In the following document, we will inform you about the data that will be recorded when you visit the Autostadt’s websites and how these data will be specifically used.

“Autostadt” refers to Autostadt GmbH, the operator of the www.autostadt.de websites, along with subpages with the online shop “Autostadt ZeitReise E-Shop”.

A. General Information

1. Who is responsible for processing the data?

For purposes related to data protection law, the responsible party is

Autostadt GmbH
Stadtbrücke
38440 Wolfsburg
email: service@autostadt.de

You will find more information about our company, in particular information regarding individuals authorised to represent the company and additional contact options, in the imprint on our website: https://www.autostadt.de/footer/impressum

Contact information for our data protection officer:

Data Protection Officer Autostadt GmbH
Volkswagen AG
Brieffach 8091
38436 Wolfsburg
Tel. +49 (0)5361 / 9-24333
konzerndatenschutz@volkswagen.de

Unless otherwise specified in the following, your data are processed solely by Autostadt GmbH.

2. What are personal data?

Data protection laws protect personal data. Personal data are all information that refers to a particular identified or identifiable natural person (data subject). This information includes name, postal or email address of an individual as well as information about the particular time the individual viewed which page.

We use the following data categories:

• Private contact and identification data (last name, first name, gender, address, email address, telephone number, mobile telephone number, date and place of birth, identification numbers, nationality etc.)
• Credit rating and bank data (payment history, balances, data from credit agencies, credit scores, financial standing, bank account details, credit card numbers etc.)
• Professional contact and (work) organisation data (last name, first name, gender, address, email address, telephone number, mobile telephone number, company, division, department, cost centre, employee numbers, responsibilities, positions, attendance [yes/no] etc.)
• Remuneration and attendance time data (wage bracket, payroll statement, special payments, seizure, daily attendance times, reasons for absence etc.)
• Contract data (products purchased, services, date of sales contract, purchase price, special equipment, guarantees etc.)
• Data regarding personal/professional circumstances and attributes (details regarding spouses or children, marital status, portrait photo, honorary post, job description, professional record, years of service, tasks, activities, entry and leaving dates, qualifications, evaluations/appraisals etc.)
• Especially sensitive personal data (Article 9 of the GDPR: “racial and ethnic background, political opinions, religious* or philosophical beliefs, or trade union membership as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, and data concerning a person’s health, sex life or sexual orientation”)
• Criminal offences/misdemeanours (data regarding criminal offences or the suspicion of such, special requirements pursuant to Article 10 of the GDPR)
• IT usage data (user ID, roles, authorisations, login times, computer name, IP address, GID, Legic number etc.)
• Motor vehicle usage data with VIN/motor vehicle registration number guarantee, warranty, product liability, safe vehicle operation (data regarding motor vehicle usage that are linked to VIN/motor vehicle registration numbers and connected with workshop repairs, guarantees and warranties or are of significance in the context of product liability or whose availability is necessary for safe vehicle operation)
• Motor vehicle usage data with VIN/motor vehicle registration number convenience settings, multimedia, navigation (data regarding motor vehicle usage that are linked to VIN/motor vehicle registration numbers and relate to convenience settings, such as seat adjustment, preferred radio station, climate control, navigation data, email/SMS contact details etc.)
• Motor vehicle usage data with VIN/motor vehicle registration number assistance systems, driving performance etc. (data regarding motor vehicle usage that are linked to VIN/motor vehicle registration numbers and relate to driving performance or the use of assistance systems and their specific operational data etc.)
• Position data (GPS, mobile network positioning data, movement profile, Wi-Fi hotspot positioning data etc.). Other potential data can include order data (e.g. payment order), data from fulfilling our contractual obligations (e.g. sales revenue data in payment transactions), information on your financial situation (e.g. credit rating data, scoring/rating data), advertising and sales data, documentation data and other data similar to the categories outlined here.

B. Collecting, Processing and Using Your Personal Data

1. Access to the website, access to files

As a fundamental principle, you may visit our website without providing any personal information. In this case, we will automatically collect only the following log data:

1. An anonymous cookie ID from which your IP address cannot be inferred
2. The operating system and browser you are using as well as the screen resolution settings you have selected
3. The date and time of your visit
4. The pages you visited on our site, and
5. The page that redirected you to us

This involves typical technical information that virtually every web server collects.

