The Data Controller is VOLKSWAGEN GROUP ITALIA S.p.A., with registered office in 37137 - Verona, Viale G. R. Gumpert, 1, email: privacy@volkswagengroup.it, (hereinafter referred as to “VGI”), Authorized Dealer of vehicles and related accessories and spare parts distinguished by the Brands Volkswagen, Škoda, Audi, Seat and Volkswagen Commercial Vehicles.

The DPO nominated by VGI, who will be the contact reference point for the Data Subjects, can be contacted through the following contact details:
- e-mail: dpo@volkswagengroup.it;
- fax no.: +390458623154;
- mail: Volkswagen Group Italia S.p.A., 37137 - Verona, Viale G. R. Gumpert, 1, DPO Office.

User’s personal data will be processed for the following purposes:

a) provision of services requested by the user through the proper section of the relevant website;

b) direct and indirect and market researches;

c) profiling related to the automotive sector.

The processing referred to in a) is necessary to provide the service requested by the user, while the ones referred to in b) and c) require your consent which can be provided by flagging the relevant items.

It should be noted that the activity of direct marketing (carried out by VGI) and indirect marketing (carried out by VGI through third parties it appoints) aim at collecting and using relevant data only to the extent of what is required with respect to the purpose for which it has been processed, that means to conduct studies, researches, market statistics, to send advertising and informative material, to carry out those activities designed for the direct sale and placement of goods and services, to send commercial information and perform interactive commercial communications. The profiling activity, instead, is aimed at collecting information about commercial behaviours and habits in the automotive sector in order to enhance the offered services according to the needs of the customers who provide their explicit consent.

It should be noted that if the user does not provide an explicit consent to the processing of his/her data, it will not be possible to perform the above-mentioned marketing and profiling activities.

With reference to the specified purposes, your data may be communicated to:1) companies belonging to the Volkswagen Group Italia Network;
2) the following companies: VOLKSWAGEN AG., with registered office in Wolfsburg and Hannover (Germany), SKODA AS., with registered office in Mladà Boleslav (Czech Republic); Audi AG., with registered office in Ingolstadt (Germany); SEAT S.A., with registered office in Barcelona (Spain);
3) companies and professional operators providing data processing services and software and IT consultancy as well as information services management related to what mentioned before;
4) companies and professional bodies providing services to carried out statistics and/or market researches and/or surveys about the customer satisfaction;
5) professional advertising, marketing and mailing agencies in Italy, always with regard to commercial initiatives linked to the above mentioned automotive or financial sectors.For the subjects specified in 1) and from 3) to 5) only a single recipient category is indicated as it is subject to frequent updates and revisions.Therefore the Data Subjects may require an updated list of the recipients by contacting the Data Controller through the channels specified in Article 1 of this information notice.

The Data Controller may transfer the user’s data to the companies belonging to Volkswagen Group which have their registered offices in Countries outside the European Union according to the provisions set out by the relevant binding corporate rules pursuant to Article 47 of the GDPR (“BCR”) and in order to pursuit the purposes indicated thereof.The updated list of the BCRs signed between the companies belonging to Volkswagen Group is available at http://www.volkswagengroup.it/privacy.
Moreover, user’s data may be transferred to the third parties specified in the items from 3) to 5) of Article 4 of this information notice which have their registered offices in Countries not belonging to the European Union, anyway always in compliance with the provisions set out in Articles 45 and 46 of the GDPR with regard to the existence of an adequacy decision granted by the European Commission, i.e. based on adequate guarantees.The updated list of the recipients of the data in Countries not belonging to the European Union is available at http://www.volkswagengroup.it/privacy.

Data is retained for the period required to pursuit the specific processing purposes for which the users expressed his/her consent and specifically:for the purposes specified in a) of Article 3 for the period required to fulfil the contract obligations and, anyway, for a period not exceeding 10 years from the data collection for the fulfilment of legal obligations and not after the period of prescription of the rights established by law;for the purposes specified in b) (i.e. for the purposes related to direct and indirect marketing and market researches) of Article 3 for 24 (twenty-four) months from the consent to personal data processing;for the purposes specified in c) (i.e. for profiling purposes) of Article 3 for 12 (twelve) months from the consent to personal data processing.

At any time, the user may exercise the following rights.a. Access to personal data: he/she may obtain the confirmation that his/her data are being processed and, in this case, he/she may access the following information: purposes, data categories, recipients, retention period, the right to lodge a complaint to a supervisory authority, the right to request the rectification or deletion or blocking of the processing or to object to the processing of his/her data as well as to the existence of an automated search procedure;
b. Request for rectification and deletion of the data or blocking of his/her data processing; “blocking” shall mean the marking of stored personal data with the aim of limiting the processing in future;
c. Objection to data processing: right to object, on grounds relating to a particular situation of the data subject, to the processing of personal data with regard to the performance of a task carried out in the public interest or in the exercise of a legitimate interest of the Data controller;
d. Data portability: in case of automatic processing carried out according to the consent or in execution of a contract, you may ask to receive your data in a structured format, commonly used and readable by an automatic device; particularly, data shall be provided by the Data Controller in .xml format, or similar format;
e. Withdrawal of consent to the processing of personal data for both direct and indirect marketing, market researches and profiling; the exercise of this right shall not prejudice the lawfulness of processing carried out before the withdrawal;
f. Lodging of a complaint pursuant to Article 77 of the GDPR to the competent supervisory authority according to your usual residence, to your working place or to the place where your rights were infringed; in Italy the competent authority is the Italian Data Protection Authority (Garante per la protezione dei dati personali) that can be contacted by using the contact details indicated on the relevant website http://www.garanteprivacy.it.The aforementioned rights may be exercised by sending a proper request to the Data Controller through the channels specified in Article 1 of this information notice.
The requests related to the exercise of the rights of the user shall be processed without undue delay and, in any case, within a month from the receipt of the request; only in case of special complex situations or in case of a high number of requests, this period may be extended by a further period of 2 (two) months.

The provision of data by the user is compulsory as it is necessary to perform the service requested. Therefore, a possible refusal by the user to provide data may imply the a non-provision of the services to the extent that such data is required for those purposes.