Porsche Sales & Marketplace GmbH Splošni pravilnik o zasebnosti

Porsche Sales & Marketplace GmbH

Splošni pravilnik o zasebnosti

Infrastruktura digitalnih storitev Porsche/Porsche ID

Mi, družba Porsche Sales & Marketplace GmbH (v nadaljevanju „mi“ ali „PSM GmbH“), se veselimo vaše uporabe infrastrukture digitalnih storitev Porsche in drugih naših digitalnih ponudb (v nadaljevanju posamično ali skupno tudi „storitve“ in skupno „infrastruktura digitalnih storitev Porsche“). Varstvo vaših osebnih podatkov in njihovo zaupno obdelavo jemljemo zelo resno. Obdelava vaših osebnih podatkov se izvaja izključno v okviru zakonskih določil Zakona o varstvu osebnih podatkov, še posebej Splošne uredbe o varstvu podatkov (v nadaljevanju „SUVP“). S to izjavo o varstvu osebnih podatkov vas obveščamo o obdelavi osebnih podatkov in o vaših pravicah, ki jih imate kot oseba, katere osebni podatki se obdelujejo, v okviru uporabe digitalne servisne infrastrukture Porsche in naših storitev. Za informacije o posameznih storitvah glejte posebno izjavo o varstvu podatkov in po potrebi nadaljnja posebna obvestila o varstvu podatkov za posamezno storitev.

1. Odgovorna oseba in pooblaščena oseba za varstvo

podatkov

Če ni izrecno drugače navedeno v tej ali na njej temelječi posebni izjavi o varstvu podatkov in po potrebi v nadaljnjih posebnih obvestilih o varstvu podatkov za zadevno storitev, je oseba, odgovorna za obdelavo podatkov v smislu zakonov o varstvu podatkov:

Porsche Sales & Marketplace GmbH Xxxxxxxxxxxx 0

70435 Stuttgart

Nemčija

E-pošta: xxxxxxxxxxxxx@xx.xxxxxxx.xxx

V primeru vprašanj ali predlogov glede varstva osebnih podatkov

smo vam vedno na voljo.

Z našim pooblaščencem za varstvo osebnih podatkov lahko

stopite v stik prek naslednjih podatkov za stik:

Porsche Sales & Marketplace GmbH Beauftragter für Datenschutz Xxxxxxxxxxxx 0

70435 Stuttgart

Nemčija

Kontakt: xxxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxx@xxxxxxx.xx

V zvezi z nekaterimi postopki obdelave smo lahko skupni upravljavci z Dr. Ing. h.c. Porsche AG (Xxxxxxxxxxxx 0, 00000 Xxxxxxxxx, Xxxxxxx, e-pošta: xxxx@xxxxxxx.xx, v nadaljevanju „Porsche AG“), družbami v njegovi skupini in/ali tretjimi osebami („mi“ v tem primeru pomeni tudi te soodgovorne osebe). Glede takšnih skupnih procesov skupaj določamo cilje in sredstva za obdelavo osebnih podatkov. V takšnih primerih v dogovoru o skupnem upravljanju podatkov v skladu s 26. členom SUVP opredelimo tudi naloge in pristojnosti pri obdelavi osebnih podatkov ter določimo, kdo mora izpolnjevati katere obveznosti v zvezi z varstvom podatkov. Določimo predvsem načine zagotavljanja primerne stopnje varnosti in vaših pravic v zvezi z obdelavo osebnih podatkov, načine

skupnega izpolnjevanja obveznosti v zvezi z varstvom osebnih podatkov in načine nadzora morebitnih dogodkov, povezanih z varstvom osebnih podatkov. V to je vključeno tudi naše zagotavljanje izpolnjevanja obveznosti sporočanja in obveščanja. Če se boste obrnili na nas, se bomo v skladu z omenjenim dogovorom na podlagi 26. člena SUVP posvetovali ter odgovorili na vašo poizvedbo in poskrbeli za uveljavljanje vaših pravic v zvezi z obdelavo osebnih podatkov. Na katerih področjih in s katerimi podjetji obstaja skupna odgovornost, lahko preverite v posebni izjavi o varstvu podatkov in po potrebi v nadaljnjih posebnih obvestilih o varstvu podatkov zadevne storitve.

2. Predmet varstva podatkov

Predmet varstva podatkov je varstvo osebnih podatkov. To so vse informacije, ki se navezujejo na identificirano fizično osebo ali fizično osebo, ki jo je mogoče identificirati (t. i. osebo, katere osebni podatki se obdelujejo). To vključuje podatke, kot so ime, poštni naslov, e-poštni naslov ali telefonska številka, pa tudi druge podatke, ki nastanejo med uporabo naše infrastrukture za digitalne storitve Porsche, in podatke o uporabi vozila.

3. Nameni in pravne podlage za obdelavo podatkov

Ta splošna izjava o varstvu podatkov vam v nadaljevanju ponuja pregled namenov in pravnih podlag za obdelavo podatkov v okviru registracije, ustvarjanja in uporabe vašega uporabniškega računa Porsche ID ter zakupa in uporabe naših storitev na podlagi vašega uporabniškega računa Porsche ID. Osebne podatke v vsakem primeru obdelujemo v skladu z zakonskimi zahtevami, tudi če je v posameznih primerih ustrezna drugačna pravna podlag a, kot je navedena spodaj.

Vaše osebne podatke obdelujemo zlasti, če je to potrebno za izvajanje pogodbe, katere stranka ste, ali za izvajanje predpogodbenih ukrepov, ki se izvajajo na vašo zahtevo. Podatki se obdelujejo na podlagi točke b) 1. odstavka 6. člena SUVP. Namen obdelave vključuje omogočanje uporabe naših posebnih produktov in storitev v okviru ponudbe, kot je pojasnjeno v nadaljevanju.

Vaše osebne podatke obdelujemo tudi z namenom izpolnjevanja zakonskih obveznosti, ki veljajo za nas. Podatki se obdelujejo na podlagi točke c) 1. odstavka 6. člena SUVP. Obveznosti lahko nastanejo npr. na podlagi trgovinskega prava, davčne zakonodaje, zakonov o preprečevanju pranja denarja, finančne ali kazenske zakonodaje. Nameni obdelave pri tem izhajajo iz posamezne pravne obveznosti; obdelava se praviloma izvaja z namenom izpolnjevanja državnih nadzornih obveznosti in obveznosti glede obveščanja. Tudi v zvezi s tem boste v nadaljevanju našli podrobnejše informacije.

Vaše posredovanje osebnih podatkov je lahko zakonsko ali pogodbeno zahtevano pri uporabi storitev ali pa je potrebno za sklenitev pogodbe. Ločeno vas bomo obvestili o tem, ali ste dolžni posredovati osebne podatke in kakšne bi bile morebitne posledice, če tega ne bi storili (npr. izguba pravic ali naša navedba, da brez

posredovanja določenih informacij ne moremo zagotoviti zahtevane

storitve).

4. Uporabniški račun Porsche ID

Registracija in vzpostavitev uporabniškega računa Porsche ID na Registracija in vzpostavitev uporabniškega računa Porsche ID na portalu Moj Porsche sta potrebni za polno uporabo infrastrukture digitalnih storitev Porsche in storitev, ki so na voljo v okviru te infrastrukture. Po uspešno opravljeni registraciji in ustvarjenem uporabniškem računu Porsche ID boste prejeli tudi svoj Porsche ID (uporabniško ime uporabniškega računa Porsche ID), s katerim se lahko prijavite na vseh prijavnih mestih Porsche ID v povezavi z vašim geslom ali kodo QR. Pri registraciji ter ustvarjanju in uporabi uporabniškega računa Porsche ID se osebni podatki obdelujejo in po potrebi posredujejo tretjim osebam, kot je opisano spodaj, da lahko izpolnimo svoje pogodbene obveznosti v tem okviru. Vse v tem razdelku opisane postopke obdelave – če ni drugače navedeno

– izvajamo za namene izpolnjevanja pogodbe, ki ste jo sklenili z

nami, v skladu s točko b) 1. odstavka 6. člena SUVP.

4.1 Postopek registracije in ustvarjanje uporabniškega računa Porsche ID

Registracijo in ustvarjanje uporabniškega računa Porsche ID lahko po želji izvedete na dva načina:

4.1.1 Povabilo s strani pooblaščenih trgovcev

Če želite, bo vaš pooblaščeni prodajalec osebne podatke, ki ste mu jih posredovali, za vas vnesel v naše sisteme prek svojega dostopa. Nato na primer po e-pošti prejmete povezavo, prek katere morate potrditi registracijo in ustvarjanje uporabniškega računa Porsche ID. Upoštevajte, da so pooblaščeni trgovci neodvisna podjetja, na katera nimamo vpliva. Prek drugega kanala poteka dodatno preverjanje, na primer prek kode, ki jo prejmete v sporočilu SMS in jo vnesete med postopkom registracije in ustvarjanja uporabniškega računa Porsche ID.

4.1.2 Samostojna registracija

Če registracije in ustvarjanja uporabniškega računa Porsche ID ne opravite prek pogodbenega trgovca, ju lahko opravite sami in samostojno vnesete svoje osebne podatke. V izbranih državah lahko poleg tega dodate vozilo in uporabljate druge digitalne storitve, za katere je potrebno lastništvo vozila. V ta namen morate poleg tega po vnosu identifikacijske številke vozila naložiti kopijo identifikacijskega dokumenta in dokazila o lastništvu ter – če niste lastnik vozila – pooblastilo lastnika vozila. Ti dokumenti bodo na osnovi naših kriterijev preverjanja posredovani podpori Porsche Connect, v državah, katerih uradnega jezika podpora Porsche Connect ne podpira, pa bodo neposredno posredovani izbranemu trgovcu in lokalno preverjeni. Kot dokaz za uspešno preverjanje shranjujemo tudi imena, datume rojstva, kraje rojstva, naslove in datume veljavnosti dokumentov, ki so navedeni na identifikacijskih dokumentih, ter identifikacijske številke vozila, imena lastnikov in naslove, ki so navedeni v dokazilih o lastništvu. Po zaključenem preverjanju bomo kopije dokumentov izbrisali. Druga možnost je, da uporabite postopek video identifikacije za preverjanje s strani naše podpore Porsche Connect. Če dodate vozilo in je tako v okviru uporabniškega računa Porsche ID z vami povezano konkretno vozilo, se vzpostavi tako imenovano razmerje z vozilom (v nadaljevanju „razmerje z vozilom“). Po uspešnem prever janju prejmete na primer po e-pošti povezavo, prek katere morate potrditi registracijo in ustvarjanje uporabniškega računa Porsche ID. Prek drugega kanala poteka dodatno preverjanje, na primer prek kode, ki jo prejmete v sporočilu SMS in jo vnesete med postopkom registracije in ustvarjanja uporabniškega računa Porsche ID.

Pri samostojni prijavi morate slike naložiti s svoje končne naprave.

Zato morate tem funkcijam ali storitvam dovoliti dostop do svoje

kamere ali knjižnice slik v napravi. Dovoljenje se poda prostovoljno. Če želite kljub temu uporabljati samostojno registracijo, morate omogočiti ustrezno dovoljenje, sicer samostojne registracije ne morete uporabljati. Dovoljenje je aktivno tako dolgo, dokler ga ne ponastavite v svoji napravi in/ali internetnem brskalniku z deaktivacijo posamezne nastavitve.

Če je pooblaščeni prodajalec na vašo željo vaše vozilo že povezal s Porsche ID, pri čemer je uporabil vaš e-poštni naslov in številko mobilnega telefona, je možno poenostavljeno ustvarjanje vozila prek naše spletne strani ali aplikacije My Porsche. V ta namen se primerjajo samo številka VIN, ki jo morate vnesti, ter kontaktni podatki, ki so že shranjeni pri nas, potrditveno kodo po prejmete v sporočilu SMS.

(a) Obvezni podatki pri registraciji in ustvarjanju

uporabniškega računa Porsche ID

Pri registraciji in ustvarjanju uporabniškega računa Porsche ID morate – v primeru samostojne registracije – vnesti svoj e-poštni naslov, geslo, svoje ime in dodatke k imenu, kontaktne podatke in naslov, številko mobilnega telefona, e-poštni naslov in po potrebi jezik, v katerem želite komunicirati z nami, ali – v primeru registracije in ustvarjanja uporabniškega računa Porsche ID s strani pooblaščenega prodajalca – potrditi te osebne podatke kot del postopka registracije in ustvarjanja uporabniškega računa Porsche ID. Ti osebni podatki so potrebni za vzpostavitev in upravljanje vašega uporabniškega računa Porsche ID, da lahko uporabljate celotno paleto naših storitev v okviru infrastrukture digitalnih storitev Porsche. V izbranih državah lahko našo ponudbo uporabljate tudi kot zainteresirana stranka. V tem primeru morate navesti le svoje ime, e-poštni naslov in geslo. Nenazadnje te in morebitne druge osebne podatke potrebujemo tudi zato, da se lahko odzovemo na zahteve, vprašanja in kritike. Shranjujemo tudi čas vaše zadnje prijave. Ko se registrirate in ustvarite uporabniški račun Porsche ID, preverimo vaše ime in naslov s preverjanjem verodostojnosti.

(b) Prostovoljno podani podatki pri registraciji in ustvarjanju uporabniškega računa Porsche ID

Ob registraciji in ustvarjanju uporabniškega računa Porsche ID lahko prostovoljno vnesete tudi dodatne podatke, kot so dodatni podatki o imenu (npr. akademski naziv itd.), kontaktni podatki podjetja, datum rojstva, dodatne telefonske številke, podatki o kreditni kartici (te podatke hrani samo ponudnik plačilnih storitev) ter registrska številka vašega vozila in osebno ime vozila. Poleg tega lahko posredujete informacije o svojih interesih, željah in kanalih za stike, ki jih želite uporabljati. Upoštevajte, da ti podatki niso obvezni za prijavo in ustvarjanje uporabniškega računa Porsche ID in da se sami odločite, ali nam želite te osebne podatke posredovati.

4.1.3 Vključitev Porsche ID v ponudbe tretjih oseb

Sodelujočim partnerjem lahko omogočimo, da ponudijo postopek registracije in prijave, ki vključuje Porsche ID. To pomeni, da si vam ni treba zapomniti novih podatkov za prijavo v ponudbo tretje osebe. Če se v okviru ponudbe tretjega ponudnika odločite za uporabo postopka registracije in prijave, ki vključuje Porsche ID, boste preusmerjeni na prijavni/registracijski zaslon PSM GmbH za Porsche ID. Tu se prijavite s svojim uporabniškim imenom in geslom za Porsche ID. Našemu partnerju za sodelovanje bomo poslali sporočilo, da ste se uspešno prijavili. V postopku registracije in prijave nam lahko potrdite, da lahko sodelujoči partner dostopa do profilnih podatkov vašega uporabniškega računa Porsche ID. To po potrebi velja tudi za tam shranjene podatke o plačilih. To pomeni, da vam ni treba ponovno vnašati ali posodabljati podatkov o profilu in po potrebi podatkov o plačilu (npr. če se spremeni vaš naslov), da bi ustvarili svoj uporabniški profil za ponudbo tretjega ponudnika. Spremembe podatkov profila v uporabniškem računu ponudbe

tretjega ponudnika pa se nato ustrezno sinhronizirajo tudi v vašem uporabniškem računu za Porsche ID.

Obdelava podatkov v okviru postopka registracije in prijave z

vključitvijo Porsche ID se izvaja na podlagi točk b) in f) 1. odstavka

6. člena SUVP z namenom registracije za ponudbo tretjega ponudnika oz. za identifikacijo pri prijavi. Poleg izvedbe dejanja ali postopka, ki ga želite, je v našem interesu, da je postopek registracije in prijave učinkovit in priročen. Pri tem smo soodgovorni skupaj s svojim sodelujočim partnerjem in zato v zvezi s tem procesom skupaj določamo cilje in sredstva za obdelavo osebnih podatkov. V dogovoru o skupni odgovornosti v skladu s 26. členom SUVP smo opredelili, kako so določene naloge in pristojnosti pri obdelavi osebnih podatkov ter kdo mora izpolnjevati katere obveznosti v zvezi z varstvom podatkov. Določili smo predvsem načine zagotavljanja primerne stopnje varnosti in vaših pravic v zvezi z obdelavo osebnih podatkov, načine skupnega izpolnjevanja obveznosti v zvezi z varstvom osebnih podatkov in načine nadzora morebitnih dogodkov, povezanih z varstvom osebnih podatkov. V to je vključeno tudi naše zagotavljanje izpolnjevanja obveznosti sporočanja in obveščanja. Če se boste obrnili na nas, se bomo v skladu z omenjenim dogovorom na podlagi 26. člena SUVP posvetovali ter odgovorili na vašo poizvedbo in poskrbeli za uveljavljanje vaših pravic v zvezi z obdelavo osebnih podatkov.

