In this Data Protection Notice (Privacy Policy) we are informing you about the processing of your personal data by AUDI AG, Ettinger Str. 70, 85057 Ingolstadt, Germany ("we") as the manufacturer, in the context of your contact to an Audi Service Partner or a service company (e.g. for the purpose of carrying out repairs, services, inspections).
We will inform you about data processing in connection with the use of other products and services, e.g. myAudi and the Audi connect services, in a separate data protection notice. Your Audi partner will also inform you separately about data processing by such partner.
Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number (e.g. the vehicle identification number (FIN), location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person).
Each vehicle is assigned a unique vehicle identification number. In various countries, this vehicle identification number (“FIN”) can be traced back to the current and former owner of the vehicle via information from the respective national Motor Transport Authority. There are also other ways of tracing data collected from the vehicle back to the owner or driver, e.g. via the vehicle license plate.
The data generated or processed by control units may therefore be personal data or may under certain conditions become personal data. Depending on the vehicle data available, conclusions can be drawn, for example, about your driving behavior, your location or route or your usage behavior.
Processing means any operation or set of operations performed with or without the aid of automated processes in connection with personal data such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
1. Who is responsible for data processing and whom can I contact?
The entity responsible for the processing of your personal data (the controller) is:
AUDI AG, Ettinger Str. 70, 85057 Ingolstadt, Germany.
If you have concerns about data protection, you can also contact our company's data protection officer:
AUDI AG, Datenschutzbeauftragter, Auto-Union-Straße 1, 85045 Ingolstadt; Germany
E-Mail: datenschutz@audi.de
If you wish to assert your data protection rights, please address them to
There you will find further information on how to assert your data protection rights.
You may also send your request via mail:
AUDI AG, DSGVO-Betroffenenrechte, Auto-Union-Str. 1, 85057 Ingolstadt, Germany
2. What data do we process and what sources do such data come from?
2.1 Data provided by you
We process personal data which we receive directly from you within the scope of our business relationship, i.e. during the initiation, execution and management of your business relationship with us or the provision of services (including the processing of possible warranty and guarantee cases) or your enquiries if you contact us directly. The relevant personal data usually includes personal details (name, address and other contact data (e.g. telephone, e-mail), date and place of birth and nationality). In addition, further personal data may be processed depending on the type of vehicle.
Secondly, we process personal data that we have lawfully obtained and are permitted to process from publicly accessible sources (e.g. the National Motor Transport Authority).
Information on the processing of your personal data within the framework of our direct business relationship with you can also be found at www.audi.de/datenschutz.
2.2 Data provided by Audi Partners or service companies
We process - to the extent necessary in connection with your enquiry - personal data which we lawfully receive from Audi Service Partners or independent service companies in the course of carrying out repairs, services or processing your enquiries (e.g. for the execution of orders, for the performance of contracts or on the basis of your consent).
The personal data include
The vehicle identification number of your vehicle serves as a unique identifier for your vehicle in the event of possible warranty or guarantee cases, repair, maintenance and support services, our internal quality monitoring and in the event of theft of your vehicle.
2.3 Data from your vehicle
If you use the Services (e.g. repair services, maintenance work), data stored in the vehicle (software status, vehicle operation data, technical data and other vehicle status data) can be extracted and processed together with the FIN and other vehicle master data (e.g. vehicle model, vehicle equipment).
The collection of data from the vehicle can be achieved by extracting it using a so-called diagnostic device or specific extraction devices (analysis tools) by employees of the Audi service network (Audi Service Partner) or third parties (e.g. roadside assistance and towing services, independent service companies), or by an employee of Audi AG, either directly or via remote access to the diagnostic device of the service company.
Vehicle-related data (e.g. event memory, operating data, vehicle identification number, model, software version) are always extracted by the diagnostic device for analysis of the request and transferred to a diagnostic protocol. The service company transmits the diagnostic protocol to us for the purposes specified in Section 3.
Further data can be extracted on an individual basis depending on your request.
