Privacy Policy
Privacy Policy
We, Porsche Digital GmbH (hereafter "we" or "Porsche Digital"), appreciate your visit to our website (www.porsche.digital). We take the protection of your personal data very seriously. Your personal data will be processed exclusively in accordance with the statutory provisions of data protection law, in particular the General Data Protection Regulation (hereinafter "GDPR").
With this Privacy Policy, we inform you about the processing of your personal data and about your rights as a data subject, among other things, as affected in connection with the Online Service, see in particular for the purposes and the legal basis Section 3 ff.
If we refer to this Privacy Policy from external social media profiles, the following explanations apply only insofar as the processing takes place in our area of responsibility, see in particular Section 7. We also provide information on processing in connection with the handling of existing or future business relationships, see in particular Section 8.
For the processing of personal data in connection with job applications, please refer to our Privacy Policy for the Careers website.
For information on other products and services offered by other companies in the Porsche Group, please consult the respective privacy policy for these services or companies.
1. Controller and data protection officer
Responsible for the data processing as controller in terms of data protection law is:
Porsche Digital GmbH Grönerstrasse 11/1 71636 Ludwigsburg Germany
Contact: dataprotection@porsche.digital
If you have any questions or suggestions regarding data protection, please feel free to contact us. You can reach our data protection officer as follows:
Porsche Digital GmbH Data Protection Officer Grönerstrasse 11/1 71636 Ludwigsburg Germany
Contact: datenschutzbeauftragter@porsche.digital
2. Subject of data protection
The subject of data protection is the protection of personal data. This is all information relating to an identified or identifiable natural person (so-called data subject). This includes information such as name, postal address, email address or telephone number, but also other information that may be generated when using the Online Service, in particular information about the beginning, end and extent of use as well as the transmission of your IP address.
3. Purposes and legal basis of data processing
In the following, you will find an overview of the purposes and legal basis of data processing in connection with the Online Service, in particular our website. In any case, we process personal data in accordance with the legal requirements, even if in individual cases a different legal basis should be relevant than that stated below.
The provision of personal data by you may be required by law or contract or may be necessary for the conclusion of a contract. We will point it out separately if you are obliged to provide personal data and what possible consequences the non-supply would then have (e.g. a loss of claims or our position not to provide the requested service without providing certain information). The use of the Online Service is generally possible without registration. The use of individual functions may require prior registration. Even if you use the Online Service without registration, personal data may still be processed.
3.1 Performance of a contract and pre-contractual measures
We process your personal data if this is necessary for the performance of a contract to which you are a party or for the implementation of pre-contractual measures taken in response to your request. The data processing is based on Article 6 paragraph 1 letter b) GDPR. The purposes of processing include enabling the use of our specific products and services within the scope of the Online Service.
You can voluntarily enter personal data on our website, e.g. when you send us requests for information. We will process your request and we will possibly disclose your information to third parties (e.g. Porsche AG) within this context, if required.
In case we implement further individual services and offers on our website, we will amend this Privacy Policy accordingly.
3.2 Compliance with legal obligations
We process your personal data to comply with legal obligations to which we are subject. The data processing is based on Article 6 paragraph 1 letter c) GDPR. These obligations may arise, for example, from commercial, tax, money laundering, financial or criminal law. The purposes of the processing result from the respective legal obligation; as a rule, the processing serves the purpose of complying with state control and information obligations.
3.3 Safeguarding of legitimate interests
We also process your personal data to pursue the legitimate interests of ourselves or third parties, unless your rights, which require the protection of your personal data, outweigh these interests. The data processing is based on Article 6 paragraph 1 letter f) GDPR. The processing to safeguard legitimate interests is carried out for the following purposes or to safeguard the following interests. - Handling of non-contractual inquiries and concerns; - Ensuring legally compliant actions, prevention of and protection against legal violations (especially criminal offences), assertion of and defense against legal claims, internal and external compliance measures; - Ensuring availability, operation and security of technical systems as well as technical data management; - Answering and evaluation of contact requests and feedback.
When you call up the Online Service, data relating to your end device and your use of the online offer are processed and stored in a so-called log file. This concerns in particular technical data such as date and time of access, duration of the visit, type of terminal device, operating system used, functions used, amount of data sent, IP address and referrer URL. We process this data to ensure technical operation and to determine and eliminate faults. In doing so, we pursue the interest of permanently ensuring technical operability. We do not use this data for the purpose of drawing conclusions about your person.