4.2 Infrastruktura digitalnih storitev Porsche: Obdelava podatkov po registraciji in vzpostavitvi uporabniškega računa Porsche ID

Če ste se registrirali in ustvarili uporabniški račun Porsche ID, bomo na podlagi točke b) 1. odstavka 6. člena SUVP izmenjali osnovne podatke o vašem uporabniškem računu Porsche ID in vaših vozilih s servisnimi trgovci Porsche, da bi izpolnili pogodbo z vami in vam po potrebi zagotovili storitve tudi prek naše trgovske organizacije. Pri tem poleg identifikacijske številke vozila posredujemo tudi vaše uporabniško ime (Porsche ID), tehnično ali prodajno razpoložljivost storitev in ponudb izdelkov za vaš uporabniški račun Porsche ID ali vozilo ter pomembne dogodke v zvezi z ustvarjanjem, spreminjanjem ali brisanjem vašega uporabniškega računa Porsche ID, povezovanjem vozil, izbiro trgovcev ter aktiviranjem ali deaktiviranjem storitev.

Če ste izbrali pooblaščenega trgovca in podali privolitev, se osebni podatki, shranjeni v vašem uporabniškem računu Porsche ID, zlasti kontaktni podatki, podatki o podpori, pogodbah in storitvah ter podatki o vaših interesih, uporabljenih vozilih in storitvah, prav tako izmenjajo s pooblaščenim trgovcem in po potrebi sinhronizirajo z osebnimi podatki, ki jih o vas hrani trgovec. Če v prihodnosti ne želite več izmenjave podatkov, lahko to ustrezno spremenite v uporabniških nastavitvah svojega uporabniškega računa Porsche ID. Od tega trenutka naprej se zgoraj navedeni osebni podatki ne bodo več izmenjevali s pooblaščenim trgovcem. Naša pravna podlaga za obdelavo osebnih podatkov v zvezi s tem je vaša privolitev v skladu s točko a) 1. odstavka 6. člena SUVP.

Če čakate na dostavo svojega vozila, vam bomo podatke o statusu dostave posredovali v vašem uporabniškem računu Porsche ID. V ta namen VIN vašega vozila in vaš Porsche ID izmenjamo s Porsche AG. Naša pravna podlaga za obdelavo vaših osebnih podatkov v zvezi s tem je izpolnjevanje z vami sklenjene pogodbe v skladu s točko b) 1. odstavka 6. člena GDPR.

4.3 Brisanje uporabniškega računa Porsche ID

Če izbrišete svoj uporabniški račun Porsche ID, se s prekinitvijo pogodbenega razmerja, ampak ne prej kot s prenehanjem veljavnosti vaših obstoječih licenc za storitve, izbrišejo tudi vaši osebni podatki, shranjeni v uporabniškem računu Porsche ID. Če je treba podatke hraniti iz zakonskih razlogov, jih bomo blokirali (t. i. omejitev obdelave). V tem primeru osebni podatki ne bodo več na voljo za nadaljnjo uporabo, še posebej za uporabo storitev.

Delovanje storitev je posledično lahko omejeno ali se prekine. Tudi polni obseg uporabe infrastrukture za digitalne storitve Porsche vam ne bo več na voljo. Če drugi upravljavci znotraj skupine Porsche in njene prodajne organizacije osebne podatke obdelujejo na lastno odgovornost, obdelava teh osebnih podatkov poteka nemoteno. Če so bili osebni podatki na podlagi vaše privolitve v skladu s točko a) 1. odstavka 6. člena SUVP posredovani trgovcu, ki ste ga izbrali, bomo trgovca obvestili o izbrisu vašega uporabniškega računa za Porsche ID.

5. Centralne storitve

5.1 Zakup in aktivacija storitev, obravnava podatkov o

plačilu

Zakupite lahko posamezne ali več storitev My Porsche in storitev Porsche Connect ter aktivirate servisne licence. Ko izberete ustrezno storitev ali paket storitev, si lahko v podrobnostih ponudbe ogledate tudi ustrezne informacije o obdelavi osebnih podatkov v okviru zadevnih storitev. Za izvedbo in izpolnitev zakupa ter z njim povezanega pogodbenega razmerja poleg ustreznih informacij o zakupu obdelujemo tudi vaše osebne podatke, zbrane med registracijo in ustvarjanjem uporabniškega računa Porsche ID. Naslov za pošiljanje računov lahko spremenite pred zaključkom postopka zakupa. V tem primeru podatke o naslovu, ki ste nam jih posredovali, uporabljamo za izdajanje in obdelavo računov.

Za obdelavo plačil za naše plačljive storitve in produkte v okviru storitev My Porsche, Porsche Connect in spletne tržnice sodelujemo s ponudnikom plačilnih storitev. V ta namen skupaj s ponudnikom plačilnih storitev, s katerim sodelujemo, obdelujemo podatke o vaših kreditnih karticah in podatke o trenutnem plačilu. Upravljanje podatkov o vaši kreditni kartici in obdelava plačil se izvajata prek sistemov ponudnika plačilnih storitev, s katerim sodelujemo. Ko vnesete podatke o kreditni kartici, poteka vnos neposredno prek vnosnega polja ponudnika plačilnih storitev, ki te podatke samostojno kodira, shrani in uporabi za vaša plačila. Družba Porsche/mi kodirane podatke nato posredujemo ponudniku plačilnih storitev, kjer se shranijo in uporabijo za vaše plačilo. Naša pravna podlaga za obdelavo osebnih podatkov za obdelavo plačil je izpolnjevanje pogodbe v skladu s točko b) 1. odstavka 6. člena uredbe GDPR.

Ponudnik plačilnih storitev, s katerim sodelujemo, obdeluje podatke o strankah in podatke za stik (kot so ime, naslov, e-poštni naslov, številka stranke Porsche Connect, po potrebi družba in povezana podjetja) ter identifikacijsko številko vozila, ki je navedena v dokazilih o lastništvu, izključno za namen upravljanja z dolžniki (vključno s pregledi skladnosti, če so ti zakonsko potrebni) in za izvajanje nadzora nad kreditiranjem. Pravna podlaga za obdelavo navedenih osebnih podatkov za zgoraj navedene namene je izpolnjevanje naše zakonske obveznosti v skladu s točko c) 1. odstavka 6. člena SUVP oz. naš zakoniti interes za ustrezno upravljanje z dolžniki in za nadzor nad kreditiranjem v skladu s točko

f) 1. odstavka 6. člena SUVP, če za nas ne veljajo zakonske

obveznosti.

Pri nakupih v spletnih trgovinah naš ponudnik plačilnih storitev na podlagi podatkov kupca (npr. ime in identifikacijski podatki, zgodovina prodaje itd.) ugotavlja tveganje goljufij. Preveri tudi podatke o transakciji in preišče, ali vsebujejo kaj neobičajnega (npr. pogostost menjave gesla, naslov za dostavo drugačen kot naslov računa). Pravna podlaga za obdelavo omenjenih osebnih podatkov v navedene namene je izpolnjevanje pogodbe v skladu s točko b) 1. odstavka 6. člena SUVP oz. naš zakoniti interes za preprečevanje goljufij v skladu s točko f) 1. odstavka 6. člena SUVP.

Po opravljenem zakupu lahko aktivirate storitve. Pri tem se pooblastilo shrani za uporabo na strani sistema in ustrezno posodobi seznam razpoložljivih storitev.

Za uporabo nekaterih storitev (na primer ponudbe polnilnih postaj) se v številnih državah, v katerih je ponudba na voljo, pri nakupu izdelka po pošti pošlje prilagojena kartica, ki vsebuje čipe RFID (t. i. kartica Porsche ID, Porsche Charging Card). Na kartici je shranjena identifikacijska številka, na podlagi katere lahko kartico dodelite svojemu uporabniškemu računu Porsche ID. Na kartici razen identifikacijske številke niso digitalno shranjeni nobeni osebni podatki, še posebej ne podatki o vašem imenu ali naslovu. Če kartico izgubite, jo lahko blokirate v uporabniškem računu Porsche ID.

Kartico Porsche ID Card lahko po dostavi takoj uporabite v povezavi s podprto infrastrukturo (npr. javne polnilne postaje).

Če ni drugače navedeno, vse v tem razdelku opisane postopke obdelave za namene izpolnjevanja pogodbe, ki ste jo sklenili z nami, izvajamo v skladu s točko b) 1. odstavka 6. člena SUVP.

5.2 Uporaba storitev My Porsche in Porsche Connect

Glede na storitev lahko zakupljene storitve My Porsche in storitve Porsche Connect uporabljate v vozilu (če so za vaše vozilo na voljo) prek radijske omrežne povezave ali prek drugih končnih naprav v My Porsche ali aplikaciji Porsche Connect in po potrebi tudi z več ali vseh dostopnih točk. V ta namen se vaše vozilo ali ustrezna končna naprava poveže s Porschejevo infrastrukturo digitalnih storitev.

Če storitve, zakupljene prek rešitve My Porsche ali Porsche Connect Store, uporabljate v svojem vozilu ali drugih končnih napravah, bomo vaše osebne podatke obdelovali za namene zagotavljanja uporabe storitev, za namene podpore in za druge posamezno opredeljene namene. Vaše osebne podatke obdelujemo le v obsegu, ki je potreben za omogočanje uporabe posameznih storitev My Porsche ali storitve Porsche Connect, razen če je navedeno drugače.

Pri uporabi posameznih storitev My Porsche ali storitev Porsche Connect se lahko obdelujejo na primer naslednje kategorije osebnih podatkov, odvisno od konkretne funkcionalnosti izbrane storitve:

- identifikacijski podatki, kot so identifikacijska številka vozila, vaš Porsche ID ter ID naprave in sistema vaših končnih naprav in mobilnih modulov, ki so potrebni za identifikacijo vaše osebe, vaše končne naprave ali vašega vozila zaradi vzpostavljanja povezav, uporabe storitev ali dostopa do vsebin,

- informacije o avtorizaciji, ki vključujejo podatek, da sta vozilo ali zadevna terminalska naprava aktivirana za zadevno storitev Porsche Connect in ju je mogoče povezati z vašimi osebnimi podatki, ki ste jih vnesli pri

registraciji in ustvarjanju uporabniškega računa Porsche

ID,

- prijavni podatki, ki so potrebni, če želite v vozilu ali dodatnih končnih napravah uporabljati storitve drugih ponudnikov, ki zahtevajo prijavo,

- komunikacijske informacije, potrebne za vzpostavitev povezave med vašim vozilom in/ali drugimi končnimi napravami in našimi strežniki ali strežniki tretjih ponudnikov vsebin za storitve Porsche Connect,

- informacije o lokaciji in premikanju, na primer podatke GPS ali podatke o hitrosti, ki so potrebni za uporabo z lokacijo povezanih vsebin v vozilu,

- glasovni podatki, ki omogočajo glasovno upravljanje in glasovni vnos v nekaterih storitvah Porsche Connect. Glasovni podatki se nam posredujejo kot posnetek za pretvorbo v besedilo iz vozila ali končne naprave.

Besedilo, ki ga ustvari ponudnik storitev, se nato

prenese nazaj v vozilo, mi pa posnetek izbrišemo,

- kontaktni podatki, ki se uporabljajo v komunikacijskih storitvah, na primer za pošiljanje e-pošte ali sporočil SMS,

- podatki o obračunavanju, na primer dokazila o posamičnih priključitvah za postopke polnjenja. Te podatke po potrebi združimo z vašimi podatki o naslovu in plačilu za namene individualnega zaračunavanja,

- slikovni/videopodatki vašega vozila oz. njegovih

komponent,

- druge vsebine, ki jih je treba deliti z nami ali ponudniki storitev, da vam lahko zagotovimo storitev.

Podrobne informacije o tem, kateri osebni podatki se obdelujejo v okviru katere storitve, so na voljo v opisih posameznih storitev na spletni strani xxxxx://xxxxxxx-xxxxx.xxxxxxx.xxx/xx/xx/.

Predvsem v okviru obiskov servisne delavnice in s tem povezane

uporabe spletne razširitve naročila velja naslednje:

Spletna razširitev naročila je storitev, ki našim strankam omogoča, da lahko kadar koli in kjer koli spremljajo postopek prevzema vozila med obiskom servisne delavnice prek posnetih in osebnih videoposnetkov servisnega svetovalca in/ali tehnika. Poleg tega lahko stranka odobri/dovoli dodatna popravila/razširitve popravil neposredno prek portala My Porsche in/ali aplikacije My Porsche.

Če ni drugače navedeno tukaj, v eni od posebnih izjav o zasebnosti ali po potrebi v nadaljnjih posebnih obvestilih o zasebnosti zadevne storitve, vaše osebne podatke v vsakem primeru obdelujemo v skladu s točko b) 1. odstavka 6. člena SUVP, da bi vam zagotovili storitve v tem okviru in izvedli s tem povezano pogodbeno razmerje.

5.3 Uporaba storitev zunanjega ponudnika

Če uporabljate storitve tretjih ponudnikov, s katerimi imate ločeno pogodbeno razmerje, bodo vsebine teh storitev po potrebi prikazane v vašem vozilu ali končni napravi, izmenjava informacij pa bo potekala med vašim vozilom ali končno napravo in ponudnikom storitev.

Nimamo vpliva na obdelavo podatkov s strani tega zunanjega ponudnika in tudi ne na kraj obdelave podatkov. Zato se pri ustreznem zunanjem ponudniku pozanimajte o načinu, obsegu in namenu obdelave osebnih podatkov v povezavi z ustrezno spletno storitvijo in njegovih ločenih navedbah o varstvu podatkov.

Potrebne osebne podatke posredujemo zunanjemu ponudniku na podlagi točke b) 1. odstavka 6. člena SUVP zaradi izpolnjevanja pogodbe, sklenjene med vami in nami.

5.4 Center za stik z družbo Porsche

Če želite z nami stopiti v stik, so vam na voljo različni komunikacijski kanali, še posebej dežurna telefonska linija servisa za stik prek telefona, na nas pa se lahko obrnete tudi prek e-pošte oz. klepeta v živo. Če stopite v stik z našim centrom za stik, bomo vaše osebne podatke obdelali samo, če je to potrebno za zagotavljanje storitve centra za stik in obdelavo vaše zahteve. Morda vas bomo prosili, da navedete osebne podatke, ki so potrebni za pripravo na vzpostavitev stika in njegovo izvedbo za obdelavo posamezne zahteve. Brez teh podatkov vaše poizvedbe ne bomo mogli obdelati oziroma ne bomo mogli izpolniti vaše zahteve. Nameni obdelave nastanejo konkretno na podlagi vaše poizvedbe in storitev, ki ste jih zakupili. Obsegajo še posebej

- obdelavo poizvedb potencialnih kupcev, strank in trgovcev v smislu izdelkov in storitev družbe Porsche Sales & Marketplace GmbH. Sem sodijo npr.

- zagotavljanje tehnične podpore,

- podpora pri nakupu storitev ali izdelkov,

- odgovori na splošna vprašanja o družbi Sales &

Marketplace,

- tehnična podpora za stranke in trgovce, še posebej z zagotavljanjem dežurne telefonske linije servisa, ki omogoča, da z nami stopite v stik prek telefona.

Podatki se obdelujejo v skladu s točko b) 1. odstavka 6. člena SUVP za namene izpolnjevanja pogodbe z vami ali za izvajanje predpogodbenih ukrepov.

