Data Privacy

Porsche Sales & Marketplace Canada, Ltd. 

General Privacy Policy 

Porsche Digital Service Infrastructure / Porsche ID 

We, Porsche Sales & Marketplace Canada, Ltd. (hereinafter referred to as "we" or "PSMC Ltd."), are pleased about your use of the Porsche Digital Service Infrastructure and other of our digital offers (hereinafter individually or jointly also referred to as "services" and jointly "Porsche Digital Service Infrastructure"). We take the protection of your personal data very seriously. Your personal data will only be processed in accordance with the provisions of data protection legislation, in particular the General Data Protection Regulation (hereinafter "GDPR") and applicable Canadian privacy laws. This Privacy Policy provides information about the processing of your personal data and your privacy rights as a data subject in connection with your use of the Porsche Digital Service Infrastructure and our services. For information on the individual services, please refer to the Specific Privacy Policy and, if applicable, the further Special Data Protection Notices of the respective service. 

1. Data Controller and Data Protection Officer 

Unless otherwise expressly stated in this or a Specific Privacy Policy based thereon and, if applicable, in the further Special Data Protection Notices of the respective service, the entity responsible for data processing within the meaning of the data protection laws is PSMC Ltd. 

Please do not hesitate to contact us if you have any questions or ideas relating to data protection. You can contact our Privacy Office as follows: 

Porsche Sales & Marketplace Canada, Ltd. 
165 Yorkland Blvd. Unit #150 
Toronto, Ontario, Canada 
M2J 4R2 
Email : privacy@porsche.ca 

In relation to certain processing operations, we may be joint controllers with Dr. Ing. h.c. Porsche AG (Porscheplatz 1, 70435 Stuttgart, Germany, e-mail:  info@porsche.de, hereinafter "Porsche AG"), its group companies and/or third parties ("we" then also stands for these joint controllers). In relation to such joint processes, we jointly determine the purposes and means of processing personal data. In such cases, in an agreement on joint responsibility pursuant to GDPR Article 26 and applicable Canadian privacy laws, we accordingly also define the respective tasks and responsibilities in the processing of personal data and the responsible parties to fulfil data protection obligations. In particular, we define how an appropriate level of security and your rights as a data subject can be ensured, how we can jointly comply with information obligations under data protection law and how we can monitor potential data protection incidents. This also includes ensuring that we can fulfil our reporting and notification obligations. Insofar as you contact us, we will come to an agreement in accordance with the aforementioned agreement pursuant to GDPR Article 26 and applicable Canadian privacy laws in order to answer your enquiry and guarantee your data subject rights. You can find out in which areas and with which companies joint responsibility exists in the Specific Privacy Policy and, if applicable, in the further Special Data Protection Notices of the respective service. 

2. Object of data protection 

The object of data protection is the protection of personal data. This is any information that relates to an identified or identifiable natural person (so-called data subject). This includes details such as name, postal address, e-mail address or telephone number, but also other information that arises in the course of using our Porsche Digital Service Infrastructure and vehicle usage data. 

3. Purposes of and legal grounds for data processing  

This General Privacy Policy provides you with the following overview of the purposes and legal bases of data processing in the context of registering, creating and using your Porsche ID user account and booking and using our services on the basis of your Porsche ID user account. We process personal data in any case in accordance with the legal requirements, even if a different legal basis should apply than stated below in individual cases.  

We process your personal data in particular if this is necessary for the performance of a contract to which you are a party or for the performance of pre-contractual measures that take place at your request. Data is processed on the basis of Article 6 Paragraph 1 (b) GDPR and applicable Canadian privacy laws. The purposes of the processing include enabling the use of our specific products and services within the services as explained below. 

We also process your personal data, insofar as this is necessary, to comply with legal obligations to which we are subject. The data processing takes place on the basis of Article 6 Paragraph 1 (c) of the GDPR and applicable Canadian privacy laws. The obligations may result, for example, from the commercial, tax, money laundering, financial or criminal law. The purposes of processing arise from the respective legal obligation; the processing generally serves the purpose of complying with state obligations with regard to monitoring and duty of disclosure. In this respect, too, you will find more detailed information below. 

