Privacy Policy

Use of person-independent email addresses to contact Volkswagen Communication
drive.info@volkswagen.de
drive.konferenz@volkswagen.de
mailto:drive.tour@volkswagen.de
drive.event@volkswagen.de
drive.gastro@volkswagen.de
drive.store@volkswagen.de
drive.salon@volkswagen.de
drive.facebook@volkswagen.de

In the following, we inform you about the processing of your personal data ("data") by us and the claims and rights to which you are entitled under the data protection regulations. Version: December 2025

Version: December 2025

I. What data do we process and from which sources does it originate?

We process data that we generally receive from you. Relevant personal data is regularly the following:

• • Private contact and master data
  • o Name, address, e-mail, telephone number
• • Professional work and organizational data
  • o Contact details (professional): name, address, e-mail, telephone number, company
  • Work Organization Assignment: Area, Department, Personnel Numbers, Responsibilities
• • IT usage data
  • User and login data: username, roles, permissions
  • Logging data: Technical logs, login times
  • Software and hardware data: IP address, MAC address, computer name

In addition, to the extent necessary for the performance of obligations imposed by law or the authorities, we process data that we have lawfully received from authorities (e.g. on the basis of legal authority, to execute orders, to fulfil contracts or on the basis of consent given by you).

Furthermore, we process data that we have lawfully collected from publicly accessible sources (e.g. commercial and association registers, company directories, credit agencies, credit bureau, press, publications, Internet) as well as from other sources (e.g. municipalities, other persons commissioned by you, authorities) and are allowed to process.

II. Is there an obligation to provide data

You only have to provide the data that is necessary for the initiation, establishment, implementation and termination of a business relationship or that we are legally obliged to collect. Without this data, we will usually have to refuse to conclude a contract or execute an order, or we will not be able to perform an existing contract or service.

If we are asking you for your consent to the processing of your personal data, such consent will always be voluntary. However, if you do not give your consent, we might not be able to provide a particular service, if the relevant service cannot be provided without such data.

III. For what purposes and on what legal basis do we process your data?

3.1. General

In principle, the processing of your data can be carried out on the basis of the following legal bases:

• If you have given us your consent in accordance with Art. 6 para. 1 lit. a) GDPR for certain purposes (e.g. advertising, market or opinion research, or the recording and publication of recordings), the lawfulness of the processing on the basis of consent is given.
  A given consent can be withdrawn at any time. A withdrawal is only effective for the future. Processing that took place before the withdrawal remains unaffected.
• The processing is necessary for the initiation and/or performance of a contract to which you are a party or to which you represent a contracting party, or for the implementation of pre-contractual measures that are taken upon request, Art. 6 (1) (b) GDPR.
• The processing is necessary for compliance with a legal obligation under EU law or the law of an EU member state to which Volkswagen AG is subject, Art. 6 (1) (c) GDPR.
• The processing is necessary to protect your vital interests or those of another natural person, Art. 6 para. 1 lit. d) GDPR.
• The processing is necessary for the performance of a task that is in the public interest or is carried out in the exercise of official authority vested in Volkswagen AG, Art. 6 (1) (e) GDPR.
• The processing is necessary to safeguard the legitimate interests of Volkswagen AG or a third party, unless your interests or fundamental rights and freedoms, which require the protection of personal data, prevail over Art. 6 (1) (f) GDPR

If special categories of personal data are processed, this may be done differently on the following legal bases:

• You have given your explicit consent, Art. 9 para. 2 lit. a) GDPR.
• The processing is necessary to protect your vital interests or those of another natural person and the data subject is unable to give his or her consent for physical or legal reasons, Art. 9 para. 2 lit. c) GDPR.
• The processing refers to data that you have obviously made public, Art. 9 para. 2 lit. e) GDPR.
• The processing is necessary for the establishment, exercise or defence of legal claims, Art. 9 para. 2 lit. f) GDPR.
• The processing is necessary for reasons of substantial public interest, Art. 9 para. 2 lit. g) GDPR,
• The processing is necessary for the purposes of preventive health care or occupational medicine, e.g. for the assessment of the ability to work, Art. 9 para. 2 lit. h) GDPR.

3.2. Datenverarbeitungen

IV. Who receives your data?

Within Volkswagen AG, only those departments will have access to your data that need it to fulfil the above-mentioned purposes.

A transfer to third parties will only take place if this is necessary for the aforementioned purposes and a legal basis exists or if you have given your prior consent. If Volkswagen AG has commissioned service providers for the processing of data or the associated provision of services, the transfer is usually carried out on the basis of a data processing agreement in accordance with Art. 28 GDPR or there are professional obligations that ensure a sufficient level of data protection.