This may also include data from the infotainment module, e.g. address book entries for requests regarding the access to the address book, or profile settings that you have stored locally in the vehicle.
The service company processes the data extracted in order to analyse and resolve your complaint.
The service company processes the data extracted in order to analyse and resolve your complaint. As a principle, we generally only process such data relating to you or to your vehicle which is necessary for the efficient processing of your request and to support the service company or us in processing it.
In the following, we explain to you which data your vehicle processes and which data can be extracted and processed by us in connection to a request.
2.4 Electronic control units - General information
Electronic control units are installed in your vehicle. Control units process data that they for example receive from vehicle sensors, generate themselves or exchange with each other. Some control units are necessary for the safe operation of your vehicle, others support you while driving (driver assistance systems), others enable comfort or infotainment functions. Specific information on data processing in your vehicle can be found in the respective operating manual, which is available online and, depending on the vehicle equipment, also in digital form in the vehicle, in direct connection with the data protection notices on the relevant features.
2.5 Operational data in the vehicle
Control units process data to operate the vehicle. These include, for example:
Generally, such data is volatile and is not stored beyond the operating time and only processed within the vehicle itself. Control units often contain event logs (including the vehicle key). These are used to temporarily or permanently document technical incidents as well as information about the vehicle condition (e.g. component stress, maintenance information).
The following data is stored, depending on the technical equipment:
In special cases (e.g. if the vehicle has detected a malfunction) it may be necessary to store data which would otherwise only be volatile.
If you make use of services, the stored operational data can be extracted together with the FIN if necessary. The extracted operating data documents the technical status of the vehicle or individual components and supports diagnosis, quality improvement and compliance with warranty or guarantee obligations.
The data is generally extracted via defined interfaces, e.g. the legally required connection for OBD ("on-board diagnosis") or the Service Key. These data, in particular information on component stress, technical events (event log entries), operation errors and malfunctions, are transmitted to us, together with the FIN, if necessary as part of the diagnostic protocol.
Event logs in the vehicle can be reset by a service company as part of repair or service work or at your request.
2.6 Technical data (IUMPR)
Regular functionality checks of components involved in exhaust gas cleaning are legally required.
To proof regular checks (diagnosis) have been conducted, the In-Use Monitor Performance Ratio (IUMPR) is determined in the control unit (data verifying the diagnostic function) and stored there as technical data.
2.7 Comfort and infotainment functions
You can save comfort settings and individualisations in the vehicle and change or reset them at any time. Depending on the respective equipment, these include, for example
Within the scope of the selected equipment, you can introduce your own data into the infotainment-functions of the vehicle. Depending on the respective equipment, these include, for example:
Such data regarding comfort and infotainment functions can be stored locally in the vehicle or on a device you have connected to the vehicle (e.g. smartphone, USB stick or MP3 player). If you have entered data yourself, you can delete it at any time.
Generally, such data will only be transferred from the vehicle at your request, especially regarding the use of online services according to the settings you have selected.
Data from comfort and infotainment functions, e.g. individual settings or individualizations, cannot be extracted using the diagnostic device and are therefore not a standard part of the diagnostic protocol. Such data is extracted only in individual cases and upon request of the customer. In connection to a complaint regarding the area of comfort and infotainment functions, it may be necessary for this data to be extracted and transmitted to us for the purpose of repair support.
Depending on the respective equipment, the following data in particular can be extracted from the comfort functions and processed, if required:
Depending on the respective equipment, the following data in particular can be extracted from the infotainment functions and processed, if required:
In this context for example, the last recognized voice command can also be extracted.
Such data regarding comfort and infotainment functions can be stored locally in the vehicle or on a device you have connected to the vehicle (e.g. smartphone, USB stick or MP3 player). If you have entered data yourself, you can delete it at any time.
If a control unit is replaced as part of a repair, this data is usually extracted from the old control unit and transferred to the new control unit.
2.8 Online services
If you vehicle has a wireless network connection, this enables the exchange of data between your vehicle and other systems (data servers of Audi AG or data servers of service providers). In certain countries, the wireless network connection is made possible by an onboard transmitter and receiver unit (built-in by us) or by a mobile device (e.g. smartphone) installed by you.
