internet, debtors’ registers, commercial and associations registers) and are permitted to process.

d. Contact forms

We have provided forms in various places so that you can get in touch with us.

When you contact us via the contact form, your personal data is automatically stored when you fill in the relevant fields on the form and submit the data. It is entirely up to you whether you choose to provide us with any information in this way, and if so, what information. The personal data collected in this context includes, in particular, your contact details, such as your first name, surname and email address.

C. Booking products and services

When you book day passes, event tickets, guided tours, driving experiences, highlights, family packages and educational programmes with us, personal data will be collected, processed and used to the extent necessary for order processing and your use of the services, or where you have provided this information voluntarily (legal basis: Art. 6 para. 1 lit.b and f of the GDPR).

The data processed may include:

• Personal contact and identification details
• Credit history and bank details
• Professional contact and organisation details
• Booking enquiries
• Contract details

Particularly sensitive personal data, such as information regarding reduced mobility, will only be collected and processed if you voluntarily provide this information when making your booking.

To book tickets, we will redirect you to the website of Regiondo GmbH, Grafinger Str. 6, 81671 Munich, www.regiondo.de You can tell this by the fact that the internet address is autostadt.regiondo.de.

When making a booking, you are required to provide your contact details (first name, surname, email address and telephone number). Payment can be made by credit card (MasterCard, Visa, American Express), direct debit, PayPal or Klarna on account. Depending on the payment method, additional data may be collected (address, date of birth, IBAN, BIC, credit card number, cardholder name and the card security code).

These pages are the responsibility of Regiondo GmbH. Regiondo GmbH acts as an independent sales partner and also handles payment collection.

Once the booking has been completed, Regiondo GmbH will then send us

• contact and identification details (first name, surname, email address, optional mobile number)
• Contract details
• Particularly sensitive personal data

Once the contract has been fully processed, your data will be blocked for further use and deleted once the relevant tax and commercial law requirements have expired, unless you have expressly consented to the continued use of your data.

D. Booking an annual pass (Autostadt Key)

If you order an annual pass from our shop and create a customer account, personal data will be collected, processed and used to the extent necessary for order processing and provided that you have supplied the information voluntarily. (Legal basis: Art. 6 para. 1 lit.b and f of the GDPR)

The data processed may include:

• Personal contact and identification details
• Professional contact and organisation details
• Booking enquiries
• Contract details

We ask for your email address so that we can create a customer account and contact you should we have any queries or encounter delivery delays regarding your order.

When making a booking, you are required to provide your contact details (first name, surname, address, date of birth and email address).

Orders are generally processed only upon receipt of payment in advance and using the payment methods accepted by the relevant payment gateway (PayPal, credit card, SEPA direct debit and invoice). Autostadt GmbH reserves the right to exclude certain payment methods.

Payments are processed via the external payment service provider J.P. Morgan. As part of the payment process, the data required for processing (e.g. name, payment amount, bank details, credit card number, cardholder, account holder, IBAN, PayPal account verification request) is transmitted to J.P. Morgan. This data is processed solely for the purpose of processing payments in accordance with Article 6 para. 1 lit. b of the GDPR (performance of a contract).

For further information on data processing by J.P. Morgan, please refer to the provider’s privacy policy: https://www.jpmorgan.com/privacy

In order to process your order, we will pass on your details to a data processor, who will, for example, produce and post the physical cards.

Your personal data is collected, processed and used solely for the purpose of enabling you to use the Autostadt Shop and to process your order. We will only collect your personal data to the extent that you yourself provide it to us, for example when placing an order or registering.

Once the contract has been fully processed, your data will be stored for further use and deleted once the relevant tax and commercial law requirements have expired, unless you have expressly consented to the continued use of your data.

E. Purposes of processing and legal bases

a. To fulfil contractual obligations (Art. 6 para. 1 lit. b of the GDPR)

We process your personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG)

Data is processed for the purpose of conducting business in connection with the operation of a leisure and theme park, including the organisation of tourist, artistic, entertainment and other public events of all kinds, as well as the delivery of vehicles for Volkswagen AG in the context of fulfilling our contracts with our customers or carrying out pre-contractual measures undertaken at the customer’s request. The purposes of data processing are primarily determined by the specific business context (e.g. admission to the Autostadt, events, processing of vehicle collection).

Purchase and delivery of products and services

We use your personal information to take and process orders, deliver products and services, process payments, and communicate with you about orders, products and services.

