Data Protection Information

Technical and editorial implementation

This data protection notice acc. Art. 13, 14 EU GDPR informs you about the processing of your personal data by AUDI AG, Auto-Union-Straße 1, 85045 Ingolstadt in connection with the use of the "AudiStream" offer on the website www.audi.stream.

The subject of the "AudiStream" offer are virtual tours ("livestream sessions"). After registration, registered participants are offered the opportunity to take part in a livestream session. A livestream session is a virtual tour of a plant or other facility at Audi, in which a trained guide explains the processes and answers participants' questions live online, just as in a classic plant tour. Participants interact with the guide via the chat function of their own computer, tablet, smartphone or other end device.

Personal data is all information that relates to an identified or identifiable natural person. An identifiable person is a natural person who can directly or indirectly be identified either via an identifier such as a name, an identification number, location data, an online identifier, or via one or more special characteristics which express the physical, physiological, genetic, psychological, economic, cultural or social identity of this natural person.
Processing means every operation or series of operations carried out with or without the help of automated processes in connection with personal data, for example the collection, recording, compiling, organization, storage, adaptation or modification, reading, querying, use, the disclosure by transmission, distribution or any other form of provision, comparison or linking, restriction, deletion or destruction

1. Who is responsible for data processing and who can I contact?

Responsible for the processing of your personal data is:
AUDI AG, Auto-Union-Straße 1, 85045 Ingolstadt.

If you have any concerns about data protection, you can also contact our company data protection officer:
AUDI AG, Data Protection Officer, Auto-Union-Straße 1, 85045 Ingolstadt
E-mail: datenschutz@audi.de

If you want to assert your data protection rights, please use the contact options at www.audi.de/betroffenenrechte. There you will find further information on how you can assert your data protection rights.

If you have general questions about this data protection notice or the processing of your personal data by AUDI AG, please use the following contact options:

In case of processing personal data of customers:
Audi Kundenbetreuung Deutschland, Postfach 10 04 57, 85045 Ingolstadt
E-mail: kundenbetreuung@audi.de

2. What data do we process and where is this data sourced from?

2.1 Access to the website

In principle, you can use the website for registration without providing personal data. However, registration for an event (live stream session) requires the provision of personal data (see Section 2.2).

Every time you use this website your browser automatically transmits certain information which we save in so-called log files.

The following information is automatically transmitted:

IP address (Internet protocol address) of the Internet connection from which the online offer is accessed;
Internet address of the website from which the online offer was navigated to (so-called origin or referrer URL);
Name of the service provider used to access the online offer;
Names of files or information retrieved;
Date and time as well as duration of the access;
Amount of data transferred;
Operating system and information about the internet browser used, including installed add-ons (e.g. for the Flash Player);
http status code (e.g. "request successful" or "requested file not found")

The above data is stored in log files which do not contain your full IP address, meaning no conclusions can be drawn about your IP address.

2.2. Use of the website / data provided by you

We process personal data that we receive from you as part of the registration for participation in an event (live stream session) and during the event (live stream session).

Relevant personal data includes:

First name or nickname
E-mail address
IP address of the internet connection you are using
Selected live stream

3. For what purposes do we process your data and on what legal basis?

We process your personal data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) for various purposes.

The processing of your personal data must be based on one of the following legal bases:

You have given your consent (Art. 6, para. 1, sub-para. 1, letter a) GDPR);
The processing is necessary for the fulfillment of a contract with you or for the implementation of pre-contractual measures that are carried out at your request (Art. 6, para. 1, sub-para. 1, letter b) GDPR);
The processing is necessary to fulfill a legal obligation under EU law or the law of an EU member state we are subject to (Art. 6, para. 1, sub-para. 1, letter c) GDPR);
The processing is necessary to protect your vital interests or those of another person (Art. 6, para. 1, sub-para. 1, Letter d) GDPR);
The processing is necessary for the performance of a task that is in the public interest or in the exercise of official authority that has been transferred to us (Art. 6, para. 1, sub-para. 1, letter e) GDPR);
Processing is necessary to safeguard the legitimate interests of AUDI AG or a third party, provided that your interests or fundamental rights and freedoms that require the protection of personal data do not outweigh them, especially this concerns a child (Art. 6, para. 1, sub-para. 1, letter f) GDPR).

