Privacy policy pursuant to art. 14 of Regulation (EU) 2016/679 regarding the protection of personal data (GDRP). 

This privacy policy is provided in order to inform you of how your personal data is processed.

Index

1. Identity and contact details of the Data Controller

2. Contact details of the Data Protection Officer (“DPO”)

3. Purpose and legal basis of processing

4. Recipients of personal data

5. Transfer of data to third countries

6. Data storage period

7. Rights of the interested party

1. Identity and contact details of the Data Controller

The Data Controller is VOLKSWAGEN GROUP ITALIA S.p.A., with registered office in 37137 - Verona, Viale G. R. Gumpert, 1, email: privacy@volkswagengroup.it, (hereafter “VGI”), authorised distributor of motor vehicles and related accessories and spare parts under the brands Volkswagen, Škoda, Audi, Seat and Volkswagen Commercial Vehicles.

2. Contact details of the Data Protection Officer (“DPO”)

The DPO appointed by VGI is the point of contact for interested parties, and can be contacted through the following channels:

- e-mail: dpo@volkswagengroup.it;

- post: Volkswagen Group Italia S.p.A., 37137 - Verona, Viale G. R. Gumpert, 1, ufficio RPD.

3. Purpose and legal basis of processing

Data is communicated to VGI by a third party and, in particular, by SKICAROSELLO CORVARA CONSORZIO Str. Col Alt, 40 - 39033 Corvara in Badia (BZ) – SKILINE di Alturos Destination GmbH- Lakeside B03 – 9020 Klangerfurt Austria, which has collected your data independently, as is the corresponding consent to the communication of such data to VGI for the purposes of direct and indirect marketing activities carried out by VGI (i.e., for purpose a) below).

The data processed is of common typology and concerns, in particular, contact and identification data. 

The personal data of the user will be processed for the following purposes:

a) direct and indirect marketing activities of VGI;

b) formalities required by law;

c) protection (assessment, exercise or defence) of a right of the Data Controller or third parties, in court or out of court. 

Please note that the direct (conducted by VGI) and indirect (conducted by VGI through appointed third parties) marketing activities specified in lett. A) has the purpose of collecting and using data limited to the purposes for which it is processed, to carry out studies, research, market statistics, send advertising and information materials, conduct direct sales or product placement activities or services, send commercial information, conduct commercial communications. 

The processing specified in lett. B) is necessary in order to comply with regulations and, in the event of failure to comply with regulatory obligations, legal sanctions will be incurred. The processing specified in lett. C) is based on legitimate interest regarding the protection of rights, recognised in GDPR Recital 47as a fundamental legitimate interest. The processing specified in lett. A) requires your express consent.

4. Recipients of personal data

The personal data you have provided for the purposes described above may be communicated:

1. to the companies of the Volkswagen Group Italia network;

2. to the following companies: VOLKSWAGEN AG., based in Wolfsburg and Hannover (Germany), ŠKODA AS., based in Mladà Boleslav (Czech Republic); Audi AG., based in Ingolstadt (Germany); SEAT S.A., based in Barcelona (Spain); 

3. to companies and professional operators who supply electronic data processing and consultancy services for software and information technology, and/or are responsible for the management of information services relating to the above, and/or communication services; 

4. to companies and professional organisations, used for the purposes of statistical survey services and/or market research and/or customer satisfaction surveys; 

5. to professional advertising, marketing and mailing agencies in Italy and to consultants and agencies involved in the organisation of events, exclusively in relation to their commercial initiatives related to the aforementioned automotive or financial sector;

6. to organisations and authorities tasked with protecting the rights of the Data Controller or of third parties; consultants and collaborators of the Data Controller, for the same protection. 

7. to consultants and professionals of the Data Controller for the purposes of conducting their economic and entrepreneurial activity, including compliance with applicable regulations.

For the persons specified in nos. 1) and from 3) to 7), only the category of recipients is indicated, as it is subject to frequent update and revisions. Interested parties may, therefore, request the updated list of recipients by contacting the Data Controller through the channels provided in art. 1 of this information.

5. Transfer of data to third countries

Under the data processing activities as described in this policy, the owner does not transfer data to third countries

6. Data storage period

Your personal data will be stored for the period of time strictly required to realise the purpose of collection, specifically:

- for the purposes indicated in letter a) (i.e., for direct and indirect marketing purposes) of art. 3, for 24 (twenty four) months from the moment of consent to the moment of processing;

- for the purposes indicated in letter b) (i.e. for the purpose of compliance with regulatory obligations) of art. 3, for the entire duration provided for by applicable regulations;

- for the purposes indicated in letter c) (or the protection of rights) of art. 3, for a period not exceeding ten years from the collection of your data, or alternative terms established by law pertaining to the prescription of rights.

8. Rights of the interested party

The user may, at any time, exercise the following rights.

a. Access to personal data: obtain confirmation of whether data concerning you are being processed and, in this case, access to the following information: the purposes, the categories of data, the recipients, the retention period, the right to lodge a complaint with a supervisory authority, the right to request rectification or cancellation or limitation of processing or opposition to the processing itself and the existence of an automated decision-making process;

b. Request for rectification or erasure of the same, or restriction of processing of data that concerns you; “restriction” refers to the identification of data stored with the intention of limiting its processing in the future;

c. Opposition to processing: To oppose, for reasons connected with your particular situation, to the processing of data for the performance of a task of public interest or for the pursuit of a legitimate interest of the Data Controller; 

d. Data portability: in the case of automated processing carried out on the basis of consent or in execution of a contract, to receive data concerning you in a structured format, commonly used and readable by automatic device; in particular, the data will be provided by the Data Controller in .xml format;

e. Revocation of consent, where requested;

f. Pursuant to GDPR art. 77, to lodge a complaint to the designated supervisory authority of your habitual residence, workplace or place of violation of your rights; in Italy, the designated authority is the Guarantor for the Protection of Personal Data, who can be contacted via the contact details on the website http://www.garanteprivacy.it;

The aforementioned rights may be exercised by sending a specific request to the Data Controller through the contact channels indicated in art. 1 of this privacy policy.

Requests relating to the exercise of your rights will be processed without undue delay and, in any case, within one month of the request; only in cases of particular complexity and in the number of requests, this deadline may be extended by a further 2 (two) months.