The following categories of recipients may receive data:

• Service providers/suppliers
  • Hosting service providers
  • Technical support service providers
  • Consulting companies/service providers
• Trading partners
• Group companie

V. Will your data be transferred to a third country or to an international organisation?

As a rule, your data will be processed within the EEA (European Economic Area), to which the GDPR applies without restriction. As a globally active company, it is necessary in exceptional cases to store and process data outside the EU. In individual cases, data may also be passed on to authorities and courts in third countries. Please note that not all third countries have an adequate level of data protection recognised by the European Commission. Unless an adequacy decision has been made by the European Commission, Volkswagen AG will only transfer your data to third countries if this is permissible under Art. 44 – 49 GDPR. To the extent that Volkswagen AG relies on appropriate safeguards in accordance with Article 46 para. 2 GDPR for the transfer to third countries (e.g. standard contractual clauses or binding corporate rules), Volkswagen AG will take additional technical and/or organizational measures if this is necessary to maintain adequate protection of your data. The agreements with processors regularly provide for the conclusion of standard contractual clauses of the European Commission to ensure an adequate level of data protection. You can obtain a copy of the specifically applicable or agreed regulations to ensure the appropriate level of data protection from us. Please use the information in section B. VII for this purpose.

VI. How long will your data be stored?

Where necessary, we process and store your data for the purposes mentioned. If the purpose has been fulfilled and there are no retention obligations, the data will be deleted regularly. It should be noted that a business relationship is usually a permanent relationship, which is usually designed for years.

You may unsubscribe from your newsletter at any time, free of charge and with future effect, by notifying Volkswagen AG. For example, you can use the "Newsletter abbestellen" link included in every newsletter, or contact the following email address: info@drive-volkswagen-group.com. info@drive-volkswagen-group.com.

In addition, we are subject to various retention and documentation obligations, which result from the German Commercial Code and the German Fiscal Code, among others. The retention and documentation periods specified there are up to 15 years for VW AG.

Finally, the storage period is also assessed according to the statutory limitation periods, which, for example, according to §§ 195 et seq. of the German Civil Code, can usually be three years, in exceptional cases up to thirty years.

VII. Data Protection Officer and Rights of Data Subjects

If you have general questions about this privacy policy or the processing of your data by Volkswagen AG, you can contact our Data Protection Officer Dr. Oliver Draf, using your own language via:

• Post: Volkswagen AG, Data Protection Officer, Berliner Ring 2, 38440 Wolfsburg, Germany
• E-mail: dataprivacy@volkswagen.de
• Phone: 00800-8932836724889 (00800-VWDATENSCHUTZ)

You have the following rights vis-à-vis us, subject to the respective legal requirements:

• Right to information (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure or "right to be forgotten" (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR).

Furthermore, you have the right to contact a data protection supervisory authority at any time in accordance with Art. 77 GDPR if you believe that the processing of the data concerning you violates applicable law. The address of the data protection supervisory authority responsible for VOLKSWAGEN is:

Der Landesbeauftragte für den Datenschutz Niedersachsen Prinzenstraße 5 30159 Hannover Deutschland / Germany
Prinzenstraße 5
30159 Hannover
Deutschland / Germany

However, you can also lodge a complaint with any other data protection supervisory authority competent for you within or outside the EU, in particular with the one in the Member state of your habitual residence, place of work or place of the alleged infringement. Please find hereinafter a link where you can find all contact details of the national authorities in all member states: https://edpb.europa.eu/about-edpb/board/members_en. https://edpb.europa.eu/about-edpb/board/members_en.

Ihnen steht ein Widerspruchsrecht gegen die Verarbeitung Ihrer Daten zu,

• if the processing is carried out for direct marketing purposes (including profiling for direct marketing purposes) or
• if the processing (including profiling) is necessary to protect the legitimate interests of us or a third party (Art. 6 para. 1 lit. f GDPR). In the event of such an objection, we ask you to inform us of your reasons for objecting to the data processing. We will no longer process your data in the event of your objection, unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Please send your objection and, if necessary, the reasons for it to Volkswagen AG, Berliner Ring 2, 38440 Wolfsburg, by e-mail to privacy@volkswagen.de or via our data protection portal https://datenschutz.volkswagen.de/.

Asserting your rights

If you want to assert your rights as a data subject, please use the data protection portal or the other contact options provided.
https://datenschutz.volkswagen.de/

You can also send your request via the following contact options

• Post: Volkswagen AG, Privacy Team, Berliner Ring 2, 38440 Wolfsburg, Germany
• E-mail: privacy@volkswagen.de
• Phone: 00800-8932836724889 (00800-VWDATENSCHUTZ)