If, in exceptional cases, we process special categories of personal data (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data uniquely identifying an individual, health data, or data concerning sex life or sexual orientation) about you, one of the following legal bases must also be relevant:

You have given your consent (Art. 9, para. 2, letter a) GDPR);
The processing is necessary to protect your vital interests or those of another person, and the person concerned is for physical or legal reasons unable to give their consent (Article 9, para. 2, letter c) GDPR);
The processing relates to personal data that you have evidently made public (Art. 9, para. 2, letter e) GDPR);
Processing is necessary to assert, exercise or defend legal claims (Art. 9, para. 2, letter f) GDPR);
The processing is required for reasons of considerable public interest, data is processed based on EU law or the law of an EU member state and is proportionate to the objective pursued, upholds the essence of the right to data protection and provides appropriate and specific measures to protect your fundamental rights and interests (Art. 9, para. 2, letter g) GDPR).

Based on the above, we process your personal data based on the following legal bases for the following purposes:

(1) Purpose: Provision of the website for the general public and for registered participants of AudiStream.

Legal basis: Implementation of pre-contractual measures and fulfillment of contract (registration and implementation of livestream sessions) or balancing of interests
Legitimate interest in balancing of interests: We have a legitimate interest in providing an Internet presence also for non-registered users in order to provide general information about our company.

(2) Purpose: To identify faults and ensure system security, including detection and tracking of unauthorized access attempts and access to our web server

Legal basis: Fulfillment of our legal obligations in the area of data security and balancing ofinterests
Legitimate interest in balancing of interests: We have a legitimate interest in eliminating malfunctions, ensuring system security and detecting and tracking unauthorized access or attempted access.

(3) Purpose: Disclosure as part of official/judicial measures for the purpose of gathering evidence, prosecuting and enforcing civil law claims.

Legal basis: fulfillment of legal obligations, balancing of interests
Legitimate interest when balancing interests: Fulfillment of legal and regulatory requirements

In individual cases we can also process your personal data for the following purposes:

(1) Purpose: Disclosure as part of official/judicial measures for the purpose of collecting evidence, prosecuting and enforcing civil law claims

Legal basis: fulfillment of legal obligations, balancing of interests
Legitimate interest when balancing interests: Fulfillment of legal and regulatory requirements

(2) Purpose: Assertion of legal claims and defense in legal disputes

Legal basis: Weighing of interests
Legitimate interest in weighing of interests: We have a legitimate interest in asserting, exercising or defending legal claims.

3.1 Is there an obligation to provide personal data?

As part of events (live stream sessions) on AudiStream, you only need to provide the personal data that is either necessary for participation in and implementation of such events or that we are legally obliged to collect. We cannot provide the AudiStream service without this data.

4. Web analysis by Matomo (formerly PIWIK)

This website uses the open source web analysis service Matomo. Matomo uses so-called "cookies". Cookies are text files that are saved on your computer and enable an analysis of your use of the website. For this purpose, the information generated by the cookie about the use of this website is stored on our server. The IP address is anonymized before being saved. Matomo cookies remain on your device until you delete them. The website operator has a legitimate interest in the anonymized analysis of user behavior in order to optimize the website. The information generated by the cookie about the use of this website will not be passed on to third parties. You can prevent the storage of cookies by setting your browser software accordingly; however, we would like to point out that you may not be able to use all functions of this website to their full extent if you do so. If you do not agree to the storage and use of your data, you can deactivate the storage and use here. In this case an opt-out cookie is stored in your browser which prevents Matomo from storing usage data. If you delete your cookies, the Matomo opt-out cookie will also be deleted. The opt-out must be reactivated when you visit our website again.

