In this Privacy Notice according to Art. 13, 14 EU-GDPR we are informing you about the automated, electronic processing of your personal data by AUDI AG, Auto-Union-Straße 1, 85057 Ingolstadt, Deutschland / Germany (”we”) in the context of your professional engagement as an employee of an Audi sales partner.

Personal data means any information relating to an identified or identifiable natural or, if forseen under local law, legal person, including, as the case may be, sensitive personal data as defined under the laws of the country where you are located at the relevant time (‘data subject’); a data subject is one that can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1.            Who is the controller for the processing and who can I contact?

The controller for the processing of your personal data is:

AUDI AG, Auto-Union-Straße 1, 85057 Ingolstadt, Germany.

For matters concerning data protection, you can also consult our company data protection officer, using your own language:

AUDI AG, Data Protection Officer, 85045 Ingolstadt, Germany

E-mail: datenschutz@audi.de

Telephone number: +49841 890

Office address of the company data protection officer: AUDI AG, Data Protection Officer, Auto-Union-Straße 1, 85057 Ingolstadt, Germany

If you wish to assert your data protection rights, please use the contact options at

https://gdpr.audi.com

There, you will find further information regarding how you can assert your data protection rights. You may also send your request via mail:

·       AUDI AG, DSGVO-Betroffenenrechte, 85045 Ingolstadt, Germany

·       E-mail address: datenschutz@audi.de

·       Telephone number: +49841 890

2.             Which data do we process for which purposes and from which sources does it originate?

We process personal data which we receive from you within the scope of business relations with an Audi sales partner (Audi partner, Audi service partner, Audi importer or large dealer) at whom you are employed and within the scope of your interaction with us.

The personal data include:

·       Private contact and master data

·       Professional work and organisational data

·       Data on personal circumstances and preferences

·       IT usage data

·       Recordings

We collect your data whenever you contact  or communicate with us or you use IT systems provided by AUDI AG as a data controller.

3.             Which data do we process for which purposes and which legal bases apply?

We process your personal data in accordance with the provisions of the General Data Protection Regulation (“GDPR”) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”) and other local law for various purposes.

The processing of your personal data must be based on one of the following legal bases:

·       You have given your consent (Art. 6(1)(a) GDPR);

·       Processing is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR);

·       Processing is necessary for compliance with a legal obligation under EU law or the law of an EU member state to which we are subject (Art. 6(1)(c) GDPR);

·       Processing is necessary in order to protect your vital interests or those of another person (Art. 6(1)(d) GDPR);

·       processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Art. 6(1)(e) GDPR)

·       Processing is necessary for the purposes of the legitimate interests pursued by AUDI AG or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular where the data subject is a child (Article 6(1)(f) GDPR).

If, in exceptional cases, we process special categories of personal data (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning a person's sex life or sexual orientation) about you, one of the following legal bases must also apply:

·       You have given your explicit consent (Art. 9(2)(a) GDPR);

·       The processing is necessary to protect your vital interests or those of another person and the data subject is physically or legally incapable of giving consent (Art. 9(2)(c) GDPR);

·       the processing relates to personal data which you have manifestly made public (Art. 9(2)(e) GDPR)

·       processing is necessary for the establishment, exercise or defence of legal claims (Art. 9(2)(f) GDPR)

·       processing is necessary for reasons of substantial public interest on the basis of EU law or the law of an EU Member State which is proportionate to the aim pursued, respects the essence of the right to data protection and provides for suitable and specific measures to safeguard your fundamental rights and interests (Art. 9(2)(g) GDPR).

Following on from the above, we process your personal data on the basis of the following legal bases for the following purposes:

Please note: If the applicable local law of the country where you are located at the relevant time foresees additional requirements regarding the legal bases, we will comply with such additional requirements and will inform you accordingly. This in particular applies, where such local law requires (express) consent for the processing of your personal data.

Please note your rights to object to the processing of data for the purpose of direct marketing or for personal reasons and your right to withdraw consent (see section "Which rights do you have?" and the section "Information on your right to object").

3.1.         Is there an obligation to provide personal data?

As part of our business relationship, you only need to provide the personal data that is required for the execution of the business relationship, or that we are required or permitted to collect by law. Without this data, we may not be able to provide certain services. For example, if you do not provide us with your contact details, we will not be able to contact you regarding a request.

4.             Who receives my data?

Within AUDI AG, those entities receive your data that need your data for data processing purposes (e.g. Sales Germany, IT).

