e-Call.

United Arab Emirates, Audi Volkswagen Middle East FZE
Official Center:
Dubai Airport Free Zone, West Wing, Building 8W/A, Office 101
P.O. Box 27758, Dubai
Telephone: +971 45479500
www.audi-me.com


AUDI AG does not commit to nor is it obliged to participate in the alternative dispute resolution for consumer disputes in front of a consumer dispute resolution entity.

This data protection notice provides information about how your personal data are processed by AUDI AG, Auto-Union-Strasse 1, 85045 Ingolstadt (“we”) in connection with data processing and data transmission from your vehicle.

The organisation responsible for processing your personal data is:
AUDI AG, Auto-Union-Strasse 1, 85045 Ingolstadt, Germany.
If you have any data protection concerns, you can also contact our company data protection officer:

AUDI AG, company data protection officer, Auto-Union-Strasse 1, 85045 Ingolstadt

Email: datenschutz@audi.de

a) General
Electronic control units have been installed in your vehicle. Control units process data that they receive, for example, from vehicle sensors, that they generate themselves or that they share among one another. Some control units are required to ensure that your vehicle functions safely, others help you while drive (driver assistance systems), and others provide comfort features. Below is some general information about data processing in your vehicle. Specific information can be found in the relevant operating manual, which is available online and, depending on its features, digitally in your vehicle as well, in the section on the relevant features and below under “Special information”.

b) Personally identifiable data
Each vehicle has a unique vehicle identification number. In Germany, this vehicle identification number can be used to obtain information about the current and past owners of the vehicle from the Federal Motor Transport Authority. There are other ways to use the data collected from the vehicle to learn about the owner or driver of the vehicle, e.g. via the number plate.

So the data generated or processed by the control units may be personally identifiable or may, under certain circumstances, become personally identifiable. Depending on the vehicle data that are available, if may be possible to draw conclusions about, for example, your driving behaviour, your location or route or user behaviour.

c) Statutory data disclosure requirements
Where there are statutory requirements, manufacturers are generally obliged, in response to requests by government agencies, to provide data stored by the manufacturer in individual cases and to the extent necessary (e.g. to assist with the investigation of a criminal offence).

With the scope of the applicable law, government agencies are also authorised to read data from vehicles themselves in individual cases. For example, if there is an accident, data can be read from the airbag control unit to help with the investigation of the accident.

Control units process data in order to operate the vehicle. This includes, for example:
- Vehicle status information (e.g. speed, deceleration, lateral acceleration, wheel revolution speed, whether the seat belts are fastened),
- Environmental conditions (e.g. temperature, rain sensor, distance sensor).

These data are generally temporary; they are not stored after the vehicle is no longer in operation and are only processed in the vehicle itself. Control units often have data storage units (including the vehicle keys). These are used to temporarily or permanently document information about the vehicle status, component stress, maintenance requirements and technical events and errors.

Depending on selected equipment, the following information is stored:
- Operating conditions of system components (e.g. fill level, tyre pressure, battery status),
- Disruptions and defects in key system components (e.g. lights, brakes),
- System responses in special driving situations (e.g. deployment of airbags, use of stability control systems),
- Information about vehicle-damaging events,
- For electric vehicles, the state of charge of the high-voltage battery, estimated range.

In special cases (e.g. when the vehicle has detected a malfunction), it may be necessary to store data that would otherwise only be temporary.

When you use services (e.g. repair services, maintenance work), it may, where required, be necessary to read and use the stored operating data together with the vehicle identification number. The data may be read from the vehicle by an employee of the service network (e.g. workshops, manufacturer) or third parties (e.g. breakdown service centres). The same applies for warranty cases and quality assurance measures.