Scope of processing personal data
We use the open source software tool Matomo (formerly PIWIK) on our website to analyze the surfing behavior of our users. The software places a cookie on the user's computer (for cookies see above). If individual pages of our website are accessed, the following data is stored:

Two bytes of the IP address of the user's calling system
The website accessed
The website from which the user came to the called website (referrer)
The subpages that are accessed from the website accessed
The time spent on the website
The frequency of accessing the website

The software runs exclusively on the servers of our website. The personal data of users is only stored there. The data will not be passed on to third parties. The software is set to not save complete IP addresses, but rather to mask 2 bytes of the IP address (e.g. 192.168.xxx.xxx). In doing so the shortened IP address can no longer be linked to the calling computer.

Legal basis for the processing of personal data
The legal basis for the processing of users' personal data is Art. 6, para. 1, lit. f GDPR.

Purpose of data processing
The processing of users' personal data enables us to analyze the surfing behavior of our users. By evaluating the data obtained, we are able to compile information about the use of the individual components of our website. This enables us to continuously improve our website and its user-friendliness. Thus, we also have a legitimate interest in processing the data in accordance with Art. 6, para. 1, lit. f GDPR. By anonymizing the IP address the users' interests in the protection of their personal data are sufficiently taken into account.

Duration of storage
The data will be deleted as soon as it is no longer needed for our recording purposes, which is after 365 days.

Possibility of objection and removal
Cookies are stored on the user's computer and transmitted to our site by the user. Therefore, you as a user also have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website in full.
We offer our users the option of opting out of the analysis process on our website. To do this, you must follow the corresponding link. In this way, another cookie is set on their system, which signals to our system not to store the user's data. If the user deletes the corresponding cookie from their own system in the meantime, they must set the opt-out cookie again.
For more information on the privacy settings of the Matomo software, please see the following link: https://matomo.org/docs/privacy/.

5. Who receives my data?

Due to the size and complexity of data processing by AUDI AG, it is not possible to list each recipient of your personal data individually in this data protection notice, which is why usually only categories of recipients are specified.

Within AUDI AG, areas that require your data for processing will receive your data (e.g. the sales department Audi Training, Sales Germany, IT).

Service providers employed by us and supporting us on our behalf with data processing (so-called contract processors) receive data for these purposes. We only use processors in Germany. For example, your e-mail address will be passed on to a service provider so that they can deliver your subscribed newsletter. Service providers can also be commissioned to provide server capacities. These include:

Participants Management
Platform operators
Hosting providers and support service providers

Your personal data will only be given to third parties if this is necessary for the fulfillment of the contract, we or the third party have a legitimate interest in the transfer or your consent is given. In addition, data can be transmitted to third parties should we be obliged to do so by law or by enforceable official or judicial order. Third parties to whom we pass on your personal data and who are responsible for data protection are:

External consultants from AUDI AG (e.g. lawyers, tax consultants, auditors),
Authorities within the scope of their responsibilities (e.g. tax office, police, public prosecutor's office),
Courts,
Other third parties, insofar as you instruct us to pass on data or you give us your consent to do so.

6. Is data transferred to a third country?

We process your data in Germany. We generally do not transfer your data to other countries or third countries (countries that are neither members of the European Union nor the European Economic Area) or to international organizations.

Data may be transferred to third countries (i.e. countries that are neither a member of the European Union nor the European Economic Area) if this is necessary in order to render services to you, is required by law or you have given us your consent.

Please note that not all third countries have a level of data protection recognized as appropriate by the European Commission. For data transfers to third countries where there is no adequate level of data protection, we ensure that the recipient either has an adequate level of data protection (e.g. through self-certification of the recipient for the EU-US Privacy Shield or the agreement of so-called EU standard contractual clauses between the European Union and the recipient) or we have received our users’ consent.

You can request a copy of the specifically applicable or agreed on rules to ensure the appropriate level of data protection from us. Please refer to the information in the Contact section.

7. How long will my data be stored?

We store your data for as long as it’s necessary to enable us to provide our services to you or as long as we have a legitimate interest in further storage.