Service providers employed by us and working on our behalf (so-called processors), who support data processing on our behalf, also receive data for these purposes. We only use processors in Germany. For example, your email address may be passed on to a service provider so that they can deliver a newsletter you have ordered. Service providers may also be commissioned to provide server capacity. This includes:

We will generally share your personal data with third parties only if this is necessary for the performance of the contract, if we or the third party have a legitimate interest in the disclosure, or if you have given your consent, subject to applicable local laws. In addition, data may be shared with third parties (including investigative or security authorities) to the extent we should be required to do so by law or by enforceable regulatory or judicial orders. Third parties to whom we disclose your personal data and who act as data controllers under data protection law include

·       Service providers / suppliers

·       Insurance companies

·       Public authorities

·       Legal, economic and financial representatives

5.             Is data transferred to a third country?

We process your data in Germany. As a rule, we do not transfer your data to other countries or third countries (countries that are neither members of the European Union nor the European Economic Area) or to international organisations.

A transfer of data to third countries (i.e. countries that are neither members of the European Union nor of the European Economic Area) may take place, to the extent this is required for the provision of services to you, is required by law, or you have given us your consent (in the absence of any other appropriate safeguarding mechanism under applicable law). Please note: Under the applicable local laws of the jurisdiction where you are located at, a transfer to a third country might be defined as a transfer outside of the territory or country where you are located at the relevant time.

Please note that not all third countries have a level of data protection recognised as adequate by the competent body of the country where you are located at the relevant time (e.g. the European Commission). AUDI AG will only transfer your personal data to third countries to the extent permitted by applicable law. Insofar as AUDI AG relies on appropriate safeguards in accordance with applicable law (e.g. Standard Contractual Clauses or Binding Corporate Rules pursuant to Art. 46(2) GDPR for third country transfers), AUDI AG will take such additional technical and/or organizational measures to the extent necessary to maintain an adequate level of protection of your personal data, as required under applicable laws.

You can obtain a copy from us of the specific applicable or agreed rules to ensure the adequate level of data protection. Please use the information in the Contact section for this purpose.

Your data will be transferred to the following recipients in a third country: n/a

6.             How long will my data be stored?

We store your data as long as your employment relationship with the respective sales partner or your interaction with us continues  and it is necessary for you or we have a legitimate interest in the further storage.

, “BGB”), with the regular period of limitation being three years.

Under certain circumstances, your data may also need to be retained for a longer period of time, such as when a so-called legal hold or litigation hold (i.e. a prohibition of data deletion for the duration of the proceedings) is ordered in connection with administrative or judicial proceedings.

We may also be subject to retention and documentation obligations in line with the local legislation of your country.

7.     Which rights do I have?

All the below described rights concerning the personal data and the processing thereof may be subject to limitations, according to the applicable EU and/ or national laws. Depending on your jurisdiction, as the data subject, you may be entitled to the following data protection rights. Please note: Your data protection rights under the local laws of the country where you are located at the relevant time may differ from the rights described below. Please see Annex 1 for additional, country-specific information, in particular on rights that you might have under local laws. Such rights apply, to the extent the legal requirements are met, in addition to your rights provided under the GDPR.

As a data subject, you are generally entitled to the following data protection rights: 

See Appendix 1 "Additional rights of data subjects and further country-specific information" for contact details of national supervisory authorities and further country-specific information. 

7.1.    Information on your right to object

Right to object on grounds relating to your particular situation

You have the right to object to the processing of your personal data on grounds relating to your particular situation. The prerequisite for this is that the data processing takes place in the public interest or on the basis of balancing of interests. This also applies for any profiling.
Insofar as we base the processing of your personal data on balancing of interests, we generally assume that we can demonstrate compelling legitimate grounds, but we will, of course, examine each individual case.
In the event of an objection, we will no longer process your personal data, unless, 
•    we can demonstrate compelling legitimate grounds for the processing of such data which over-ride your inter-ests, rights and freedoms or
•    your personal data are used for the establishment, exercise or defence of legal claims.

Objection to the processing of your data for our direct marketing purposes

Where we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object to the processing for direct market-ing purposes, we will no longer process your personal data for such purposes, which includes profiling to the extent that it is related to such direct marketing. 
If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.
Objection to the processing of your data for product improvement and general customer analysis
As part of the legitimate interests, we grant you a separate right of objection with regard to the pro-cessing of your personal data for product improvement and general customer analysis. 
If you object to the processing for the purpose of product improvement and/or general customer analysis, we will no longer process your personal data for these purposes. Purely statistical evaluations of aggre-gated or otherwise anonymous data remain unaffected by this.

Exercise of the right to object

The objection can be exercised in any form and should preferably be addressed to the contact details listed in this privacy notice.

