Web Content Display Web Content Display

Photo: Klaus Bossemeyer

Web Content Display Web Content Display

Privacy Policy

Web Content Display Web Content Display

In the following document, we will inform you about the data that will be recorded when you visit the Autostadt’s websites and how these data will be specifically used.

“Autostadt” refers to Autostadt GmbH, the operator of the www.autostadt.de websites, along with subpages with the online shop “Autostadt ZeitReise E-Shop”.

A. General Information

1. Who is responsible for processing the data?

For purposes related to data protection law, the responsible party is

Autostadt GmbH
Stadtbrücke
38440 Wolfsburg
email: service@autostadt.de

You will find more information about our company, in particular information regarding individuals authorised to represent the company and additional contact options, in the imprint on our website: https://www.autostadt.de/footer/impressum

Contact information for our data protection officer:

Data Protection Officer Autostadt GmbH
Volkswagen AG
Brieffach 8091
38436 Wolfsburg
Tel. +49 (0)5361 / 9-24333
konzerndatenschutz@volkswagen.de

Unless otherwise specified in the following, your data are processed solely by Autostadt GmbH.

2. What are personal data?

Data protection laws protect personal data. Personal data are all information that refers to a particular identified or identifiable natural person (data subject). This information includes name, postal or email address of an individual as well as information about the particular time the individual viewed which page.

We use the following data categories:

  • Private contact and identification data (last name, first name, gender, address, email address, telephone number, mobile telephone number, date and place of birth, identification numbers, nationality etc.)
  • Credit rating and bank data (payment history, balances, data from credit agencies, credit scores, financial standing, bank account details, credit card numbers etc.)
  • Professional contact and (work) organisation data (last name, first name, gender, address, email address, telephone number, mobile telephone number, company, division, department, cost centre, employee numbers, responsibilities, positions, attendance [yes/no] etc.)
  • Data regarding personal/professional circumstances (details regarding spouses or children, marital status, portrait photo, honorary post, job description, professional record, years of service, tasks, activities, entry and leaving dates, qualifications, evaluations/appraisals etc.)
  • Remuneration and attendance time data (wage bracket, payroll statement, special payments, seizure, daily attendance times, reasons for absence etc.)
  • Contract data (products purchased, services, date of sales contract, purchase price, special equipment, guarantees etc.)
  • Data regarding personal/professional circumstances and attributes (details regarding spouses or children, marital status, portrait photo, honorary post, job description, professional record, years of service, tasks, activities, entry and leaving dates, qualifications, evaluations/appraisals etc.)
  • Especially sensitive personal data (Article 9 of the GDPR: “racial and ethnic background, political opinions, religious* or philosophical beliefs, or trade union membership as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, and data concerning a person’s health, sex life or sexual orientation”)
  • Criminal offences/misdemeanours (data regarding criminal offences or the suspicion of such, special requirements pursuant to Article 10 of the GDPR)
  • IT usage data (user ID, roles, authorisations, login times, computer name, IP address, GID, Legic number etc.)
  • Motor vehicle usage data with VIN/motor vehicle registration number guarantee, warranty, product liability, safe vehicle operation (data regarding motor vehicle usage that are linked to VIN/motor vehicle registration numbers and connected with workshop repairs, guarantees and warranties or are of significance in the context of product liability or whose availability is necessary for safe vehicle operation)
  • Motor vehicle usage data with VIN/motor vehicle registration number convenience settings, multimedia, navigation (data regarding motor vehicle usage that are linked to VIN/motor vehicle registration numbers and relate to convenience settings, such as seat adjustment, preferred radio station, climate control, navigation data, email/SMS contact details etc.)
  • Motor vehicle usage data with VIN/motor vehicle registration number assistance systems, driving performance etc. (data regarding motor vehicle usage that are linked to VIN/motor vehicle registration numbers and relate to driving performance or the use of assistance systems and their specific operational data etc.)
  • Position data (GPS, mobile network positioning data, movement profile, Wi-Fi hotspot positioning data etc.). Other potential data can include order data (e.g. payment order), data from fulfilling our contractual obligations (e.g. sales revenue data in payment transactions), information on your financial situation (e.g. credit rating data, scoring/rating data), advertising and sales data, documentation data and other data similar to the categories outlined here.

B. Collecting, Processing and Using Your Personal Data

1. Access to the website, access to files

As a fundamental principle, you may visit our website without providing any personal information. In this case, we will automatically collect only the following log data:

1. An anonymous cookie ID from which your IP address cannot be inferred
2. The operating system and browser you are using as well as the screen resolution settings you have selected
3. The date and time of your visit
4. The pages you visited on our site, and
5. The page that redirected you to us

This involves typical technical information that virtually every web server collects.