Vaše osebne podatke obdelujemo tudi z namenom izpolnjevanja obveznosti, ki veljajo za nas. Obveznosti lahko nastanejo npr. na podlagi trgovinskega prava, davčne zakonodaje, telekomunikacijskega prava, zakona o preprečevanju pranja denarja, finančnega prava ali kazenskega prava. Nameni obdelave pri tem nastanejo na podlagi posamezne zakonske obveznosti; obdelava se praviloma izvaja z namenom izpolnjevanja državnih nadzornih obveznosti in obveznosti glede obveščanja.

Podatki se obdelujejo v skladu s točkama c) oz. e) 1. odstavka 6. člena SUVP. Če podatke zbiramo na podlagi zakonske obveznosti ali v javnem interesu, morate pri tem navesti osebne podatke, ki so potrebni za izpolnjevanje zakonske obveznosti. Če ne zagotovite teh podatkov, vaše poizvedbe morda ne bomo mogli obdelati oziroma teh obveznosti ne bomo mogli izpolniti.

Če uporabite storitev podpore v centru Porsche, bo tudi trgovec lahko priklical te podatke. Za omogočanje te storitve bomo omenjene podatke posredovali tudi zadevnemu trgovcu. V tem primeru bomo vaše osebne podatke obdelovali v skladu s točko f)

1. odstavka 6. člena SUVP na podlagi našega zakonitega interesa za omogočanje storitev za stranke prek točke za stike, ki ste jo izbrali, oz. prek izbranega trgovca.

6. Varovanje zakonitih interesov

Vaše osebne podatke obdelujemo tudi za zaščito zakonitih interesov nas ali tretjih oseb, razen če vaši interesi, ki zahtevajo zaščito vaših osebnih podatkov, prevladajo nad temi interesi. Podatki se obdelujejo na podlagi točke f) 1. odstavka 6. člena SUVP. Obdelava zaradi zakonitega interesa se izvaja za naslednje namene ali za zaščito naslednjih interesov:

- nadaljnji razvoj izdelkov, storitev in ponudb za podporo strankam ter drugi ukrepi za upravljanje poslovnih dogodkov in postopkov,

- izboljšanje kakovosti izdelkov, odpravljanje napak in motenj, med drugim z analizo podatkov o vozilu in analizo povratnih informacij strank,

- obdelava podatkov v osrednji platformi za iskanje novih strank in skrb za obstoječe stranke ter v sistemih pred prodajo po njej za namene zvestobe strank in prodaje,

- reševanje primerov garancije in kulance, obdelava nepogodbenih poizvedb interesentov in strank ter njihovih zahtev,

- analiza potreb in segmentacija strank, npr. izračun in

ocena naklonjenosti, preferenc in potencialov strank,

- upravljanje tveganja in usklajevanje umikov izdelkov,

- ocenjevanje kreditne sposobnosti z izmenjavo podatkov s kreditnimi agencijami (npr. SCHUFA),

- Zagotavljanje zakonsko skladnih ukrepov,

preprečevanje kršitev zakonov in zaščita pred njimi (zlasti kaznivih dejanj), uveljavljanje pravnih zahtevkov in obramba pred njimi, notranji in zunanji ukrepi za zagotavljanje skladnosti,

- zagotavljanje razpoložljivosti, delovanja in varnosti tehničnih sistemov ter upravljanje tehničnih podatkov.

Ko pošiljamo e-poštna sporočila za podporo strankam in potencialnim strankam, lahko uporabljamo standardne tržne tehnologije, kot so piksli za sledenje ali povezave s klikom. Tako

lahko analiziramo, katera ali koliko e-poštnih sporočil je bilo dostavljenih in/ali zavrnjenih in/ali odprtih. Slednje se izvaja zlasti s piksli za sledenje. Merjenje stopnje odpiranja naših e-poštnih sporočil s piksli za sledenje ni v celoti mogoče, če ste na primer onemogočili prikaz slik v svojem programu za e-pošto. V tem primeru e-poštno sporočilo ne bo prikazano v celoti. Vendar pa lahko še vedno spremljamo, ali je bilo e-poštno sporočilo odprto, če kliknete na besedilne ali grafične povezave v e-poštnem sporočilu. Z uporabo povezav s klikom lahko analiziramo, katere povezave so kliknjene v naših e-poštnih sporočilih, in sklepamo, kakšno je zanimanje za določene teme. Ko kliknete ustrezno povezavo, boste pred priklicem ciljne strani vodeni prek našega ločenega strežnika za analizo. Na podlagi rezultatov analize lahko e-poštna sporočila prilagodimo, da so ustreznejša, jih pošljemo bolj ciljno usmerjeno ali pa njihovo pošiljanje ustavimo. Če ne želite, da se ti podatki zbirajo in spremljajo, ne klikajte na besedilne ali grafične povezave v e-poštnih sporočilih.

7. Privolitev

Vaše osebne podatke obdelujemo na podlagi ustrezne privolitve. Podatki se obdelujejo na podlagi točke a) 1. odstavka 6. člena SUVP. Če nam podate privolitev, je posamezna privolitev vedno povezana z določenim namenom; nameni vedno izhajajo iz vsebine v točno določeni izjavi o privolitvi. Predloženo privolitev lahko kadar koli prekličete, pri tem pa zakonitost obdelave na podlagi privolitve ostane nedotaknjena vse do preklica privolitve.

Če ste dali ustrezno privolitev, lahko podjetja, navedena v izjavi o privolitvi, uporabljajo podatke na podlagi te privolitve, npr. za individualno podporo strankam in potencialnim strankam, ter vas v te namene kontaktirajo prek komunikacijskih kanalov, ki ste jih izbrali. Vaši podatki se pri tem uporabljajo za zagotavljanje navdušujoče izkušnje z blagovno znamko Porsche in skrbjo za stranke ter za čim bolj osebno in ustrezno komunikacijo in interakcijo z vami. Kateri od vaših podatkov se uporabljajo za individualno podporo strankam in potencialnim kupcem, je odvisno zlasti od tega, kateri podatki so bili zbrani v okviru uporabe storitev in katere podatke ste posredovali v okviru storitev (npr. vaši osebni interesi).

8. Sprememba namena

Kadar vaše osebne podatke po privolitvi ali obvezni pravni podlagi obdelujemo za drug namen od tistega, za katerega so bili zbrani, bomo v skladu s 4. odstavkom 6. člena SUVP upoštevali združljivost prvotnega namena in namena, za katerega si prizadevamo zdaj, naravo osebnih podatkov, možne posledice nadaljnje obdelave za vas in zaščitne ukrepe za varstvo osebnih podatkov.

9. Profiliranje

V skladu z 22. členom SUVP za pripravo, sklepanje in izvajanje poslovnih odnosov ne uporabljamo avtomatiziranega sprejemanja odločitev. Če se profiliranje izvaja, se izvaja samo za namene, navedene v splošni izjavi o varstvu podatkov, posebnih izjavah o varstvu podatkov in po potrebi dodatnih posebnih obvestilih o varstvu podatkov zadevne storitve, ter na podlagi navedenih pravnih podlag.

10. Dovoljenja za dostop v končni napravi

Nekatere funkcije storitev zahtevajo odobritev dovoljenja za dostop do vaše končne naprave (npr. dostop do podatkov o lokaciji). Dovoljenja se podajo prostovoljno. Če želite kljub temu uporabljati izbrane funkcije, morate omogočiti ustrezna dovoljenja, sicer teh funkcij ne morete uporabljati. Dovoljenja ostanejo aktivna tako dolgo, dokler v svoji končni napravi ne deaktivirate ustrezne nastavitve in s tem prekličete dovoljenj. Na katerih področjih se izvaja dostop do končne naprave, lahko preverite v posebni izjavi o

varstvu podatkov in po potrebi v nadaljnjih posebnih obvestilih o varstvu podatkov zadevne storitve.

11. Piškotki in primerljive tehnologije

Če v okviru storitev uporabljamo piškotke in primerljive tehnologije, lahko ustrezna pojasnila najdete v posebni izjavi o varstvu podatkov in nadaljnjih posebnih informacijah o varstvu podatkov za posamezno storitev.

12. Viri in kategorije podatkov v sklopu zbiranja podatkov prek zunanjih ponudnikov

Obdelujemo tudi osebne podatke, ki jih prejmemo od tretjih oseb ali iz javno dostopnih virov. V nadaljevanju je pregled ustreznih virov in kategorij podatkov, pridobljenih iz teh virov.

- Družba Porsche AG in družbe v njeni skupini, prodajalci Porsche in servisne službe: npr. informacije o izdelkih, ki jih uporabljate, in vaših interesih;

- sodelujoči partnerji in ponudniki storitev: npr. podatki o

kreditni sposobnosti iz kreditnih agencij.

Za podrobnosti o zbiranju podatkov prek zunanjih ponudnikov glejte posebne izjave o varstvu podatkov in po potrebi nadaljnja posebna obvestila o varstvu podatkov za posamezno storitev.

13. Prejemniki osebnih podatkov

Znotraj naše družbe imajo do osebnih podatkov dostop le tiste osebe, ki te podatke potrebujejo za zgoraj navedene namene. Vaše osebne podatke posredujemo zunanjim prejemnikom le, če nam to dovoljuje zakon ali če imamo vašo privolitev. V nadaljevanju najdete pregled ustreznih prejemnikov:

- Obdelovalci: družba Porsche AG in družbe v njeni skupini ali zunanji ponudniki storitev, na primer na področju tehnične infrastrukture in vzdrževanja, ki so skrbno izbrani in preverjeni. Obdelovalci lahko podatke uporabljajo le v skladu z našimi navodili.

- Uradni organi: uradi in državne ustanove, npr. davčni uradi, državna tožilstva ali sodišča, ki jim moramo osebne podatke posredovati zaradi izpolnjevanja zakonskih obveznosti ali zaradi varovanja zakonitih interesov.

- Zasebni subjekti: družba Porsche AG in družbe v njeni skupini, prodajna podjetja Porsche, trgovci in servisna podjetja, sodelujoči partnerji, ponudniki storitev (ki niso vezani na navodila) ali pooblaščene osebe, kot so centri Porsche in servisni centri Porsche, finančne banke, kreditne agencije ali ponudniki prevoznih storitev.

14. Obdelava podatkov v tretjih državah

Če se podatki posredujejo organom, katerih sedež ali kraj obdelave podatkov ni v državi članici Evropske unije, v drugi državi članici Sporazuma o evropskem gospodarskem prostoru ali državi, pri kateri je bila s sklepom Evropske komisije ugotovljena ustrez na raven varstva podatkov, pred posredovanjem podatkov zagotovimo, da ima posredovanje podatkov zakonsko podlago, da so v okviru posredovanja podatkov zagotovljena jamstva za ustrezno raven varstva podatkov (npr. z dogovorom o pogodbenem jamstvu, upravno priznanimi predpisi ali obvezujočimi notranjimi predpisi prejemnika glede varstva podatkov) ali da ste privolili v posredovanje podatkov.

Če posredovanje podatkov poteka na podlagi 46. ali 47. člena ali

2. točke 1. odstavka 49. člena SUVP, lahko pri nas pr idobite izvod jamstev za vzpostavljeno ustrezno raven varstva podatkov v okviru posredovanja podatkov ali informacijo o razpoložljivosti teh jamstev. Za to uporabite podatke v točki 1.

15. Trajanje shranjevanja, izbris

Če v opisu posameznih storitev ni navedenih podatkov o specifičnem trajanju shranjevanja oz. o izbrisu osebnih podatkov, velja naslednje:

Vaše osebne podatke hranimo, če za to obstaja zakonsko dovoljenje, le toliko časa, kolikor je potrebno za doseganje zastavljenih namenov oz. dokler ne prekličete svoje privolitve. V primeru ugovora zoper obdelavo bomo vaše osebne podatke izbrisali, razen če je nadaljnja obdelava podatkov dovoljena v skladu z zadevnimi zakonskimi določbami. Vaše osebne podatke bomo izbrisali tudi, če smo k temu zavezani iz drugih pravnih razlogov. V skladu s temi splošnimi načeli bomo vaše osebne podatke praviloma izbrisali takoj,

- ko preneha veljati pravna podlaga in če ni v veljavi nobena druga pravna podlaga (npr. trajanje hrambe v skladu s trgovinsko in davčno zakonodajo). V slednjem primeru bomo podatke izbrisali po tem, ko preneha veljati druga pravna podlaga;

- če vaši osebni podatki niso več potrebni za namene, ki jim sledimo, in če ni v veljavi nobena druga pravna podlaga (npr. trajanje hrambe v skladu s trgovinsko in davčno zakonodajo). V slednjem primeru bomo podatke izbrisali po tem, ko preneha veljati druga pravna podlaga.

16. Pravice oseb, katerih osebni podatki se obdelujejo

Pravica do poizvedbe: imate pravico, da od nas prejmete informacijo o tem, katere vaše osebne podatke shranjujemo.

Pravica do popravka in izbrisa: od nas lahko zahtevate, da popravimo napačne podatke ali jih izbrišemo, če so za to izpolnjeni zakonski pogoji.

Omejitev obdelave: če so zakonski pogoji izpolnjeni, lahko od nas

zahtevate, da omejimo obdelavo vaših podatkov.

Prenosljivost podatkov: če ste svoje podatke zagotovili na podlagi pogodbe ali privolitve, lahko, če so zakonski pogoji izpolnjeni, zahtevate, da podatke, ki ste jih zagotovili, prejmete v strukturirani, običajni in strojno berljivi obliki zapisa ali da se ti podatki posredujejo drugemu upravljavcu.

Pravica do ugovora: imate pravico, da na podlagi razlogov, povezanih z vašim posebnim položajem, kadar koli ugovarjate obdelavi osebnih podatkov, če ti razlogi temeljijo na pravni podlagi „zakonitega interesa“. Če uveljavite pravico do ugovora, bomo prekinili obdelavo vaših podatkov, razen če lahko v skladu z zakonskimi določili dokažemo obstoj zakonitih in nujnih razlogov za nadaljnjo obdelavo, ki prevladajo nad vašimi pravicami.

Ugovarjanje neposrednemu trženju: če vaše osebne podatke obdelujemo za namen neposrednega trženja, imate pravico, da kadar koli ugovarjate naši obdelavi vaših podatkov v ta namen. Če uveljavljate pravico do ugovora, bomo prenehali obdelovati podatke v ta namen.

Preklic privolitve: če ste privolili v obdelavo svojih osebnih podatkov, lahko kadar koli prekličete privolitev z veljavnostjo za naprej. Zakonitost obdelave vaših podatkov vse do preklica privolitve ostane nedotaknjena.

Pravica do pritožbe pri nadzornem organu: poleg tega lahko pri pristojnem nadzornem organu vložite pritožbo, če menite, da je bila pri obdelavi vaših podatkov kršena veljavna pravica. Obrnete se lahko na pristojni urad za varstvo podatkov, ki je pristojen za kraj

vašega prebivališča oz. vašo državo ali na urad za varstvo

podatkov, ki je pristojen za nas.

Vaš stik z nami in uveljavljanje vaših pravic: prav tako se lahko brezplačno obrnete na nas v primeru vprašanj o obdelavi vaših osebnih podatkov, zadevnih pravicah in morebitni privolitvi, ki jo želite predložiti. Obrnite se na nas po e-pošti na xxxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxx@xxxxxxx.xx, prek spletne strani xxxxx://xxx.xxxxxxx.xxx/xxxxxxxxxxxxx/xxxxxxx/xxxxxxx/ ali po navadni pošti na naslov, ki je naveden zgoraj pod točko 1. Pri tem poskrbite, da vas bomo lahko brez težav identificirali. Pri preklicu privolitve lahko izberete tudi kanal za stike, ki ste ga uporabili ob podaji privolitve.

17. ponudbe tretjih oseb

Storitve drugih ponudnikov, na katere ste napoteni v okviru naših storitev, so in bodo ustvarjale ter upravljale tretje osebe. Na obliko, vsebino in delovanje teh storitev tretjih ponudnikov nimamo vpliva.

Izrecno zavračamo povezavo z vsemi vsebinami vseh povezanih ponudb, ki jih navajamo. Upoštevajte, da lahko te storitve, na primer spletne strani tretjih oseb, namestijo svoje piškotke v vašo končno napravo oz. zbirajo osebne podatke. Na to nimamo nobenega vpliva. Po potrebi se o tem pozanimajte neposredno pri ponudnikih teh povezanih storitev.