3.4 Consent
We process your personal data on the basis of corresponding consent. The data processing is based on Article 6 paragraph 1 letter a) GDPR. If you give your consent, it is always for a specific purpose; the purposes of processing are determined by the content of your declaration of consent. You may revoke any consent you have given at any time, without affecting the legality of the processing that has taken place on the basis of the consent until revocation.
3.5 Change of purpose
If we process your personal data for a purpose other than that for which the data was collected, beyond the scope of a corresponding consent or a mandatory legal basis, we will take into account, in accordance with Article 6 paragraph 4 GDPR, the compatibility of the original and the now pursued purpose, the nature of the personal data, the possible consequences of further processing for you and the guarantees for the protection of the personal data.
3.6 Profiling
We do not carry out automated decision making or profiling in accordance with Article 22 GDPR. Profiling is only carried out to protect our legitimate interests as described above.
4. Access authorizations in the end device
To the extent functions of the Online Service require the granting of authorization to access your end device (e.g. access to location data or photos), the granting of these authorizations is voluntary. However, if you wish to use the corresponding functions, you must grant the appropriate authorizations, otherwise you will not be able to use these functions. The permissions remain active as long as you have not reset them in your device by deactivating the respective setting.
5. Cookies and comparable technologies
We may use cookies and comparable technologies in connection with the Online Service which serve to communicate with your end device and exchange stored information (hereinafter collectively referred to as "Cookies"). Cookies are primarily used to make the functions of the Online Service usable. General examples in which the use of Cookies is technically required in this sense are the storage of a language selection, login data or a shopping or watch list. Accordingly, technically required Cookies may be used by us to enable the processing described in Section 3.1 and to ensure the proper and secure operation of the Online Service. The data processing is then carried out on the basis of Article 6 paragraph 1 letters b) and f) GDPR, as it is necessary to implement the functions you have selected or to protect our legitimate interest in the functionality of the Online Service.
Insofar as we should also use Cookies in order to analyse the use of the Online Service and to be able to target it to your interests and, if necessary, to provide you with interest-based content and advertisements, this is done exclusively on the basis of your voluntary consent in accordance with Article 6 paragraph 1 letter a) GDPR. You will then have the opportunity to make the appropriate settings within the Online Service via a consent management. You may then revoke any consent you have given at any time with effect for the future. Further information on Cookies and their function in detail as well as on setting and revocation options can then be found directly in the corresponding areas of the consent management. Please note that we only make available the consent management in the context of the Online Service if, in addition to the above-mentioned technically required Cookies, consent based Cookies are to be used.
If you do not wish to use Cookies in general, you can also prevent their storage by adjusting the settings of your end device accordingly. Stored Cookies can be deleted at any time in the system settings of your terminal device. Please note that blocking certain types of Cookies can lead to impaired use of the Online Service.
6. Integrated third-party services
Insofar as we integrate services of other providers within the scope of the Online Service in order to provide you with certain content or functions (e.g. playing videos or route planning) and we process personal data in the process, this is done on the basis of Article 6 paragraph 1 letters b) and f) GDPR. This is because the data processing is then necessary to implement the functions you have selected or to protect our legitimate interest in an optimal range of functions of the Online Service. Insofar as Cookies may be used within the scope of these third-party services, the statements under Section 5 apply. Please also refer to the privacy policy of the respective third-party provider with regard to the third-party services.
Services of other providers which we integrate or to which we refer are provided by the respective third parties. We have no influence on the content and function of the third-party services and are generally not responsible for the processing of your personal data by their providers, unless the third-party services are completely designed on our behalf and then integrated by us on our own responsibility. Insofar as the integration of a third-party service results in us establishing joint processes with its provider, we will define with this provider in an agreement on joint controllership pursuant to Article 26 GDPR how the respective tasks and responsibilities in the processing of personal data are structured and who fulfils which data protection obligations. Insofar as Cookies are to be set on the basis of your consent, you will receive further information on the responsibility for setting these Cookies and any associated third-party services in the corresponding area of the consent management.