Should problems occur in gaining access to our website or should access fail to be Internet compliant in some way, we will store the data listed above along with your IP address. We will use this information to identify and correct technical problems on our website as a way of improving the technical quality of our website. We will however also use these data to uncover misuse of our website or identify attacks on it as well as to prevent such problems in future. The legal foundation for processing your data is provided by Article 6 (1) (f) of the GDPR. It is our legitimate interest to ensure the security and operation of the website, the demand-driven design of the website, the prevention of misuse and investigation of criminal offences insofar as not solely to fulfil legal requirements. We delete these data after 30 days if the data are longer needed for the purposes described above.

2. Contact form

We provide you with contact forms at various locations, which you can use to contact us.

When you use such a contact form to contact us, your personal data will be automatically stored when you fill out the respective fields in the form and submit the data. It is up to you to decide whether and which information you will provide in this manner. The personal data collected consist in particular of your contact details, which include your first name, last name and email address.

We store your information for the purpose of answering your query and helping us respond to follow-up questions (legal foundation: Article 6 (1) (b) of the GDPR).

3. Booking daily tickets and tickets for events and tours

When you book daily tickets, event tickets, tours, driving adventures, highlights, family programmes and training courses with us, personal data are collected, processed and used to the extent needed to carry out your request and to enable you to use the services or to the extent that you provided the information voluntarily (legal foundation: Article 6 (1) (b) (f) of the GDPR).

Processed data can include:

• Private contact and identification data
• Credit rating and bank data
• Professional contact and (work) organisation data
• Booking requests
• Contract data
• Particularly sensitive personal data, including limited mobility (these details are collected and processed only if you voluntarily provide them during the booking process)

As part of the ticket booking process, we will forward you to the pages of Regiondo GmbH, Grafinger Str. 6, 81671 Munich, www.regiondo.de. You will notice this when you see the Internet address autostadt.regiondo.de.

The booking process will require you to provide contact information (first name, last name, email address and telephone number). You may pay with a credit card (MasterCard, Visa, American Express), direct debit, PayPal or a Klarna transaction on account. Other data (address, date of birth, IBAN, BIC, credit card number, card owner and credit card security number) may also be collected for individual payment options.

Regiondo GmbH is responsible for these pages. Regiondo GmbH acts as an independent sales partner and also assumes responsibility for payment collection.

Once the booking has been completed, Regiondo GmbH will provide us with such information as

• Private contact and identification data
• Contract data
• Particularly sensitive personal data

Once your request has been completely processed, your data will be blocked from further use and deleted following expiry of retention periods set by tax and business regulations if you have not expressly consented to the continued use of your data.

4. Notice on the use of photographs as well as audio and video recordings

Autostadt GmbH corporate communications will take photographs or record audio and/or video at an event, or commission a contractor to do so. All attendees at an event must expect to be photographed or recorded in audio or video with the resulting material distributed by Autostadt GmbH itself or the contractor hired for the purpose. These contractors will be photographers and/or camera or sound teams who will process your personal data either as the data controllers themselves or on commission by us. Any commissioned processing will involve a corresponding processing contract having been concluded with the respective processor.

Autostadt GmbH shall only digitally create, edit, and use the resulting material for internal and external communication purposes, such as in preparing press kits, to be distributed and published in whole or in part for the purpose of documenting the corresponding event. Unusable photographic, audio or video material will be deleted immediately.

• Corporate websites of Autostadt GmbH
• Social media channels used by Autostadt – Facebook, Twitter, Instagram, YouTube, and LinkedIn
• Internal communication media at Autostadt GmbH and Volkswagen AG

Photographs as well as audio and video recordings will be published for third parties such as the media, agency employees, bloggers, and influencers using and in addition to the above channels.

We will be processing your data on the legal basis of our legitimate interest according to GDPR Art. 6(1)(f). The legitimate interest of Autostadt GmbH lies in providing documentation and presentation in an accessible form using photographs, audio, and video when reporting on Autostadt GmbH events. Therefore, this only refers to materials of a general nature showing the event proceedings. Autostadt GmbH shall contact you to obtain your consent according to GDPR Art. 6(1)(a) immediately if Autostadt GmbH wishes to involve you in portraits and/or interviews.

Autostadt GmbH corporate communications shall also make sure that your interests or fundamental rights and freedoms requiring your personal data to be protected do not outweigh our interest in reporting before publishing the recorded material on the web or in social networks, or towards other third parties. If your rights and interests should prevail, we shall refrain from publishing such material or obtain your consent before publication according to GDPR Art. 6(1)(a).