Če v okviru storitev vključujemo tudi storitve drugih ponudnikov, s pomočjo katerih vam zagotavljamo določene vsebine ali funkcije, lahko ustrezna pojasnila najdete v posebni izjavi o varstvu podatkov in morebitnih nadaljnjih posebnih informacijah o varstvu podatkov za posamezno storitev.

18. Status

Velja najnovejša različica te izjave o varstvu osebnih podatkov. Status: 01.02.2023

Specifični pravilnik o zasebnosti

Spletne strani Porsche Sales & Marketplace

Storitve My Porsche, Porsche Connect Store in spletno tržnico lahko uporabljate prek naše spletne strani (v nadaljevanju tudi

„spletna stran“).

Na portalu My Porsche in v trgovini Porsche Connect Store lahko zakupite storitve My Porsche, storitve Porsche Connect in funkcije na zahtevo (FoD) ter aktivirate ustrezne licence. Za to morate biti registrirani na portalu My Porsche in morate imeti uporabniški račun Porsche ID. Tako lahko glede na določeno storitev uporabljate in upravljate zgoraj navedene storitve prek naše spletne strani, različnih aplikacij Porsche in v vozilu prek povezave z mobilnim omrežjem, če vaše vozilo to omogoča.

Poleg tega je na spletnem trgu na voljo razširjena ponudba izdelkov in storitev naših povezanih družb ter tretjih ponudnikov. Stranke, ki imajo uporabniški račun Porsche ID, lahko uporabljajo storitvi spletnega trga Porsche Finder in Porsche Store.

Nekatere funkcije na naših spletnih straneh lahko uporabljate tudi brez registracije. Za več informacij glejte točko 2.3.

1. Posebni napotki za uporabo naše spletne strani

1.1 Zagotavljanje naše spletne strani

Uporaba naše spletne strani je delno mogoča brez prijave. Tudi če te funkcije uporabljate brez prijave, se kljub temu lahko obdelujej o osebni podatki. V nadaljevanju je pregled načina, obsega, namenov in pravnih podlag samodejne obdelave podatkov v sklopu uporabe naše spletne strani. Informacije o obdelavi osebnih podatkov pri uporabi posameznih funkcij in storitev najdete pod točko 2.

Ko s svojo napravo dostopate do naše spletne strani, obdelujemo

naslednje podatke:

– datum in uro dostopa,

– trajanje obiska,

– vrsto naprave,

– uporabljeni operacijski sistem,

– funkcije, ki jih uporabljate,

– količino poslanih podatkov,

– vrsto dogodka,

– naslov IP,

- URL posrednika,

- ime domene.

Te podatke obdelujemo na podlagi točk b) in f) 1. odstavka 6. člena SUVP za zagotavljanje spletne strani, za zagotavljanje tehničnega delovanja ter za namene odkrivanja in odpravljanja motenj. Pri tem sledimo tudi interesu stalnega zagotavljanja tehnične funkcionalnosti spletnega mesta, izboljšanja zmogljivosti in optimizacije uporabniške izkušnje. Pri odpiranju naše spletne strani se ti podatki samodejno obdelujejo. Brez zagotavljanja podatkov naše spletne strani ne morete uporabljati. Teh podatkov ne uporabljamo za namen sklepanja o vas oz. vaši identiteti.

1.2 Piškotki in primerljive tehnologije

V okviru spletnega mesta uporabljamo piškotke in podobne tehnologije, ki služijo za komunikacijo z vašo končno napravo in izmenjavo shranjenih informacij (v nadaljevanju skupaj „piškotki“). Ti piškotki se uporabljajo predvsem za omogočanje uporabe funkcij spletnega mesta. Splošni primeri, pri katerih je uporaba piškotkov v tem smislu tehnično potrebna, so shranjevanje izbire jezika, prijavnih podatkov ali nakupovalnega oz. opazovalnega seznama. Zato lahko tehnično potrebne piškotke uporabljamo za omogočanje

zgoraj opisanih postopkov obdelave ter za zagotavljanje pravilnega in varnega delovanja spletnega mesta. Obdelava podatkov poteka na podlagi točk b) in f) 1. odstavka 6. člena SUVP, ker je potrebna za zagotavljanje izbranih funkcij oz. uveljavljanje našega zakonitega interesa do delovanja spletnih strani.

Če poleg tega uporabljamo piškotke tudi za analizo uporabe spletnega mesta in za usmerjeno prilagajanje spletnega mesta vašim interesom ter, če je to primerno, tudi za zagotavljanje vsebin in oglasov, ki temeljijo na interesih, se to izvaja le na podlagi vaše prostovoljne privolitve na podlagi točke a) 1. odstavka 6. člena SUVP. Ustrezne nastavitve lahko nato opravite prek upravljanja privolitev na spletnem mestu xxxxx://xxxxxxx- xxxxx0.xxxxxxx.xxx/xx/xx/xxxxxxxxxxxx. Privolitev, ki ste jo na ta način podali, lahko prekličete kadar koli z veljavnostjo od trenutka preklica naprej. Nadaljnje informacije o piškotkih in njihovi funkciji ter možnostih nastavitve in preklica lahko najdete neposredno na ustreznih področjih upravljanja privolitev. Upoštevajte, da upravljanje privolitev kot del spletnega mesta načeloma zagotavljamo le, če se poleg zgoraj navedenih tehnično zahtevanih piškotkov uporabljajo tudi piškotki, ki temeljijo na privolitvi.

Če se v celoti ne strinjate z uporabo piškotkov, lahko njihovo shranjevanje onemogočite v ustreznih nastavitvah v končni napravi. Shranjene piškotke lahko v sistemskih nastavitvah končne naprave kadar koli izbrišete. Upoštevajte, da ima lahko blokiranje določenih vrst piškotkov za posledico lahko omejeno uporabo naše spletne strani.

1.3 Dovoljenja za dostop v končni napravi

Pri uporabi posameznih funkcij vas aplikacija lahko pozove, da

omogočite dostop do svoje lokacije.

Dovoljenja se podajo prostovoljno. Če želite vseeno uporabljati posamezne funkcije, morate omogočiti ustrezna dovoljenja, sicer teh funkcij ne morete uporabljati.

Dovoljenja so aktivna tako dolgo, dokler jih ne ponastavite v napravi in/ali internetnem brskalniku z deaktivacijo posamezne nastavitve.

2. Posebne storitve in funkcije

V okviru uporabe naše spletne strani lahko prostovoljno posredujete osebne podatke ali se registrirate v storitve ali funkcije. Pri registraciji in uporabi storitev in funkcij, opisanih v nadaljevanju, bomo osebne podatke obdelovali na naslednji način.

Če želite na naši spletni strani uporabljati storitve in funkcije, navedene pod točko 2.2, se morate predhodno registrirati in ustvariti uporabniški račun Porsche ID. Uporaba storitev in funkcij, navedenih pod točko 2.3, je mogoča brez predhodne registracije.

2.1 Postopek registracije in ustvarjanje uporabniškega računa Porsche ID

Informacije o postopku registracije in ustvarjanju uporabniškega računa Porsche ID so na voljo pod točko 4.1 Splošne izjave o varstvu osebnih podatkov za infrastrukturo digitalnih storitev Porsche/Porsche ID.

2.2 Uporaba posameznih funkcij z registracijo/prijavo

Funkcije v okviru naše ponudbe na naši spletni strani ter posamezni obdelani osebni podatki, nameni uporabe in pravne podlage so opisani v nadaljevanju.

2.2.1 Zakup in aktivacija storitev, obravnava podatkov o

plačilu, preverjanje identitete

Informacije o zakupu storitev prek naše spletne strani in s tem povezane obravnave podatkov o plačilu so na voljo pod točko 5.1 Splošne izjave o varstvu osebnih podatkov za infrastrukturo digitalnih storitev Porsche/Porsche ID.

V nekaterih državah je za zakup določenih telekomunikacijskih storitev iz pravnih razlogov lahko potrebno preverjanje identitete na osnovi osebnega dokumenta. Pri izvajanju tovrstnega preverjanja identitete smo za obdelavo odgovorni skupaj z družbo

– IDnow GmbH, Auenstr. 100, 80469 München, Nemčija.

Izjava o varstvu osebnih podatkov našega partnerja, družbe IDnow

GmbH, je na voljo na povezavi xxxxx://xxxxx.xx/xxxxxxx/.

Za izvajanje preverjanja identitete sta na voljo dva postopka. Ena možnost je, da ste v okviru zakupa storitev preusmerjeni na zunanjo stran oz. v aplikacijo ponudnika storitev IDnow. Pri tem na vašo zahtevo posredujemo ponudniku storitev podatke, ki se preverjajo (vaše ime, vaš naslov in vaš datum rojstva), in evidenčno številko, ki omogoča poznejšo uvrstitev rezultata preverjanja. Pri preverjanju identitete ponudnik storitev primerja omenjene podatke z vašim osebnim dokumentom ter shrani podatke in optično-elektronsko kopijo osebnega dokumenta, fotografijo preverjene osebe in zvočni posnetek seje v živo. Nato nam ponudnik storitev posreduje rezultat preverjanja identitete z navedbo evidenčne številke.

Druga možnost je, da preverjanje izvedete v pristojnem servisnem centru Porsche. Osebje servisnega centra Porsche preveri vašo identiteto na podlagi osebnega dokumenta in prek sistema Porsche posreduje ponudniku storitev preverjene podatke (vaše ime, vaš naslov in vaš datum rojstva) skupaj z evidenčno številko. Z navedbo te evidenčne številke lahko ponudniku storitev prek njegove aplikacije na lastno zahtevo posredujete optično-elektronsko kopijo osebnega dokumenta. Nato nam ponudnik storitev posreduje rezultat z navedbo evidenčne številke.

Osebne podatke, povezane s tem preverjanjem identitete, posredujemo tretjim osebam samo, če smo k temu zakonsko zavezani. Samo v tem primeru nam ponudnik storitev za namene izpolnjevanja naših zakonskih obveznosti omogoči tudi dostop do kopije vašega identifikacijskega dokumenta.

Pravna podlaga za našo obdelavo vaših osebnih podatkov v okviru izvajanja preverjanja identitete je člen 6(1)(c) oz. (f) GDPR, saj s preverjanjem identitete izpolnjujemo svojo zakonsko obveznost oz. uveljavljamo svoj zakoniti interes za izpolnjevanje zakonskih zahtev.

Kot skupni upravljavec z družbo IDnow GmbH smo v dogovoru na podlagi člena 26 GDPR določili, kako naj bodo oblikovani posamezne funkcije in razmerja pri obdelavi osebnih podatkov ter kdo mora izpolnjevati katere zakonske obveznosti v zvezi z varstvom osebnih podatkov, predvsem glede zagotavljanja ustrezne stopnje varnosti, uveljavljanja pravic oseb, katerih podatki se obdelujejo, izpolnjevanja obveznosti posredovanja informacij v zvezi z varstvom osebnih podatkov in nadzora morebitnih dogodkov, povezanih z varstvom osebnih podatkov, vključno z zagotavljanjem obveznosti sporočanja in obveščanja (če je potrebno). Več informacij o tem dogovoru lahko pridobite prek možnosti za stik, ki so navedene pod točko 1 (Splošne izjave o varstvu osebnih podatkov), prek katerih vam lahko posredujemo bistvene predpise.

Za poizvedbe in uveljavljanje svojih pravic v zvezi z obdelavo osebnih podatkov se lahko obrnete na katerega koli od skupnih upravljavcev. V skladu z omenjenim dogovorom na podlagi člena 26 GDPR se bomo posvetovali z družbo IDnow GmbH ter odgovorili

na vaše vprašanje in po potrebi poskrbeli za uveljavljanje vaših

pravic v zvezi z obdelavo osebnih podatkov.

Izmenjava osebnih podatkov med skupnima upravljavcema poteka na podlagi člena 6(1)(f) GDPR, torej na podlagi našega zakonitega interesa za učinkovito izvajanje preverjanja identitete v sodelovanj u z družbo IDnow GmbH.

Več informacij o obdelavi osebnih podatkov za storitve, ki jih je mogoče zakupiti, je po potrebi na voljo v posebnih informacijah o varstvu osebnih podatkov za določeno storitev.

2.2.2 Uporaba storitev My Porsche in Porsche Connect

Informacije o uporabi storitev My Porsche in Porsche Connect prek naše spletne strani so na voljo pod točko 5.2 Splošne izjave o varstvu osebnih podatkov za infrastrukturo digitalnih storitev Porsche/Porsche ID.

2.2.3 Zagotavljanje informacij o servisu in garanciji

Če želite uporabljati to funkcijo, se morate predhodno registrirati in ustvariti uporabniški račun Porsche ID.

Za zagotavljanje podatkov o vašem vozilu, trenutno veljavnih garancijah in odpoklicih v storitvi My Porsche na naši spletni strani obdelujemo matične podatke o opremi in vozilu, kot so identifikacijska številka vozila iz dokazil o lastništvu, trenutno veljavne garancije, modelsko leto in slika modela.

Pravna podlaga za obdelavo osebnih podatkov je v skladu s členom

6(1)(b) GDPR izpolnjevanje pogodbe, ki jo sklenete z nami.

2.2.4 Zahteva po servisnih terminih

Za uporabo te funkcije se je treba predhodno registrirati in ustvariti

uporabniški račun Porsche ID.

Za povpraševanje po servisnih terminih pri trgovcih Porsche in servisnih podjetjih prek storitve My Porsche na naši spletni strani ali v aplikaciji lahko na vašo željo tem podjetjem, ki jih izberete, zagotavljamo podatke o strankah in vozilih. Na vašo željo izbranemu trgovskemu ali servisnemu podjetju, kjer naj bi dela izvedli, posredujemo vaše ime, vaš naslov, vašo telefonsko številko, vaš e- poštni naslov, vaš Porsche ID, identifikacijsko številko vozila iz dokazil o lastništvu, model vašega vozila, izbrane servisne termine, želeni obseg servisa in vaše spremljevalno sporočilo k zahtevi ter želene načine komunikacije.

Posredovanje vaših osebnih podatkov nastopi v okviru posameznega povpraševanja po servisu na pravni podlagi člena 6(1)(b) GDPR kot predpogodbeni ukrep na vaše povpraševanje. Vsako vaše povpraševanje po servisu shranimo za izpolnjevanje pogodbe, ki jo sklenete z nami, v skladu s členom 6(1)(b) GDPR.

2.2.5 Rezervacija dogodkov

S funkcijo rezervacije dogodkov se lahko v aplikaciji in na portalu My Porsche prijavite na izbrane Porschejeve dogodke.

V ta namen obdelujemo zlasti naslednje osebne podatke: matične podatke, kontaktne podatke in podatke, potrebne za izvedbo dogodka. Navedene osebne podatke obdelujemo na pravni podlagi točke b) 1. odstavka 6. člena SUVP z namenom izpolnjevanja določil pogodbe glede zagotavljanja aplikacije in njenih funkcij ter na pravni podlagi točke f) 1. odstavka 6. člena SUVP z namenom izpolnjevanja naših zakonitih interesov glede zagotavljanja servisnih storitev. Za izvedbo posameznega dogodka in s tem za nadaljnjo obdelavo podatkov, ki je potrebna za izvedbo dogodka, je odgovoren organizator, ki je naveden v prijavnici za posamezni dogodek.

2.2.6 Novice My Porsche

S funkcijo Novice My Porsche lahko novice prikličete v aplikaciji in prek portala My Porsche. Pri tem gre praviloma za s pogodbo povezane podatke v zvezi s pridobitvijo ali uporabo računa, vozila oz. digitalnih ponudb družbe Porsche.

V ta namen obdelujemo zlasti naslednje osebne podatke: matične podatke, kontaktne podatke, podatke o pogodbi, podatke o trgovcu in podatke o vozilu.

Navedene osebne podatke obdelujemo na pravni podlagi točke b)

1. odstavka 6. člena SUVP z namenom izpolnjevanja določil naše pogodbe glede zagotavljanja aplikacije in njenih funkcij ter na pravni podlagi točke f) 1. odstavka 6. člena SUVP z namenom izpolnjevanja naših zakonitih interesov glede zagotavljanja servisnih storitev v povezavi z vašo pogodbo.