The readout is generally carried out via the statutorily prescribed connection for on-board diagnostics (OBD). The operating data that is read out documents the technical conditions of the vehicle or individual components to help with the error diagnosis, compliance with maintenance obligations and quality improvement. These data, especially information about component stress, technical events, operating errors and other errors are sent together with the vehicle identification number to the manufacturer, if necessary. The manufacturer is also subject to product liability. The manufacturer also uses operating data from the vehicle for recalls. These data may also be used to review warranty and guarantee claims by customers.

Error storage units in the vehicle can be reset by a service centre as part of repair or service work or at your request.

You can save comfort settings and customisations in the vehicle and modify or reset them at any time. Depending on the vehicle equipment, these include for example:

- Seat and steering wheel position settings,
- Chassis and climate control settings,
- Driver assistance system and driver information system,
- Settings in the instrument cluster,
- Customisations such as interior lighting.

Within the framework of the selected equipment, you can add data to the vehicle MMI features yourself. Depending on the vehicle equipment, these include for example:

- Multimedia data, such as music, videos or photos for replay in an integrated multimedia system,
- Address book data for use in conjunction with an integrated speaker phone system or an integrated navigation system,
- Entered navigation destinations,

These comfort features can be stored locally or they can be located on a device that you have linked with the vehicle (e.g. smartphone, USB stick or MP3 player). If you have entered the data yourself, you can delete it at any time.

These data are only transmitted from the vehicle at your request, particularly as part of the use of online services in line with the settings selected by you. Further information about online services can be found in Section 3.

If your vehicle has the corresponding equipment, you can link your smartphone or other mobile device to the vehicle so you can control the control elements integrated in the vehicle. If you do, you can have video and sound from your smartphone stream via the multimedia system. At the same time, certain information will be transmitted to your smartphone. Depending on the type of integration, this includes for example, location data, day/night mode and other general vehicle information. More information can be found in the operating manual for the vehicle as well as under “Special information”.

The integration enables the use of selected smartphone apps, such as navigation or music replay. There is no further interaction between the smartphone and the vehicle; in particular, there is no active access to vehicle data. The type of other data processing is determined by the provider of the app used. Whether and which settings you can adjust depends on the relevant app and your smartphone’s operating system.

If your vehicle has a wireless internet connection, this will enable you to share data between your vehicle and other systems (the data servers of AUDI AG or the data servers of service providers). In certain countries, the wireless internet connection is enabled by an on-board transmitting and receiving unit (installed by us) or via a mobile device provided by you (e.g. a smartphone). This wireless internet connection enables the use of online features (information and control services for your vehicle). These include online services and apps that are provided by us or other providers (the “Audi connect services ”or the “services”).

Information about the individual services can be found under “Special information ”in Sections 3 and 4.

Please note that the services given here may not all be available in your vehicle or country.

For AUDI AG online services, the relevant features are described in the appropriate location (e.g. the vehicle MMI, manufacturer website). The related data protection information can be found below under “Special information”. Personal data may be used to provide online services. The data exchange necessary for this purpose is carried out over a secure connection, e.g. via the AUDI AG IT systems provided for this purpose. Personal data is only collected, processed and used beyond the scope of the provision of the services on the basis of a statutory authorisation, e.g. as part of a statutorily required emergency call system, if there is a contractual agreement or if consent has been obtained.

You can have the services and features (some of which are subject to charges) and – depending on the vehicle –in some cases the entire wireless internet connection activated or deactivated. This does not include statutorily required features and services, such as an emergency call system.

If you use the online services of other providers (third parties), these services are the responsibility of and subject to the data protection terms and terms and conditions of use of the relevant provider. We generally have no influence over the information that is shared.

You can learn more about the type, scope and purpose of the personal data that is collected and used during the use of third-party services from the relevant service provider.

In section 2 of this data protection notice, you will find general information about how your personal data are used in the scope of the services and the rights to which you are entitled according to the data protection regulations.

