Porsche Home Charging Equipment Privacy Policy
(Applies to Mobile Charger Connect, Wall Charger Connect and Porsche Wallbox)

We, Dr. Ing. h.c. F. Porsche AG (hereinafter, "we" or "Porsche AG"), want to thank you for your interest in our home charging products (hereinafter, "Porsche charging hardware"). We take the protection of your personal data very seriously. Your personal data will only be processed in accordance with the provisions of data protection legislation, in particular the General Data Protection Regulation (hereinafter "GDPR"). This Privacy Policy provides information about the processing of your personal data and your privacy rights as a data subject in connection with the online offer. Information on the processing of your personal data in other areas can be found in the respective specific privacy policy. If we reference this Privacy Policy from external social media profiles, the following statements only apply insofar as the processing takes place in our area of responsibility and insofar as no more specific and therefore prioritised information on data protection is provided in the context of such social media profiles.

1. Data controller and data protection officer

Unless otherwise expressly stated in this Privacy Policy, the entity responsible for data processing within the meaning of the data protection laws is:

Porsche Cars Australia Pty Ltd ACN 004 327 048
109-111 Victoria Parade
Collingwood VIC 3066
Australia
Email address: contact@porsche.com.au

If you have any questions or suggestions relating to data protection, please feel free to contact us. Our data protection officer can be reached at:

Dr. Ing. h.c. F. Porsche AG
Data Protection Officer
Porscheplatz 1
70435 Stuttgart
Germany
Contact: https://www.porsche.com/privacy-contact/

2. Object of data protection

The subject matter of Data Privacy is the protection of personal data. This is any information that relates to an identified or identifiable natural person (so-called data subject). This includes, for example, information such as the name, postal address, e-mail address or telephone number, but also other information that is generated in the course of using the online offer, in particular information about the start, end and scope of its use as well as the transmission of your IP address.

3. Purposes of and legal grounds for data processing

Below you will find an overview of the purposes and legal bases of data processing within the scope of the online offer. We always process personal data in accordance with the legal requirements, even if, in specific cases, a different legal basis from that stated below may be applicable.

You may be legally or contractually obligated to provide personal data when using the services or it may be necessary for the conclusion of a contract. We will inform you separately if you are obliged to provide personal data and what the possible consequences of not doing so would be (e.g. a loss of claims, or we might have to inform you that we cannot provide the requested service without being provided with certain details). The use of the online offer is generally possible without registration. The use of individual services and functions may require prior registration. However, even if you make use our online offer without registration, personal data can still be processed.

3.1. Fulfilment of contractual and precontractual obligations

We process your personal data if this is necessary for performance of a contract to which you are a party or for the performance of pre-contractual measures that take place at your request. Data is processed on the basis of Article 6 Paragraph 1 (b) GDPR. The purposes of the processing include enabling the use of our specific products and services within the scope of the online offer.

In this specific case, these are the following functions in particular:

Transfer of technical diagnostic data for support purposes

In the event that faults occur in the device, the technical diagnostic data can be sent to Porsche AG in encrypted form. With this data, the support staff will be able to provide you with the best possible support. Consent to automatic data transfer is voluntary and can be revoked at any time. The transfer contains the following data: unique ID of the device, technical status values at a specific point in time, diagnostic codes, performance class, software and hardware versions, production date, manufacturer information, country specifications including status information.

Checking and installing software updates

To ensure the proper functionality of the Porsche charger, it is necessary to regularly install updates. These updates include feature enhancements, bug fixes, and important security updates. A check is carried out at regular intervals to determine whether new software is available on the Porsche back ends. If so, the package will be downloaded and installed on the device after you have agreed to this.

Linking to an existing Porsche ID account

If you would voluntarily like to use other online services for the Porsche charging equipment, it is necessary to link your Porsche charging equipment with your Porsche ID account, which is offered in selected markets by the respective Porsche Connect sales company. As part of using the online services, the following personal and device-specific data are transferred to Porsche for provision and processing there:

Customer identification (Porsche ID or device serial number)

Charging statistics

Charging history information

Status (of the device and the charging process)

Connection status and

time stamp of the last communication setup.

3.2. Compliance with legal obligations

We process your personal data in order to comply with legal obligations to which we are subject. The data processing takes place on the basis of Article 6 Paragraph 1 (c) of the GDPR. The obligations may result, for example, from commercial, tax, money laundering, financial or criminal law. The purposes of processing arise from the respective legal obligation; the processing generally serves the purpose of complying with state obligations with regard to monitoring and duty of disclosure.

3.3. Safeguarding legitimate interests

We also process your personal data to protect legitimate interests of ourselves or third parties, unless these interests are outweighed by your interests which require the protection of your personal data. Data is processed on the basis of Article 6 Paragraph 1 (f) GDPR. Processing for legitimate interests is carried out for the following purposes or to protect the following interests.

Further development of products, services and mentoring, as well as other measures for business transactions and process control;

Improvement of product quality, elimination of errors and malfunctions, etc. by analysing vehicle data and customer feedback

When you access the online service, data relating to your device and your use of the offer service is processed and stored in a log file. In particular, this involves technical data such as date and time of access, duration of the visit, type of device, operating system used, the functions used, quantity of data sent, IP address and referrer URL. We process this data in order to ensure technical operation and to identify and rectify faults. We thereby pursue the interest of enabling long-term technical functionality. We do not use this data for the purpose of drawing conclusions about you.

3.4. Consent

We process your personal data on the basis of corresponding consent. Data is processed on the basis of Article 6 Paragraph 1 (a) of the GDPR. If you have given consent, this is always for a specific purpose; the purposes of processing arise from the respective content in your declaration of consent. You may revoke your consent at any time, without affecting the legality of the processing carried out on the basis of your consent until revocation.