Online functions (information and control services for your vehicle) can be used via this network connection. This includes online services and applications/apps provided to you by us or other providers ("Audi connect services" or "Services").
Regarding the Audi AG online services, a description of the respective functions and the associated data protection information are provided at a suitable location (e.g. MMI, Audi AG website). Personal data may be processed for the purpose of providing online services. Personal data may be processed for the purpose of providing online services.
If this is necessary for processing your service request, we can also access the data stored in our IT systems from the online services as well as information on the status of the Audi connect services, i.e. license periods, connection status, contract status.
2.9 Video, image and sound recording
In some individual cases it may be necessary to make video, image or sound recordings of individual components and to transmit these to Audi AG, e.g. in the event of complaints, to be able to carry out a targeted analysis and the resolution of complaints (repair support). This may be possible, for example, in the case of acoustic complaints in order to find the cause of the noise emission and to be able to resolve the complaint.
3. For what purposes do we process your data and on which legal basis?
We process your personal data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act [Bundesdatenschutzgesetz (“BDSG”)] for the following purposes:
|
Purpose |
Legal Basis |
Legitimate Interest for Balancing of Interests |
|
Processing your inquiry when contacting us, our customer service, in particular customer complaints and customer requests |
Performance of contract (vehicle purchase/ leasing/ service contract), Balancing of interests |
Effective processing of your enquiries and feedback on your requests |
|
Supporting the Audi partner or third parties in error analysis and diagnosis (including analyzing vehicle modifications) and examination and handling of warranty and guarantee claims against Audi partners |
Balancing of interests |
- Effective diagnosis and analysis in order to be able to resolve complaints; - Supporting the Audi partner in fulfilling its legal obligations towards you; - If there are concrete indications that a fault during the warranty or guarantee period was caused by changes to the vehicle itself (tuning, conversions, etc.), Audi AG and the Audi partner have a legitimate interest in identifying such changes; - exchange with the respective partner in warranty and guarantee cases in order to be able to settle the costs internally. |
|
Error analysis (including analyzing changes to vehicles) and examination and handling of warranty and guarantee claims against Audi AG |
Performance of contract, Balancing of interests |
- If there are concrete indications that a fault during the warranty or guarantee period was caused by changes to the vehicle itself (tuning, conversions, etc.), Audi AG has a legitimate interest in identifying such changes;
|
|
Settlement of warranty claims against manufacturers of parts/components/systems (if necessary by disclosing the vehicle information number) |
Balancing of interests |
Processing of warranty and guarantee claims in the event of defects in a component/component/system manufactured by a third party |
|
Observation of emission levels and monitoring of exhaust gas levels |
Balancing of interests, fulfillment of a legal obligation |
As a manufacturer, we are also subject to legal requirements regarding the disclosure of certain data, e.g. for the fulfillment of official reporting obligations in connection with the monitoring of emission systems. |
|
Audi AG assisting you in your personal matters in the context of legal disputes and the assertion of insurance claims |
Consent |
|
|
Handling of legal disputes |
Balancing of interests |
Asserting, exercising or defending legal claims of the Audi AG or the respective Audi partner |
|
Product improvement, optimization and development of vehicle functions, analysis tools |
Balancing of interests |
Use of data concerning specific vehicle malfunctions for the further development of diagnostic devices and processes, vehicle components and functions |
|
Support for law enforcement authorities in the event of vehicle theft by tracking vehicles and vehicle parts using the vehicle identification number |
Public interest |
|
|
Improvement of theft protection |
Balancing of interests |
Evaluation of data collected during theft investigations for the general improvement of the anti-theft functions of vehicles relevant to theft protection |
|
Settlement of Audi-partner claims from remuneration and bonus programs |
Balancing of interests |
Fulfillment of legal claims of Audi partners |
|
General customer analysis, statistical evaluations for business management, cost recording and controlling using the vehicle identification number |
Balancing of interests |
Reporting on key business figures using the vehicle identification number if necessary |