Your vehicle sends certain data to our IT systems or the IT systems of service providers we use. On the basis of the data sent from your vehicle, we provide you with a service or content that we deliver directly from our IT systems or via the IT systems of our service providers to your vehicle. At minimum, this requires the technical allocation of a query to a service to a vehicle. This allocation is done either via your vehicle’s vehicle identification number or an alias. We process your personal data from the vehicle for various purposes in compliance with the provisions of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (FDPA). The specific data and purposes of the data processing are mainly based on the relevant vehicle and the vehicle equipment and the services used. Please note that the services given here may not all be available in your vehicle or country.

With so-called swarm services, the data from many vehicles is used to provide security and comfort features in your vehicle. As with online navigation features, the data is transmitted in anonymised form, with a different alias (session ID) in each driving cycle1. As location- based services are involved, it is necessary to send and process precise location information in a timely manner. The vehicle identification number is not transmitted to the processing systems of AUDI AG or the service providers involved. The data are only collected if the related services in your vehicle have been activated. For details about which data are transmitted for which service, please see the description of swarm services under Section 4. In addition to these service-specific data, the metadata required to provide the service are also transmitted: time stamp, information about the software versions used, the map or map tile versions used.

Further details about the specific data categories that are processed as well as the corresponding sources can be found under the “Special information ”section for each service (“Special information –service name”)

The specified data processing for each service is necessary to provide a service used by you in fulfilment of a contract (performance of a contract with you or in order to take steps at your request prior to entering into a contract (Art. 6, para. 1, sub-para. 1b) GDPR)) as well as to investigate disruptions and ensure system security, including the detection and tracking of unauthorised access attempts and access to our IT systems on the basis of our legal obligations in the area of data security as well as our legitimate interests in correcting

disruptions, ensuring system security and detecting and tracking unauthorised access attempts and access to our IT systems (required to safeguard the legitimate interests of AUDI AG or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (Art. 6, para. 1, sub-para. 1f) GDPR)).

In individual cases, data may be processed to safeguard or defend legal claims on the basis of our legitimate interests (Art. 6, para. 1, sub-para. 1f) GDPR).

If we process the personal data of other passengers, we do so to provide services used by you or the other passenger or to safeguard our legitimate interests in fulfilment of a contract with the relevant contractual partner (Art. 6, para. 1, sub-para. 1b) GDPR or Art. 6, para. 1, sub-para. 1f) GDPR).

With so-called swarm services, the service provider aggregates the data that it processes for the provision of the service with data from other vehicles and it stores the aggregated results without reference to the vehicles. Our service provider processes these data to optimise and enhance services to safeguard legitimate interests in order to provide customers with high-quality service (required to safeguard the legitimate interests of AUDI AG or a third party), except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (Art. 6, para. 1, sub-para. 1f) GDPR).
Doing so makes it necessary to process and store the precise location information with the relevant events; there is no reference to your vehicle or you personally.

If we process data for other purposes or on a different legal basis, we specify this, together with the relevant legal basis, separately under “Special information –service”.

In the framework of our business relationship, you must only provide us with personal data that are necessary to commence and carry out a business relationship, or which we are legally obliged to collect. Without these data, we would generally have to refuse to conclude the contract or carry out the order, or it would no longer be able to carry out an existing contract and it may have to be terminated. This means for the use of a service it is necessary for you to provide the specified data. If you do not provide the data, we cannot provide you with the service.

Within AUDI AG, those entities receive your data that require it to fulfil our contractual and legal obligations as well as to protect our legitimate interests.

Service providers (so-called processors) employed and commissioned by us may also receive data for these purposes.

Your personal data will generally only be given by us to third parties if this is necessary for the fulfilment of the contract, if we or the third party have a legitimate interest in the disclosure of the data or if you give your consent.

Details about the processors we employ as well as other recipients who receive personal data can be found in the section “Special information –service”.

In addition, data may be transmitted to third parties (including investigative or security authorities) if we are required to do so on the basis of statutory provisions or an enforceable regulatory or judicial authority.

