Data Protection Notice AUDI AG Social Media Pages

In this Data Protection Notice (Privacy Policy) according to Article 13, 14 GDPR we are informing you about the processing of your personal data by AUDI AG, Auto-Union-Straße 1, 85057 Ingolstadt ("we") in the context of visiting a AUDI AG social media page.

Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Processing means any operation or set of operations performed with or without the aid of automated processes in connection with personal data such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The entity responsible for the processing of your personal data (the controller) through the use  of social media platforms:

The operators of the social media platforms are independently and solely responsible for the processing of personal data through the use of social media platforms and visits to the associated websites. They process your personal data through your visit to one of our social media pages, regardless of whether you have a user account on the respective platform or are logged in, and usually also use cookies and other storage and (in some cases cross-device) tracking technologies. Further information on the processing of your personal data by the operator of the respective social media platform can be found in the information on data protection on the following websites of the respective social media platform:

1. Facebook (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Irland) under https://de-de.facebook.com/privacy/policy/
2. Instagram (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Irland) under https://de-de.facebook.com/privacy/policy/
3. LinkedIn (if you are located within the European Union, the European Economic Area and Switzerland, LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2 Ireland; if you are located outside the European Union, the European Economic Area and Switzerland, LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA) under https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy
4. YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland) for YouTube-page under https://policies.google.com/privacy?hl=de&gl=de

Responsibility of AUDI AG for the processing of your personal data when you interact with one of our social media pages:

When interacting with social media pages of AUDI AG,

AUDI AG, Auto-Union-Straße 1, 85057 Ingolstadt

processes personal data such as the content of your messages and posts as well as your publicly viewable profile data (see section 2).

If you have concerns about data protection, you can also contact our company's data protection officer:

AUDI AG Datenschutzbeauftragter, 85045 Ingolstadt. E-Mail: datenschutz@audi.de

Joint responsibility of AUDI AG and Meta or AUDI AG and LinkedIn for usage statistics:

With regard to page insights data (see section 2) from Facebook and Instagram, we are jointly responsible for data processing with Meta Platforms and have entered into an agreement between joint controllers that regulates our respective obligations under the GDPR: https://de-de.facebook.com/legal/terms/page_controller_addendum.

With regard to page insights data (see section 2) of LinkedIn, we are jointly responsible for data processing with LinkedIn and have concluded an agreement between joint controllers in this respect, which regulates our respective obligations under the GDPR: https://legal.linkedin.com/pages-joint-controller-addendum.

Further information on the data processed in the context of the usage statistics and legal bases can be found in the following sections 2 and 3.

If you visit a social media page of AUDI AG, we, as the operator of the social media page, process your actions and interactions with our social media page (e.g. the content of your messages, inquiries, posts or comments that you send to us or leave on our social media pages or if you like or share our posts) as well as your publicly accessible profile data (e.g. your name and profile picture). Which personal data from your profile is publicly accessible depends on your profile settings, which you can adjust yourself in your settings on the social media platform.

The social media platforms also provide us with anonymous usage statistics (so-called analysis services or page insights data) of our social media pages based on the actions and interactions of our interested parties (e.g. likes, shares, comments, number of followers, views of individual page areas, reach of a post and statistics on followers by age, language, origin or interests), which help us to communicate with our followers and interested parties to get in touch, to understand the use and reach of our posts, to evaluate content and to recognize usage preferences as well as to be able to design our social media pages as closely as possible to the target group. We have no influence or access to the creation of these usage statistics and the underlying data, they are carried out by the operator of the respective social media platform and without us being able to view personal data of individual followers or users. It may happen that the social media platforms themselves create personalized usage statistics, for example for their own market research, advertising, other commercial or business purposes, and process personal data outside the European Union, to which we also have no influence or access. Further information on the processing of your personal data by the operator of the respective social media platform in the context of the creation and processing of usage statistics can be found in the information on data protection of the respective social media platform.

We evaluate posts that you have published yourself in publicly accessible social media channels, news, blog entries and forum entries for market research purposes. This includes, for example: username, date, source, content, title, length of the post, – if applicable – reach figures. For this purpose, we use an algorithm-based process (so-called data scraping) to extract this data and then analyze it for market research purposes. Based on certain search terms (brand or model names such as "Audi", "e-tron", etc.), text articles are classified according to their tonality (positive, negative, neutral) and mentioned topics (vehicle aspects, e.g. design, price, quality). The collected data records are anonymised regularly after 30 minutes.

We process your personal data for various purposes in accordance with the provisions of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act [Bundesdatenschutzgesetz (“BDSG”)].

You can find the specific purposes of the data processing in the context of this website in Section 3.