Should problems occur in gaining access to our website or should access fail to be Internet compliant in some way, we will store the data listed above along with your IP address. We will use this information to identify and correct technical problems on our website as a way of improving the technical quality of our website. We will however also use these data to uncover misuse of our website or identify attacks on it as well as to prevent such problems in future. The legal foundation for processing your data is provided by Article 6 (1) (f) of the GDPR. It is our legitimate interest to ensure the security and operation of the website, the demand-driven design of the website, the prevention of misuse and investigation of criminal offences insofar as not solely to fulfil legal requirements. We delete these data after 30 days if the data are longer needed for the purposes described above.

2. Contact form

We provide you with contact forms at various locations, which you can use to contact us.

When you use such a contact form to contact us, your personal data will be automatically stored when you fill out the respective fields in the form and submit the data. It is up to you to decide whether and which information you will provide in this manner. The personal data collected consist in particular of your contact details, which include your first name, last name and email address.

We store your information for the purpose of answering your query and helping us respond to follow-up questions (legal foundation: Article 6 (1) (b) of the GDPR).

3. Booking daily tickets and tickets for events and tours

When you book daily tickets, event tickets, tours, driving adventures, highlights, family programmes and training courses with us, personal data are collected, processed and used to the extent needed to carry out your request and to enable you to use the services or to the extent that you provided the information voluntarily (legal foundation: Article 6 (1) (b) (f) of the GDPR).

Processed data can include:

  • Private contact and identification data
  • Credit rating and bank data
  • Professional contact and (work) organisation data
  • Booking requests
  • Contract data
  • Particularly sensitive personal data, including limited mobility (these details are collected and processed only if you voluntarily provide them during the booking process)

As part of the ticket booking process, we will forward you to the pages of Regiondo GmbH, Grafinger Str. 6, 81671 Munich, www.regiondo.de. You will notice this when you see the Internet address autostadt.regiondo.de.

The booking process will require you to provide contact information (first name, last name, email address and telephone number). You may pay with a credit card (MasterCard, Visa, American Express), direct debit, PayPal or a Klarna transaction on account. Other data (address, date of birth, IBAN, BIC, credit card number, card owner and credit card security number) may also be collected for individual payment options.

Regiondo GmbH is responsible for these pages. Regiondo GmbH acts as an independent sales partner and also assumes responsibility for payment collection.

Once the booking has been completed, Regiondo GmbH will provide us with such information as

  • Private contact and identification data
  • Contract data
  • Particularly sensitive personal data

Once your request has been completely processed, your data will be blocked from further use and deleted following expiry of retention periods set by tax and business regulations if you have not expressly consented to the continued use of your data.

4. Product orders

When you book products in our ZeitReise E-Shop and open a customer account, personal data are collected, processed and used to the extent needed to carry out your request or to the extent that you provided the information voluntarily (legal foundation: Article 6 (1) (b) and (f) of the GDPR).

Processed data can include:

  • Private contact and identification data
  • Credit rating and bank data
  • Contract data

We need these data in order to create your invoice and have your item shipped to you. The information about your email address is used to create a customer account and will enable us to contact you if we have questions about your order or experience delivery bottlenecks.

To fulfil your order, we provide your data to payment and transport service providers.

Once your request has been completely processed and paid for in full, your data will be blocked from further use and deleted following expiry of retention periods set by tax and business regulations if you have not expressly consented to the continued use of your data.

Your personal data will be collected, processed and used solely for the purpose of facilitating your use of the Autostadt ZeitReise E-Shop and to process your order. Personal data are collected only to the extent that you provide your data, i.e. as part of your order or registration process.

5. Table reservations

When you use our website to reserve a table at one of the Autostadt restaurants, we will use your data to pass the table reservation to the particular restaurant. Personal data are collected, processed and used here to the extent needed to carry out your request and to enable you to use the services or to the extent that you provided the information voluntarily (legal foundation: Article 6 (1) (b) (f) of the GDPR).

Processed data can include:

  • Private contact and identification data
  • Contract data
  • Particularly sensitive personal data, including limited mobility (these details are collected and processed only if you voluntarily provide them during the booking process)

Autostadt GmbH does not operate the restaurants. Rather, it transmits the information to the respective operator of the restaurant, particularly Mövenpick.

We store the data only for the purpose of technically transmitting them to the particular restaurant. The data are deleted from our system once they have been transferred.

6. Use of our day planner

Our website gives you the opportunity to individually plan your visit to the Autostadt at autostadt.de/tagesplaner.