Insofar as you have given corresponding consent, the companies listed in the declaration of consent may, on this basis, use the data for individual customer and prospective customer support, for example, and contact you for these purposes via the communication channels you have requested. Your data is used within this framework to offer you an inspiring brand and support experience with Porsche and to make our communication and interaction with you as personal and as relevant as possible. Which of your data is specifically used for individual customer and prospective customer support depends in particular on which data was collected on the basis of orders and consultations (e.g. when purchasing or servicing Porsche products) and which data you provided (e.g. your personal interests) at the respective contact points (e.g. in the Porsche Centre).

3.5. Change of purpose

Where we process your personal data for a purpose other than that for which it was collected, beyond appropriate consent or a compelling legal basis, we will take into account, in accordance with Article 6 Paragraph 4 of the GDPR, the compatibility of the original purpose and the purpose now pursued, the nature of the personal data, the possible consequences for you of further processing and the guarantee of the protection of the personal data.

4. Access authorisations in the device

Some functions of our online offer require you to grant access to your device (e.g. access to location data). Granting authorisations is voluntary. However, if you wish to use the corresponding functions, you must grant the corresponding authorisations, otherwise you will not be able to use these functions. Authorisations remain active unless you revoke them in your device by deactivating the relevant setting.

5. Recipients of personal data

Within our company, the only people who have access to your personal data are those who need it for the purposes indicated above. We only pass on your personal data to external recipients if a legal licence exists or if we have your consent. Below you will find an overview of the corresponding recipients:

Processors: group companies or external service providers, for example in the areas of technical infrastructure and maintenance, who are carefully selected and checked. The processors may only use the data in accordance with our instructions.

Public bodies: authorities and public institutions, such as public prosecutors, courts or tax authorities to which we (must) transfer personal data, e.g. to fulfil legal requirements or to safeguard legitimate interests.

Private entities: group companies, Porsche dealerships and service companies, cooperation partners, service providers (not bound by instructions) or authorised persons such as Porsche Centres and Porsche Service Centres, financing banks, credit agencies or transport service providers.

6. Data processing in non-EU countries

If data is transferred to bodies whose headquarters or place of data processing is not located in a member state of the European Union, another country outside of the European Union that is a signatory to the Agreement on the European Economic Area or a state for which an appropriate level of data protection has been determined through a decision of the European Commission, we will ensure, before disclosure, that the data transfer is either covered by a legal authorisation, that there are guarantees for an adequate level of data protection with regard to the data transfer (e.g. through the agreement of contractual warranties, officially recognised regulations or binding internal data protection regulations applied by the recipient) or that you have given your consent to the data transfer.

Insofar as data is transferred on the basis of Articles 46, 47 or 49, Paragraph 1, Subparagraph 2 of the GDPR, you can obtain from us a copy of the guarantees for the existence of an adequate level of data protection with regard to the data transfer or information on the availability of a copy of the guarantees. For this purpose, please use the information in Section 1.

7. Storage duration, deletion

We store your personal data, if a legal permission exists for this, only as long as necessary to achieve the purposes pursued or as long as you have not revoked your consent. In the event that you object to the processing, we will delete your personal data unless further processing is permitted by the legal provisions. We will also delete your personal data if we are obligated to do so for other legal reasons. Pursuant to these general principles, we will usually delete your personal information immediately

after the legal basis ceases to exist and unless another legal basis (e.g. commercial and tax retention periods) applies. If the latter is the case, we will delete the data once the other legal basis ceases to apply;

if your personal data is no longer required for our purposes, and if no other legal basis (for example, commercial and tax retention periods) is applicable. If the latter is the case, we will delete the data once the other legal basis ceases to apply.

8. Rights of the data subject

Right of access: you have the right to receive information about your personal data stored by us.

Right to rectification and deletion: you may request that we correct incorrect data and – insofar as the legal requirements are fulfilled – to have your data deleted.

Right to restriction of processing: you may require that we restrict the processing of your data, provided that the legal requirements are met.

Data transferability: if you have provided us with data based on a contract or consent, you may, if the statutory requirements are met, obtain from us the data provided by you in a structured, commonly used and machine-readable format, or require us to transmit it to another responsible party.

**Right to object: you have the right to object at any time, on grounds relating to your particular situation, to our processing of your data, provided this objection is based on the safeguarding of legitimate interests. If you make use of your right to object, we will stop processing your data, unless we can prove compelling legitimate reasons for further processing that outweigh your rights and interests.

Objection to direct marketing: if we process your personal data for the purpose of direct marketing, you have the right to object to our processing of your data for this purpose at any time. If you exercise your right to object, we will stop processing for this purpose.

Withdrawal of consent: if you have given us consent to the processing of your personal data, you can revoke this at any time with effect for the future. The withdrawal of consent will not affect the lawfulness of processing before its withdrawal.**

Right of appeal to the supervisory authority: you can also lodge a complaint with the responsible supervisory authority if you believe that the processing of your data violates applicable law. You can contact the supervisory authority responsible for your place of residence or country or the supervisory authority responsible for us.

Your contact with us and exercising your rights: furthermore, you can contact us free of charge with questions about the processing of your personal data and about your rights as a data subject. Please contact https://www.porsche.com/privacy-contact/ or one of the postal addresses specified above in section 1. When doing so, please make sure that we can clearly identify you. If you wish to withdraw your consent, you can alternatively use the method of contact that you used when you gave your consent.

9. Version

The latest version of this privacy policy applies.

As of 12/02/2024.