The processing of your personal data must be based on one of the following legal bases:

• You have given your consent (Art. 6 (1) (a) GDPR);
• Processing is necessary to perform a contract with you, or in order to take steps your request prior to entering into a contract (Art. 6 (1) (b) GDPR);
• Processing is necessary for compliance with a legal obligation under EU law or under a Member State law to which we are subject (Art. 6 (1) (c) GDPR);
• Processing is necessary to protect your vital interests or the vital interests of another person (Art. 6 (1) (d) GDPR);
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority which has been vested in us (Art. 6 (1) (e) GDPR);
• Processing is necessary for the purposes of the legitimate interests pursued by AUDI AG or a third party, except where these interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, particularly where this concerns a child (Art. 6 (1) (f) GDPR).

To the extent that we, in exceptional cases, process special categories of personal data about you (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning sex life or sexual orientation), then one of the following legal bases must also apply:

• You have given explicit consent (Art. 9 (2) (a) GDPR);
• Processing is necessary to protect your vital interests or those of another person where the relevant person is physically or legally incapable of giving consent (Art. 9 (2) (c) GDPR);
• Processing relates to personal data which you manifestly made public (Art. 9 (2) (e) GDPR);
• Processing is necessary for the establishment, exercise or defence of legal claims (Art. 9 (2) (f) GDPR);
• Processing is necessary for reasons of substantial public interest, on the basis of EU law or Member State law which shall be proportionate to the aim pursued, which shall respect the essence of the right to data protection and which shall provide for suitable and specific measures to safeguard your fundamental rights and interests (Art. 9 (2) (g) GDPR).

Following on from the above, we process your personal data on the basis of the following legal bases for the following purposes:

In individual cases we can process your data for the following purposes:

Please observe your rights of objection when processing of data on the basis of our legitimate interest and your right to withdraw consent (see section 8 "What rights do you have?" and section "Information about your right to object").

There is no obligation to provide personal data. To enter into a business relationship, you only have to provide the personal data that is necessary for the establishment and implementation of a business relationship or that we are legally obliged to collect. Without this data, we will usually have to refuse to conclude the contract or execute the order, or we will no longer be able to perform an existing contract and, if necessary, terminate it.  

Due to the size and complexity of the data processing by the AUDI AG, it is not possible to list each recipient of your personal data individually in this data protection notice, which is why usually only categories of recipients are specified.

Within AUDI AG, your data is provided to the respective departments that need such data for data processing (e.g. sales division, human ressources)

As part of our social media activities, we also work with service providers (e.g. IT service providers or advertising and content agencies as well as personnel consultancies who support us in the creation of our articles as well as the provision and optimization of our social media page and our recruiting). To the extent that these service providers process personal data on our behalf, we have concluded a data processing agreement with these service providers and have agreed on appropriate safeguards to safeguard the protection of personal data. Our service providers in the context of our social media activities include

1. We are Social, Klenzestraße 38, 80469 München (Publishing, Administration)
2. Audi Interaction GmbH, Zeppelinstr. 48, 14471 Potsdam (Customer Care)
3. Territory GmbH, Am Baumwall 11, 20459 Hamburg (Publishing, Administration)
4. VICO Research & Consulting GmbH, Friedrich-List-Straße 46, 70771 Leinfelden-Echterdingen (Market research)

Your personal data will be disclosed by us to third parties only if this is necessary for the fulfilment of the contract, if we or the third party have a legitimate interest in the disclosure, or if you have given your consent. In addition, data may be transferred to third parties to the extent we are required to do so by law or by enforceable regulatory or judicial order. Third parties to whom we may transfer your personal data, irrespective of the services we provide, include

• Your Audi-dealer
• Service partner
• Importers
• External consultants of the AUDI AG (e.g. attorneys, tax consultant, chartered accountant)
•  Authorities within their jurisdiction (e.g. tax office, police, public prosecutor's office),
•  Courts
• Other third parties, if you instruct us to pass on data or give your consent.

A transfer of data to third countries (i.e., countries that are neither members of the European Union nor of the European Economic Area) may occur to the extent necessary to perform services for you, if required by law, or where you have given us your consent.

Please note that not all third countries have a level of data protection recognised as adequate by the European Commission. AUDI AG will only transfer your personal data to third countries to the extent permitted by Art. 44 – 49 GDPR. Insofar as AUDI AG relies on appropriate safeguards in accordance with Article 46 (2) GDPR for third country transfers (e.g Standard Contractual Clauses or Binding Corporate Rules), AUDI AG will take additional technical and/or organizational measures to the extent necessary to maintain an adequate level of protection of you personal data.

You can obtain from us a copy of the specific applicable or agreed provisions to ensure an adequate level of data protection. To do so, please use the information in the contact section.

We store your data for as long as this is necessary to provide our services to you or we have a legitimate interest in further storage. If you wish to have your data deleted from the social media platform, please contact the operator of the respective social media platform, which alone has the direct access options in each case.

As the data subject, you are entitled to the following data protection rights:

Access:

You have the right to request access to personal data related to you and saved by AUDI AG, to be informed about the scope of data processing and data transfer by AUDI AG and to obtain a copy of your stored personal data.