|
Product monitoring and fulfillment of other legal obligations |
Fulfillment of a legal obligation, |
|
|
Quality control through appropriate product monitoring and documentation (including proactive complaint management through direct contact with you), product liability, recall campaigns |
Balancing of interests |
Control of product quality and prevention of product damage, preventive complaint management |
|
Prevention of fraud and money laundering |
Fulfillment of a legal obligation, Balancing of interests |
Compliance with statutory and regulatory requirements |
|
Prevention, combating and clarification of the financing of terrorism and crimes that pose a threat to property, comparisons with European and international anti-terror lists, |
Fulfillment of a legal obligation, Balancing of interests |
Compliance with statutory and regulatory requirements |
|
Compliance with official requirements (e.g. recall campaigns by the German Federal Motor Transport Authority) |
Fulfillment of a legal obligation, Balancing of interests |
Compliance with statutory and regulatory requirements |
|
Compliance with fiscal control and reporting obligations, archiving of data |
Fulfillment of a legal obligation, Balancing of interests |
Compliance with statutory and regulatory requirements |
|
Disclosure within the framework of official/judicial measures for the purposes of gathering evidence, prosecution and enforcement of civil claims |
Fulfillment of a legal obligation, Balancing of interests |
Compliance with statutory and regulatory requirements |
|
Customer and prospect support |
Consent |
---- |
|
Customer survey (including satisfaction survey), |
Consent, Balancing of interests |
Quality control and measurement of customer satisfaction |
|
Creation of customer information tailored to your personal needs, direct advertising |
Consent |
---- |
|
Data consolidation between Audi and Audi partners to create a uniform customer database |
Consent |
---- |
|
Billing and tax valuation of operational services |
Performance of contract, Fulfillment of a legal obligation,
|
Compliance with statutory and regulatory requirements |
|
Audits and special inspections, internal investigations |
Balancing of interests |
Verification of compliance with contractual and statutory obligations by Audi AG, its employees and its sales partners, suppliers, etc., if necessary using the vehicle identification number |
Optimization and development of vehicle functions, analysis tools: For the purposes of research and development, in order to optimize our product range of vehicle functions and to adapt them to high customer expectations, in particular by further developing innovative vehicle functions, components and parts in our vehicles as well as analysis tools and processes, we process technical performance data from assistance systems, comfort systems, operating elements or components (e.g., control units); if necessary together with environmental data (e.g. outside temperature, brightness) and information on route length, vehicle speed, vehicle condition data (e.g. tank level or charge level, mileage) and system usage data. To the extent possible, we anonymize the data in our IT systems prior to evaluation. If this is not possible, we analyze the data from your vehicle in such a way that as little conclusions as possible can be drawn about you or your vehicle. For this purpose, Audi AG has established additional measures where required, so that a personal reference can only be established in duly substantiated exceptional cases, e.g. in order to be able to carry out field measures or if malfunctions relevant to safety or product liability are detected, and the data is only processed for the aforementioned purposes. Such additional measures include for example strict access restrictions, IT security measures, deletion deadlines and purpose limitation. We do not use this data to create profiles or evaluations based on individual vehicles. In addition, no data attributes are used that allow for the generation of a profile or for conclusions about your behavior or patterns of behavior. The processing is carried out to safeguard the legitimate interests of Audi AG in order to meet our customers' high expectations regarding the quality of our products and services and the provision of new, innovative functions and solutions.
Further product information and market research: If you would like to receive information on our products and services, you can order this promotion. Then, the following data will be processed for the purpose of advertising delivery within the scope of the consent to be provided by you (Art. 6 (1) (a) GDPR): name, first name, e-mail address and/or telephone number). If you agree to be contacted by e-mail, we will use the so-called double opt-in procedure, i.e. we will send you an e-mail to the e-mail address provided with the request for confirmation of your consent. You can find out how to revoke your consent in the section "What rights do I have?”