The provision of personal data by you may be required by law or contract when using the services or may be necessary for the conclusion of a contract. We will inform you separately if you are obliged to provide personal data and what the possible consequences of not doing so would be (e.g. a loss of claims or our advice not to provide the requested service without providing certain information).  

4. Porsche ID user account 

Registration and creation of a Porsche ID user account on My Porsche is required for full use of the Porsche Digital Service Infrastructure and the services offered under it. Once you have successfully completed registration and created your Porsche ID user account, you will also receive your Porsche ID (user name of the Porsche ID user account). When registering and creating and using your Porsche ID user account, personal data is processed and, if necessary, transmitted to third parties as described below in order to fulfil our contractual obligations in this context. Unless otherwise stated, we carry out all processing operations described in this section in order to fulfil our contract with you on the basis of Article 6 Paragraph 1 (b) GDPR and applicable Canadian privacy laws. 

4.1 Registration process and creation of a Porsche ID user account 

There are two methods to choose from in order to register and create your Porsche ID user account:  

4.1.1 Invitation by authorised dealers 

If you wish, a Porsche Centre y will enter the personal data you have provided to them on our systems for you via their access. You will then receive, for example, an e-mail with a link which you must use to confirm your registration and creation of your Porsche ID user account. Please note that the Porsche Centres are independent companies and we have no influence over them. A second feature allows you to additionally verify your identity, for example via an SMS code, which you then enter during the process of registering and creating your Porsche ID user account. 

4.1.2 Self-registration  

In the event that the registration and creation of your Porsche ID user account was not carried out by a Porsche Centre, you can register and create your Porsche ID user account yourself and enter your personal data independently. In selected countries, including Canada you can also add a vehicle and use other digital services that require vehicle ownership. You must also upload a copy of an identification document and proof of ownership and, in case you are not the owner of the vehicle, a power of attorney from the vehicle owner after entering your vehicle identification number. These documents are forwarded to Porsche Connect Support or, in countries whose official language is not supported by Porsche Connect Support, directly to the Porsche Centre selected by you and checked locally, using our verification criteria. As proof of successful verification, we also save the names, birth dates, birthplaces and addresses shown in the relevant identification documents along with the validity dates of the documents, as well as the vehicle identification numbers, owner names and addresses shown in the proof of ownership. After verification is complete, the copies of the documents will be deleted. If you add a vehicle and a specific vehicle is therefore assigned to you in your Porsche ID user account, a so-called vehicle relationship (hereinafter referred to as "vehicle relationship") exists. After successful verification, you will receive, for example, an e-mail with a link, which you must use to confirm your registration and creation of your Porsche ID user account. A second feature allows you to additionally verify your identity, for example via an SMS code, which you then enter during the process of registering and creating your Porsche ID user account.  

Self-registration requires the upload of images from the terminal. You will therefore be asked to grant permission for the app to access your device's camera or photo library. Granting permission is voluntary. However, if you wish to use the self-registration function, you must grant the relevant permission, otherwise you will not be able to use the self-registration. Permission remains active unless you revoke it in your device and/or Internet browser by deactivating the relevant setting. 

If your vehicle has already been linked to your Porsche ID by a Porsche Centre, you can use a simplified vehicle registration process through our website or the My Porsche app. For this purpose, only the VIN entered by you and the contact data already stored by us are compared and a confirmation code is sent to you via SMS 

(a) Mandatory data when registering and creating a Porsche ID user account 

When registering and creating your Porsche ID user account, you must - in the case of self-registration - enter your e-mail address, a password, your name and name affixes, contact and address data, mobile phone number, e-mail address and, if applicable, the language in which you wish to communicate with us or - in the case of registration and creation of your Porsche ID user account by a Porsche Centre - confirm this personal data as part of the process of registering and creating your Porsche ID user account. This personal data is required to set up and manage your Porsche ID user account for you so that you can use the full range of our services as part of the Porsche Digital Service Infrastructure. In selected countries, including Canada, you can also use our offer as an interested party. In this case, you only need to provide your name, e-mail address and a password. Last but not least, we also need this and possibly other personal data in order to be able to respond to requests, questions and criticism. We also save the time of your last log-in. When you register and create your Porsche ID user account, we check your name and address data by means of a plausibility check. 