Rectification:

With respect to your personal data stored, you have the right to demand the immediate rectification of incorrect personal data and you have the right to have incomplete personal data completed. 

Erasure:

You have the right to demand the immediate deletion or erasure of your personal data stored, if the legal requirements are satisfied.

This is the case, in particular, if

• your personal data is no longer needed for the purposes for which it was collected;
• the sole legal basis for processing such data was your consent, and you have withdrawn such consent;
• you have objected to processing on the legal grounds relating to your particular situation, and we cannot prove that there are overriding legitimate grounds for processing;
• your personal data were processed unlawfully; or
• your personal data must be erased in order to comply with legal requirements.

Please note that your right to erasure is subject to certain limitations. For example, we may not and/or must not erase data that we are still required to retain due to statutory retention obligations. In addition, your right of erasure does not extend to data that we need in order to assert, exercise or defend against legal claims.

Restriction to the Processing:

Under certain conditions, you have the right to request that processing be limited (i.e., the marking of stored personal data with the aim of limiting its processing in the future). The requirements are:  

• The accuracy of your personal data is contested by you and it must be verified the accuracy of the personal data;
• the processing is unlawful, but you oppose the erasure of the personal data and request the restriction of their use instead; 
• your personal data is no longer needed for the purposes of processing, but you require the data to establish, exercise or defend your legal claims;
• you have objected to processing pending the verification of whether the legitimate grounds of the controller override your legitimate grounds.

Where processing has been restricted, such data will be marked accordingly and, with the exception of storage, will be processed only with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the EU or of an EU Member State.

Data Portability:

To the extent that we automatically process your personal data that you have provided to us based on your consent or any contract with you (including your employment contract), you have the right to receive such data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from AUDI AG. You also have the right to have the personal data transmitted directly from AUDI AG to another controller where technically feasible, provided that such transmission does not adversely affect the rights and freedoms of others.

Right to Object:

If we process your personal data on grounds of legitimate interests or in the public interest, then you have the right to object to the processing of your personal data on grounds relating to your particular situation. In addition, you have an unrestricted right to object if we process your data for our direct marketing purposes. Please see our separate note in the section titled “Information about your right to object”.

Withdrawal of Consent:

If you have given consent to the processing of your personal data, then you can withdraw such consent at any time. Please note that the withdrawal applies prospectively only. Processing that occurred before the withdrawal of consent is unaffected.

Complaint:

Furthermore, you have a right to file a complaint with a data protection authority, if you believe that the processing of your personal data is unlawful. The right to file a complaint is without prejudice to any other administrative or judicial remedies. 

The address of the data protection supervisory authority responsible for AUDI AG is: 

Bayerisches Landesamt für Datenschutzaufsicht

Promenade 18

91522 Ansbach

Deutschland

Information about your right to object

Right to object for personal reasons

You have the right to object to the processing of your personal data on grounds relating to your particular situation. The prerequisite for this is that the data processing takes place on the basis of a balancing of interests. This applies also to profiling.

Insofar as we base the processing of your personal data on a balancing of interests, we generally assume that we can demonstrate compelling legitimate grounds but will, of course, examine each individual case.

In the event of an objection, we will no longer process your personal data, unless 

• we can demonstrate compelling legitimate grounds for the processing of these data that override your interests, rights and freedoms, or
• your personal data serves the establishment, exercise or defence of legal claims.

Exercise of the right of objection

The objection can be made without form and should preferably be made to the contact data listed in this data protection notice.

With regard to data processing by AUDI AG, you can assert your above rights against AUDI AG at any time free of charge. With regard to data processing by the operator of the respective social media platform, you can assert your above rights against the respective operator at any time free of charge. For more information on how to exercise your rights, please see Section 9 below.

The contact person for exercising your rights is primarily the operator of the respective social media platform, who alone has direct access to the necessary information or makes the functionality of the respective platform available and can take appropriate measures immediately. The contact persons for exercising your rights vis-à-vis the operators of the respective social media platform and further information can be found in the information on data protection on the following websites of the respective social media platform:

1. Facebook privacy policy under https://de-de.facebook.com/privacy/policy/
2. Instagram privacy policy under https://de-de.facebook.com/privacy/policy/
3. LinkedIn privacy policy under https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy
4. YouTube privacy policy under https://policies.google.com/privacy?hl=de&gl=de

If the support of AUDI AG is possible or necessary, we will of course support you and, for example, forward your request to exercise your rights vis-à-vis the operators of the respective social media platform to them.

If you wish to assert your data protection rights concerning data processing activities by AUDI AG, please adress them to 

https://gdpr.audi.com/

There you will find further information on how to assert your data protection rights.

Postally you can contact:

AUDI AG, DSGVO-Betroffenenrechte, 85045 Ingolstadt.