Volkswagen Group Italia S.p.A. (“VGI”)
Privacy Notice pursuant to art. 13 of the EU 2016/679 General Data Protection Regulation (GDPR)
1. Data Controller Identity and Contact Details
The Data controller for the processing of personal data is Volkswagen Group italia S.p.A. with registered office at Viale G.R. Gumpert, 1 37137 Verona (hereinafter also VGI), a company belonging to Volkswagen Group that distributes, in Italy, products and services identified by the trademarks Volkswagen, Volkswagen Commercial Vehicles, ŠKODA, SEAT, Cupra and Audi.
For any request concerning the protection of your personal data and the exercise of rights, please use the following contact: email@example.com
2. Data Protection Officer (DPO) Contact Details
The Data Protection Officer appointed by VGI that will represent the point of contact for the Data Subjects may be reached as follow:
- email: firstname.lastname@example.org;
- by post: Volkswagen Group Italia S.p.A, 37137 – Verona, Viale G.R. Gumpert 1, DPO Department.
3. Purpose and Legal Basis of the data processing activities
Your personal data will be processed for the following purposes:
a) provision of the service requested by the user within the relevant section of the website (such as test-drive, request for information on cars' availability, newsletter subscription).
The processing referred in letter a) is necessary for the provision of the service requested by the user, therefore in the absence it will not be possible to carry out the aforementioned activities. With regard to the purpose referred in letter a), it is specified that in order to access certain services, users may be issued, on the pages relating to these, a specific information on processing pursuant to art. 13 of the GDPR relating to the processing of data as part of the specific service requested.
4. Recipients of Personal Data
According to the indicated purposes the user’s personal data may be communicated:
To the following companies: VOLKSWAGEN AG with registered office in Wolfsburg and Hannover (Germany), ŠKODA A.S. with registered office in Mlada Boleslav (Czech Republic), SEAT S.A. with registered office in Barcelona (Spain), CUPRA S.A.U. with registered office in Abrera (Spain), AUDI AG with registered office in Ingolstadt (Germany), in their quality of Data Controllers.
To companies and professional operators that provide services concerning electronic data processing and consultancy services for software and information technology companies, as well as companies for the management of information services related to the foregoing.
For the recipients indicated in the above-mentioned number 3) it is indicated only the category of recipients of the personal data as the list might be subject to frequent updates and revisions. Therefore, the data subjects can request the updated list of recipients, contacting the Data Controller at the addresses indicated in article 1 above.
5. Data Transfer to Third Countries
With regards to the purposes of the data processing, as described by art. 1 of the present Privacy Notice, VGI does not transfer or communicate personal data in non-EU countries.
6. Data Retention Period
Your personal data will be kept for the time strictly necessary to pursue the specific purposes of the processing, specifically:
for the purposes indicated in letter a) of art. 3 (Service requested by the user) for the time necessary for the fulfillment of contractual obligations and, in any case, no later than 10 years from the time of collection of your data for compliance with regulatory obligations and, in any case, no later than the deadlines established by law for the prescription of rights.
7. Rights of the Data Subjects
Users shall have the right, at any time, to exercise the following rights:
a. Right of access to personal data: the Data Subject shall have the right to obtain from the Data Controller confirmation as to whether or not personal data concerning him or her are being processed, and where that is the case, access to the personal data and the following information: the purposes of the processing, categories of personal data concerned, the recipients , storage period, the right to lodge a complaint with a supervisory authority, the right to request the rectification or the erasure or the restriction of processing and the right to object to processing of data as well as the existence of an automated decision-making.
b. Request to rectification or ensure of or restriction of processing of personal data; “restriction of processing” means the marking of stored personal data with the aim of limiting their processing in the future.
c. Object to the processing of personal data: to object, on grounds relating to his or her particular situation to processing of personal data for the execution of a task of public interest or for the pursuit of a legitimate interest of the Data Controller.
d. Data portability: in case of data processing carried out by automated means with the consent of the Data Subject or in the execution of contractual obligations, the Data Subject shall have the right to receive his/her personal data in a structured, commonly used and machine-readable format; in particular the personal data will be provided by the Data Controller in xml or similar format.
e. Withdraw of the consent to processing personal data for marketing purposes, both direct and indirect, market research and profiling. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdraw.
f. Lodge a complaint with a supervisory authority, according to article 77 GDPR, before the court where the data subject has his or her habitual residence, or the place of employment or the place of violation of his or her rights. In Italy the competent Authority for the protection of personal data processing may be contacted using the address indicated in the website http://garanteprivacy.it
The above-mentioned rights may be exercised by sending a request to the Data Controller to the addresses indicated in article 1 above. The request concerning the exercise of the rights of the Data Subject will be handled without undue delay and, in any case, within one month from the receiving of the request; this deadline may be extended by two months, only in case of particular complexity and in case of high number of requests.