 
Annex 1 – Additional data subject rights and further country-specific information

Argentina

You have the right to
•    access;
•    rectification;
•    erasure; 
•    file a complaint regarding the processing of your personal data to THE PUBLIC INFORMATION ACCESS AGENCY, which, depending on the facts of the individual case, in its capacity as the Con-trol Entity of Law No. 25,326, has the power to attend complaints and claims filed by those whose rights are affected due to breaches with applicable regulations on personal data protec-tion.

Australia

You have the right to 
•    access;
•    rectification;
•    lodge a complaint with both AUDI AG and the Office of the Australian Information Commissioner (“OAIC”) or any other dispute recognition scheme recognised by the OAIC which can be found on the OAIC website www.oaic.gov.au.
If you are concerned with the way we have handled your personal data, you may lodge a privacy complaint with the Office of the Australian Information Commissioner (“OAIC”).  However, it is a requirement of the OAIC that prior to lodging a complaint, you have raised your complaint with us. If you are not satisfied with our response or we fail to provide a response within 30 days of re-ceipt, you can lodge a complaint with the OAIC. The contact details for the OAIC are set out be-low:
 
Phone      1300 363 992
Fax          (02) 9284 9666
Website   https://www.oaic.gov.au/
Post        GPO Box 5288, Sydney NSW 2001

Brazil

You have the right to
•    to be informed about the collection and use of your personal data, by us, in a readily accessible manner, and in plain and clear language. You also have the right to be informed about any public or private entity with whom your data has eventually been shared. We are implementing your right to be informed, also through this notice, the content of which may be updated from time to time.
•    information access;
•    obtain a copy when the legal basis for processing is consent or performance of a contract;
•    erasure when consent is the legal basis for processing: please note that exceptions to this right might apply, namely, when the data is needed for (i) compliance with legal obligations; (ii) study by a research organization; (iii) transfer to third parties; (iv) use solely by the controller, as long as the data is anonymized;
•    rectification;
•    object to the processing (e.g. if the data is being unlawfully processed);
•    data portability;
•    withdraw consent at any time;
•    anonymize, block or delete unnecessary or excessive personal data or data processed in noncom-pliance with data protection law;
•    review decisions made solely on the basis of automated processing;
•    lodge a complaint before ANPD (Autoridade Nacional de Proteção de Dados) against the data con-troller;
•    be informed of the possibility of not providing consent and the consequences thereof;
•    be informed about the public and private entities with whom the data has been shared.

Colombia

Pursuant to the provisions of art. 8 of Law 1581 of 2012, you have the right to
•    know, update and rectify your Personal Data from the Controller or the Processor. This right can be exercised, among other, regarding partial data as well as in respect to data that is incomplete or fractioned, that induces error, or those whose Processing is expressly forbidden or has not been authorized;
•    request evidence of the authorization granted to the Controller unless when it is expressly ex-cepted as a requirement for the Processing, pursuant to the provisions of article 10 of law 1581 of 2012;
•    be informed by the Controller or the Processor upon request, in respect to the use that has been made of your Personal Data;
•    file to the Superintendence of Industry and Commerce complaints for infractions to the provi-sions of Law 1581 of 2012 as amended, added to or supplemented from time to time;
•    revoke the authorization and/or to request the deletion of the specific data, provided that there is no legal or contractual obligation that imposes on you the duty to remain in the database;
•    have access, free of charge, to your Personal Data that has been the subject of Processing, at least once per calendar month and whenever there are substantial amendments to the Processing poli-cies.