We will otherwise store and process the personal data we have collected from you for as long as necessary for internal and external company communication on the event. We will erase the data after terminating internal and external event communication. We will delete any unused materials after the event at the latest with the exception of permanent group-wide archives on historically significant documentation relevant to the company. Your data may also be archived indefinitely.

Note that your data may be accessible from anywhere in the world including countries with data privacy standards less stringent than those applicable in the European Union.

5. Product orders

When you book products in our ZeitReise E-Shop and open a customer account, personal data are collected, processed and used to the extent needed to carry out your request or to the extent that you provided the information voluntarily (legal foundation: Article 6 (1) (b) and (f) of the GDPR).

Processed data can include:

• Private contact and identification data
• Credit rating and bank data
• Contract data

We need these data in order to create your invoice and have your item shipped to you. The information about your email address is used to create a customer account and will enable us to contact you if we have questions about your order or experience delivery bottlenecks.

To fulfil your order, we provide your data to payment and transport service providers.

Once your request has been completely processed and paid for in full, your data will be blocked from further use and deleted following expiry of retention periods set by tax and business regulations if you have not expressly consented to the continued use of your data.

Your personal data will be collected, processed and used solely for the purpose of facilitating your use of the Autostadt ZeitReise E-Shop and to process your order. Personal data are collected only to the extent that you provide your data, i.e. as part of your order or registration process.

6. Table reservations

When you use our website to reserve a table at one of the Autostadt restaurants, we will use your data to pass the table reservation to the particular restaurant. Personal data are collected, processed and used here to the extent needed to carry out your request and to enable you to use the services or to the extent that you provided the information voluntarily (legal foundation: Article 6 (1) (b) (f) of the GDPR).

Processed data can include:

• Private contact and identification data
• Contract data
• Particularly sensitive personal data, including limited mobility (these details are collected and processed only if you voluntarily provide them during the booking process)

Autostadt GmbH does not operate the restaurants. Rather, it transmits the information to the respective operator of the restaurant, particularly Mövenpick.

We store the data only for the purpose of technically transmitting them to the particular restaurant. The data are deleted from our system once they have been transferred.

7. Use of our day planner

Our website gives you the opportunity to individually plan your visit to the Autostadt at autostadt.de/tagesplaner.

Personal data are collected, processed and used here to the extent needed to carry out your request and to enable you to use the services or to the extent that you provided the information voluntarily (legal foundation: Article 6 (1) (b) (f) of the GDPR).

Processed data can include:

• Private contact and identification data
• Contract data
• Particularly sensitive personal data, including limited mobility (these details are collected and processed only if you voluntarily provide them during the booking process). You can use a wish list code to retrieve the stored data again.

If you book an attraction for which Autostadt does not provide the service, we will transmit the data to the external service provider who performs the activity for Autostadt.

8. Yearly ticket exchange

As an annual ticket holder we offer you the option to exchange your annual ticket online.

Personal data are collected, processed and used only to the extent needed to carry out your request (legal foundation: Article 6 (1) (b) of the GDPR).

Processed data can include:

• Private contact and identification data
• Contract data
• Data regarding personal/professional circumstances and attributes (portrait photo)

If you have given us permission to store your photograph, we will use this image to create your new annual ticket.

9. Opening an online account

You have the option to open an online account at various locations on our website. If you do so and want to use certain functions or services on the website, data such as personal and usage data will be collected, processed and used to the extent needed to carry out your request and enable your use of the services or to the extent that you provided the information voluntarily. (Legal foundation: Article 6 (1) (b) (f) of the GDPR).

Processed data can include:

• Private contact and identification data
• Professional contact and (work) organisation data
• Data regarding personal/professional circumstances
• Data regarding personal/professional circumstances and attributes
• Particularly sensitive personal data (these details are collected and processed only if you voluntarily provide them)
• IT usage data
• Contract data

If you delete your account, the data related to it are likewise deleted as long as tax and commercial regulations do not require continued retention.

