Porsche AG - Privacy

Für eine deutsche Version bitte hier klicken.

We, Dr. Ing. h.c. F. Porsche AG (“we” or “Porsche AG”) appreciate that you are interested in our company as well as in our products and services. Your privacy is an important concern for us. We take the protection of your personal data and the confidential treatment of your data very seriously. Your personal data is only processed within the scope of the legal provisions of data protection law in the European Union, in particular the General Data Protection Regulation ("GDPR").

With this Privacy Policy, we provide you with information about the processing of your personal data and your rights as a data subject within the course of your general communication with Porsche AG or in the course of our general communication with you. In light of this background, this Privacy Policy remains fairly generalized, because we cannot exhaustively describe every occasion and accompanying circumstance of individual communication in advance. This Privacy Policy shall therefore include the basic general points of data processing and principal topics, such as your rights as a data subject, that are independent of the individual case.

Further specific information concerning data processing in the course of specific services and offers of Porsche AG and other companies of the Porsche Group can be readily found in each specific privacy policy. This particularly applies to the websites of Porsche AG and other companies of the Porsche Group.

1. Controller and Data Protection Officer; contact
Controller of data processing within the meaning of the GDPR is:

Dr. Ing. h.c. F. Porsche AG
Porscheplatz 1
70435 Stuttgart
Germany
Tel: +49 711 911-0
datenschutz@porsche.de

Should you have any questions or suggestions concerning data protection, you are welcome to contact us.

You can contact our Data Protection Officer at:

Dr. Ing. h.c. F. Porsche AG
Data Protection Officer (Beauftragter für den Datenschutz)
Porscheplatz 1
70435 Stuttgart
Germany
datenschutz@porsche.de

2. Subject matter of data protection
The subject matter of data protection is the protection of personal data. These encompass all information relating to an identified or identifiable natural person (the so-called data subject). Included among such are, e.g., details such as one’s name, mailing address, email address, or telephone number.

3. Purposes and legal basis of data processing
Below you will find an overview of the purposes and legal basis of data processing in the course of general communication with you.

3.1 Fulfillment of contractual and pre-contractual duties
We process personal data whenever such is necessary to prepare or to perform a contract with you or for the purpose of processing an inquiry from you. The specific purposes depend upon the specific inquiry or the specific contract, and can, in particular, include:

• processing inquiries and complaints from interested parties, customers and business partners with regard to products and services of Porsche AG
• processing inquiries and applications to be employed or engaged by Porsche AG

We process these personal data on the basis of Article 6 (1) (b) GDPR. For this purpose, you have to provide the personal data necessary to process your particular matter, for the preparation or for carrying out the business relationship with you. Without these personal data, we will not be in a position to process your inquiry or to fulfill the contract with you.

3.2 Fulfillment of statutory obligations or processing of personal data in the public interest
We also process your personal data in order to comply with statutory obligations to which we are subject. The obligations can result from, e.g., commercial, tax, or telecommunications law, or from the laws governing money laundering, finance, or criminal activity. The purposes of the processing in such case emerge from the respective statutory obligation; as a general rule, the processing serves the purpose of complying with monitoring and access duties imposed by the government.

The data processing is effected on the basis of Article 6 (1) (c) or (e) GDPR. Whenever we collect personal data due to legal obligations or in the public interest, then you have to provide those personal data which are necessary to fulfill the legal obligation. Without the provision of such, it is possible that, under the circumstances, we will be unable to process your inquiry or to comply with these duties.

3.3 Pursuit of legitimate interests
We also process your personal data for the purpose of protecting legitimate interests of ours or of third parties. The following interests – which are simultaneously the respective purposes – are pursued by us in particular, depending upon the individual case, as applicable:

• business correspondence with you, your employer or client
• conveyance of inquiries and offers
• ensuring customer support as well as carrying out customer satisfaction measures
• processing data on a centralized platform for interested parties and customer support, as well as upstream and downstream systems for customer loyalty and sales purposes
• continued development of products, services, and support offers, as well as other measures for managing business transactions and processes
• safeguarding of availability, operation, and security of technical systems as well as technical data management
• responding to inquiries from authorities
• asserting and reviewing legal claims
• operational reporting

We process these personal data on the basis of Article (6) (1) (f) GDPR. In cases in which you must provide personal data for these purposes, we will notify you. Without the provision of such, it is possible that, under the circumstances, we will be unable to process your inquiry or to comply with your concern.

3.4 Consent
Should you have given consent for particular purposes, then the purposes shall result from the content of the consent declaration in the individual case.

The data processing is effected on the basis of Article 6 (1) (a) GDPR. In cases in which you must provide personal data for this purpose, we will notify you. Without the provision of such, we cannot comply with your wish as encompassed by the consent. You can withdraw a consent at any time without affecting the lawfulness of the processing effected on the basis of the consent up to the point of the withdrawal.

4. Recipients of personal data
Internal recipients: within Porsche AG, access is held only by those persons who require such for the purposes set forth above under (3).

External recipients: we will share your personal data with external recipients outside Porsche AG only if (i) doing so is necessary to resolve or process your concern, (ii) another statutory permission or obligation exists, or (iii) we are in possession of your consent for this purpose.