Procedures you have to follow to exercise your personal data rights

A.    Complaints: You may file complaints regarding the Personal Data kept in AUDI AG's databases, according to the following rules:
•    The complaint will be analyzed to verify your identification. If the complaint is made by a person other than you and the capacity of such person is not accredited according to the laws in force, the complaint will be rejected.
•    All the complaints will be resolved in a maximum term of ten (10) business days as from the date in which the same are received. If it is not possible to answer the complaint within said term, you will be informed, expressing the reasons for the delay and informing a date in which the enquiry will be answered, which cannot exceed, in any case, five (5) business days after the expiration of the original term.
B.    Requests: If you consider that the data contained in AUDI AG's databases must be subject to cor-rections, updates or deletion, or when they notice the alleged breach of any of the duties, you may file a request according to the following rules:
•    The requests will be analyzed to verify your identification. If the request is made by a person other than you and the representation thereof is not accredited according to the regulations in force, the request will be rejected.
•    The request must contain the following information: (i) your identification; (ii) contact data (physical and/or electronic address and contact phone numbers); (iii) the documents that ac-credit your identity, or your representation; (iv) The clear and precise description of the Per-sonal Data regarding which you seek to exercise any of the rights; (v) The description of the facts that lead to the request; (vi) The documents that they intend to enforce; (vii) signature and identification number.
•    If the request is incomplete, AUDI AG shall make a requirement to you, within a term of five (5) days after the receipt of the request, to remedy the defects. If two (2) months lapse from the date of the requirement and you have not given the information required, it shall be construed that you have desisted the request.
•    If the area that receives the request is not competent to answer it, it shall pass it to the relevant area or person within a term of two (2) business days and will inform this situation to the interested party.
•    Once the complete request has been received, a note saying “request being processed” shall be included in the database with the reason thereof, in a term of no more than two (2) busi-ness days. Said note must be left in place until the moment in which the claim is decided.
•    The maximum term to answer the request will be fifteen (15) business days as from the day after the date in which it is received. When it is not possible to answer the request with-in that term, the reasons of the delay shall be informed to the interested party together with the date in which the request will be answered, which under no circumstances can ex-ceed eight (8) business days after the expiration of the first term.
•    You have the right, at all times, to request the deletion of you Personal Data. The deletion implies the total or partial removal of the Personal Data from the Data Bases, according to your request. The deletion right is not absolute and AUDI AG may refuse the exercise there-of in the following events: (i) If you have a legal or contractual duty to remain in the Data-base or if the Controller has a legal or contractual obligation that means that it has to keep the Personal Data; (ii) The deletion of the Personal Data would thwart judicial or adminis-trative activities related to fiscal obligations, the investigation and persecution of crimes or the update of administrative sanctions; (iii) The Personal Data is necessary to protect your interests protected by the laws, to perform an action pursuant to the public interest, or to comply with an obligation legally acquired by you or by the Controller. 
Authorization: As from the enactment of this Notice, at the time of the collection of Personal Data, AUDI AG shall request the prior authorization from you and you shall be duly informed about the specific purposes of the Processing for which such consent has been obtained, excepting in the case of any one of the exceptions provided in article 10 of Law 1581 of 2012 for such purposes.
AUDI AG may transmit and/or transfer your Personal Data to third parties located in Colombia or abroad, as long as AUDI AG has the prior and express authorization of you of the Personal Data.
Retention period: The information provided by you shall only be used for the purposes herein established. Once the need for the Processing of the Personal Data has ceased, the same shall be deleted from AUDI AG's databases.

Hong Kong

In addition to your rights set out in Sec. 7, you may withdraw your consent to the use of your personal da-ta.
In addition to your rights set out in Sec. 7.1, you will be informed at the time of the first communication with you in direct marketing without charge to you.

India

You have the right to
•    access;
•    rectification;
•    withdraw consent;
•    contact the Grievance Officer. The Data Protection Officer is the Grievance Officer for AUDI AG. For the contact details please see Sec. 1.

Israel

You have the right, subject to Protection of Privacy Law, 5741-1981 and the regulations enacted there-from, to
•    be informed if you are under a legal duty to provide the data, the purpose of collection, and de-tails of any third party that will receive the data and for what purpose;
•    access;
•    rectification: request correction of the inaccurate or missing data or request deletion or destruc-tion of the data;
•    object to the processing (e.g. if the data is being unlawfully processed).

Malaysia

You have the right to
•    request access to your personal data;
•    request correction of your personal data;
•    prevent processing likely to cause damage or distress; and
•    prevent processing for purposes of direct marketing.
Upon exercising your rights stated above in written form addressed to the contact details listed in section 1., if you are dissatisfied with our response or we fail to provide a response within 21 days of receipt, you have the right to submit an application to the Personal Data Commissioner to require us to comply with your request. The application to the Personal Data Commissioner can be made to the following address:
Commissioner of Personal Data Protection, 6 th Floor, KKMM Complex Lot 4G9, Persiaran Perdana, Presint 4 Federal Government Administrative Centre 62100 Putrajaya.
In the event of any inconsistencies between the English version and the Bahasa Malaysia version of this Privacy Notice, the English version shall prevail.

Mexico

You have the right to:
•    access;
•    rectify;
•    cancel;
•    oppose;
•    file data protection measures with the Federal Institute for Access to Information and Data Pro-tection;
•    request a reconsideration of a decision made via automated decision making in case you are of the opinion that the data processed in this context is (partly) incomplete or incorrect.