10. Newsletter registration

This website offers a number of different ways to order a newsletter. We use the data provided in this regard (email address and optionally first name, last name, interests) solely for the purpose of providing this service, subject to your consent (Article 6 (1), page 1 (a) of the GDPR). Autostadt GmbH uses the double opt-in process in this respect. An email will be sent to you at the email address provided, requesting you to confirm your consent. You may withdraw your consent to Autostadt GmbH at any time and free of charge with immediate effect, for example by using the “unsubscribe” link provided in each newsletter. Once you have unsubscribed from the newsletter, your personal data will be deleted as long as no other retention periods apply (i.e. tax-related retention requirements). The newsletter is sent with the help of a contract data processor.

If you have given us your consent to receive advertising that has been personally customised by us with the aid of profiling, you will also receive emails from us with content that enables the following:

• When you open emails from us, click links in them or send a website form after clicking a link, these actions will be detected and this information will be stored.
• When you open emails from us or click links in them, information about topics of interest to you will be noted and stored.
• When you download images from emails or click links, the kind of device you are using will be detected, and this information will be stored.
• When you download images from emails or click links, your IP address will be used to determine the location from which you took the action, and this information will be stored. We use the collected information to learn about which topics are of particular interest to our newsletter recipients so we can tailor the content of future newsletters more effectively.

11. Consent to advertising and market research

If you would like to receive information about our offerings, you can order advertising materials. In such cases, the following data will be processed for the purpose of supplying advertising materials subject to the consent you have provided (Article 6 (1), page 1, (a) of the GDPR): last name, first name, email address and/or telephone number). Autostadt GmbH uses the double opt-in process to obtain your consent. An email will be sent to you at the email address provided, requesting you to confirm your consent. Refer to the section titled “Your rights” for information on how to withdraw your consent.

12. Use of YouTube

For purposes of showing videos, our page uses videos provided by YouTube LLC , 901 Cherry Avenue, San Bruno, CA 94066, USA, represented by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Normally, your IP address is sent to YouTube and cookies are installed on your computer when a page with embedded videos is retrieved. However, we have also added an additional data protection mode to our YouTube videos (in this case, YouTube always contacts the Google service called DoubleClick. According to Google’s privacy statement, no personal data are analysed here). No other information about the visitor is stored by YouTube unless you view the video. When you click the video, your IP address is transmitted to YouTube, and YouTube learns that you watched the video. If you are logged onto YouTube, this information will also be linked to your user account (you can prevent this by logging out before you watch the video on YouTube).

We have no information or influence over the way YouTube may collect and use your data. For more information, refer to the YouTube privacy policy at www.google.de/intl/de/policies/privacy/. Refer also to our general description in this privacy policy for information on general use of cookies and how to deactivate them.

13. Use of Cookies and Tracking Tools

a. General information
The Autostadt GmbH uses various cookies on its website. Cookies are small files with configuration formation which are stored on your device. Cookies may be subdivided into three categories. There are cookies which are essential for the functioning of the website (functional cookies), cookies which make the use of the website more convenient, for example by storing your language settings (convenience cookies) and cookies which are used for the production of a pseudonymized user profile (tracking cookies). The processing of functional cookies is necessary in order to enable you to visit our website (cf. Art. 6 (1b) GDRP). The legal basis of convenience cookies is a legitimate interest (Art. 6 (1f) GDPR). The legitimate interest is the provision of convenience for visiting the website. You can object to the processing of your data at any time with effect for the future by preventing the storage of cookies using your browser settings. Tracking cookies will not be stored on the device of the website user unless the user has given consent for such storage (Art. 6 (1a) DSGVO). Such consent may be given via the cookie banner which must be clicked actively. You may withdraw your consent to data collection and processing at any time by clicking on the following link:

Manage my cookie preferences

More information on cookies is available in our Cookie guidelines.

b. Matomo Website analytics
The Autostadt websites use the open source web analytics service Matomo. The data processing takes place on the basis of a consent given by you (Art. 6(1)(a) GDPR). Matomo uses so-called “cookies”. These are text files that are stored on your computer and that allow an analysis of the use of the website by you. For this purpose, the information generated by the cookie about the use of this website is stored on our server. The evaluation of the cookies is done for website optimization. Your IP address is transmitted only shortened in this process so that you remain anonymous to us. The information generated by the cookies about your use of this website will not be disclosed to third parties. You can prevent these cookies being stored by selecting the appropriate settings in your browser. However, we wish to point out that doing so may mean you will not be able to enjoy the full functionality of this website. If you do not agree with the storage and use of your data, you can disable this feature here. In this case, an opt-out cookie will be stored in your browser to prevent Matomo from storing your usage data. If you delete your cookies, this will mean that the opt-out cookie will also be deleted. You will then need to reactivate it when you return to our site if you wish your activity not to be tracked.