2.2.7 Zbiranje podatkov o vozilu, storitvah in izdelkih za razvoj in izboljšavo izdelkov in storitev

V povezavi z uporabo storitev, pri obvestilih o napakah ali v okviru opredeljenih ukrepov za analizo podatkov se lahko določeni podatki o vozilu, storitvah in izdelkih iz vozila, iz storitev oz. iz drugih izdelkov Porsche prenesejo od družbe Porsche Sales & Marketplace GmbH na družbo Porsche AG, kjer se lahko uporabljajo za analizo zgoraj navedenih namenov.

Soglasje za to lahko podate na spletni strani My Porsche.

Podatki o vozilu, storitvah in izdelkih v glavnem vključujejo identifikacijske podatke, osnovne podatke, podatke o uporabi, analizi, okolju in prometu ter podatke o lokaciji in premikanju.

Nekaterih podatkov ni mogoče posamično izbrisati z veljavnostjo za nazaj, ker se shranijo brez konkretne identifikacije vozila. V tem primeru se podatki izbrišejo čez največ 5 let.

2.2.8 Rezervacija in pridobivanje storitev in izdelkov v okviru spletnega trga

V okviru spletnega trga vam ponujamo osrednjo platformo, prek katere lahko zakupite oz. pridobite naše storitve in izdelke ter storitve in izdelke naših partnerjev in tretjih ponudnikov (v nadaljevanju tudi „udeleženci“). Posameznim udeležencem je na naši platformi na voljo območje za predstavitev in ponudbo njihovih izdelkov in storitev (v nadaljevanju „trgovina«).

Stranke, ki imajo uporabniški račun Porsche ID, lahko uporabljajo storitvi spletnega trga Porsche Finder in Porsche Store. Stranke, ki nimajo pogodbe Porsche ID, lahko uporabljajo storitev spletnega trga Porsche Store prek funkcije „dostop kot gost“.

Obdelave v okviru spletnega trga delno izvajamo mi, delno jih

izvajajo udeleženci, delno pa se izvajajo v skupni odgovornosti.

2.2.8.1 Obdelave v odgovornosti družbe PSM GmbH

Informacije o obdelavah podatkov, ki jih izvajamo z izključno odgovornostjo (npr. upravljanje osnovnih podatkov), so na voljo v drugih poglavjih te izjave o varstvu osebnih podatkov in v drugih izjavah o varstvu osebnih podatkov družbe Sales & Marketplace GmbH.

2.2.8.2 Obdelave v odgovornosti udeležencev spletnega trga

Informacije o obdelavah podatkov, ki jih z izključno odgovornostjo izvajajo udeleženci spletnega trga (npr. obdelave v okviru izstavljanja računov, zagotavljanje izdelkov, razveljavitve v primeru vračila blaga itd.), so na voljo v izjavah o varstvu osebnih podatkov

ustreznih družb. Udeleženec, ki je odgovoren za posamezni izdelek

ali storitev, je naveden na ustrezni strani izdelka ali storitve.

PSM GmbH v označenih primerih nastopa tudi v vlogi udeleženca na trgu. Dodatne informacije o obdelavi vaših osebnih podatkov v okviru izvajanja pogodbe na spletnem trgu najdete v točki 5.1 splošne izjave o varstvu osebnih podatkov „Infrastruktura digitalnih storitev Porsche/Porsche ID“.

2.2.8.3 Obdelave v skupni odgovornosti družbe PSM GmbH in udeležencev spletnega trga

Z ustreznimi udeleženci spletnega trga, ki na določeni strani objavijo ponudbo in pri katerih lahko zakupite storitve ali izdelke, smo skupni upravljavci podatkov pri naslednjih načinih obdelave:

- obdelava podatkov v okviru obiska in postopka zakupa, zahtevka ali rezervacije v trgovini udeleženca spletnega trga, vendar ne temu podrejena obdelava storitve zunaj platforme;

- izvajanje samodejnega zbiranja podatkov, obdelava podatkov za izboljšanje naše spletne ponudbe, shranjevanje piškotkov in analiza podatkov (glejte točko

1.1 te izjave o varstvu osebnih podatkov);

- obdelava podatkov v okviru oglaševalskih, komunikacijskih in trženjskih funkcij platforme, predvsem modulov navzkrižne prodaje;

- obdelava plačil za plačljive zakupe, zahtevke in rezervacije v okviru določene trgovine spletnega trga;

- podpora strankam za določeno trgovino na spletnem

trgu.

Glede na te obdelave podatkov skupaj z ustreznimi udeleženci spletnega trga določamo namene in sredstva obdelave osebnih podatkov.

Z določenimi udeleženci spletnega trga smo v dogovoru o skupnem upravljanju podatkov v skladu s členom 26 GDPR opredelili naloge in pristojnosti pri obdelavi osebnih podatkov ter določili, kdo mora izpolnjevati katere obveznosti v zvezi z varstvom podatkov. Določili smo predvsem načine zagotavljanja primerne stopnje varnosti in vaših pravic v zvezi z obdelavo osebnih podatkov, načine skupnega izpolnjevanja obveznosti v zvezi z varstvom osebnih podatkov in načine nadzora morebitnih dogodkov, povezanih z varstvom osebnih podatkov. V to je vključeno tudi naše zagotavljanje izpolnjevanja obveznosti sporočanja in obveščanja.

Družba PSM GmbH vam je na voljo kot osrednja oseba za stik v zvezi z omenjenimi načini obdelave v skupni odgovornosti. Svoje pravice v zvezi z obdelavami v skupni odgovornosti pa lahko uveljavljate tudi pri skupno odgovornem udeležencu spletnega trga. Če se obrnete na nas v zvezi s temi obdelavami, se bomo v skladu z omenjenim dogovorom na podlagi člena 26 GDPR posvetovali z ustreznim udeležencem spletnega trga ter odgovorili na vašo zahtevo in poskrbeli za uveljavljanje vaših pravic v zvezi z obdelavo osebnih podatkov. V tem primeru veljajo smernice, ki so navedene pod točko 13 Splošne izjave o varstvu osebnih podatkov.

Iz skupnega upravljanja podatkov so izvzete predvsem obdelave, ki so zajete v Splošni izjavi o varstvu osebnih podatkov, kar med drugim vključuje upravljanje matičnih podatkov (Porsche ID) in obdelavo podatkov na platformi, ki se izvajata v izključni odgovornosti družbe Porsche Sales & Marketplace GmbH. Ne v skupni odgovornosti, temveč v izključni odgovornosti določenega ponudnika spletnega trga potekata predvsem obdelava storitve pri sklenjeni pogodbi o nakupu, zakupu, zahtevku ali rezervaciji in izdaja računov.

2.3 Uporaba posameznih funkcij brez registracije/prijave

Funkcije na naši spletni strani ter posamezni obdelani osebni podatki, nameni uporabe in pravne podlage so opisani v nadaljevanju.

2.3.1 Stik z nami prek klepeta v živo

Za uporabo te funkcije se vam ni treba predhodno registrirati niti

vam ni treba ustvariti uporabniškega računa Porsche ID.

V določenih delih naše spletne strani lahko z nami stopite v stik in prosite za svetovanje prek klepeta v živo. Prek klepeta v živo lahko komunicirate z našim svetovalcem z besedilnimi sporočili. Pri aktivaciji in uporabi klepeta v živo vaš brskalnik ob začetku uporabe iz tehničnih razlogov samodejno posreduje naslednje podatke, ki jih shranjujemo ločeno od drugih podatkov, ki nam jih v določenih primerih posredujete:

- datum in uro dostopa,

- trajanje obiska naše spletne strani,

- vrsto in različico spletnega brskalnika,

- uporabljeni operacijski sistem,

- količino poslanih podatkov,

- vrsto dogodka,

- naslov IP.

Te podatke obdelujemo na podlagi točk b) in f) 1. odstavka 6. člena SUVP za zagotavljanje funkcije, za zagotavljanje tehničnega delovanja ter za namene odkrivanja in odpravljanja motenj. Pri tem sledimo tudi interesu stalnega zagotavljanja tehnične funkcionalnosti funkcije, izboljšanja zmogljivosti in optimizacije uporabniške izkušnje. Pri priklicu funkcije se ti podatki samodejno obdelajo. Če teh podatkov ne zagotovite, funkcije ne morete uporabljati. Teh podatkov ne uporabljamo za namen sklepanja o vas oz. vaši identiteti.

Če nam poleg tega prek klepeta v živo posredujete še druge podatke, to počnete prostovoljno. Če so za obravnavo vaše zadeve potrebni osebni podatki, vas na to opozorimo in vas pozovemo, da nam jih posredujete. Besedila, ki jih vnesete v vnosna polja klepeta v živo, se po našem naročilu shranijo v strežniku zunanjega ponudnika storitev. Pravna podlaga te obdelave podatkov je člen 6(1)(b) GDPR.

2.3.2 Dostop kot gost pri rezervaciji in pridobivanju storitev in izdelkov v okviru spletnega trga

Poleg uporabe spletnega trga z uporabniškim računom Porsche ID lahko stranke storitev spletnega trga Porsche Store uporabljajo tudi brez predhodne registracije in ustvarjanja uporabniškega računa Porsche ID, in sicer prek funkcije „dostop kot gost“. Informacije o obdelavi podatkov v zvezi s tem so na voljo pod točko 2.2.6.

2.4 Novice

Novice pošiljamo po ustrezni prijavi, tj. z vašo privolitvijo. Če je vsebina novic konkretno opisana v okviru prijave, je ta vsebina odločilna za obseg privolitve. Poleg tega naše novice vsebujejo informacije o naših izdelkih, ponudbah, promocijah in našem podjetju. Za obdelavo vaših podatkov je odgovorna zadevna družba, ki je navedena v postopku registracije. Prijava poteka s tako imenovanim postopkom dvojne prijave, kar pomeni, da boste po registraciji prejeli elektronsko sporočilo, v katerem boste pozvani k potrditvi registracije, da se prepreči zloraba vašega elektronskega naslova. Prijave na novice beležimo, da lahko v skladu z zakonskimi zahtevami dokažemo postopek prijave in privolitev, ki jo vsebuje. Prijava in obdelava podatkov, ki ste jih vnesli med prijavo in so potrebni za ta namen, se zato izvajata na podlagi naših zakonitih interesov v skladu s točko f) 1. odstavka 6. člena SUVP. Svojo privolitev za prejemanje naših novic lahko kadar koli prekličete, npr. tako, da se odjavite od prejemanja novic. Na koncu vsakih novic

boste našli povezavo za odjavo, s katero lahko uveljavljate to

pravico.

3. Integrirane storitve tretjih oseb

Če v okviru naše spletne strani vključujemo storitve drugih ponudnikov, tako da vam lahko ponudimo določeno vsebino ali funkcije (npr. predvajanje videoposnetkov ali načrtovanje poti) in pri tem obdelujemo osebne podatke, to delamo na podlagi točk b) in f)

1. odstavka 6. člena SUVP. Obdelava podatkov je namreč potrebna za izvajanje funkcij, ki ste jih izbrali, ali za zaščito našega zakonitega interesa za optimalen nabor funkcij. Če se v okviru teh storitev tretjih oseb uporabljajo piškotki, veljajo pojasnila iz razdelka 1.1.3. Prav tako se v zvezi s storitvami tretjih oseb seznanite s politiko zasebnosti zadevnega ponudnika.

Storitve drugih ponudnikov, ki jih vključujemo ali na katere se sklicujemo, zagotavljajo ustrezne tretje osebe. Med storitve tretjih oseb običajno sodijo tudi storitve, ki jih ponujajo družba Porsche AG in druge družbe v skupini. Načeloma nimamo vpliva na vsebino in delovanje storitev tretjih oseb in nismo odgovorni za obdelavo vaših osebnih podatkov s strani njihovih ponudnikov, razen če storitve tretjih oseb niso v celoti zasnovane v našem imenu in jih nato ne vključimo na svojo odgovornost. Če ima vključitev storitve tretje osebe za posledico, da s ponudnikom storitve vzpostavim o skupne procese, z zadevnim ponudnikom v dogovoru o skupni odgovornosti v skladu s 26. členom SUVP določimo, kako so urejene zadevne naloge in pristojnosti pri obdelavi osebnih podatkov in kdo mora izpolnjevati katere obveznosti v zvezi z varstvom podatkov. Če bodo piškotki nameščeni tudi na podlagi vaše privolitve, boste na ustreznih področjih upravljanja privolitev prejeli tudi dodatne informacije o odgovornosti za namestitev teh piškotkov ali morebitnih povezanih storitev tretjih oseb.

Če ni drugače navedeno, so profili v družbenih medijih vključeni le kot povezave do ustreznih storitev tretjih oseb. Po kliku na vdelano besedilno/slikovno povezavo boste preusmerjeni na ponudbo zadevnega ponudnika družbenih medijev. Po posredovanju prek povezave lahko osebne podatke zbira neposredno tretji ponudnik. Če ste v tem času prijavljeni v uporabniški račun zadevnega ponudnika družbenih medijev, lahko ponudnik zbrane informacije o določenem obisku dodeli vašemu osebnemu uporabniškemu računu. Če sodelujete prek gumba „Deljenje“ ustreznega ponudnika družbenih medijev, se te informacije lahko shranijo v osebni uporabniški račun in po možnosti objavijo. Če želite preprečiti, da bi bili zbrani podatki neposredno dodeljeni vašemu uporabniškemu računu, se morate odjaviti, preden kliknete na vdelano besedilno/slikovno povezavo.

4. Pravice oseb, katerih osebni podatki se obdelujejo

Kot oseba, katere osebni podatki se obdelujejo, so vam na voljo številne pravice. Predvsem lahko kadar koli zavrnete uporabo piškotkov in piškotkom podobnih tehnologij. Podrobnosti o tem najdete v pravilniku o piškotkih družbe Porsche Sales & Marketplace za spletne strani, ki je na voljo na naslovu xxxxx://xxxxxxx-xxxxx.xxxxxxx.xxx/xx/xx/x/xxxxxxx.

V zvezi z vašimi pravicami, ki iz tega izhajajo, se nanašamo na ustrezne navedbe pod točko 13 naše Splošne izjave o varstvu osebnih podatkov za storitve My Porsche in Porsche Connect/infrastrukturo digitalnih storitev Porsche, ki je na voljo na naslovu xxxxx://xxxxxxx-xxxxx.xxxxxxx.xxx/xx/xx/x/xxxxxxx.

5. Spremembe te izjave o varstvu osebnih podatkov in datum izdaje

Pridržujemo si pravico do sprememb te Posebne izjave o varstvu osebnih podatkov. Najnovejša različica izjave o varstvu osebnih podatkov je vedno na voljo na naslovu xxxxx://xxxxxxx- xxxxx.xxxxxxx.xxx/xx/xx/xxxxxxx.

Datum izdaje: 01.02.2023

Porsche Sales & Marketplace GmbH

General Privacy Policy

Porsche Digital Service Infrastructure / Porsche ID

We, Porsche Sales & Marketplace GmbH (hereinafter referred to as "we" or "PSM GmbH"), are pleased about your use of the Porsche Digital Service Infrastructure and other of our digital offers (hereinafter individually or jointly also referred to as "services" and jointly "Porsche Digital Service Infrastructure"). We take the protection of your personal data very seriously. Your personal data will only be processed in accordance with the provisions of data protection legislation, in particular the General Data Protection Regulation (hereinafter "GDPR"). This Privacy Policy provides information about the processing of your personal data and your privacy rights as a data subject in connection with your use of the Porsche Digital Service Infrastructure and our services. For information on the individual services, please refer to the Specific Privacy Policy and, if applicable, the further Special Data Protection Notices of the respective service.

1. Data Controller and Data Protection Officer

Unless otherwise expressly stated in this or a Specific Privacy Policy based thereon and, if applicable, in the further Special Data Protection Notices of the respective service, the entity responsible for data processing within the meaning of the data protection laws is:

Porsche Sales & Marketplace GmbH Xxxxxxxxxxxx 0

70435 Stuttgart

Germany

E-mail: xxxxxxxxxxxxx@xx.xxxxxxx.xxx

Please do not hesitate to contact us if you have any questions or ideas relating to data protection.