7. Social Media
We also maintain publicly accessible profiles with various social media providers (e.g. LinkedIn, Instagram, X (formerly Twitter)). Unless otherwise stated, the profiles are generally only included in our Online Service as a link.
After clicking on the integrated text/image link, you will be redirected to the offer of the respective social media provider. After the redirection or if you access our profile directly within the social media provider's offering, personal data is collected directly by the respective social media provider and any other third-party providers integrated there. If you are logged in to your user account of the respective social media provider, the provider may be able to assign the collected information of the specific visit to your personal user account. If you interact with one of our posts via a "share" button of the respective social media provider, this information can be stored in the personal user account. If you want to prevent the collected information from being assigned directly to your user account, you must log out before clicking the included text/image link. However, the data is processed regardless of whether you have a user account with the respective social media provider or are logged out. But in this case there is no assignment to your user account.
In general, we can only directly view the information stored in your public profile. In addition, the social media provider may provide us with anonymous statistics about the interaction with our profile, which we use to improve the user experience when visiting our profiles. We do not have access to your specific usage data that the social network collects to compile these statistics. This data processing serves our legitimate interests in improving the visitor experience on our profiles and further developing support offers. The data processing is then carried out on the basis of Article 6 paragraph 1 letter f) GDPR.
If you use our profile with the respective social media provider to contact us (e.g. by creating your own posts, responding to one of our posts or sending us private messages), the data you provide will be processed by us for the purpose of contacting you and, if necessary, responding to your request. Depending on the context of the interaction, the legal basis for the data processing is either the performance of a contract or the taking of pre-contractual measures pursuant to Article 6 paragraph 1 letter b) and/or our legitimate interest in processing non-contractual inquiries and requests pursuant to Article 6 paragraph 1 letter f) GDPR.
The individual data processing operations and their scope may vary depending on the social media provider. For details on the collection and storage of your personal data when interacting with the respective profile, as well as the nature, scope and purpose of use by the social media provider, please refer to the respective privacy policy of the social media provider.
You are not required to provide us with your personal information. However, this may be necessary for certain functionalities of our profiles on the respective social media provider. These functionalities will not be available to you, or only in a limited way, if you do not provide the personal data.
Below you will find an overview of the sources, purposes and legal basis of data processing in the context of existing or future business relationships. In the context of our business relationships, we process your personal data, among other things, as an employee of a business partner or as a person involved in the performance of a contract. Such business relationships include existing or potential suppliers, service providers, customers or consultants, as well as cooperation partners or other partner companies.
The provision of personal data by you may be required by law or contract or may be necessary for the conclusion of a contract. We will inform you separately if you are required to provide personal data and the possible consequences of not providing it (e.g. loss of claims or our notification that we cannot provide the requested service without the provision of certain data).
8. Processing of business relationships
We primarily process your personal data that you provide to us in the course of the business relationship or that we receive from the relevant business partners (e.g. from your colleagues with whom we are already in contact), for example in the course of processing an inquiry or an order. In addition, we process personal data that we obtain from publicly available sources (e.g. commercial registers, press, internet) or that we receive from third parties (e.g. other business partners). The scope of the data processed about an individual varies depending on the function in which you appear before us, e.g. the position you hold with the respective business partner. Relevant personal data may include, in particular, name, position and contact details.
The purposes of processing include the preparation, execution and processing of contracts, in particular purchase and supply contracts, service and work contracts and other contractual relationships (e.g. processing and checking of corresponding offers and enquiries; authentication of contractual partners, preparation and signing of contractual documents, processing of services; sending of information letters, etc.) as well as the optimization of business processes and general support of business partners.
In this context, we process your personal data to protect our own legitimate interests or the legitimate interests of third parties. Data processing is carried out on the basis of Article 6 paragraph 1 letter f) GDPR. Processing in pursuit of legitimate interests is carried out in order to follow the following interests: handling of non-contractual inquiries and concerns, ensuring legally compliant actions (prevention of and protection against legal violations, assertion of and defense against legal claims, internal and external compliance measures), ensuring availability, operation and security of technical systems as well as technical data management. In addition, data processing may be carried out on the basis of Article 6 paragraph 1 letter b) GDPR because we have a business relationship either directly with you or with your employer and the processing is necessary for the performance and fulfillment of your obligations arising from the employment relationship. Finally, we process your personal data to comply with legal obligations to which we are subject. Data processing is then carried out on the basis of Article 6 paragraph 1 letter c) GDPR; see Section 3.2.