Data may be transmitted to third countries (i.e. countries that are not members of the European Union or the European Economic Area) if doing is required for the provision of services to you, if it is required by law or you have given us your consent. In addition, we may also forward your personal data to processors in third countries.

Please note that not all third countries have a level of data protection recognised as adequate by the European Commission. If data is transmitted to third countries where the level of data protection is not adequate, we ensure that the recipient either has an adequate level of data protection (e.g. through self-certification by the recipient as part of the EU-US Privacy Shield, or the agreement of the European Union’s so-called EU standard contractual clauses with the recipient) or the express consent of our users.

You can obtain from us a copy of the specifically applicable or agreed rules ensuring an adequate level of data protection. Please see the contact information under the “Contact ” section.

Details about data transmissions to third countries can be found in the section “Special information –service”.

We store your data as long as required to provide our services to you or we have a legitimate interest in continuing to store them, particularly to correct faults or to optimise services. We only store the data that we need for the relevant purpose, or we create an alias or anonymise the data processed beyond what we require for the provision of our services to the extent possible.

In addition, we are subject to various storage and documentation obligations, which are based on, among other things, the German Commercial Code (Handelsgesetzbuch, or HGB) and the German Fiscal Code (Abgabenordnung, or AO). The storage and documentation periods prescribed in these codes are up to ten years. The storage period is also determined on the basis of the statutory periods of limitation, which under, for example, Sec. 195 ff. of the German Civil Code (Bürgerliches Gesetzbuch, or BGB) can be up to 30 years, although the normal period of limitation is three years.

Under certain circumstances, your data may also need to be stored longer, e.g. if a so- called legal hold or litigation hold is ordered in connection with official or judicial proceedings (i.e. a prohibition against deleting the data for the duration of the proceedings).

If specific details are available, you will find further information in the section “Special information –service”.

Depending on your vehicle equipment, you can deactivate the collection of certain personal data using your vehicles privacy settings. Deactivation means that the services using these data cannot be provided and therefore cannot be used. Please note that the emergency call service cannot be deactivated using this function and continues to send the data necessary to provide the services. In addition, for security reasons the Audi connect key cannot be deactivated using the privacy settings.

As an affected person, you generally have the following data protection rights:

Information: You have the right to receive information about the data stored about you at AUDI AG as well as the scope of the data that is processed and shared, and to obtain a copy of your personal data that we have on file.

Correction: You have the right to request immediate correction of information related to you that is incorrect as well as completion of incomplete personal data that AUDI AG has on file for you.

Deletion: You have the right to request immediate deletion of the personal data on file for you at AUDI AG if the statutory requirements for doing so have been met.

This is the case in particular if
- your personal data are no longer needed for the purposes for which they were collected;
- your consent formed the sole legal basis for processing the data and you have revoked this consent;
- you object to processing for personal reasons on the legal basis of a weighing of interests and we cannot prove that there are overriding legitimate interests in favour of the processing;
- your personal data have been unlawfully processed; or
- your personal data must be deleted in order to comply with statutory requirements.

If we have disclosed your data to third parties, we will inform such third parties about the deletion if this is required by law.

Please note that your right to deletion is subject to restrictions. For example, we must or may not delete any data that we are required to retain on the basis of statutory retention periods. Data that we need to assert, exercise or defend legal claims is also exempt from your right to deletion.

Limitation of processing: Under certain conditions you have the right to request that the processing of your personal data be limited (i.e. the designation of stored personal data with the aim of limiting future processing of it). These conditions are:
- The accuracy of the personal data is disputed and AUDI AG must review the accuracy of the personal data;
- The processing is unlawful, but you do not want the personal data deleted and instead request that the use of the personal data be limited;
- AUDI AG no longer needs your personal data for the purpose of processing, but you need the data to assert, exercise or defend legal claims.
- You have objected to the processing of your personal data, but it is still not clear whether the legitimate interests of AUDI AG outweigh your interests.