Please observe your rights of objection when processing data for the purpose of direct marketing or for personal reasons and your right to object consent (see section "What rights do you have?" and section "Information about your rights of objection").
4. Is there an obligation to provide personal data?
In the context of service performance to you, you need to provide only the personal data that is required for the performance of the services (in particular the repair order, repair support, warranty/guarantee) or that we are required to collect by law. Without this data, we will generally not be able process your request in whole or in part, for example analyzing and resolving a complaint may not be possible.
5. Who receives my data?
Due to the size and complexity of the data processing by Audi AG, it is not possible to list each recipient of your personal data individually in this data protection notice, which is why usually only categories of recipients are specified.
Your personal data will be disclosed by us to third parties only if this is necessary for the fulfillment of the contract, if we or the third party have a legitimate interest in the disclosure, or if you have given your consent. In addition, data may be transferred to third parties to the extent we are required to do so by law or by enforceable regulatory or judicial order.
Within Audi AG, your data is provided to the respective departments that require such data for the performance of our contractual and statutory obligations and to pursue legitimate interests (e.g. quality control).
Service providers (so-called “processors”) who are commissioned by us and who operate on our behalf may also receive data for these purposes. Service providers may, for example, be commissioned to provide server capacities. We use the following contract processors for the abovementioned purposes:
Third parties to whom we may disclose your personal data for the purpose of assisting the Audi partner in the analysis and diagnosis or settlement of warranty and guarantee claims include
We generally only transmit technical data of your vehicle and, if necessary, the hardware components (e.g. control unit) to the aforementioned third parties if this is necessary in order to carry out the service/repair order or to analyze or resolve a complaint. Please note that in individual cases we also transmit the FIN together with the technical data or the hardware component if this is necessary for the analysis, e.g. for the assignment to a specific production batch. In some control units, the FIN is programmed into the hardware component and cannot be removed by us. In this case, the third party may be able to access and extract the FIN in the hardware component.
Third parties to whom we may transfer your personal data, irrespective of the services we provide, include
As far as there are statutory provisions, manufacturers are obligated to release data they store to the extent required upon request of government agencies in individual cases (e.g. to investigate a criminal offence).
Within the scope of applicable law, government agencies are also authorised to extract data from vehicles themselves in individual cases. In the event of an accident, for example, information can be read from the airbag control unit that can help to clarify the situation. In the event of an accident, for example, information may be extracted from the airbag control unit that may support the investigation of the accident.
6. Is data transmitted to a third country?
A transfer of data to third countries (i.e., countries that are neither members of the European Union nor of the European Economic Area) may occur to the extent necessary to perform services for you, if required by law, or where you have given us your consent.
Particularly in the context of the analysis and diagnosis or settlement of warranty and guarantee claims, it may be necessary to transfer your data to manufacturers of a component/ part/ system in third countries (see Section 5). We avoid the transfer of your personal data as far as possible and only provide the third party with data that it absolutely needs.
Please note that not all third countries have a data protection level recognized as adequate by the European Commission. For data transfers to third countries where there is no adequate level of data protection, we ensure that, prior to disclosure, the recipient has either an adequate level of data protection (e.g. adequacy decision of the EU Commission or agreement of so-called EU Standard Contractual Clauses of the European Union with the recipient), or we have obtained express consent from our users.
You can obtain from us a copy of the specific applicable or agreed provisions to ensure an adequate level of data protection. To do so, please use the information in the Contact section.
7. How long will my data be stored?
We store your data as long as necessary for the provision of our services to you or do so if we have a legitimate interest in the continued storage.
In addition, we are subject to various retention and documentation requirements pursuant to inter alia the German Commercial Code (Handelsgesetzbuch - “HGB”) and the Tax Code (Abgabenordnung - “AO”). The retention and documentation periods specified therein last up to ten years. Finally, the storage period is also governed by statute of limitations periods, which can be up to thirty years, for example, pursuant to secs. 195 et seq. of the German Civil Code (Bürgerliches Gesetzbuch - “BGB”), whereby the general limitations period is three years.