(b) Voluntary data when registering and creating a Porsche ID user account 

When registering and creating your Porsche ID user account, you also have the option of entering additional voluntary details such as additional name information (e.g. academic title etc.), company contact details, date of birth, additional telephone numbers, credit card information (this is only stored by the payment service provider) as well as your vehicle registration number and a personal vehicle name. In addition, you can provide information about your interests, preferences and the contact channels you would like to use. Please note that this information is not required when registering and creating your Porsche ID user account and that you alone decide whether you want to disclose this personal data to us. 

4.1.3 Integration of the Porsche ID into third-party offers 

We may enable cooperation partners to offer a registration and login procedure involving the Porsche ID. This means that you do not have to remember any new login data for the third-party offer. If you decide to use the registration and login procedure involving the Porsche ID as part of the third-party offer, you will be redirected to the PSMC Ltd. login/registration screen for the Porsche ID. Here you log in with your user name and password for the Porsche ID. We will then send a message to our cooperation partner that you have successfully registered. As part of the registration and login process, you can confirm to us that the cooperation partner may access the profile data of your Porsche ID user account. This then also applies to the payment data stored there, if applicable. This means that you do not have to re-enter or maintain your profile data and, if applicable, payment data (e.g. if your address changes) in order to create your user profile for the third-party offer. Conversely, changes to the profile data in the user account of the third-party offer are then also synchronised accordingly in your user account for the Porsche ID.  

The data processing within the scope of the registration and login procedure with the integration of the Porsche ID is carried out on the basis of Article 6 Paragraph 1 (b) and (f) GDPR and applicable Canadian privacy laws in order to register you with your user account for the third-party offer or to identify you when you register. In addition to carrying out your desired procedure, we are interested in making the registration and application process efficient and convenient. We are jointly responsible for this with our cooperation partner and, in relation to the process, we jointly determine the purposes and means of processing personal data. In an agreement on joint responsibility, we have defined, pursuant to GDPR Article 26 and applicable Canadian privacy laws, the respective tasks and responsibilities in the processing of personal data and the responsible parties to fulfil data protection obligations. In particular, we have defined how an appropriate level of security and your rights as a data subject can be ensured, how we can jointly comply with information obligations under data protection law and how we can monitor potential data protection incidents. This also includes ensuring that we can fulfil our reporting and notification obligations. Insofar as you contact us, we will come to an agreement in accordance with the aforementioned agreement pursuant to GDPR Article 26 and applicable Canadian privacy laws in order to answer your enquiry and guarantee your data subject rights. 

4.2 Porsche Digital Service Infrastructure: data processing after registration and creation of your Porsche ID user account 

If you have registered and created your Porsche ID user account, we will, in order to fulfil the contract with you on the basis of Article 6 Paragraph 1 (b) GDPR and applicable Canadian privacy laws, exchange basic information about your Porsche ID user account and your vehicles with responsible Porsche dealers in order to be able to serve you via our dealer organisation. In addition to the vehicle identification number, we transfer your user name (Porsche ID), the technical or sales availability of services and product offers for your Porsche ID user account or vehicle, as well as relevant events as part of the creation, modification or deletion of your Porsche ID user account, the linking of vehicles, the selection of traders, or the activation or deactivation of services.  