Outside recipients can be:

• Processors
  Companies of Porsche Group or external service providers that we use to render services, e.g., in the areas of technical infrastructure and maintenance. These processors are carefully selected by us and regularly reviewed, in order to ensure that the security and confidentiality of your personal data remain safeguarded. The service providers are allowed to use the data exclusively for the purposes predefined by us.
• Public bodies
  Authorities and government institutions, e.g., prosecutors, courts, or financial authorities, to which we are compelled by law to transfer personal data. The transfer is thus effected on the basis of Article 6 (1) (c) GDPR.
• Private bodies
  Companies of the Porsche AG Group, dealers, cooperation partners, or support persons, to whom personal data are transferred upon the basis of your consent for the purpose of handling an inquiry or performing on a contract with you or for the purpose of pursuing legitimate interests, e.g., Porsche dealerships, credit agencies, or external consultants. In such instances the transfer is thus effected upon the basis of Article 6 (1) (a), (b), or (f) GDPR.

5. Data processing in third countries
If a data transfer takes place to entities whose registered office or place of data processing is not located in a member state of the European Union, another state party to the Agreement on the European Economic Area or a state for which an adequate level of data protection has been determined by a decision of the European Commission, we will ensure prior to the transfer that the data transfer is either covered by a legal authorization, guarantees for an adequate level of data protection with regard to the data transfer (e.g. through the agreement of contractual warranties, officially recognized regulations or binding internal data protection regulations at the recipient) or that you have given your consent to the data transfer.

If the data transfer takes place on the basis of Articles 46, 47 or 49 (1), second subparagraph, GDPR, you can obtain from us a copy of the guarantees for the existence of an adequate level of data protection in relation to the data transfer. Please use the information provided under point 1.

6. Sources and data categories in the event of third-party collection
It is not only personal data that we receive from you directly which is processed by us. We receive some personal data, as the case may be, from third parties. Below you will find an overview with some examples concerning the sources and the data categories in the event of data collection by third parties, whereby such will depend upon the respective individual case:

• personal or professional contact and identifying data, contractual data, as well as vehicle and vehicle use data from companies of the Porsche Group, dealerships, and cooperation partners;
• contact data from publicly accessible directories, e.g., telephone books or websites.

The collection will then be effected on the basis of Article 6 (1) (f) GDPR, in order to pursue our legitimate interests in efficient communication.

7. Automated decision-making and profiling
We do not use automated decision-making or profiling for processing the general communication with you.

8. Storage duration, deletion
We will store your personal data only as long as such is necessary to fulfill the purposes set forth in this document or in the general contractual documents between you and us, or – in the event of a consent – as long as you have not withdrawn said consent. In the event of an objection to the processing, we will delete your personal data unless further processing of it is allowed under the relevant provisions of law. Even then, we will delete your personal data if we are obligated to do so for other legal reasons.

Applying these general principles, we will, as a general rule, delete your personal data without undue delay in the following instances:

• after the legal grounds cease to apply and provided that no other legal grounds apply (e.g. commercial law and tax law retention periods). If the latter is the case, we will delete the data once the other legal grounds cease to apply.
• if we no longer need the data for the purposes of preparing and executing a contract or legitimate interests and no other legal grounds apply (e.g. commercial law and tax law retention periods). If the latter is the case, we will delete the data once the other legal grounds cease to apply.
• if the purpose of collecting the data no longer applies and no other legal grounds apply (e.g. commercial law and tax law retention periods). If the latter is the case, we will delete the data once the other legal grounds cease to apply.

9. Rights of data subjects
As the data subject affected by the data processing, you have several rights, specifically:

Right of access: You have the right to obtain information from us about the data that we have stored about you.

Right to rectification and erasure: You have the right to demand that we rectify incorrect data and – provided the legal requirements are met – that we delete your data.

Restriction of processing: You have the right – provided the legal requirements are met – to demand that we restrict the processing of your data.

Data portability: If you have provided us with data on the basis of a contract or consent, you have the right, in accordance with the legal requirements, to obtain the data you have provided in a structured, standard, and machine-readable format or you can demand that we transfer this data to another controller.

Objections to data processing on the legal basis of “legitimate interest”: You have the right to object at any time, on grounds relating to your particular situation, to our processing of your data, provided this processing is based on the legal basis of "legitimate interest". If you exercise your right to object, we will cease the processing of your data unless we can – pursuant to the legal requirements – prove compelling legitimate reasons for the further processing, which override your rights.

Objections to data processing for direct marketing purposes: We may process your personal data on the basis of “legitimate interest”, as applicable, in order to conduct direct marketing. You have the right to object to this processing at any time.

Withdrawal of consent: If you have given us consent to process your data, you can withdraw this consent at any time with effect for the future. The lawfulness of the processing of your data remains unaffected up until the time of the withdrawal of consent.

Right to lodge a complaint with a supervisory authority: You can also submit a complaint with the competent supervisory authority if you are of the opinion that the processing of your data violates applicable law. For this purpose, you can appeal to the supervisory authority that is competent for your place of residence or for your country, or to the supervisory authority that is competent for us.

Contacting us and exercising your rights: Furthermore, you can contact us at no charge for any questions concerning the processing of your data, concerning your rights as a data subject, and concerning any consent issued. To exercise the aforementioned rights with regard to us, please use the online contact form at https://www.porsche.com/privacy-contact/ or please use the address listed above under (1). In so doing, please be certain that it is possible for us to clearly identify you personally. In the event of a withdrawal of the consent, you can also select the path of contact which you used when providing the consent.

10. Third-party offers
The performances of other providers to which reference is made in the course of the communication have been and are, as applicable, arranged and provided for by third parties. We do not exert any influence on the arrangement, contents, or function of these third-party providers. We expressly distance ourselves from all contents of any and all such third-party offers. Please inform yourself in this regard, as applicable, directly at the providers of these third-party offers.

11. Status
The most current version of this data protection Policy shall be applicable, as of 16 February 2021.