You can contact our data protection officer as follows: Porsche Sales & Marketplace GmbH

Data Protection Officer

Xxxxxxxxxxxx 0

70435 Stuttgart Germany

Contact: xxxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxx@xxxxxxx.xx

In relation to certain processing operations, we may be joint controllers with Dr. Ing. h.c. Porsche AG (Xxxxxxxxxxxx 0, 00000 Xxxxxxxxx, Xxxxxxx, e-mail: xxxx@xxxxxxx.xx, hereinafter "Porsche AG"), its group companies and/or third parties ("we" then also stands for these joint controllers). In relation to such joint processes, we jointly determine the purposes and means of processing personal data. In such cases, in an agreement on joint responsibility pursuant to GDPR Article 26, we accordingly also define the respective tasks and responsibilities in the processing of personal data and the responsible parties to fulfil data protection obligations. In particular, we define how an appropriate level of security and your rights as a data subject can be ensured, how we can jointly comply with information obligations under data protection law and how we can monitor potential data protection incidents. This also includes ensuring that we can fulfil our reporting and notification obligations. Insofar as you contact us, we will come to an agreement in accordance with the aforementioned agreement pursuant to GDPR Article 26 in order to answer your enquiry and

guarantee your data subject rights. You can find out in which areas and with which companies joint responsibility exists in the Specific Privacy Policy and, if applicable, in the further Special Data Protection Notices of the respective service.

2. Object of data protection

The object of data protection is the protection of personal data. This is any information that relates to an identified or identifiable natural person (so-called data subject). This includes details such as name, postal address, e-mail address or telephone number, but also other information that arises in the course of using our Porsche Digital Service Infrastructure and vehicle usage data.

3. Purposes of and legal grounds for data processing

This General Privacy Policy provides you with the following overview of the purposes and legal bases of data processing in the context of registering, creating and using your Porsche ID user account and booking and using our services on the basis of your Porsche ID user account. We process personal data in any case in accordance with the legal requirements, even if a different legal basis should apply than stated below in individual cases.

We process your personal data in particular if this is necessary for the performance of a contract to which you are a party or for the performance of pre-contractual measures that take place at your request. Data is processed on the basis of Article 6 Paragraph 1

(b) GDPR. The purposes of the processing include enabling the use of our specific products and services within the services as explained below.

We also process your personal data, insofar as this is necessary, to comply with legal obligations to which we are subject. The data processing takes place on the basis of Article 6 Paragraph 1 (c) of the GDPR. The obligations may result, for example, from the commercial, tax, money laundering, financial or criminal law. The purposes of processing arise from the respective legal obligation; the processing generally serves the purpose of complying with state obligations with regard to monitoring and duty of disclosure. In this respect, too, you will find more detailed information below.

The provision of personal data by you may be required by law or contract when using the services or may be necessary for the conclusion of a contract. We will inform you separately if you are obliged to provide personal data and what the possible consequences of not doing so would be (e.g. a loss of claims or our advice not to provide the requested service without providing certain information).

4. Porsche ID user account

Registration and creation of a Porsche ID user account on My Porsche is required for full use of the Porsche Digital Service Infrastructure and the services offered under it. Once you have successfully completed registration and created your Porsche ID user account, you will also receive your Porsche ID (user name of the Porsche ID user account), with which you will be able to log in

to all Porsche ID interfaces linked with your password or the QR code. When registering and creating and using your Porsche ID user account, personal data is processed and, if necessary, transmitted to third parties as described below in order to fulfil our contractual obligations in this context. Unless otherwise stated, we carry out all processing operations described in this section in order to fulfil our contract with you on the basis of Article 6 Paragraph 1(b) GDPR.

4.1 Registration process and creation of a Porsche ID user account

There are two methods to choose from in order to register and create your Porsche ID user account:

4.1.1 Invitation by authorised dealers

If you wish, your authorised dealer will enter the personal data you have provided to them on our systems for you via their access. You will then receive, for example, an e-mail with a link which you must use to confirm your registration and creation of your Porsche ID user account. Please note that the authorised dealers are independent companies and we have no influence over them. A second feature allows you to additionally verify your identity, for example via an SMS code, which you then enter during the process of registering and creating your Porsche ID user account.

4.1.2 Self-registration

In the event that the registration and creation of your Porsche ID user account was not carried out via an authorised dealer, you can register and create your Porsche ID user account yourself and enter your personal data independently. In selected countries you can also add a vehicle and use other digital services that require vehicle ownership. You must also upload a copy of an identification document and proof of ownership and, in case you are not the owner of the vehicle, a power of attorney from the vehicle owner after entering your vehicle identification number. These documents are forwarded to Porsche Connect Support or, in countries where the official language is not supported by Porsche Connect Support, directly to the dealer selected by you and are then checked locally using our verification criteria. As proof of successful verification, we also save the names, dates and places of birth, and addresses shown in the relevant identification documents along with the validity dates of the documents, as well as the vehicle identification numbers, owner names and addresses shown in the proof of ownership. After verification is complete, the copies of the documents will be deleted. Alternatively, you can use the video identification procedure for verification by our Porsche Connect Support. If you add a vehicle and a specific vehicle is therefore assigned to you in your Porsche ID user account, a vehicle relationship exists (hereinafter referred to as "vehicle relationship"). After successful verification, you will receive, for example, an email with a link that you must use to confirm your registration and creation of your Porsche ID user account. A second feature allows you to additionally verify your identity, for example via a text message code that you then enter when registering and creating your Porsche ID user account.

Self-registration requires the upload of images from the terminal. You will therefore be asked to grant permission for the app to access your device's camera or photo library. Granting permission is voluntary. However, if you wish to use the self-registration function, you must grant the relevant permission, otherwise you will not be able to use the self-registration. Permission remains active unless you revoke it in your device and/or Internet browser by deactivating the relevant setting.

If your vehicle has already been linked to your Porsche ID by an Official Porsche Centre at your request using your email address and mobile phone number, a simplified creation process for the

vehicle is possible instead via our website or the MyPorsche app. For this purpose, only the VIN entered by you and the contact data already stored by us are compared and a confirmation code is sent to you via SMS.

(a) Mandatory data when registering and creating a Porsche ID user account

When registering and creating your Porsche ID user account, you must - in the case of self-registration - enter your e-mail address, a password, your name and name affixes, contact and address data, mobile phone number, e-mail address and, if applicable, the language in which you wish to communicate with us or - in the case of registration and creation of your Porsche ID user account by an authorised dealer - confirm this personal data as part of the process of registering and creating your Porsche ID user account. This personal data is required to set up and manage your Porsche ID user account for you so that you can use the full range of our services as part of the Porsche Digital Service Infrastructure. In selected countries, you can also use our offer as an interested party. In this case, you only need to provide your name, e-mail address and a password. Last but not least, we also need this and possibly other personal data in order to be able to respond to requests, questions and criticism. We also save the time of your last log-in. When you register and create your Porsche ID user account, we check your name and address data by means of a plausibility check.

(b) Voluntary data when registering and creating a Porsche ID user account

When registering and creating your Porsche ID user account, you also have the option of entering additional voluntary details such as additional name information (e.g. academic title etc.), company contact details, date of birth, additional telephone numbers, credit card information (this is only stored by the payment service provider) as well as your vehicle registration number and a personal vehicle name. In addition, you can provide information about your interests, preferences and the contact channels you would like to use. Please note that this information is not required when registering and creating your Porsche ID user account and that you alone decide whether you want to disclose this personal data to us.

4.1.3 Integration of the Porsche ID into third-party offers

We may enable cooperation partners to offer a registration and login procedure involving the Porsche ID. This means that you do not have to remember any new login data for the third-party offer. If you decide to use the registration and login procedure involving the Porsche ID as part of the third-party offer, you will be redirected to the PSM GmbH login/registration screen for the Porsche ID. Here you log in with your user name and password for the Porsche ID. We will then send a message to our cooperation partner that you have successfully registered. As part of the registration and login process, you can confirm to us that the cooperation partner may access the profile data of your Porsche ID user account. This then also applies to the payment data stored there, if applicable. This means that you do not have to re-enter or maintain your profile data and, if applicable, payment data (e.g. if your address changes) in order to create your user profile for the third-party offer. Conversely, changes to the profile data in the user account of the third-party offer are then also synchronised accordingly in your user account for the Porsche ID.

The data processing within the scope of the registration and login procedure with the integration of the Porsche ID is carried out on the basis of Article 6 Paragraph 1 (b) and (f) GDPR in order to register you with your user account for the third-party offer or to identify you when you register. In addition to carrying out your desired procedure, we are interested in making the registration and application process efficient and convenient. We are jointly responsible for this with our cooperation partner and, in relation to

the process, we jointly determine the purposes and means of processing personal data. In an agreement on joint responsibility, we have defined, pursuant to GDPR Article 26, the respective tasks and responsibilities in the processing of personal data and the responsible parties to fulfil data protection obligations. In particular, we have defined how an appropriate level of security and your rights as a data subject can be ensured, how we can jointly comply with information obligations under data protection law and how we can monitor potential data protection incidents. This also includes ensuring that we can fulfil our reporting and notification obligations. Insofar as you contact us, we will come to an agreement in accordance with the aforementioned agreement pursuant to GDPR Article 26 in order to answer your enquiry and guarantee your data subject rights.

4.2 Porsche Digital Service Infrastructure: data processing after registration and creation of your Porsche ID user account

If you have registered and created your Porsche ID user account, we will, in order to fulfil the contract with you on the basis of Article 6 Paragraph 1 (b) GDPR, exchange basic information about your Porsche ID user account and your vehicles with responsible Porsche dealers in order to be able to serve you via our dealer organisation. In addition to the vehicle identification number, we transfer your user name (Porsche ID), the technical or sales availability of services and product offers for your Porsche ID user account or vehicle, as well as relevant events as part of the creation, modification or deletion of your Porsche ID user account, the linking of vehicles, the selection of traders, or the activation or deactivation of services.

If you have selected an authorised dealer and provided your consent, your personal data stored in your Porsche ID user account, in particular contact data, support, contractual and service data, as well as data about your interests, vehicles and services used will also be exchanged with the authorized dealer and with synchronised with any personal data stored about you. If you no longer wish data to be transferred in the future, you can change this in the user settings of your Porsche ID user account accordingly. The aforementioned personal data will no longer be exchanged with the authorised dealer from that date. The applicable legal basis for this processing of your personal data is your consent pursuant to Article 6 Paragraph 1 (a) GDPR.

If you are waiting for your vehicle to be delivered, we will provide you with information on the delivery status in your Porsche ID user account. To do this, we will share the VIN of your vehicle and your Porsche ID with Porsche AG. The applicable legal basis for the processing of your personal data is the fulfilment of our contract with you on the basis of Article 6 Paragraph 1 (b) GDPR.

4.3 Deletion of your Porsche ID user account

If you delete your Porsche ID user account, your personal data stored in your Porsche ID user account will also be deleted when the contractual relationship ends, but upon expiration of your existing service licenses at the earliest. As far as data must be stored for legal reasons, these are blocked (so-called limitation of processing). The personal data is for further use, especially for the use of services, and then is no longer available. The functionality of the services may be limited or eliminated. The full use of the Porsche Digital Service Infrastructure will then also no longer be available to you. If further responsible individuals within the Porsche Group and its sales organisation process personal data within their own responsibility, the processing of this personal data remains unaffected. If, on the basis of your consent pursuant to Article 6 Paragraph 1 (a) GDPR, personal data has been exchanged with a dealer of your choice, we inform the dealer about the deletion of your Porsche ID user account.

5. Central services

5.1 Booking and activating services, handling payment information

You can book individual or several My Porsche services and Porsche Connect services and activate service licences. When selecting the respective service or service package, you can also view the respective information on the processing of personal data within the scope of the services concerned under the offer details. In order to carry out and fulfil a booking and the associated contractual relationship, we process, in addition to the respective booking information, your personal data collected during registration and creation of your Porsche ID user account. You can change your billing address before completing the booking process. In this case, we use the address data provided by you for invoicing and processing.

We use a payment service provider to process payments for our paid services and products within the framework of My Porsche, Porsche Connect and the Online Marketplace. For this purpose, we and the payment service provider used will process your credit card information and the respective payment information. The payment service provider's systems are used to manage your credit card information and to process payments. When you enter your credit card information, it is done directly via an input field from the payment service provider, which encrypts, stores and uses this information independently for your payments. The encrypted information is then transferred from Porsche / from us to the payment service provider, where it is stored and used for your payment. Our legal basis for processing your personal data in order to process the payment is the fulfilment of the contract pursuant to Article 6 Paragraph 1(b) GDPR.

The payment service provider commissioned will process your customer and contact information (for example name, address, email address, Porsche Connect customer number, and if applicable, company and affiliates) and the vehicle identification number shown in the proof of ownership exclusively for the purpose of debtor management (including compliance checks, where legally required) and to carry out credit checks. The legal basis for processing the named personal data for the aforementioned purposes, in accordance with Article 6 Paragraph 1 (c) of the GDPR, is the fulfilment of a legal obligation incumbent on us and, in accordance with Article 6 Paragraph 1 (f) of the GDPR, our legitimate interest in appropriate accounts receivable management and credit controls, provided we are not subject to any legal obligation.

When purchasing through online shops, our payment service provider determines the fraud risk using customer data (e.g. name and identifier, sales history, etc.). The transaction data is checked and examined for abnormalities (e.g. frequency of password changes, delivery address differing from the invoicing address). The legal basis for the processing of the mentioned personal data for the aforementioned purposes is, in accordance with GDPR Article 6 Paragraph 1 (b), the fulfilment of a contract, or, pursuant to GDPR Article 6 Paragraph 1 (f), our legitimate interest in preventing fraud.

After completing the booking, you can activate the services. This saves the authorisation for use on the system side and updates the list of available services accordingly.

In order to use certain services (e.g. E-Charging offers), a personalised card (referred to as a Porsche ID Card, Porsche Charging Card) containing RFID chips is sent by post to numerous countries when a product is purchased. An identification number is stored on the card, which can be used to assign it to your Porsche ID user account. No personal data beyond the identification number, in particular your name or address, is stored digitally on

the card itself. If the card is lost, you can block it within your Porsche ID user account.

After delivery, the Porsche ID card can be used directly with the supported infrastructure (e.g. public E-charging pedestals).

Unless stated otherwise, we carry out the processing described in this section for fulfilment of our contract with you on the basis of Article 6 Paragraph 1 (b) GDPR.

5.2 Using the My Porsche services and Porsche Connect services

Depending on the service, you can use the booked My Porsche services and Porsche Connect services in your vehicle (if available for your vehicle) via a radio network connection or via other terminal devices in My Porsche or in your Porsche Connect app and, if necessary, also from several or all access points. For this purpose, your vehicle or the respective end device connects to the Porsche Digital Service Infrastructure.

When you use the services booked via My Porsche or the Porsche Connect Store in your vehicle or on other devices, your personal data will be processed by us for the purpose of enabling the use of services, for support purposes and for other individually defined purposes. Unless otherwise stated, we will only process your personal data to the extent necessary to enable the relevant My Porsche service or Porsche Connect service to be used.

When using the individual My Porsche services or Porsche Connect services, the following categories of personal data, for example, may be processed, depending on the specific functionality of the respective service:

- Identification information, such as the vehicle identification number, your Porsche ID and device and system IDs of your end devices and mobile modules, which are required to identify your person, your end device or your vehicle for the purpose of establishing connections, using services or accessing content,

- Authorisation information, which includes that the vehicle or the respective terminal device is activated for the respective Porsche Connect service and which can be linked to your personal data that you entered as part of the registration and creation of your Porsche ID user account,

- Login information that is required if you want to use services from other providers that require a login in your vehicle or on additional end devices,

- Communication information required to establish a connection between your vehicle and/or other terminal devices and our servers or with the servers of third- party content providers for Porsche Connect services,

- Location and movement information, such as GPS or speed data, required in order to use location-related content,

- Voice data that enables voice control and voice input in certain Porsche Connect services. Voice data is transmitted to us as a recording for the purpose of conversion to text from the vehicle or a terminal. The text then generated by a service provider is transmitted back to the vehicle and the recording is then deleted by us,

- Contact data used in communication services, for

example to send an e-mail or SMS,

- Billing data such as an itemised bill from charging operations. If necessary, we will combine this information with your address and payment information for individual billing purposes,

- Image/video data of your vehicle or its components

- Other content that needs to be shared with us or with service providers in order to provide a service to you.