If you have selected an authorised dealer and provided your consent, your personal data stored in your Porsche ID user account, in particular contact data, support, contractual and service data, as well as data about your interests, vehicles and services used will also be exchanged with the authorized dealer and with synchronised with any personal data stored about you. If you no longer wish data to be transferred in the future, you can change this in the user settings of your Porsche ID user account accordingly. The aforementioned personal data will no longer be exchanged with the authorised dealer from that date. The applicable legal basis for this processing of your personal data is your consent pursuant to Article 6 Paragraph 1 (a) GDPR and applicable Canadian privacy laws. 

4.3 Deletion of your Porsche ID user account 

If you delete your Porsche ID user account, your personal data stored in your Porsche ID user account will also be deleted when the contractual relationship ends, but upon expiration of your existing service licenses at the earliest. As far as data must be stored for legal reasons, these are blocked (so-called limitation of processing).  The personal data is then no longer available for further use; in particular for the use of services. The functionality of the services may be limited or eliminated. The full use of the Porsche Digital Service Infrastructure will then also no longer be available to you. If further responsible individuals within the Porsche Group and its sales organisation process personal data within their own responsibility, the processing of this personal data remains unaffected. If, on the basis of your consent pursuant to Article 6 Paragraph 1 (a) GDPR and applicable Canadian privacy laws, personal data has been exchanged with a dealer of your choice, we inform the dealer about the deletion of your Porsche ID user account.  

5. Central services 

5.1 Booking and activating services, handling payment information 

You can book individual or several My Porsche services and Porsche Connect services and activate service licences. When selecting the respective service or service package, you can also view the respective information on the processing of personal data within the scope of the services concerned under the offer details. In order to carry out and fulfil a booking and the associated contractual relationship, we process, in addition to the respective booking information, your personal data collected during registration and creation of your Porsche ID user account. You can change your billing address before completing the booking process. In this case, we use the address data provided by you for invoicing and processing.  

We use a payment service provider to process payments for our paid services and products within the framework of My Porsche, Porsche Connect, Online Marketplace and Porsche Drive Rental. For this purpose, we and the payment service provider used will process your credit card information and the respective payment information.  The payment service provider's systems are used to manage your credit card information and to process payments. When you enter your credit card information, this is done directly via an input field of the payment service provider, which encrypts, stores and uses this information independently for your payments. The encrypted information is then transferred from Porsche/from us to the payment service provider where it is stored and used for your payment. The applicable legal basis for this processing of your personal data in order to process payment is the fulfilment of the contract pursuant to Article 6 Paragraph 1 (b) of the GDPR and applicable Canadian privacy laws. 

The payment service provider commissioned will process your customer and contact information (for example name, address, email address, Porsche Connect customer number, and if applicable, company and affiliates) and the vehicle identification number shown in the proof of ownership exclusively for the purpose of debtor management (including compliance checks, where legally required) and to carry out credit checks. The legal basis for processing the named personal data for the aforementioned purposes, in accordance with Article 6 Paragraph 1 (c) of the GDPR and applicable Canadian privacy laws, is the fulfilment of a legal obligation incumbent on us and, in accordance with Article 6 Paragraph 1 (f) of the GDPR and applicable Canadian privacy laws, our legitimate interest in appropriate accounts receivable management and credit controls, provided we are not subject to any legal obligation. 

When purchasing through online shops, our payment service provider determines the fraud risk using customer data (e.g. name and identifier, sales history, etc.). The transaction data is checked and examined for abnormalities (e.g. frequency of password changes, delivery address differing from the invoicing address). The legal basis for the processing of the mentioned personal data for the aforementioned purposes is, in accordance with GDPR Article 6 Paragraph 1 (b) and applicable Canadian privacy laws, the fulfilment of a contract, or, pursuant to GDPR Article 6 Paragraph 1 (f) and applicable Canadian privacy laws, our legitimate interest in preventing fraud. 

After completing the booking, you can activate the services. This saves the authorisation for use on the system side and updates the list of available services accordingly. 