Preparation, design and implementation of

• visitor services offered by Autostadt that guests can access when purchasing tickets via an online portal, the Autostadt Customer Care Centre, or on site;
• Tourism services offered by Autostadt, which guests can book via various channels, such as an online shop, the Customer Care Centre or in person on site;
• Rides and attractions at the Autostadt site, which guests can book via an online portal, the Autostadt Customer Care Centre or on site;
• Guided tours of the Autostadt site, which guests can book via the Customer Care Centre or on site;
• Autostadt vouchers, which allow customers to make cashless payments within the Autostadt;
• Autostadt’s hotel services, which enable guests to book accommodation at various hotels through Autostadt, either as part of their vehicle handover or as tourists;
• Annual pass (Autostadt Key), which guests can purchase via an online shop and which grants them free entry to Autostadt for twelve months, as well as further discounts on Autostadt’s attractions;
• Parking spaces on the Autostadt site that allow visitors to park cars and motorhomes on the Autostadt site for a specified period;
• Sale of merchandise to customers at the shop run by Autostadt and at the boutique at The Ritz-Carlton, Wolfsburg;
• Events for all age groups and interests – including, for example, workshops, talks and concerts – with the aim of giving visitors the opportunity to discover and book what’s on;
• Workshops for children, schools, universities and educators, offered by the Autostadt as an extracurricular learning venue, in cooperation with the Lower Saxony Ministry of Education and Cultural Affairs to provide learning opportunities in line with the Mobility Curriculum;
• Arranging tickets for customers and Autostadt staff for football matches at the Volkswagen Arena. Guests can purchase football tickets for matches at the Volkswagen Arena, whilst Autostadt employees can enter an internal prize draw for such tickets;
• Arranging meeting rooms for customers and Autostadt staff
• Services offered as part of the vehicle collection service at the Autostadt. Volkswagen dealers can offer the Autostadt as a collection point for their customers. Autostadt will hand over the new vehicle to the customer on the agreed handover date, together with any additional services booked as part of a so-called ‘collector package’. Customers collecting their vehicles receive electronic information about the Autostadt and the handover process both in advance and during their visit;
• Services relating to communication with Volkswagen’s business partners. Volkswagen dealers can purchase tickets and guided tours for their customers through customer loyalty schemes (KBA) and organise a day programme to give customers a better understanding of the Autostadt as a vehicle handover venue;
• Coverage for personal injury and property damage for customers and employees.

b. In the context of the weighing of interests (Art. 6 para. 1 lit. f of the GDPR)

Where necessary, we process your data beyond the actual performance of the contract in order to safeguard our legitimate interests or those of third parties.

• The preparation, design and implementation of marketing, market research and opinion polling activities across various channels, with a view to maintaining our existing customer base, attracting new customers and continuously improving Autostadt’s overall offering, provided you have not objected to the use of your data;
• The planning, organisation and running of trade fairs and classical music events for visitors and prospective customers, serving as key touchpoints for providing information about the wide range of attractions on offer at the Autostadt;
• Review and optimisation of demand analysis procedures for the purpose of direct customer approach;
• Ensuring IT security and IT operations at Autostadt;
• Asserting legal claims and defending against legal disputes;
• Prevention and investigation of criminal offences, unless this is done solely to comply with legal requirements;
• Building and facility security (e.g. access control and video surveillance);
• Enforcement of the right to admit or refuse entry;
• Business management and the further development of services, products, systems and processes;
• Supervision by supervisory bodies or regulatory authorities (e.g. audit);
• Traceability of orders and other agreements, as well as quality control through appropriate documentation.

c. On the basis of your consent (Article 6 para. 1 lit. a of the GDPR)

Where you have given us your consent to process personal data for specific purposes (e.g. sharing data within the group, analysing data for marketing purposes), the lawfulness of such processing is based on your consent. Consent that has been given may be withdrawn at any time. This also applies to the withdrawal of consent given to us prior to the entry into force of the GDPR, i.e. before 25 May 2018. Withdrawing consent does not affect the lawfulness of the processing carried out prior to the withdrawal.

d. On the basis of legal requirements (Art. 6 para. 1 lit. c) of the GDPR) or in the public interest (Art. 6 para. 1 lit. e of the GDPR)

Furthermore, as a company, we are subject to various legal obligations, i.e. statutory requirements (e.g. the German Commercial Code, the Money Laundering Act, tax laws). The purposes of processing include, amongst other things:

• identity and age verification;
• the prevention of fraud and money laundering;
• combating and investigating terrorist financing and offences that jeopardise assets;
• compliance with tax-related control and reporting obligations, as well as the assessment and management of risks at Autostadt GmbH and within the Volkswagen Group.

Furthermore, the disclosure of personal data may be required in the context of administrative or judicial proceedings for the purposes of gathering evidence, criminal prosecution or the enforcement of civil claims.