9. Recipients of personal data
Within our company, only those persons who need your personal data for the respective purposes mentioned have access to it. Your personal data will only be passed on to external recipients if we have legal permission to do so or have your consent. Below you will find an overview of the corresponding recipients: - Commissioned processors: Group companies of Porsche AG or external service providers, for example in the areas of technical infrastructure and maintenance, which are carefully selected and reviewed. The processors may only use the data in accordance with our instructions. - Public bodies: Authorities and state institutions, such as tax authorities, public prosecutors' offices or courts, to which we (must) transfer personal data, e.g. to fulfil legal obligations or to protect legitimate interests. - Private bodies: Group companies of Porsche AG, cooperation partners, service providers (not bound by instructions) or commissioned persons
10. Data processing in third countries
If a data transfer takes place to entities whose registered office or place of data processing is not located in a member state of the European Union, another state party to the Agreement on the European Economic Area or a state for which an adequate level of data protection has been determined by a decision of the European Commission, we will ensure prior to the transfer that either the data transfer is covered by a statutory permit, that guarantees for an adequate level of data protection with regard to the data transfer are in place (e.g., through the agreement of contractual warranties, officially recognized regulations or binding internal data protection regulations at the recipient), or that you have given your consent to the data transfer.
If the data is transferred on the basis of Articles 46, 47 or 49 paragraph 1, subparagraph 2 GDPR, you can obtain from us a copy or reference to the availability of the guarantees for an adequate level of data protection in relation to the data transfer. Please use the information provided under Section 1.
11. Storage duration, erasure of data
We store your personal data, if there is legal permission to do so, only as long as necessary to achieve the intended purposes or as long as you have not revoked your consent. In the event of an objection to processing, we will delete your personal data, unless further processing is still permitted by law. We will also delete your personal data if we are obliged to do so for other legal reasons. Applying these general principles, we will usually delete your personal data immediately - after the legal permission has ceased to apply and provided that no other legal basis (e.g. commercial and tax law retention periods) intervenes. If the latter applies, we will delete the data after the other legal basis has ceased to apply; - if your personal data is no longer required for the purposes we pursue and no other legal basis (e.g. commercial and tax law retention periods) intervenes. If the latter is the case, we will delete the data after the other legal basis has ceased to apply.
12. Rights of data subjects
Right to access: You have the right to receive information about your personal data stored by us.
Right to rectification and erasure: You can demand that we correct incorrect data and, if the legal requirements are met, delete your data.
Restriction of processing: You can demand that we restrict the processing of your data, provided that the legal requirements are met.
Data portability: If you have provided us with data on the basis of a contract or consent, you may, if the legal requirements are met, demand that the data you have provided us with are handed over in a structured, common and machine-readable format or that we transfer it to another controller.
Objection: You have the right to object at any time to data processing by us based on the safeguarding of legitimate interests for reasons arising from your particular situation. If you make use of your right to object, we will stop processing the data unless we can prove compelling reasons for further processing worthy of protection which outweigh your rights and interests.
Objection to direct marketing: If we process your personal data for the purpose of direct marketing, you have the right to object to our processing of your data for this purpose at any time. If you exercise your right to object, we will stop processing your data for this purpose.
Revocation of consent: If you have given us your consent to process your personal data, you can revoke it at any time with effect for the future. The legality of the processing of your data until revocation remains unaffected.
Right to lodge a complaint with a supervisory authority: You can also lodge a complaint with the competent supervisory authority if you believe that the processing of your data violates applicable law. You can contact the supervisory authority responsible for your place of residence or your country or the supervisory authority responsible for us.
Your contact with us and the exercise of your rights: Furthermore, you can contact us free of charge if you have questions regarding the processing of your personal data and your rights as a data subject. Please contact us at dataprotection@porsche.digital or by letter mail to the address provided under Section 1. Please make sure that we can definitely identify you. If you revoke your consent, you can alternatively choose the contact method that you used when you gave your consent.
13. Effective date
The latest version of this Privacy Policy applies. This version dates from 12.03.2024.