In order to use certain services (e.g. E-Charging offers), a personalised card (referred to as a Porsche ID Card, Porsche Charging Card) containing RFID chips is sent by post to numerous countries when a product is purchased. An identification number is stored on the card, which can be used to assign it to your Porsche ID user account. No personal data beyond the identification number, in particular your name or address, is stored digitally on the card itself. If the card is lost, you can block it within your Porsche ID user account. 

After delivery, the Porsche ID card can be used directly with the supported infrastructure (e.g. public E-charging pedestals). 

Unless stated otherwise, we carry out the processing described in this section for fulfilment of our contract with you on the basis of Article 6 Paragraph 1 (b) GDPR and applicable Canadian privacy laws. 

5.2 Using the My Porsche services and Porsche Connect services  

Depending on the service, you can use the booked My Porsche services and Porsche Connect services in your vehicle (if available for your vehicle) via a radio network connection or via other terminal devices in My Porsche or in your Porsche Connect app and, if necessary, also from several or all access points. For this purpose, your vehicle or the respective end device connects to the Porsche Digital Service Infrastructure. 

When you use the services booked via My Porsche or the Porsche Connect Store in your vehicle or on other devices, your personal data will be processed by us for the purpose of enabling the use of services, for support purposes and for other individually defined purposes. Unless otherwise stated, we will only process your personal data to the extent necessary to enable the relevant My Porsche service or Porsche Connect service to be used. 

• When using the individual My Porsche services or Porsche Connect services, the following categories of personal data, for example, may be processed, depending on the specific functionality of the respective service: 
• Identification information, such as the vehicle identification number, your Porsche ID and device and system IDs of your end devices and mobile modules, which are required to identify your person, your end device or your vehicle for the purpose of establishing connections, using services or accessing content, 
• Authorisation information, which includes that the vehicle or the respective terminal device is activated for the respective Porsche Connect service and which can be linked to your personal data that you entered as part of the registration and creation of your Porsche ID user account,  
• Login information that is required if you want to use services from other providers that require a login in your vehicle or on additional end devices,  
• Communication information required to establish a connection between your vehicle and/or other terminal devices and our servers or with the servers of third-party content providers for Porsche Connect services,  
• Location and movement information, such as GPS or speed data, required in order to use location-related content,  
• Voice data that enables voice control and voice input in certain Porsche Connect services. Voice data is transmitted to us as a recording for the purpose of conversion to text from the vehicle or a terminal. The text then generated by a service provider is transmitted back to the vehicle and the recording is then deleted by us,  
• Contact data used in communication services, for example to send an e-mail or SMS,  
• Billing data such as an itemised bill from charging operations. If necessary, we will combine this information with your address and payment information for individual billing purposes, 
• Image/video data of your vehicle or its components 
• Other content that needs to be shared with us or with service providers in order to provide a service to you. 

Detailed information on which personal data is processed within the scope of which service can be found in the respective service descriptions at https://connect-store.porsche.com/ca/en/. 

The following applies especially in the context of workshop visits and the associated use of online order extension: 

Online order extension is a service that offers our customers the possibility to follow the vehicle acceptance process during a workshop appointment at any time and from anywhere through recorded and personalised videos of the service consultant and/or technician. In addition, the customer can release/approve additional repairs/repair extensions directly via the My Porsche Portal and/or the My Porsche App. 

Unless otherwise stated here, in one of the Specific Privacy Policies or, where applicable, in the further Special Data Protection Notices of the respective service, we process your personal data in each case on the basis of Article 6 Paragraph 1 (b) GDPR and applicable Canadian privacy laws in order to provide you with the services in this context and to perform the associated contractual relationship. 

5.3 Use of third-party services 

If you use the services of a third-party provider with whom you have your own contractual relationship, the content of these services may be displayed in your vehicle or on your terminal device and information may be exchanged between your vehicle or your terminal device and the respective service provider.  

We have no influence on the data processing by this third-party provider or on the location of the data processing. Therefore, please inform yourself with the respective third-party provider about the type, scope and purpose of the processing of personal data with regard to the respective service in their separate data protection notices. 

