Vehicle Loan / Vehicle Rent and Declaration of consent for the transfer of personal data for a rapid antigen test
1. Vehicle Loan / Vehicle Rent
We, AVANTGARDE Experiences GmbH, are happy about your interest in our products and services. We take the protection of your personal data very seriously. Your personal data will be processed exclusively in accordance with the statutory provisions of data protection law, in particular the General Data Protection Regulation (hereinafter referred to as "GDPR"). With this Privacy Policy, we inform you about the processing of your personal data and about your rights as a data subject as affected in the context of a vehicle loan or rent. For information on the processing of personal data in other areas, please refer to the respective specific privacy policies.
1.1 Controller and data protection officer
Responsible for the data processing as controller in terms of data protection law is:
AVANTGARDE Experiences GmbH
Atelierstraße 10
81671 München
T +49 711 652-000222
E-Mail: info.porscheexperience@avantgarde.de
If you have any questions or suggestions regarding data protection, please feel free to contact us. You can reach our data protection officer as follows:
Nico Lepel
Director Data Privacy Compliance
AVANTGARDE Management GmbH
Atelierstraße 10
81671 München
E-Mail: datenschutz.porscheexperience@avantgarde.de
1.2 Subject of data protection
The subject of data protection is the protection of personal data. This is all information relating to an identified or identifiable natural person (so-called data subject). This includes information such as name, postal address, email address or telephone number, but also other information about your person that arises in the course of our interaction with you, in particular contact and identification data, contract data, driver's license data, credit rating and bank data.
1.3 Purposes and legal basis of data processing
In the following, you will find an overview of the purposes and legal basis of data processing. In any case, we process personal data in accordance with the legal requirements, even if in individual cases a different legal basis should be relevant than that stated below.
The provision of personal data by you may be required by law or contract or may be necessary for the conclusion of a contract. We will point it out separately if you are obliged to provide personal data and what possible consequences the non-supply would then have (e.g. a loss of claims or our position not to provide the requested service without providing certain information).
1.3.1 Performance of a contract and pre-contractual measures
We process your personal data if this is necessary for the performance of a contract to which you are a party or for the implementation of pre-contractual measures taken in response to your request. The data processing is based on Article 6 paragraph 1 letter b) GDPR. The purposes of processing include enabling the use of our specific products and services within the framework of the performance of the contract on vehicle loan or rental. This includes in particular the execution of the contract, the accompanying support services, the transfer of the vehicle and the processing of claims. Please find more details in the respective documents describing our products and services further to this Privacy Policy.
1.4 Compliance with legal obligations
We process your personal data to comply with legal obligations to which we are subject. The data processing is based on Article 6 paragraph 1 letter c) GDPR. These obligations may arise, for example, from commercial, tax, money laundering, financial or criminal law. The purposes of the processing result from the respective legal obligation; as a rule, the processing serves the purpose of complying with state control and information obligations.
1.5 Safeguarding of legitimate interests
We also process your personal data to pursue the legitimate interests of ourselves or third parties, unless your rights, which require the protection of your personal data, outweigh these interests. The data processing is based on Article 6 paragraph 1 letter f) GDPR. The processing to safeguard legitimate interests is carried out for the following purposes or to safeguard the following interests:
Further development of products, services and support offers as well as other measures to control business transactions and processes;
Handling of non-contractual inquiries and concerns;
Risk management and coordination of recall actions;
Ensuring legally compliant actions, prevention of and protection against legal violations (especially criminal offences), assertion of and defense against legal claims, internal and external compliance measures;
Ensuring availability, operation and security of technical systems as well as technical data management;
Answering and evaluation of contact requests and feedback.
1.5.1 Consent
We process your personal data on the basis of corresponding consent. The data processing is based on Article 6 paragraph 1 letter a) GDPR. If you give your consent, it is always for a specific purpose; the purposes of processing are determined by the content of your declaration of consent. You may revoke any consent you have given at any time, without affecting the legality of the processing that has taken place on the basis of the consent until revocation.
1.5.2 Change of purpose
If we process your personal data for a purpose other than that for which the data was collected, beyond the scope of a corresponding consent or a mandatory legal basis, we will take into account, in accordance with Article 6 paragraph 4 GDPR, the compatibility of the original and the now pursued purpose, the nature of the personal data, the possible consequences of further processing for you and the guarantees for the protection of the personal data.