Detailed information on which personal data is processed within the scope of which service can be found in the respective service descriptions at xxxxx://xxxxxxx-xxxxx.xxxxxxx.xxx/xx/xx/.

The following applies especially in the context of workshop visits and the associated use of online order extension:

Online order extension is a service that offers our customers the possibility to follow the vehicle acceptance process during a workshop appointment at any time and from anywhere through recorded and personalised videos of the service consultant and/or technician. In addition, the customer can release/approve additional repairs/repair extensions directly via the My Porsche Portal and/or the My Porsche App.

Unless otherwise stated here, in one of the Specific Privacy Policies or, where applicable, in the further Special Data Protection Notices of the respective service, we process your personal data in each case on the basis of Article 6 Paragraph 1 (b) GDPR in order to provide you with the services in this context and to perform the associated contractual relationship.

5.3 Use of third-party services

If you use the services of a third-party provider with whom you have your own contractual relationship, the content of these services may be displayed in your vehicle or on your terminal device and information may be exchanged between your vehicle or your terminal device and the respective service provider.

We have no influence on the data processing by this third-party provider or on the location of the data processing. Therefore, please inform yourself with the respective third-party provider about the type, scope and purpose of the processing of personal data with regard to the respective service in their separate data protection notices.

We transfer the necessary personal data to the relevant third-party provider on the basis of Article 6 Paragraph 1 (b) GDPR in order to fulfil the contract between you and us.

5.4 Porsche Contact Centre

You can use various communication channels to contact us, in particular the service hotline if you wish to contact us by telephone, but also e-mail or live chat. When you contact our Contact Centre, we will process your personal data insofar as this is necessary in order to provide the Contact Centre service and to process your request. It is possible that we may ask you to provide personal data that is required to prepare and organise contact in order to process your specific request. Without this data, we will not be able to process your inquiry or accede to your request. The purposes of processing arise specifically from your inquiry and the services you have booked. They cover in particular

- The processing of inquiries from interested parties, customers and dealers in relation to products and services from Porsche Sales & Marketplace GmbH. This includes, for example,

- Technical support services

- Assistance when purchasing services or products

- Answering general questions about Sales & Marketplace

- Technical support for customers and dealers, in particular through the provision of a service hotline for telephone contact.

Data is processed on the basis of Article 6 Paragraph 1 (b) GDPR for the purpose of fulfilling the contract with you and implementing measures in advance of the contract.

We also process your personal data to comply with legal obligations to which we are subject. Obligations may arise, for example, from commercial, tax, telecommunications, money laundering, financial or criminal law. The purposes of processing arise from the respective statutory obligation; the processing generally serves the purpose of complying with state obligations with regard to monitoring and duty of disclosure.

Data is processed on the basis of Article 6 Paragraph 1 (c) or (e) GDPR. If we collect data on the basis of a legal oblig ation or in the public interest, you need to provide the personal data that is required to comply with the legal obligation. Without this, we might not be able to process your request or fulfil these obligations.

If you use support services in a Porsche Centre, your dealer can also retrieve this data. To facilitate this service, we also transmit the aforementioned data to the relevant dealer. In this case, we will process your personal data in accordance with Article 6 Paragraph

1 (f) GDPR on the basis of our legitimate interest in facilitating customer service at your preferred point of contact or through your preferred dealer.

6. Safeguarding legitimate interests

We also process your personal data to protect the legitimate interests of us or third parties, unless your interests which require the protection of your personal data override these interests. Data is processed on the basis of Article 6 Paragraph 1 (f) GDPR. Processing for legitimate interest is carried out for the following purposes or to protect the following interests:

- Further development of products, services and mentoring, as well as other measures for business transactions and process control,

- Improvement of product quality, elimination of errors and disruption, etc. by analysing vehicle data and customer feedback,

- Processing data on a central prospect and customer care platform, as well as in up and downstream systems for customer loyalty and sales purposes,

- Settlement of guarantee and goodwill cases, processing of non-contractual questions and concerns from prospective customers and clients,

- Needs analysis and customer segmentation, e.g. calculating and evaluating affinities, preferences and customer potentials,

- Risk management and coordination of recall campaigns,

- Credit assessment through data exchange with credit agencies (e.g. SCHUFA),

- Ensuring the legally compliant handling, prevention of and protection against statutory violations (especially criminal offences), assertion of and defence against legal claims, internal and external compliance measures,

- Ensuring availability, operation and security of technical systems, as well as technical data management.

When we send e-mails to customers and prospective customers, we may use commercially available technologies such as tracking pixels or click-through links. This allows us to analyse which or how many e-mails are delivered and/or rejected and/or opened. The latter is carried out in particular by tracking pixel. It is not possible to measure the opening rate of our e-mails in full using tracking pixels, for example, if you have deactivated the display of images in your e-mail programme. In this case, the e-mail will not be displayed completely. It is nevertheless still possible for us to

determine whether an e-mail has been opened if you click on the text or graphic link in the e-mail. Using click-through links, we can analyse which links have been clicked in our e-mails and determine the interest in certain topics. If you click on the corresponding link, you will be guided through our separate analysis server before accessing the target page. Based on the analysis results, we can make e-mails more relevant, send them in a more targeted manner or prevent e-mails from being sent. If you do not want such information collected and tracked, do not click text or graphic links in e-mails.

7. Consent

We process your personal data on the basis of corresponding consent. Data is processed on the basis of Article 6 Paragraph 1

(a) GDPR. If you have given consent, this is always for a specific purpose; the purposes of processing arise from the respective content in your declaration of consent. You may revoke your consent at any time, without affecting the leg ality of the processing carried out on the basis of your consent until revocation.

Insofar as you have given corresponding consent, the companies listed in the declaration of consent may, on this basis, use the data for individual customer and prospective customer support, for example, and contact you for these purposes via the communication channels you have requested. Your data is used within this framework to offer you an inspiring brand and support experience with Porsche and to make our communication and interaction with you as personal and as relevant as possible. Which of your data is specifically used for individual customer and prospect support depends in particular on which data was collected when using the services and which data you provided within the framework of the services (e.g. your personal interests).

8. Change of purpose

Where we process your personal data for a purpose other than that for which it was collected, beyond appropriate consent or a compelling legal basis, we will take into account, in accordance with Article 6 Paragraph 4 of the GDPR, the compatibility of the original purpose and the purpose now pursued, the nature of the personal data, the possible consequences for you of further processing and the safeguards for the protection of the personal data.

9. Profiling

We do not use automated decision-making in accordance with Article 22 GDPR to prepare, establish or conduct business relationships. If profiling is carried out, this is only done for the purposes stated in the General Privacy Policy, the Specific Privacy Policy and, if applicable, the additional Special Data Protection Notices of the respective service and on the basis of the legal grounds stated.

10. Device access permissions

Some functions of the services require you to grant access to your end device (e.g. access to location data). Granting permissions is voluntary. However, if you wish to use the corresponding functions, you must grant the corresponding authorisations, otherwise you will not be able to use these functions. Permissions remain active unless you revoke them in your device by deactivating the relevant setting. You can find out in which areas access to the device should occur in the Specific Privacy Policy and, if applicable, in the further Special Data Protection Notices of the respective service.

11. Cookies and comparable technologies

Insofar as we use cookies and comparable technologies within the scope of the services, you can find corresponding explanations in

the specific data protection declaration and the further special data protection information of the respective service.

12. Sources and data categories in the collection of data by third parties

We also process personal data that we receive from third parties or from publicly available sources. Below is an overview of the relevant sources and the categories of data obtained from these sources.

- Porsche AG and its group companies, Porsche dealers and service operations: e.g. information about the products you use and your interests;

- Cooperation partners and service providers: e.g. creditworthiness data from credit agencies.

For information on collection of data by third parties, please refer to the Specific Privacy Policies and, if applicable, the further Special Data Protection Notices of the respective service.

13. Recipients of personal data

Within our company, the only people who have access to your personal data are those who need this for the purposes named above. We only pass on your personal data to external recipients if a legal licence exists or if we have your consent. Below you will find an overview of the corresponding recipients:

- Processors: Porsche AG and its group companies or external service providers, for example in the areas of technical infrastructure and maintenance, who are carefully selected and checked. The processors may only use the data in accordance with our instructions.

- Public bodies: authorities and public institutions, such as public prosecutors, courts or tax authorities to which we (must) transfer personal data, e.g. to fulfil legal requirements or to safeguard legitimate interests.

- Private entities: Porsche AG and its group companies, Porsche sales companies, dealerships and service companies, cooperation partners, service providers (not bound by instructions) or authorised persons such as Porsche Centres and Porsche Service Centres, financing banks, credit agencies or transport service providers.

14. Data processing in third countries

If data is transferred to bodies whose headquarters or place of data processing is not located in a member state of the European Union, another country outside of the European Union that is a signatory to the Agreement on the European Economic Area or a state for which an appropriate level of data protection has been determined through a decision of the European Commission, we will ensure before disclosure that the data transfer is either covered by a legal authorisation, that there are guarantees for an adequate level of data protection with regard to the data transfer (e.g. through the agreement of contractual warranties, officially recognised regulations or binding internal data protection regulations at the recipient) or that you have given your consent to the data transfer.

Insofar as data is transferred on the basis of Articles 46, 47 or 49, Paragraph 1, Subparagraph 2 GDPR, you can obtain from us a copy of the guarantees for the existence of an adequate level of data protection with regard to the data transfer or information on the availability of a copy of the guarantees. For this purpose, please use the information under point 1.

15. Duration of storage, deletion

The following shall apply if the description of the individual services does not provide information about the specific duration of storage or the deletion of the personal data:

We store your personal data, if a legal permission exists for this, only as long as necessary to achieve the purposes pursued or as long as you have not revoked your consent. In the event that you object to the processing, we will delete your personal data unless further processing is permitted by the legal provisions. We will also delete your personal data if we are obligated to do so for other legal reasons. Pursuant to these general principles, we will usually erase your personal information immediately

- after elimination of the legal basis and if no other legal basis (e.g. commercial and tax retention periods) impinges. If the latter is the case, we will erase the data once that other legal basis ceases to apply;

- if your personal data is no longer required for our purposes, and if no other legal basis (for example, commercial and tax retention periods) impinges. If the latter is the case, we will delete the data once that other legal basis ceases to apply.

16. Rights of data subjects

Right to information: you have the right to receive information about your personal data stored by us.

Permission and deletion right: you may request us to correct incorrect data and – insofar as the legal requirements are fulfilled – to delete your data.

Limitation of processing: you may require us to restrict the processing of your data, provided that the legal requirements are met.

Data transferability: if you have provided us with data based on a contract or consent, you may, if the statutory requirements are met, obtain from us the data provided by you in a structured, commonly used and machine-readable format, or require us to transmit it to another controller.

Objection: you have the right to object at any time, on grounds relating to your particular situation, to our processing of your data, provided this objection is based on the safeguarding of "legitimate interests". If you make use of your right of objection, we will stop processing your data, unless we can prove, in accordance with the legal requirements, compelling legitimate reasons for further processing that outweigh your rights.

Objection to direct marketing: if we process your personal data for the purpose of direct marketing, you have the right to object to our processing of your data for this purpose at any time. If you exercise your right to object, we will stop processing for this purpose.

Withdrawal of consent: if you have given us consent to the processing of your personal data, you can revoke this at any time with effect for the future. The withdrawal of consent will not affect the lawfulness of processing before i ts withdrawal.

Right of appeal to the supervisory authority: you can also lodge a complaint with the competent supervisory authority if you believe that the processing of your data violates applicable law. You can contact the supervisory authority responsible for your place of residence or country or the supervisory authority responsible for us.

Your contact with us and exercising your rights: furthermore, you can contact us free of charge with questions about the processing of your personal data and about your rights as a data subject. Please contact us by e-mail at xxxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxx@xxxxxxx.xx, via the website xxxxx://xxx.xxxxxxx.xxx/xxxxxxxxxxxxx/xxxxxxx/xxxxxxx/ or by post at the address indicated in section 1 above. When doing so, please make sure that we can clearly identify you. If you wish to withdraw your consent, you can alternatively use the method of contact that you used when you gave your consent.

17. Offers from third parties

Services of other providers that are referred to via our services were and are created and hosted by third parties. We have no influence over the design, content and function of these services. We dissociate ourselves expressly from the content of all services referred to. Please note that these services, for example third-party websites, may place their own cookies on your device and may collect personal data. We have no influence over this. If necessary, please refer directly to the providers of these referred services.

Insofar as the services also incorporate services of other providers in order to offer you certain content or functions, you can find corresponding explanations in the Specific Privacy Policy and the further Special Data Protection Notices of the respective service.

18. Status

The most up-to-date version of this Privacy Policy shall apply. Status: 01.02.2023

Specific Privacy Policy Porsche Sales & Marketplace Websites

You can use My Porsche, Porsche Connect Store and the Online Marketplace via our website (hereinafter also referred to as "website").

You can book My Porsche services, Porsche Connect services and Functions on Demand (FoD) and activate the corresponding licences in My Porsche and the Porsche Connect Store. This requires you to be registered with My Porsche and have a Porsche ID user account. Depending on the service, you can use and manage the aforementioned services via our website, via various Porsche apps and, if available for your vehicle, in your vehicle via the wireless network connection.

In addition, you can use the Online Marketplace to access the extended range of products and services offered by our Group companies and third-party providers. Customers with a Porsche ID user account can use the Marketplace sections Porsche Finder and Porsche Store.

Some features on our websites are also available without registration. For further details see Point 2.3.

1. Special notes on the use of our website

1.1 Provision of our website

To a certain extent, it is possible to use this website without logging in. Even if you use the website without registration, personal data may still be processed. Below you will find an overview of the type, scope, purposes of and legal grounds for automated data processing that takes place when using our website. For information on the processing of personal data when using the individual specific features and services, please refer to Point 2 below.

The following data will be processed by us when you access our website with your device:

- Date and time of access,

- Duration of visit,

- Type of device,

- Operating system used,

- The features you use,

- Amount of data transmitted,

- Type of event,

- IP address,

- Referrer URL,

- Domain name.

We process this data on the basis of the GDPR Article 6 Paragraph 1 (b) and (f) for the purpose of providing the website, safeguarding its technical operation and identifying and resolving malfunctions. In doing so, we also pursue the aim of permanently ensur ing the technical functionality of the website, improving performance and optimising the user experience. This data is processed automatically when you access our website. Without the provision of data, you cannot use our website. We do not use this data for the purpose of drawing conclusions about your person or your identity.

1.2 Cookies and comparable technologies

We use cookies and similar technologies within the framework of the website, which serve to communicate with your terminal device and to exchange stored information (hereinafter collectively "cookies"). These cookies are primarily used to make the functions of the website usable. General examples in which the use of cookies

is technically necessary in this sense are the storage of a language selection, login data or a shopping or watch list. Accordingly, technically necessary cookies may be used by us to enable the processing operations described above and to ensure the proper and secure operation of the website. Data processing takes place on the basis of the GDPR Article 6, Paragraph 1 (b) and (f), as this is necessary for implementation of the functions that you select and in order to safeguard our legitimate interest in the functionality of our website.

If we also use cookies to analyse the use of the website and to target it to your interests and, if applicable, to provide you with interest-based content and advertisements, this will only be done on the basis of your voluntary consent in accordance with Article 6 Paragraph 1 (a) GDPR. You then have the option of making your corresponding settings via the consent management at xxxxx://xxxxxxx-xxxxx0.xxxxxxx.xxx/xx/xx/xxxxxxxxxxxx. You can revoke your consent at any time with effect for the future. Further information on the cookies and their function in detail, as well as on setting and revocation options, is available directly in the corresponding areas of the consent management. Please note that we only provide consent management as part of the website if consent-based cookies are to be used in addition to the technically required cookies mentioned above.