We transfer the necessary personal data to the relevant third-party provider on the basis of Article 6 Paragraph 1 (b) GDPR and applicable Canadian privacy laws in order to fulfil the contract between you and us.  

5.4 Porsche Contact Centre 

You can use various communication channels to contact us, in particular the service hotline if you wish to contact us by telephone, but also e-mail or live chat. When you contact our Contact Centre, we will process your personal data insofar as this is necessary in order to provide the Contact Centre service and to process your request. It is possible that we may ask you to provide personal data that is required to prepare and organise contact in order to process your specific request. Without this data, we will not be able to process your inquiry or accede to your request. The purposes of processing arise specifically from your inquiry and the services you have booked. They cover in particular: 

• The processing of inquiries from interested parties, customers and Porsche Centres in relation to products and services from PSMC Ltd. This includes, for example,  
• Technical support services  
• Assistance when purchasing services or products  
• Answering general questions about Sales & Marketplace  
• Technical support for customers and dealers, in particular through the provision of a service hotline for telephone contact. 

Data is processed on the basis of Article 6 Paragraph 1 (b) GDPR and applicable Canadian privacy laws for the purpose of fulfilling the contract with you and implementing measures in advance of the contract.  

We also process your personal data to comply with legal obligations to which we are subject. Obligations may arise, for example, from commercial, tax, telecommunications, money laundering, financial or criminal law. The purposes of processing arise from the respective statutory obligation; the processing generally serves the purpose of complying with state obligations with regard to monitoring and duty of disclosure.  

Data is processed on the basis of Article 6 Paragraph 1 (c) or (e) GDPR and applicable Canadian privacy laws. If we collect data on the basis of a legal obligation or in the public interest, you need to provide the personal data that is required to comply with the legal obligation. Without this, we might not be able to process your request or fulfil these obligations. 

If you use support services in at a Porsche Centre, your Porsche Centre can also retrieve this data. To facilitate this service, we also transmit the aforementioned data to the relevant Porsche Centre. In this case, we will process your personal data in accordance with Article 6 Paragraph 1 (f) GDPR and applicable Canadian privacy laws on the basis of our legitimate interest in facilitating customer service at your preferred point of contact or through your preferred dealer. 

6. Safeguarding legitimate interests 

We also process your personal data to protect the legitimate interests of us or third parties, unless your interests which require the protection of your personal data override these interests. Data is processed on the basis of Article 6 Paragraph 1 (f) GDPR and applicable Canadian privacy laws. Processing for legitimate interest is carried out for the following purposes or to protect the following interests:  

• Further development of products, services and mentoring, as well as other measures for business transactions and process control, 
• Improvement of product quality, elimination of errors and disruption, etc. by analysing vehicle data and customer feedback,  
• Processing data on a central prospect and customer care platform, as well as in up and downstream systems for customer loyalty and sales purposes, 
• Settlement of guarantee and goodwill cases, processing of non-contractual questions and concerns from prospective customers and clients, 
• Needs analysis and customer segmentation, e.g. calculating and evaluating affinities, preferences and customer potentials, 
• Risk management and coordination of recall campaigns, 
• Credit assessment through data exchange with credit agencies, 
• Ensuring the legally compliant handling, prevention of and protection against statutory violations (especially criminal offences), assertion of and defence against legal claims, internal and external compliance measures, 
• Ensuring availability, operation and security of technical systems, as well as technical data management. 

When we send e-mails to customers and prospective customers, we may use commercially available technologies such as tracking pixels or click-through links. This allows us to analyse which or how many e-mails are delivered and/or rejected and/or opened. The latter is carried out in particular by tracking pixel. It is not possible to measure the opening rate of our e-mails in full using tracking pixels, for example, if you have deactivated the display of images in your e-mail programme. In this case, the e-mail will not be displayed completely. It is nevertheless still possible for us to determine whether an e-mail has been opened if you click on the text or graphic link in the e-mail. Using click-through links, we can analyse which links have been clicked in our e-mails and determine the interest in certain topics. If you click on the corresponding link, you will be guided through our separate analysis server before accessing the target page. Based on the analysis results, we can make e-mails more relevant, send them in a more targeted manner or prevent e-mails from being sent. If you do not want such information collected and tracked, do not click text or graphic links in e-mails. 