1.5.3 Profiling
We do not carry out automated decision making or profiling in accordance with Article 22 GDPR. Profiling is only carried out to protect our legitimate interests as described above.
1.6 Recipients of personal data
Within our company, only those persons who need your personal data for the respective purposes mentioned have access to it. Your personal data will only be passed on to external recipients if we have legal permission to do so or have your consent. Below you will find an overview of the corresponding recipients:
Commissioned processors: Group companies or external service providers, for example in the areas of technical infrastructure and maintenance, which are carefully selected and reviewed. The processors may only use the data in accordance with our instructions.
Public bodies: Authorities and state institutions, such as tax authorities, public prosecutors' offices or courts, to which we (must) transfer personal data, e.g. to fulfil legal obligations or to protect legitimate interests.
Private bodies: Group companies, cooperation partners, (non-processor) service providers or commissioned persons such as Porsche Centres and service companies, financing banks, credit agencies or transport service providers.
1.7 Data processing in third countries
If a data transfer takes place to entities whose registered office or place of data processing is not located in a member state of the European Union, another state party to the Agreement on the European Economic Area or a state for which an adequate level of data protection has been determined by a decision of the European Commission, we will ensure prior to the transfer that either the data transfer is covered by a statutory permit, that guarantees for an adequate level of data protection with regard to the data transfer are in place (e.g., through the agreement of contractual warranties, officially recognized regulations or binding internal data protection regulations at the recipient), or that you have given your consent to the data transfer.
If the data is transferred on the basis of Articles 46, 47 or 49 paragraph 1, subparagraph 2 GDPR, you can obtain from us a copy or reference to the availability of the guarantees for an adequate level of data protection in relation to the data transfer. Please use the information provided under Sec. 1.
1.8 Storage duration, erasure of data
We store your personal data, if there is legal permission to do so, only as long as necessary to achieve the intended purposes or as long as you have not revoked your consent. In the event of an objection to processing, we will delete your personal data, unless further processing is still permitted by law. We will also delete your personal data if we are obliged to do so for other legal reasons. Applying these general principles, we will usually delete your personal data immediately
after the legal permission has ceased to apply and provided that no other legal basis (e.g. commercial and tax law retention periods) intervenes. If the latter applies, we will delete the data after the other legal basis has ceased to apply;
if your personal data is no longer required for the purposes we pursue and no other legal basis (e.g. commercial and tax law retention periods) intervenes. If the latter is the case, we will delete the data after the other legal basis has ceased to apply;
1.9 Rights of data subjects
Right to access: You have the right to receive information about your personal data stored by us.
Right to rectification and erasure: You can demand that we correct incorrect data and, if the legal requirements are met, delete your data.
Restriction of processing: You can demand that we restrict the processing of your data, provided that the legal requirements are met.
Data portability: If you have provided us with data on the basis of a contract or consent, you may, if the legal requirements are met, demand that the data you have provided us with are handed over in a structured, common and machine-readable format or that we transfer it to another controller.
Objection: You have the right to object at any time to data processing by us based on the safeguarding of legitimate interests for reasons arising from your particular situation. If you make use of your right to object, we will stop processing the data unless we can prove compelling reasons for further processing worthy of protection which outweigh your rights and interests.
Objection to direct marketing: If we process your personal data for the purpose of direct marketing, you have the right to object to our processing of your data for this purpose at any time. If you exercise your right to object, we will stop processing your data for this purpose.
Revocation of consent: If you have given us your consent to process your personal data, you can revoke it at any time
with effect for the future. The legality of the processing of your data until revocation remains unaffected.
Right to lodge a complaint with a supervisory authority: You can also lodge a complaint with the competent supervisory authority if you believe that the processing of your data violates applicable law. You can contact the supervisory authority responsible for your place of residence or your country or the supervisory authority responsible for us.
Your contact with us and the exercise of your rights: Furthermore, you can contact us free of charge if you have questions regarding the processing of your personal data and your rights as a data subject. Please contact us at datenschutz.porscheexperience@avantgarde.de or by letter mail to the address provided under Section 1. Please make sure that we can definitely identify you. If you revoke your consent, you can alternatively choose the contact method that you used when you gave your consent. For further information on the subject of data protection, please visit the Porsche Experience website at https://experience.porsche.com/privacy-policy.
1.10. Effective date
The latest version of this Privacy Policy applies. This version dates from 01.03.2023.
