Privacy Notice for the “Audi Events” Event App

This privacy notice contains information about the processing of your personal data by Audi AG, Auto-Union-Straße 1, 85057 Ingolstadt (“we”) in connection with the “Audi Events” event app.

The “Audi Events” event app is used for selected Audi events in order to provide the participant with information about the event (e.g., agenda, organizational details). Interactive functions such as voting, comments, and ratings are also integrated. After the event, any voting results, contents, or photos are made available for retrieval via the app.

Who is responsible for data processing, and whom can I contact?

The controller responsible for processing your personal data is:

AUDI AG, Auto-Union-Straße 1, 85057 Ingolstadt.

For matters relating to data protection, you can also contact our company data protection officer:

AUDI AG, Data Protection Officer, Auto-Union-Straße 1, 85057 Ingolstadt

Email: datenschutz@audi.de

If you wish to assert your data protection rights, please use the contact options at www.audi.de/betroffenenrechte

There you will find more information on how to assert your data protection rights.

If you have general questions about this privacy notice or about the processing of your personal data by Audi AG, please use the following contact options:

Audi AG, Central Contact, Auto-Union-Str. 1, 85057 Ingolstadt

2. General information

2.1 What data do we process and what is their source?

2.1.1 Access to functionalities of your mobile device

In order to use some functions, you must allow the app to access additional functions of your mobile device. If we activate such functions in an event, you are asked upon initial activation of the app or accessing of the event to allow the app to access the following additional functions of your mobile device:

• Camera
• Photos/media/files
• Location

This access is necessary in order to provide you with the app’s functionalities.

Location data: Some functions need information about your location, e.g., navigation or the location display. If you have given permission for this on your mobile device, Audi records the geographic position of your mobile device. Data on your location are used only to handle your request.

You can also activate the additional functions at any time in the settings. However, those functionalities are accessed only after your activation and with your consent.

2.1.2 Data that you input in the app

We process the data that you input in the app during registration and when you use the functionalities and services.

During registration, we record the following professional contact data: title, name, company, position, organizational entity. This is necessary to check and authorize your right to access the app’s contents.

We also process data that you provide when you use the app’s communication functions, e.g., when using the voting or commenting function. We always process your voting choices without reference to your name and identity. Votes cast in the voting process are aggregated, and only the aggregated voting results undergo further processing.

You can include or exclude your name when posting comments or questions. We inform you in the app’s respective function if questions and comments are assigned to your identity and are processed together with your name. This is done to answer questions/comments after the event.

2.2 For what purposes and on what legal basis do we process your data?

Data are processed in order to offer and provide the functionalities that you use for the purpose of contract performance (performance of a contract with you or to take steps at your request prior to entering into a contract (Art. 6 (1) (b) GDPR)) and for the purpose of identifying disruptions and ensuring system security, including detecting and tracking unauthorized access attempts and the accessing of our IT systems based on our legal obligations relating to data security as well as our legitimate interest in eliminating disruptions, ensuring system security, and detecting and tracking unauthorized access attempts and the accessing of our IT systems (Art. 6 (1) (f) GDPR)).

In some cases, data are processed to safeguard or defend legal claims on the basis of our corresponding legitimate interest (Art. 6 (1) (f) GDPR).

2.3 Am I obliged to provide data?

When you use the app, you must provide only personal data that are necessary for the provision of the app and its functionalities or the provision of the functionalities as well as data that we are legally obliged to collect. If you do not provide such data, we cannot provide you with the functionality.

2.4 Who gets my data?

Within Audi AG, your data are received by the entities that need the data in order to fulfill our contractual and statutory obligations and safeguard our legitimate interests (IT, communication, corporate strategy).

Service providers contracted by us (known as processors) may also receive data for the aforesaid purposes. In connection with our provision of the app, we use the following processor for IT operations, hosting, and support: Plazz AG, Maximilian-Welsch-Straße 2b, 99804 Erfurt.