We save your data for the duration of the event (live stream session), your IP address is deleted 7 days after the event. In addition, we are subject to various statutory retention and documentation obligations, which derive, among others, from the Commercial Code (HGB) and the Tax Code (AO). These require the storage and documentation of data for up to ten years. Finally, the storage period is also assessed according to the statutory limitation periods, which can be up to thirty years, for example according to §§ 195 ff. of the Civil Code (BGB), whereby the regular limitation period is three years.

In some circumstances your data may need to be kept longer, e.g. if a so-called legal hold or litigation hold is ordered in connection with an official or judicial procedure (i.e. a ban on data deletion for the duration of the procedure).

8. What rights do I have?

As a data subject, you generally have the following data protection rights:

Disclosure:
You have the right to request information about the data stored at AUDI AG about you and the scope of data processing and transfer carried out by AUDI AG, and to receive a copy of the personal data stored about you.

Correction:
You have the right to request the correction of incorrect personal data concerning you and the completion of incomplete personal data about you stored by AUDI AG.

Deletion:
You have the right to request the immediate deletion of the personal data about you stored at AUDI AG, if the legal requirements are met.

This is particularly the case if

your personal data is no longer needed for the purposes for which it was collected;
the legal basis for the processing was exclusively your consent and you have revoked it;
you have objected to processing on the legal basis for weighing up interests for personal reasons and we cannot prove that there are overriding legitimate reasons for processing;
your personal data has been processed unlawfully;
your personal data must be deleted in order to comply with legal requirements.

If we have passed your data on to third parties, we will inform them of the deletion if required by law.

Please note that your deletion right is subject to restrictions. For example, we do not have to or may not delete any data that we have to keep due to statutory retention periods. Data that we need to assert, exercise or defend legal claims are also excluded from your right to deletion.

Limitation of processing:
You have the right to request for the processing to be restricted under certain conditions (i.e. the marking of stored personal data with the aim of restricting its future processing). The requirements are:

You dispute the accuracy of the personal data and AUDI AG must check the accuracy of the personal data;
The processing is unlawful, however you do not want the personal data to be deleted, but instead request the use of the personal data to be restricted;
AUDI AG no longer needs your personal data for the purposes of processing, but you do need the data to assert, exercise or defend legal claims;
You have objected to the processing and it is not certain yet whether the legitimate reasons of AUDI AG outweigh yours.

In the event of a restriction of processing, the data will be marked accordingly and - apart from being stored - will only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest processed by the EU or an EU member state.

Data portability:
In case we automatically process your personal data that you have provided to us on the basis of your consent or a contract with you, you have the right to receive the data in a structured, common and machine-readable format and to have this data passed on to another responsible person without hindrance by AUDI AG. You also have the right to have the personal data transmitted directly from AUDI AG to another person in charge, given that this is technically feasible and provided that this does not affect the rights and freedoms of other people.

Objection:
If we process your personal data on the basis of legitimate interests or in the public interest, you have the right to object to the processing of your data for personal reasons. Please see our separate note in the section "Information about your right to object".

Withdrawal of consent:
If you have given your consent to the processing of your personal data, you can withdraw this consent at any time. Please note that the cancellation only applies to the future. Processing that took place before the withdrawal is not affected.

Complaint:
In addition, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data is not lawful. The right of appeal is without prejudice to any other administrative or judicial remedy. The address of the data protection supervisory authority responsible for AUDI AG is:

Bayerisches Landesamt für Datenschutzaufsicht
Promenade 18
91522 Ansbach
Germany

8.1 Information about your right to object

Right to object for personal reasons:
You have the right to object to the processing of your personal data for reasons that arise from your particular situation. For this the data processing must be taking place due public interest or on the basis of a balance of interests. This also applies to profiling.

In cases where the processing of your personal data is based on a balance of interests, we generally assume that we can demonstrate compelling reasons worthy of protection, but we will of course consider the circumstances of the individual case at hand

We will no longer process your personal data in the event of an objection, unless

we can demonstrate compelling legitimate reasons for processing this data that outweigh your interests, rights and freedoms or
your personal data is used to assert, exercise or defend legal claims.

Exercising the right to object:
The objection does not need to follow a particular form and should, if possible, be submitted to the contact details listed in this data protection notice.