2. Declaration of consent for the transfer of personal data for a rapid antigen test
With these notes on data processing, we comply with our information obligations under Art.12 et seq. of the General Data Protection Regulation (hereinafter referred to as "GDPR") in connection with the planned investigation.
2.1 Person responsible for data processing
AVANTGARDE Experiences GmbH is responsible for data processing. If you have any questions regarding our handling of personal data, please do not hesitate to contact us by e- datenschutz.porscheexperience@avantgarde.de
2.2 Data protection officer
You have the right to contact our data protection officer with questions relating to the processing of personal data, as well as regarding the exercise of your data subject rights, in accordance with the GDPR. You can reach this person under the following contact details:
Nico Lepel
Director Data Privacy Compliance
AVANTGARDE Management GmbH
Atelierstraße 10
81671 München
E-Mail: datenschutz.porscheexperience@avantgarde.de
2.3 Processing of data
Participation in COVID-19 testing by means of a nose-throat- swab (nasopharyngeal swab) is only possible if you voluntarily give your consent in writing to the processing of personal data that goes along with it. If you do not wish to give this consent, participation in the testing is unfortunately not possible. In order for us to perform the testing for the purpose of detecting acute SARS CoV-2 infection/ COVID-19 disease, we need to process your personal data. This concerns your
First and Last Name
E-mail
Mobile number
We base the lawfulness of this data processing on Art. 6 para.1 lit.a GDPR. You declare your express consent to this to us by signing this form.
2.4 Data transfer
you have given your express consent to this in accordance with Art. 6 Para.1 lit.a GDPR; the disclosure is necessary for the assertion, exercise or defense of legal claims pursuant to Art. 6 para.1 lit.f GDPR; we are legally obligated to disclose in accordance with Art. 6 para.1 lit.c GDPR; the disclosure is necessary for the processing of a contractual relationship in accordance with Art. 6 para.1 lit.b GDPR.
2.5 Data storage
Your processed data will be stored securely from access by unauthorized persons and deleted immediately after the purpose of processing has been fulfilled. Your test result in connection with your personal data will be deleted after XX days, i.e. after the expiration of the validity of the result. In the event of a positive test, we are obliged to pass on your personal data, as well as the test result, to the health authorities
2.6 Data subject rights
As a data subject within the meaning of § 4 No.1 GDPR, you are entitled to indispensable rights regulated in the GDPR (so-called data subject rights). You therefore have the right
to request information about the data we have stored about you in accordance with Art. 15 GDPR;
in accordance with Art. 16 GDPR, to demand the correction or completion of the data we have stored about you without delay;
in accordance with Art. 17 GDPR, to request the deletion of the data we have stored about you, unless this is contrary to Art. 17 (3) GDPR;
in accordance with Article 18 of the Regulation, to request the restriction of the processing of the data we have stored about you, if the conditions of Article 18(1)(a)-(d) of the Regulation apply and if the restriction of the processing of your data does not impede the containment of the epidemic.
in accordance with Art. 20 GDPR, to request the transfer of the data we have stored from you in a structured, common and machine-readable format (e.g. as a PDF) without any hurdles;
object to the processing of your data in accordance with Art. 21 GDPR, if it is processed by us on the legal basis of Art. 6 para.1 lit.f GDPR and your objection arises from a special situation or is directed against direct marketing. In the latter case, you can also object to the processing without any reason. In the event of a positive test result, an objection to this consent does not have any legal effect insofar as, according to the Epidemics Act, a notification must be made to the health authority and this entails further measures according to the Epidemics Act (implementation of subsequent testing, etc.).
revoke your consent to data processing in accordance with Article 7 (3) of the Regulation; in the event of a positive test result, revocation of this consent has no legal effect insofar as a report must be made to the health authority in accordance with the Epidemics Act and this entails further measures in accordance with the Epidemics Act (implementation of subsequent testing, etc.).
file a complaint with the competent supervisory authority pursuant to Article 77 of the GDPR. You can send your requests, objections or revocations at any time by e-mail to info.porscheexperience@avantgarde.de. Before deleting or adapting your data, your identity must first be ensured by a procedure suitable for this purpose.
2.7 Storage location and integration of service providers
We reserve the right to use various service providers for the storage and processing of your data, but they will act exclusively on our behalf and in accordance with our instructions. We will oblige the service providers we use to take technical and organizational measures that are suitable according to the current state of the art to ensure that your data is processed in compliance with data protection laws. Under no circumstances will your data be passed on or sold to third parties by our service providers.