If you do not wish to use cookies in general, you can also prevent any storage by means of the relevant settings on your device. Stored cookies can be erased at any time using the system settings of your device. Please note that blocking certain types of cookie may result in impaired use of our website.

1.3 Device access permissions

When using individual functions, you may be asked to grant access to your location.

Granting permissions is voluntary. However, if you wish to use the relevant features, you must grant the corresponding permissions, otherwise you will not be able to use these features.

Permissions remain active unless you revoke them in your device and/or Internet browser by deactivating the relevant setting.

2. Special services and features

You can voluntarily provide personal information or register for services or features when using our website. When registering and using the services and features described below, personal data will be collected, processed and used by us as shown below.

It is necessary to register in advance and to create a Porsche ID user account in order to use the services and features described in Point 2.2. The services and features described in Point 2.3 can be used without prior registration.

2.1 Registration process and creation of a Porsche ID user account

Information on the registration process and the creation of your Porsche ID user account can be found in Point 4.1 of the Porsche Digital Service Infrastructure / Porsche ID General Privacy Policy.

2.2 Using the individual features with registration/login

The features within the framework of our offering on our website and the relevant processed personal data, purposes and legal bases are described below.

2.2.1 Booking and activating services, handling payment information, identity verification

For information about how to book services via our website and how payment information is handled, see Point 5.1 of the Porsche Digital Service Infrastructure / Porsche ID General Privacy Policy.

The laws in some countries may require an identity check based on identification documents in order to book certain telecommunications services. In relation to data processing when carrying out such identity checks, we are jointly responsible with

- IDnow GmbH, Auenstr. 100, 80469 Munich, Germany.

You can access the Privacy Policy of our cooperation partner IDnow GmbH via xxxxx://xxxxx.xx/xxxxxxx/.

There are two methods available for performing identity verification. One method is that you can be redirected to the external page or app of the service provider, IDnow, as part of the service booking procedure. As part of the process, we will, at your request, transmit the information to be verified (your name, your address and your date of birth) as well as a reference number to the service provider that will allow us to assign the test result at a later point. As part of the identity check, the service provider will compare the aforementioned data with your identification document and store the data, as well as an optoelectronic copy of the identification document, a photo of the verified person and an audio record of the session. The service provider will then inform us of the result of the identity check, using the reference number.

Your other option is to have identity verification performed at a participating Porsche Centre. This involves staff at the Porsche Centre verifying your identity on the basis of an identification document and sending the verified information (your name, address and date of birth) and a reference number to the service provider via a Porsche system. By entering this reference number, you can use the service provider's app to submit an optoelectronic copy of your identification document to the service provider at your convenience. The service provider will then inform us of the result of the identity check, using the reference number.

Personal data resulting from this identity check will only be shared with third parties if we are legally obliged to do so. Only in such cases will we obtain access to a copy of your identification document from the service provider, for the purpose of fulfilling our legal obligations.

The legal basis for our processing of your personal data in order to carry out an identity check is GDPR Article 6 [1] ( c) and/or (f), as the identity check is the fulfilment of a legal obligation by which we are bound, or reflects to our legitimate interest in complying with legal requirements.

As the jointly responsible party together with IDnow GmbH, we have determined in an agreement according to GDPR Article 26 how the respective functions and relationships in the processing of personal data are to be structured and who is to satisfy which data protection obligations, in particular with regard to ensuring an adequate level of security, the implementation of your rights as a data subject, the fulfilment of data protection obligations, as well as the monitoring of potential data protection incidents, including the assurance of reporting or notification obligations (as required). You can use the contact details provided in Point 1 (of the General Privacy Policy) to request further information about this agreement; we shall then supply you with the key provisions.

You are welcome to contact either of the jointly responsible parties with questions or to exercise your rights as a data subject. In the spirit of the aforementioned agreement, we will consult with IDnow

GmbH in accordance with GDPR Article 26 in order to answer your inquiry and, if necessary, to fulfil your wish to exercise your rights as a data subject.

The exchange of personal data between the jointly responsible parties takes place on the basis of GDPR Article 6 (1) (f), in other words our legitimate interest in the effective implementation of identity checks in cooperation with IDnow GmbH.

If necessary, we supply further information about the processing of personal data for our bookable services in the additional special data protection provisions for the relevant services.

2.2.2 Using the My Porsche services and Porsche Connect services

Information on the use of My Porsche services and Porsche Connect services via our website can be found in Point 5.2 of the Porsche Digital Service Infrastructure / Porsche ID General Privacy Policy.

2.2.3 Provision of service and warranty information

Prior registration and creation of a Porsche ID user account is required to use this feature.

In order to provide you with information about your vehicle, current warranties and recall campaigns in the "My Porsche" section of our website, we process equipment and vehicle master data such as the vehicle identification number shown on the proof of ownership, current warranties, the model year and a model picture.

Pursuant to GDPR Article 6 [1] (b), the legal basis for the processing of your personal data is the fulfilment of the contract between you and us.

2.2.4 Service appointment request

Prior registration and creation of a Porsche ID user account are required to use this feature.

To request service appointments with Porsche dealers and service companies in the "My Porsche" section of our website and app, we may provide customer and vehicle data to companies of your choice at your request. If you wish, we will provide your name, address, telephone number, e-mail address, Porsche ID, vehicle identification number shown in the proof of ownership, vehicle model, the service dates you have selected, the scope of service you desire, and a supplementary message to your request, as well as the desired contact channels for the dealer or service company chosen by you for the relevant request (the dealer or service company that will be carrying out the work).

The transmission of your personal data takes place within the framework of the respective service request on the legal basis of GDPR Article 6(1) (b) as a precontractual measure at your request. We store your respective service request in order to fulfil the contract between you and us in accordance with GDPR Article 6(1) (b).

2.2.5 Event Booking

With the Event Booking function, you can register for selected Porsche events in the app and via the My Porsche portal.

For this purpose, we process the following personal data in particular: master data, contact data and data requested for the implementation of the event. We process the above personal data on the legal basis of GDPR Article 6 Paragraph 1 (b) to fulfil the contract with you to provide the app and its functions as well as on the legal basis of GDPR Article 6 Paragraph 1 (f) to fulfil our justified

interest in providing services. The responsibility for the implementation of the respective event and thus for the further data processing required for the implementation of the event lies with the organiser named in the registration form for the respective event.

2.2.6 My Porsche News

The My Porsche News function lets you call up news in the app as well as via the My Porsche portal. This usually entails information relevant to the contract in connection with the purchase and/or the use of your account, your vehicle or digital content from Porsche.

For this purpose, we process the following personal data in particular: master data, contact data, contract data, dealership data and vehicle data.

We process the above personal data on the legal basis of GDPR Article 6 Paragraph 1 (b) to fulfil our contract with you to provide the app and its functions as well as on the basis of the legal basis of GDPR Article 6 Paragraph 1 (f) to fulfil our justified interest in providing services in connection with your contract.

2.2.7 Collection of vehicle, service and product data for product and service development and improvement

In connection with the use of services, in the event of error messages or as part of defined data evaluation measures, certain vehicle, service and product data from the vehicle, from services or from other Porsche products may be transferred by Porsche Sales & Marketplace GmbH to Porsche AG in order to be available there for evaluation of the aforementioned purposes.

You can consent to this on the "My Porsche" website.

The vehicle, service and product data comprise identification, basic, usage, analysis, environmental, traffic, location and movement data.

Some data cannot be deleted retroactively, as they are stor ed without concrete vehicle identification. In this case the data will be deleted after 5 years at the latest.

2.2.8 Reservation and purchase of services and products via the "Online Marketplace" section

As part of the Online Marketplace, we offer you a central platform where you can book or purchase services and products from us, our group companies and third-party providers (hereinafter also referred to as "participants"). The respective participant is provided with an area on our platform to present and offer their products and services (hereinafter referred to as "shop").

Customers with a Porsche ID user account can use the "Marketplace" sections "Porsche Finder" and "Porsche Store". Customers without an existing Porsche ID contract can also use the Marketplace section "Porsche Store" via the "Guest access" feature.

Processing within the framework of the Online Marketplace is carried out partly by us, partly by the respective participant and partly under joint responsibility.

2.2.8.1 Processing under the responsibility of PSM GmbH

For information on the data processing (e.g. processing of master data) carried out by us under our sole responsibility, please refer to the other chapters of this and other privacy policies of Sales & Marketplace GmbH.

2.2.8.2 Processing under the responsibility of Marketplace participants

For information on data processing carried out by marketplace participants under their sole responsibility (e.g. processing for creating invoices, providing products, rescinded transactions in the event of a return etc.), please refer to the privacy policies of the respective companies. The responsible participant is indicated on the respective page of the product or service.

PSM GmbH also acts as a marketplace participant in certain cases. Further information about processing your personal data within the processing of the contract in the online marketplace can be found under Item 5.1 of the "Porsche Digital Service Infrastructure/Porsche ID" general privacy policy.

2.2.8.3 Processing under joint responsibility of PSM GmbH and Marketplace participants

With regard to the following processing, we are jointly responsible with the respective participants of the Online Marketplace who have placed the offer on the respective page and with whom you may book services or products:

- Data processing as part of the visit and the booking, application or reservation process in the respective shop of the Marketplace participant, but not the downstream service processing outside the platform;

- Automated data collection, data processing to improve our online service, storage of cookies and data analysis (see Point 1.1 of this Privacy Policy);

- Data processing within the scope of advertising, communication and marketing features of the platform, especially cross-selling modules;

- Payment processing for paid bookings, applications and reservations within the framework of the respective shop of the Online Marketplace;

- Customer support with regard to the respective shop in the Marketplace.

In relation to these data processing activities, we determine the purposes and means of processing personal data in cooperation with the respective Marketplace participants.

In an agreement with the relevant Marketplace participants on joint responsibility, we have defined, pursuant to GDPR Article 26, the respective tasks and responsibilities in the processing of personal data and the responsible parties to fulfil data protection obligations. In particular, we have defined how an appropriate level of security and your rights as a data subject can be ensured, how we can jointly comply with data protection information obligations and how we can monitor potential data protection incidents. This also includes ensuring that we can fulfil our reporting and notification obligations.

PSM GmbH is at your disposal as your central point of contact with regard to the aforementioned processing in joint responsibility. You can assert your rights in relation to processing operations under joint responsibility but also vis-à-vis a jointly responsible Marketplace participant. Insofar as you contact us in relation to these processing operations, we will consult with the relevant Marketplace participant in accordance with the aforementioned agreement under GDPR Article 26 in order to answer your enquiry and to guarantee your data subject rights. In this case, the statements in Section 13 of the General Privacy Policy apply.

This joint responsibility does not affect, in particular, the processing operations mentioned in the General Privacy Policy, including those for master data administration (Porsche ID) and data processing on the platform, which are carried out under the sole responsibility of Porsche Sales & Marketplace GmbH. In particular, the service processing of the purchase, booking, application or reservation contract as well as invoicing does not take place under joint responsibility, but under the sole responsibility of the relevant Marketplace provider.

2.3 Using the individual features without registration/login

The features within the framework of our website and the relevant processed personal data, purposes and legal bases are described below.

2.3.1 Contact via Live Chat

No prior registration and creation of a Porsche ID user account is required to use this feature.

In certain sections of our website we offer contact and advice via Live Chat. Live Chat allows you to communicate with one of our consultants via text messages. When you access and use Live Chat, your browser automatically transmits the following data at the beginning of use for technical reasons. We store this data separately from other data that you may transmit to us:

- Date and time of access

- Duration of website visit

- Type of web browser including version

- Operating system used

- Amount of data transmitted

- Type of event

- IP address.

We process this data on the basis of GDPR Article 6 Paragraph 1

(b) and (f) for the purpose of providing the function, safeguarding its technical operation and identifying and clearing up malfunctions. In doing so, we also pursue the aim of permanently ensuring the technical functionality of the function, improving performance and optimising the user experience. When you call up the function, this data will be processed automatically. Without the provision of data, you will not be able to use the function. We do not use this data for the purpose of drawing conclusions about your person or your identity.

If you provide us with additional personal data via Live Chat, you do so on a voluntary basis. If personal data is required to clarify your request, we will point this out to you and ask you for your personal data. The texts you enter into the input mask during the Live Chat session are stored on our behalf on an external service provider's server. The legal basis for this data processing is GDPR Article 6 [1] (b).

2.3.2 Guest access for reservation and purchase of services and products via the "Online Marketplace" section

In addition to using the Online Marketplace with Porsche ID, customers can use the Porsche Store Marketplace section without prior registration and creation of a Porsche ID user account via the "Guest access" feature. For information on data processing in this context, please refer to Point 2.2.6.

2.4 Newsletter

We send newsletters to people who have registered, i.e. with your consent. Insofar as the contents of the newsletter are specifically described when registering, these are decisive for the scope of the consent. In addition, our newsletters contain information about our products, offers, promotions and our company. The party responsible for processing your data is the respective company named in the registration process. Registration takes place by means of the so-called double opt-in procedure, i.e. after your registration you will receive an e-mail in which you will be asked to confirm your registration in order to prevent the misuse of your e- mail address. Registering for the newsletter is recorded by us to be able to prove the registration process and the consent in accordance with the legal requirements. The recording of the registration and the necessary processing of the data entered by you during the registration is carried out accordingly on the basis

of our legitimate interests pursuant to Article 6 Paragraph 1 (f) GDPR. You may revoke your consent to receive our newsletter at any time, e.g. by unsubscribing from the newsletter. An unsubscribe link can be found at the end of every newsletter so you can exercise this right.

3. Integrated third party services

Insofar as we integrate services of other providers within the framework of our website in order to offer you certain content or functions (e.g. playing videos or route planning) and we process personal data in the process, this is done on the basis of Article 6 Paragraph 1 (b) and (f) GDPR. This is because the data processing is then necessary to implement the functions you have selected or to safeguard our legitimate interest in an optimal range of functions. Insofar as cookies may be used within the scope of these third- party services, the explanations under section 1.1.3 apply. Please also inform yourself about the privacy policy of the respective provider with regard to the third-party services.

Services of other providers that we include or to which we refer are provided by the respective third parties. Third-party services generally also include services offered by Porsche AG and other group companies. As a matter of principle, we have no influence over the content and function of third-party services and are not responsible for the processing of your personal data by their providers, unless the third-party services are designed entirely on our behalf and then integrated by us under our own responsibility. Insofar as integrating a third-party service leads to our establishing joint processes with the service provider, we establish an agreement with this provider on joint responsibility pursuant to GDPR Article 26, defining the respective tasks and responsibilities in the processing of personal data and the responsible parties for fulfilling data protection obligations. Insofar as cookies are also to be set on the basis of your consent, you will receive further information on the responsibility for setting these cookies or any associated third-party services in the corresponding areas of the consent management.

Unless otherwise stated, profiles on social media are only integrated as links to the corresponding third-party services. After clicking on the embedded text/image link, you will be redirected to the service of the respective social media provider. After forwarding, personal data may be collected directly by the third- party provider. If you are logged into your user account of the respective social media provider during this time, the provider may be able to assign the collected information of the specific visit to your personal user account. If you interact via a "Share" button of the respective social media provider, this information may be stored in the personal user account and possibly published. To prevent the collected information from being directly assigned to your user account, you must log out before clicking on the embedded text/image link.

4. Rights of data subjects

As the person whose data is being processed, you have numerous rights at your disposal. In particular, you may object to the use of cookies or similar technologies at any time. For details please refer to our Porsche Sales & Marketplace Cookie Policy for Websites, which can be retrieved at xxxxx://xxxxxxx- xxxxx.xxxxxxx.xxx/xx/xx/x/xxxxxxx.

To find out about your additional rights, please refer to the information in Point 13 of the My Porsche and Porsche Connect Services / Porsche Digital Service Infrastructure General Privacy Policy, which you can access at xxxxx://xxxxxxx- xxxxx.xxxxxxx.xxx/xx/xx/x/xxxxxxx.

5. Changes to this Privacy Policy and version

We reserve the right to modify this Specific Privacy Policy. The current version of the Privacy Policy can always be found at xxxxx://xxxxxxx-xxxxx.xxxxxxx.xxx/xx/xx/x/xxxxxxx.

Date: 01.02.2023