F. Guidance on the creation and use of photographs, audio recordings and video footage

During events, photographs, audio recordings and/or video recordings are made either by Autostadt GmbH itself or by service providers commissioned by Autostadt GmbH. Participants should be aware that, as attendees at the event, they may be recorded and featured in photographs, audio recordings and/or video footage produced by Autostadt GmbH or its contracted service providers. The service providers we engage are photographers and/or film crews who process your personal data either as data controllers or on our behalf. In the event of data processing on behalf of a client, a data processing agreement has been concluded with the service providers.

The photographs are digitally captured, edited and used by Autostadt GmbH exclusively for internal and external communication purposes (e.g. for the production of press material) and, where applicable, may be distributed in part and published for the purpose of documenting the event. Unsuitable recordings will be deleted immediately.

In addition to and alongside publication on the channels mentioned above, photographs, audio recordings and/or video footage will be shared with third parties (media representatives, agency staff, bloggers, influencers), for example on

• Autostadt GmbH’s corporate websites
• Social media channels used by Autostadt – Facebook, X, Instagram, YouTube and LinkedIn
• Internal communication channels of Autostadt GmbH and Volkswagen AG.

Your data is processed on the legal basis of legitimate interest (Art. 6 para. 1 lit. f GDPR). Autostadt GmbH’s legitimate interest lies in documenting and presenting coverage of its events through photographs, audio recordings and/or video footage. This therefore applies only to general shots that illustrate what is happening at the event. If Autostadt GmbH is to take portrait photographs of you and/or conduct interviews with you, Autostadt GmbH will ask for your consent in advance (Art. 6 para. 1 lit. a GDPR).

Furthermore, before publishing the footage on the internet, on social media or to third parties, Autostadt GmbH will assess whether your interests or fundamental rights and freedoms—which require the protection of your personal data—take precedence over the interest in reporting. If this is the case, we will refrain from publishing the information in question, or we will ask for your consent (Art. 6 para. 1 lit. a GDPR).

Furthermore, we will store and process the personal data we have collected for as long as is necessary for internal and external corporate communications relating to the event. Once all internal and external communication regarding the event has been completed, the data will be deleted. Any recordings that are not used will be deleted at the latest after the event. An exception generally arises from the long-term retention of documents relevant to the company and of historical significance in the group archive. For archiving purposes, your data may generally be stored indefinitely.

Please note that your data may be accessible worldwide. This also applies to countries where data protection standards are lower than those in the European Union.

G. Data transmission

a. Performance of the contract

Within Autostadt, access to your data is granted only to those departments that require it in order to fulfil our contractual and legal obligations. Service providers and agents engaged by us may also receive data for these purposes, provided they comply with data protection regulations. These are companies in the following sectors: hotels, financial services, IT services and logistics.

With regard to the transfer of data to recipients outside Autostadt, it should first be noted that, under the GDPR, we may only disclose information about you if required to do so by law, if you have given your consent, or if we are authorised to provide such information, for example on the basis of our legitimate interest or that of a third party.

b. Transfer of data to recipients outside the EU or to international organisations

Data will be transferred to entities in countries outside the European Union (so-called third countries) provided that:

• it is necessary for the performance of a contract with you (e.g. processing payment orders),
• it is required by law (e.g. tax reporting obligations)
• where this is based on a legitimate interest on our part or that of a third party, or where you have us your consent.
• In this context, your data may also be processed in a third country in connection with the use of service providers acting as data processors. If the European Commission has not issued a decision confirming that the country in question has an adequate level of data protection, we will ensure, in accordance with EU data protection regulations, that your rights and freedoms are adequately protected by means of appropriate contractual arrangements. We will be happy to provide you with further details on request.

H. Retention period and deletion

As a general rule, we process and store the personal data of data subjects only for as long as is necessary to fulfil the relevant processing purposes, or where statutory retention obligations apply.

Once the purpose for which the data is being processed no longer applies, the personal data will be deleted or anonymised, provided that there are no statutory retention periods or other legitimate reasons preventing its deletion.

a. General criteria for deletion

The retention period is determined in particular by the following criteria:

• The duration of the relevant contractual relationship, including the initial stages and the processing thereof,
• statutory record-keeping and documentation requirements (e.g. under commercial, tax or fiscal law),
• statutory limitation periods which may require data to be retained for the purpose of asserting, exercising or defending legal claims,
• Granted consent and its withdrawal,
• the legitimate interests of Autostadt GmbH, in particular with regard to IT security, investigating misuse or enforcing the law.

b. Retention periods by processing category

Unless different retention periods are specified in this privacy policy, the following principles apply in particular:

• Contract and booking details
  We store personal data processed in connection with the initiation, performance and settlement of contracts for the duration of the relevant contractual relationship. Furthermore, data is only stored to the extent and for as long as is necessary to comply with statutory retention and documentation requirements, in particular those arising from commercial and tax law. Once the relevant retention obligations have expired, the data will be deleted, provided there are no other lawful grounds for continuing to store it.
• Payment and billing details Payment-related data is retained in accordance with tax and commercial law requirements and deleted once the relevant retention periods have expired.
• Enquiries and communication
  Personal data collected via contact forms, e‑mail‑enquiries or other forms of communication will be stored for the duration of the processing of the enquiry. Once processing has been completed, the data will be deleted on a regular basis, provided there are no legal obligations to retain it or further storage is required for documentation purposes or to defend against or enforce legal claims.
• Marketing, market and opinion research
  We only store personal data processed for marketing or market research purposes for as long as is necessary for the relevant purpose, or until an objection is raised against such processing or consent is withdrawn. The data will then be deleted, provided there are no legal obligations to the contrary.
• IT-Security and log data
  Log files‑ and security data are processed exclusively for the purposes of IT‑security, fault analysis and the investigation of misuse, and are deleted once the relevant purpose no longer applies, at the latest after the time limits specified in this privacy policy.
• Data on law enforcement and legal defence
  Personal data required for the establishment, exercise or defence of legal claims may be stored for the duration of the relevant statutory limitation periods and will subsequently be deleted.
• Photographs, audio recordings and video recordings
  The specific rules on retention periods and deletion set out in Section F apply to photographs, audio recordings and video recordings.

c. Deletion in the event of withdrawal or objection

Where the processing of personal data is based on consent, the data in question will be erased once consent is withdrawn, provided there is no other legal basis for further processing.

Where an objection is raised to processing on the basis of Article 6 para. 1 lit. f of the GDPR, the data concerned will be erased, unless there are compelling legitimate grounds for the processing that override those of the data subject, or the processing is necessary for the establishment, exercise or defence of legal claims.

d. Exceptions to erasure

Data will not be erased if processing is necessary:

• to comply with a legal obligation,
• for the performance of a task carried out in the public interest,
• for the purpose of establishing, exercising or defending legal claims,
• for archiving purposes in the legitimate interests of Autostadt GmbH, in particular for the documentation of events of significance to the company’s history.

In such cases, personal data is stored for as long as is necessary and is subsequently deleted.

I. Data security on the internet

We take every necessary technical and organisational security measure to ensure that your personal data is stored in such a way that it is not accessible to third parties or the public. If you wish to contact us by email, please note that this method of communication cannot fully guarantee the confidentiality of the information sent. We therefore recommend that you send us confidential information by post only.

J. Your rights

You may exercise the following rights with regard to Autostadt GmbH at any time and free of charge:

Right of access

You have the right to request information from us regarding the processing of your personal data.

Right to rectification

You have the right to request that we correct any inaccurate or incomplete personal data concerning you.

Right to erasure

You have the right to request the erasure of your data, provided that the conditions set out in Article 17 of the GDPR are met. You may then, for example, request that your data be erased if it is no longer necessary for the purposes for which it was collected. You may also request that your data be erased if we are processing it on the basis of your consent and you withdraw that consent. Please note that even if you withdraw your consent, we may still process your data on a legal basis, in which case we may not be able to erase it.

Right to restriction of processing

You have the right to request that the processing of your data be restricted if the conditions set out in Article 18 of the GDPR are met. This is the case, for example, if you dispute the accuracy of your data. While the accuracy of the data is being verified, you may request that the processing of your data be restricted.

Right to data portability

If data processing is based on consent or the performance of a contract, and if such processing is carried out using automated means, you have the right to receive your data in a structured, commonly used and machine-readable format and to transmit it to another data controller.

Right of withdrawal

If data processing is based on consent, you have the right to withdraw your consent at any time, free of charge, with effect for the future.

Right to complain

You also have the right to lodge a complaint with a supervisory authority (e.g. the State Data Protection Commissioner for Lower Saxony) regarding our processing of your data. However, we recommend that you always address any complaints to our Data Protection Officer in the first instance.

K. Your contacts

Contact person for exercising your rights

The contact person for exercising your rights and obtaining further information is

Autostadt GmbH
Stadtbrücke, 38440 Wolfsburg
datenschutz@autostadt.de

Data Protection Officer

Our Data Protection Officer is available to assist you with any data protection-related enquiries:

Volkswagen AG
Berliner Ring 2, 38440 Wolfsburg
konzerndatenschutz@volkswagen.de

Last updated: May 2026