If the processing is limited, your data will be designated accordingly and will –apart from being stored –only be processed with your consent or to assert, exercise or defend legal claims or to protect the rights of natural persons or legal entities or if the EU or an EU member state has an important public interest in doing so.

If we process the personal data that you have provided us on the basis of your consent or a contract in an automated manner, you have the right to receive the data in a structured, commonly used and machine-readable format, and to transmit these data to another controller without being prevented from doing so by AUDI AG. You also have the right to request that the personal data be transmitted directly from AUDI AG to another controller if this is technically feasible and provided that doing so does not affect the rights and freedoms of other persons.

If we process your personal data on the basis of legitimate interests or in the public interest, you have the right to object to the processing of your data for personal reasons. You also have an unlimited right to object if we process your data for our direct advertising. Please see the separate information provided in the section “Information about your right to object”.

In certain cases, we grant you an additional unlimited right to object as part of the weighing of interests, including through the privacy settings (deactivation option). For more details, see the section “Special information –service”.

If you have granted consent for the processing of your personal data, you can revoke this consent at any time. Note that such revocation only applies to future processing. Any processing carried out before the revocation is not affected.

You also have the right to lodge complaint with a data protection authority if you believe that your personal data was processed unlawfully. You have the right to lodge such a complaint irrespective of any other administrative or judicial remedies. The address of the relevant data protection authority for AUDI AG is:

Promenade 27 (Schloss)
91522 Ansbach
Germany

You have the right to object to the processing of your personal data for reasons arising from your particular situation. The prerequisite for this is that the data processing is carried out in the public interest or on the basis of a weighing of interests. This also applies for profiling.

If we process your personal data on the basis of a weighing of interests, we generally assume that there are compelling legitimate reasons for doing so, but we will of course review each individual case.

If we receive an objection, we will no longer process your personal data, unless
- we can demonstrate compelling legitimate reasons for processing these data that outweigh your interests, rights and freedoms or
- Your personal data help us to assert, exercise or defend legal claims.

If we process your personal data for direct advertising purposes, you have the right to object to the processing of your personal data for such purposes at any time; this also applies for profiling, if the profiling is connected with such direct advertising.

If you object to the processing of your personal data for the purpose of direct advertising, we will no longer process your personal data for this purpose.

The objection does not require the use of a form; it should be sent to the address specified in this data protection notice.

If you have questions about this data protection notice or about the processing of your personal data by AUDI AG, or if you would like to assert your data protection rights, please contact us using the following contact details:

AUDI AG, Customer Service Germany, P.O. Box 10 04 57, 85045 Ingolstadt

Email: kundenbetreuung@audi.de

If the statutorily required emergency call system (eCall) is triggered manually or automatically, your vehicle sends a legally stipulated minimum dataset and establishes a voice call to public safety answering point. The dataset may includes the following data: the vehicle identification number (which makes it possible to clearly identify your vehicle and assign it to a particular owner), vehicle type (car or light commercial vehicle), type of vehicle drive (petrol/diesel/CNG/LPG/electric/hydrogen), the current position of the vehicle (location data place and time) and the last three locations of the vehicle and its direction of travel, number of occupants, time stamp, trigger type (manual, automatic).

The data are generated when the trigger is activated and they are stored locally for the duration of the emergency call and up to one hour after the emergency call.

When the emergency call is triggered, your vehicle sends the data directly to the relevant emergency service centres, which are designated by the relevant authorities of the country where they are located to be the first to accept and process eCalls to the uniform European emergency number 112.
The processing of the data is based on a legal obligation to provide the emergency call functionality (Art. 6 para. 1, sub-para. 1c) GDPR).

The service is activated automatically as standard and cannot be deactivated. We have ensured that your vehicle cannot be tracked in normal usage because of this service. This means that no electronic tracking can occur.

Further details about data processing as part of the statutory emergency call can be found in your vehicle manual.