Personal data are collected, processed and used here to the extent needed to carry out your request and to enable you to use the services or to the extent that you provided the information voluntarily (legal foundation: Article 6 (1) (b) (f) of the GDPR).

Processed data can include:

  • Private contact and identification data
  • Contract data
  • Particularly sensitive personal data, including limited mobility (these details are collected and processed only if you voluntarily provide them during the booking process). You can use a wish list code to retrieve the stored data again.

If you book an attraction for which Autostadt does not provide the service, we will transmit the data to the external service provider who performs the activity for Autostadt.

7. Yearly ticket exchange

As an annual ticket holder we offer you the option to exchange your annual ticket online.

Personal data are collected, processed and used only to the extent needed to carry out your request (legal foundation: Article 6 (1) (b) of the GDPR).

Processed data can include:

  • Private contact and identification data
  • Contract data
  • Data regarding personal/professional circumstances and attributes (portrait photo)

If you have given us permission to store your photograph, we will use this image to create your new annual ticket.

8. Opening an online account

You have the option to open an online account at various locations on our website. If you do so and want to use certain functions or services on the website, data such as personal and usage data will be collected, processed and used to the extent needed to carry out your request and enable your use of the services or to the extent that you provided the information voluntarily. (Legal foundation: Article 6 (1) (b) (f) of the GDPR).

Processed data can include:

  • Private contact and identification data
  • Professional contact and (work) organisation data
  • Data regarding personal/professional circumstances
  • Data regarding personal/professional circumstances and attributes
  • Particularly sensitive personal data (these details are collected and processed only if you voluntarily provide them)
  • IT usage data
  • Contract data

If you delete your account, the data related to it are likewise deleted as long as tax and commercial regulations do not require continued retention.

9. Newsletter registration

This website offers a number of different ways to order a newsletter. We use the data provided in this regard (email address and optionally first name, last name, interests) solely for the purpose of providing this service, subject to your consent (Article 6 (1), page 1 (a) of the GDPR). Autostadt GmbH uses the double opt-in process in this respect. An email will be sent to you at the email address provided, requesting you to confirm your consent. You may withdraw your consent to Autostadt GmbH at any time and free of charge with immediate effect, for example by using the “unsubscribe” link provided in each newsletter. Once you have unsubscribed from the newsletter, your personal data will be deleted as long as no other retention periods apply (i.e. tax-related retention requirements). The newsletter is sent with the help of a contract data processor.

If you have given us your consent to receive advertising that has been personally customised by us with the aid of profiling, you will also receive emails from us with content that enables the following:

  • When you open emails from us, click links in them or send a website form after clicking a link, these actions will be detected and this information will be stored.
  • When you open emails from us or click links in them, information about topics of interest to you will be noted and stored.
  • When you download images from emails or click links, the kind of device you are using will be detected, and this information will be stored.
  • When you download images from emails or click links, your IP address will be used to determine the location from which you took the action, and this information will be stored. We use the collected information to learn about which topics are of particular interest to our newsletter recipients so we can tailor the content of future newsletters more effectively.

10. Consent to advertising and market research

If you would like to receive information about our offerings, you can order advertising materials. In such cases, the following data will be processed for the purpose of supplying advertising materials subject to the consent you have provided (Article 6 (1), page 1, (a) of the GDPR): last name, first name, email address and/or telephone number). Autostadt GmbH uses the double opt-in process to obtain your consent. An email will be sent to you at the email address provided, requesting you to confirm your consent. Refer to the section titled “Your rights” for information on how to withdraw your consent.

11. Use of YouTube

For purposes of showing videos, our page uses videos provided by YouTube LLC , 901 Cherry Avenue, San Bruno, CA 94066, USA, represented by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Normally, your IP address is sent to YouTube and cookies are installed on your computer when a page with embedded videos is retrieved. However, we have also added an additional data protection mode to our YouTube videos (in this case, YouTube always contacts the Google service called DoubleClick. According to Google’s privacy statement, no personal data are analysed here). No other information about the visitor is stored by YouTube unless you view the video. When you click the video, your IP address is transmitted to YouTube, and YouTube learns that you watched the video. If you are logged onto YouTube, this information will also be linked to your user account (you can prevent this by logging out before you watch the video on YouTube).

We have no information or influence over the way YouTube may collect and use your data. For more information, refer to the YouTube privacy policy at www.google.de/intl/de/policies/privacy/. Refer also to our general description in this privacy policy for information on general use of cookies and how to deactivate them.

12. Use of cookies

We use cookies on our website as a way of making your visit to this website as simple as possible and to facilitate the use of certain functions.