Manage my cookie preferences

C. Online Data Security

We take all necessary technical and organisational security steps to store your personal data in such a way that third parties or the general public cannot gain access to it. If you want to contact us by email, please remember that the confidentiality of the information transmitted via this communication channel cannot be completely guaranteed. For this reason, we urge you to send confidential information to us only through the postal service.

D. Do We Share Your Data with Recipients Outside the EU or International Organisations?

When YouTube is used, personal data are transmitted to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

No adequacy decision has been issued by the European commission. But Google LLC is a member of the EU-US Privacy Shield.

You will find more information about the EU-US Privacy Shield at the URL: https://www.privacyshield.gov

E. How Long Do We Retain Your Data?

We process and retain your personal data for as long as it is necessary to fulfil our contractual and statutory obligations. It should be noted that in the case of annual ticket subscriptions, our business relationship is a continuing obligation designed to operate for several years.

Data that are no longer needed for fulfilling contractual or statutory obligations are regularly deleted, except when these data require – for a limited period – further processing for the following purposes:

• Compliance with the retention requirements stipulated in commercial and tax law: this includes the German Commercial Code (HGB), the German Fiscal Code (AO) and the German Money Laundering Act (GwG). The retention or documentation periods specified by them range from two to ten years.
• Preservation of evidence in accordance with statutory limitation periods. According to Sections 195 ff. of the German Civil Code (BGB), these limitation periods can last up to 30 years, though the standard limitation period is three years.
• Required to fulfil the purposes listed. In these cases, we may store and, if necessary, use your data for a duration appropriate for the purposes even after our business relationship or our pre-contractual legal relationship ends.

F. Are You Legally or Contractually Obliged to Provide Your Data?

What are the possible consequences of you not providing your data? In the context of our business relationship, you are obliged to provide the personal data that are required for commencing and conducting a business relationship and for fulfilling the associated legal obligations or in cases where we are legally obliged to collect such data. We cannot conclude or perform a contract with you as a general rule unless you provide us with such information.

In particular, we may be obliged to follow money-laundering regulations that call for use of your identification documents to verify your identity before we enter into a business relationship with you, thereby resulting in the collection and recording of your name, date and place of birth, nationality or nationalities, address and identification data. The Money Laundering Act stipulates that you must provide us with the necessary information and documents and notify us without delay of any changes that arise during our business relationship so that we can fulfil this legal obligation. If you do not provide us with the necessary information and documents, we are not permitted to establish or continue the business relationship sought by you.

This may also apply to data needed later in the course of the business relationship. If we request additional data from you, we will notify you separately that providing such data is voluntary.

G. Your Rights

You may exercise the following rights with respect to Autostadt GmbH at any time and at no cost:

Right to information: You have the right to obtain information from us about how we process your personal data.

Right of correction: You have the right to require us to correct any personal data relating to you that are incorrect or incomplete.

Right to erasure: You have the right to request the erasure of your data, provided the prerequisites specified in Article 17 of the GDPR have been met. For example, you can ask us to delete your data if they are no longer needed for the purpose for which they were collected. You can also request that your data be deleted if we process your data on the basis of your consent and you then revoke this consent. Please note that even in the case of a revocation, processing your data on a legal basis cannot be ruled out, and in this case a deletion may not take place.

Right to limit processing: You have the right to demand processing of your data be limited, if the prerequisites of Article 18 of the GDPR are satisfied. This could be the case, for example, if you dispute the accuracy of your data. You can then request that processing be restricted while we check whether your data are correct.

Right to data portability: If data processing is based on consent or on the fulfilment of a contract and takes place using an automated process, you are entitled to receive your data in a structured, conventional and machine-readable format and to transfer them to another data processor.

Right of withdrawal: Provided data processing is based on you providing consent, you have the right to withdraw that consent to the processing of your personal data free of charge at any time, effective going forward.

Right to lodge a complaint: You also have the right to lodge a complaint with a supervisory authority (e.g. the Data Protection Commissioner for the State of Lower Saxony) about our processing of your data. However, we recommend that you always direct a complaint to our data protection officer first.

 

Version dated: April 2024