In principle, we provide your personal data to third parties only if that is necessary for contract performance, if we or the third party have a legitimate interest in disclosure, or you have given your consent.

Data can also be transmitted to third parties (including investigative or security authorities) if we are obliged to do so on the basis of provisions of law or an enforceable administrative or court order.

2.5 Are data transmitted to a third country?

As a rule, we do not transmit your data to third countries (countries that are a member of neither the European Union nor the European Economic Area) or to international organizations.

Exceptions exist if you work for a company in the Audi or VW group or an independent dealer in a third country. In some cases, personal data may also be disclosed to authorities and courts in third countries.

Please note that not all third countries provide a level of data protection recognized as adequate by the European Commission. We have taken appropriate measures with respect to transmitting data to third countries that do not provide an adequate level of data protection – e.g., entry into standard data protection clauses in order to protect your personal data. You can receive a copy of these measures. To do so, please use the contact information provided below.

2.6 How long are my data stored?

We store your data for as long as is necessary to provide our services to you or as long as we have a legitimate interest in further storage, especially for reasons of troubleshooting.

We store your registration data for as long as you are registered for the app. We also store your contributions for the duration of the event as well as an additional period of 12 months, especially for reasons of troubleshooting.

We store the log files containing personal data for the purpose of detecting disruptions and for security reasons (e.g., detecting attempted attacks) for 7 days, after which they are erased. Log files that must be retained as evidence are exempted from erasure until the respective incident is definitively cleared up.

We are also subject to various retention and documentation obligations, including those set forth in the German Commercial Code ("Handelsgesetzbuch" "HGB") and the German Tax Code ("Abgabenordnung" "AO"). The periods specified there for retention and/or documentation can be as much as ten years. Ultimately the storage period is determined in part on the basis of the statutory limitation periods, which under Sections 195 et seqq. of the German Civil Code ("Bürgerliches Gesetzbuch" "BGB"), for example, can be as much as thirty years, whereas the regular limitation period is three years.

Under certain other circumstances, your data must be retained longer, e.g., if a legal hold or a litigation hold (i.e., a prohibition of data erasure for the duration of the proceedings) is ordered in connection with administrative or judicial proceedings.

2.7 What are my rights?

2.8 Information on your right to object

Right to object for personal reasons

You have the right to object to the processing of your personal data for reasons relating to your particular situation. This is subject to the condition that the data processing is taking place in the public interest or on the basis of a balancing of interests. This also applies to profiling.

If we are basing the processing of your personal data on a balancing of interests, we assume in principle that we can demonstrate compelling legitimate grounds, but of course we will review each specific case.

In the event of an objection, we will no longer process your personal data unless

• we can demonstrate compelling legitimate grounds for the processing of such data that override your interests, rights, and freedoms, or
• your personal data serve the purpose of the establishment, exercise, or defense of legal claims.

Exercise of the right to object

The objection is subject to no requirements as to form and, if possible, should be lodged with the contact indicated in this privacy notice.

2.9 Cookies and tracking

This app uses the open source software Matomo (formerly Piwik) (www.matomo.org) to process usage data for statistical analysis of the use of our app for the purpose of optimizing the functionalities and user friendliness of our app. Such data include: type of device, dwell time, gender, app pages visited, geographic location.

These data are used to create a usage profile under a pseudonym. For that purpose, cookies are stored on your mobile device so as to distinguish returning visitors from first-time visitors.

Cookies are small data sets that are stored on your device and contain data such as personal site settings and registration information. This data set is generated by the web server and sent to you.

The information generated by the cookies about your use of the app is stored on our server in Germany. You can object to the use of cookies at any time with future effect by changing the settings on your device in such a way that it accepts no cookies or only certain ones or that you are notified when cookies are sent. Through this, you may not be able to fully use all of our app’s functions.

The data are processed for the purposes of our legitimate interest in improving the user experience with our app (Art. 6 (1) (f) GDPR).

The following is a summary of the cookies that we use, which is intended to give you information about the purpose and type of the respective cookie as well as how long it is stored.