To learn more about cookies, their types and the ones used on our website, please refer to: https://www.autostadt.de/cookie-richtlinie

C. Online Data Security

We take all necessary technical and organisational security steps to store your personal data in such a way that third parties or the general public cannot gain access to it. If you want to contact us by email, please remember that the confidentiality of the information transmitted via this communication channel cannot be completely guaranteed. For this reason, we urge you to send confidential information to us only through the postal service.

D. Do We Share Your Data with Recipients Outside the EU or International Organisations?

When YouTube is used, personal data are transmitted to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

No adequacy decision has been issued by the European commission. But Google LLC is a member of the EU-US Privacy Shield.

You will find more information about the EU-US Privacy Shield at the URL: https://www.privacyshield.gov

E. How Long Do We Retain Your Data?

We process and retain your personal data for as long as it is necessary to fulfil our contractual and statutory obligations. It should be noted that in the case of annual ticket subscriptions, our business relationship is a continuing obligation designed to operate for several years.

Data that are no longer needed for fulfilling contractual or statutory obligations are regularly deleted, except when these data require – for a limited period – further processing for the following purposes:

  • Compliance with the retention requirements stipulated in commercial and tax law: this includes the German Commercial Code (HGB), the German Fiscal Code (AO) and the German Money Laundering Act (GwG). The retention or documentation periods specified by them range from two to ten years.
  • Preservation of evidence in accordance with statutory limitation periods. According to Sections 195 ff. of the German Civil Code (BGB), these limitation periods can last up to 30 years, though the standard limitation period is three years.
  • Required to fulfil the purposes listed. In these cases, we may store and, if necessary, use your data for a duration appropriate for the purposes even after our business relationship or our pre-contractual legal relationship ends.

F. Are You Legally or Contractually Obliged to Provide Your Data?

What are the possible consequences of you not providing your data? In the context of our business relationship, you are obliged to provide the personal data that are required for commencing and conducting a business relationship and for fulfilling the associated legal obligations or in cases where we are legally obliged to collect such data. We cannot conclude or perform a contract with you as a general rule unless you provide us with such information.

In particular, we may be obliged to follow money-laundering regulations that call for use of your identification documents to verify your identity before we enter into a business relationship with you, thereby resulting in the collection and recording of your name, date and place of birth, nationality or nationalities, address and identification data. The Money Laundering Act stipulates that you must provide us with the necessary information and documents and notify us without delay of any changes that arise during our business relationship so that we can fulfil this legal obligation. If you do not provide us with the necessary information and documents, we are not permitted to establish or continue the business relationship sought by you.

This may also apply to data needed later in the course of the business relationship. If we request additional data from you, we will notify you separately that providing such data is voluntary.

G. Your Rights

You may exercise the following rights with respect to Autostadt GmbH at any time and at no cost:

Right to information: You have the right to obtain information from us about how we process your personal data.

Right of correction: You have the right to require us to correct any personal data relating to you that are incorrect or incomplete.

Right to erasure: You have the right to request the erasure of your data, provided the prerequisites specified in Article 17 of the GDPR have been met. For example, you can ask us to delete your data if they are no longer needed for the purpose for which they were collected. You can also request that your data be deleted if we process your data on the basis of your consent and you then revoke this consent. Please note that even in the case of a revocation, processing your data on a legal basis cannot be ruled out, and in this case a deletion may not take place.

Right to limit processing: You have the right to demand processing of your data be limited, if the prerequisites of Article 18 of the GDPR are satisfied. This could be the case, for example, if you dispute the accuracy of your data. You can then request that processing be restricted while we check whether your data are correct.

Right to object: You have the right to object to your data being processed if processing is based on an overriding interest or your data are used for the purposes of direct advertising. An objection is permitted if data are processed either in the public interest or in the exercise of public authority or on the basis of a legitimate interest of Autostadt GmbH or a third party. If you object to data processing, please specify the reasons why you object to data processing. You also have the right to object to data processing for the purposes of direct advertising. The same applies to profiling, provided this is related to direct advertising.

Right to data portability: If data processing is based on consent or on the fulfilment of a contract and takes place using an automated process, you are entitled to receive your data in a structured, conventional and machine-readable format and to transfer them to another data processor.

Right of withdrawal: Provided data processing is based on you providing consent, you have the right to withdraw that consent to the processing of your personal data free of charge at any time, effective going forward.

Right to lodge a complaint: You also have the right to lodge a complaint with a supervisory authority (e.g. the Data Protection Commissioner for the State of Lower Saxony) about our processing of your data. However, we recommend that you always direct a complaint to our data protection officer first.

 

Version dated: September 2018