7. Consent  

We process your personal data on the basis of corresponding consent. Data is processed on the basis of Article 6 Paragraph 1 (a) GDPR and applicable Canadian privacy laws. If you have given consent, this is always for a specific purpose; the purposes of processing arise from the respective content in your declaration of consent. You may revoke your consent at any time, without affecting the legality of the processing carried out on the basis of your consent until revocation.  

Insofar as you have given corresponding consent, the companies listed in the declaration of consent may, on this basis, use the data for individual customer and prospective customer support, for example, and contact you for these purposes via the communication channels you have requested. Your data is used within this framework to offer you an inspiring brand and support experience with Porsche and to make our communication and interaction with you as personal and as relevant as possible. Which of your data is specifically used for individual customer and prospect support depends in particular on which data was collected when using the services and which data you provided within the framework of the services (e.g. your personal interests).  

8. Change of purpose 

Where we process your personal data for a purpose other than that for which it was collected, beyond appropriate consent or a compelling legal basis, we will take into account, in accordance with Article 6 Paragraph 4 of the GDPR and applicable Canadian privacy laws, the compatibility of the original purpose and the purpose now pursued, the nature of the personal data, the possible consequences for you of further processing and the safeguards for the protection of the personal data.  

9. Profiling  

We do not use automated decision-making in accordance with Article 22 GDPR and applicable Canadian privacy laws to prepare, establish or conduct business relationships. If profiling is carried out, this is only done for the purposes stated in the General Privacy Policy, the Specific Privacy Policy and, if applicable, the additional Special Data Protection Notices of the respective service and on the basis of the legal grounds stated. 

10. Device access permissions 

Some functions of the services require you to grant access to your end device (e.g. access to location data). Granting permissions is voluntary. However, if you wish to use the corresponding functions, you must grant the corresponding authorisations, otherwise you will not be able to use these functions. Permissions remain active unless you revoke them in your device by deactivating the relevant setting. You can find out in which areas access to the device should occur in the Specific Privacy Policy and, if applicable, in the further Special Data Protection Notices of the respective service. 

11. Cookies and comparable technologies 

Insofar as we use cookies and comparable technologies within the scope of the services, you can find corresponding explanations in the specific data protection declaration and the further special data protection information of the respective service. 

12. Sources and data categories in the collection of data by third parties 

We also process personal data that we receive from third parties or from publicly available sources. Below is an overview of the relevant sources and the categories of data obtained from these sources.  

• Porsche AG and its group companies, Porsche dealers and service operations: e.g. information about the products you use and your interests; 
• Cooperation partners and service providers (e.g. creditworthiness data from credit agencies). 

For information on collection of data by third parties, please refer to the Specific Privacy Policies and, if applicable, the further Special Data Protection Notices of the respective service. 

13. Recipients of personal data 

Within our company, the only people who have access to your personal data are those who need this for the purposes named above. We only pass on your personal data to external recipients if a legal requirement to do so exists or if we have your consent. Below you will find an overview of the corresponding recipients: 

• Processors: Porsche AG and its group companies or external service providers, for example in the areas of technical infrastructure and maintenance, who are carefully selected and checked. The processors may only use the data in accordance with our instructions.  
• Public bodies: authorities and public institutions, such as public prosecutors, courts or tax authorities to which we (must) transfer personal data, e.g. to fulfil legal requirements or to safeguard legitimate interests.  
• Private entities: Porsche AG and its group companies, Porsche sales companies, dealerships and service companies, cooperation partners, service providers (not bound by instructions) or authorised persons such as Porsche Centres and Porsche Service Centres, financing banks, credit agencies or transport service providers. 