New Zealand

You have the right to
•    know what personal data is held;
•    request for personal data held and access the personal data;
•    rectification;
•    a response to your request within 20 working days, if you make a request for access to or rectifi-cation of your personal information. In limited circumstances, AUDI AG may extend this 20 working day time limit, but we must tell you the period of the extension and the reasons for the extension.
•    lodge a complaint with both AUDI AG and the Privacy Commissioner. However, it is a require-ment that before you can complain to the Privacy Commissioner you must first raise your com-plaint with AUDI AG. If you are not satisfied with AUDI AG’s response or you do not receive a re-sponse, you can lodge a complaint to the Privacy Commissioner. In general, you should wait at least 30 working days for a response before contacting the Privacy Commissioner to lodge a complaint.

Serbia

You have the right to be informed about appropriate safeguards in case of a data transfer to countries or international organisations outside Serbia that do not provide an adequate level of data protection recog-nised by a Serbian Government Decision. All EU / EEA Member states provide an adequate level of data protection recognised by a Serbian Government Decision.

Singapore

You have statutory rights as provided under Singapore's Personal Data Protection Act 2012, including the rights to
•    request access to your personal data;
•    request correction of your personal data; and
•    withdraw consent to the collection, use or disclosure of your personal data (where applicable), subject to any grounds for the collection, use or disclosure without your consent that are required or authorised under the Personal Data Protection Act 2012 or any other written law of Singa-pore.

South Africa

You have the right to
•    not have your personal data processed for the purposes of direct marketing by unsolicited elec-tronic communication;
•    initiate civil proceedings;
•    be informed if your personal information has been compromised;
•    be informed, free of charge and before the information is included in a directory, should you be a subscriber to a printed or electronic directory;
•    lodge a complaint to the Information Regulator of South Africa by completing this form and sending it to POPIAComplaints@inforegulator.org.za. 
For further information about your South African data privacy rights, please click here which will take you to the website of the Information Regulator.

South Korea

You (and your legal representative) have statutory rights under the Korean Personal Information Protec-tion Act, in particular the right to 
•    access;
•    rectification / erasure;
•    suspension of processing; and
•    withdrawal of consent.
You (or your legal representative) can exercise such rights by contacting us or our data protection officer using the contact details set out in Section B.II.
Certain personal data may be retained for compliance with local laws and regulations for certain periods, such as the following:
•    All transaction records and relevant documentary evidence as prescribed by applicable tax laws:  5 years (as required under the Framework Act on National Taxes and the Corporate Tax Act)
•    Records of logins:  3 months (as required under the Protection of Communications Secrets Act)
•    Records on labels and advertisements: 6 months (as required under the Act on Consumer Protec-tion in Electronic Commerce)
•    Records on revocation of contracts or cancellation of orders/purchases, payments, provision of products and services: 5 years  (as required under the Act on Consumer Protection in Electronic Commerce)
•    Records on handling of customer complaints or disputes: 3 years (as required under the Act on Consumer Protection in Electronic Commerce
The process and method for destroying personal data are set forth below.
•    Process of destruction: We select the relevant personal data to be destroyed and destroy it with the approval of our Data Protection Officer.
•    Method of destruction: We destroy personal data recorded and stored in the form of electronic files by using a technical method (e.g., low level format) to ensure that the records cannot be re-produced, while personal data recorded and stored in the form of paper documents shall be shredded or incinerated
If it is necessary to retain personal data for a period longer than the legal retention periods described herein, to the extent required by the laws of the applicable country, we shall obtain the data subject’s consent for such longer retention of personal data.

Taiwan

You have the right to
•    make an inquiry of and to review your personal data;
•    request a copy of your personal data;
•    supplement or correct your personal data;
•    demand the cessation of the collection, processing or use of your personal data; and
•    erase your personal data.

Thailand

Please note that your right to obtain a copy of the personal data is subject to law or pursuant to a court order, and must not adversely affect the rights and freedoms of others.

Turkey

You have statutory rights under Art. 11 of the Turkish Data Protection Law, in particular the right to
•    request reporting of the operations carried out which are rectification of the incomplete or inac-curate data, if any and the erasure or destruction of your personal data) to third parties to whom your personal data have been transferred;
•    claim compensation for the damage arising from the unlawful processing of your personal data;
•    object to the occurrence of a result against yourself by analyzing the data processed solely through automated systems,
•    lodge a complaint with the Turkish Data Protection Authority (Kişisel Verileri Koruma Kurumu) Nasuh Akar Mahallesi  1407. Sok. No:4, 06520 Çankaya/Ankara/Turkey.
The objection can be exercised in the forms stated in Article 5/1 of the Comminuque On The Principles and Procedures for the Request To Data Controller.
Local representative:
Doğuş Otomotiv Servis ve Ticaret A.Ş
Şekerpınar Mahallesi, Anadolu Cad. No:22 Çayırova/Kocaeli - Mersis No: 0-3090-1147-1300010
T: 0262 676 90 90