Under certain circumstances, your data may need to be kept longer, e.g. if a legal hold or litigation hold (i.e. a ban on deleting data for the duration of the proceedings) is ordered in connection with official or judicial proceedings.
8. What rights do I have?
As the data subject, you are entitled to the following data protection rights:
|
Access: |
You have the right to request access to personal data related to you and stored at Audi AG and about the scope of data processing and data transfer performed by Audi AG and to obtain a copy of your stored personal data.
|
|
Rectification: |
With respect to your personal data stored at Audi AG, you have the right to demand the immediate rectification of incorrect personal data and you have the right to have incomplete personal data completed.
|
|
Erasure: |
You have the right to demand the immediate deletion or erasure of your personal data stored by Audi AG, if the legal requirements are satisfied. This is the case, in particular, if
If we have transmitted your data to third parties, we will inform them about the erasure to the extent required by law. Please note that your right to erasure is subject to certain limitations. For example, we may not and/or must not erase data that we are still required to retain due to statutory retention obligations. In addition, your right of erasure does not extend to data that we need in order to assert, exercise or defend against legal claims, unless other grounds for continued storage exist.
|
|
Restriction to the Processing: |
Under certain conditions, you have the right to request that processing be limited (i.e., the marking of stored personal data with the aim of limiting its processing in the future). The requirements are:
Where processing has been restricted, such data will be marked accordingly and, with the exception of storage, will be processed only with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest the EU or an EU Member State.
|
|
Data Portability: |
To the extent that we automatically process your personal data that you have provided to us based on your consent or any contract with you (including your employment contract), you have the right to receive such data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from Audi AG. You also have the right to have the personal data transmitted directly from Audi AG to another controller where technically feasible, provided that such transmission does not adversely affect the rights and freedoms of others.
|
|
Right to Object: |
If we process your personal data on grounds of legitimate interests or in the public interest, then you have the right to object to the processing of your personal data on grounds relating to your particular situation. In addition, you have an unrestricted right to object if we process your data for our direct marketing purposes. Please see our separate note in the section titled “Information about your right to object”. In certain situations, in the context of a balancing of interests, we will grant you an additional unrestricted right to object.
|
|
Withdrawal of Consent: |
If you have given consent to the processing of your personal data, then you can withdraw such consent at any time. Please note that the withdrawal applies prospectively only. Processing that occurred before the withdrawal of consent is unaffected.
|
|
Complaint: |
Furthermore, you have a right to file a complaint with a data protection authority (Datenschutzaufsichtsbehörde), if you believe that the processing of your personal data is unlawful. The right to file a complaint is without prejudice to any other administrative or judicial remedies. The address of the data protection supervisory authority responsible for Audi AG is:
Bayerisches Landesamt für Datenschutzaufsicht
Promenade 18
91522 Ansbach
Germany |
|
Information about Your Right to Object
Right to object for personal reasons
You have the right to object to the processing of your personal data on grounds relating to your particular situation. The prerequisite for this is that the data processing takes place in the public interest or on the basis of a balancing of interests. This applies also to profiling.
Insofar as we base the processing of your personal data on a balancing of interests, we generally assume that we can demonstrate compelling legitimate grounds but will, of course, examine each individual case.
In the event of an objection, we will no longer process your personal data, unless
Objection to the processing of your data for our direct marketing purposes If we process your personal data for the purpose of direct advertising, you have the right at any time to object to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is connected with such direct advertising.
If you object to the processing for purposes of direct marketing, we will no longer process your personal data for these purposes.
Objection against the processing of your personal data for product improvement and general customer analysis As part of the balancing of interests, we grant you a separate right of objection with regard to the processing of your personal data for product improvement and general customer analysis.
If you object to the processing for purposes of product improvement and/or general customer analysis, we will no longer process your personal data for these purposes. Purely statistical evaluations of aggregated or otherwise anonymous data remain unaffected by this.
Exercise of the right of objection The objection can be made without form and should preferably be made to the contact data listed in this data protection notice. |