14. Data processing in third countries 

If data is transferred to bodies whose headquarters or place of data processing is not located in Canada, in a member state of the European Union, another country outside of the European Union that is a signatory to the Agreement on the European Economic Area or a state for which an appropriate level of data protection has been determined through a decision of the European Commission, we will ensure before disclosure that the data transfer is either covered by a legal authorisation, that there are guarantees for an adequate level of data protection with regard to the data transfer (e.g. through the agreement of contractual warranties, officially recognised regulations or binding internal data protection regulations at the recipient) or that you have given your consent to the data transfer. 

Insofar as data is transferred on the basis of Articles 46, 47 or 49, Paragraph 1, Subparagraph 2 GDPR and applicable Canadian privacy laws, you can obtain from us a copy of the guarantees for the existence of an adequate level of data protection with regard to the data transfer or information on the availability of a copy of the guarantees. For this purpose, please use the information under point 1. 

15. Duration of storage, deletion  

The following shall apply if the description of the individual services does not provide information about the specific duration of storage or the deletion of the personal data:  

We store your personal data, if a legal permission exists for this, only as long as necessary to achieve the purposes pursued or as long as you have not revoked your consent. In the event that you object to the processing, we will delete your personal data unless further processing is permitted by the legal provisions. We will also delete your personal data if we are obligated to do so for other legal reasons. Pursuant to these general principles, we will usually erase your personal information immediately:  

• After elimination of the legal basis and if no other legal basis (e.g. commercial and tax retention periods) impinges. If the latter is the case, we will erase the data once that other legal basis ceases to apply; 
• If your personal data is no longer required for our purposes, and if no other legal basis (for example, commercial and tax retention periods) impinges. If the latter is the case, we will delete the data once that other legal basis ceases to apply. 

16. Rights of data subjects 

Right to information: you have the right to receive information about your personal data stored by us.  

Permission and deletion right: you may request us to correct incorrect data and – insofar as the legal requirements are fulfilled – to delete your data.  

Limitation of processing: you may require us to restrict the processing of your data, provided that the legal requirements are met.  

Data transferability: if you have provided us with data based on a contract or consent, you may, if the statutory requirements are met, obtain from us the data provided by you in a structured, commonly used and machine-readable format, or require us to transmit it to another controller. 

Objection: you have the right to object at any time, on grounds relating to your particular situation, to our processing of your data, provided this objection is based on the safeguarding of "legitimate interests". If you make use of your right of objection, we will stop processing your data, unless we can prove, in accordance with the legal requirements, compelling legitimate reasons for further processing that outweigh your rights. 

Objection to direct marketing: if we process your personal data for the purpose of direct marketing, you have the right to object to our processing of your data for this purpose at any time. If you exercise your right to object, we will stop processing for this purpose. 

Withdrawal of consent: if you have given us consent to the processing of your personal data, you can revoke this at any time with effect for the future. The withdrawal of consent will not affect the lawfulness of processing before its withdrawal. 

Right of appeal to the supervisory authority: you can also lodge a complaint with the competent supervisory authority if you believe that the processing of your data violates applicable law. You can contact the supervisory authority responsible for your place of residence or country or the supervisory authority responsible for us.  

Your contact with us and exercising your rights: furthermore, you can contact us free of charge with questions about the processing of your personal data and about your rights as a data subject. Please contact us by e-mail at privacy@porsche.ca, or by post at the address indicated in section 1 above. When doing so, please make sure that we can clearly identify you. If you wish to withdraw your consent, you can alternatively use the method of contact that you used when you gave your consent. 

17. Offers from third parties 

Services of other providers that are referred to via our services were and are created and hosted by third parties. We have no influence over the design, content and function of these services. We dissociate ourselves expressly from the content of all services referred to. Please note that these services, for example third-party websites, may place their own cookies on your device and may collect personal data. We have no influence over this. If necessary, please refer directly to the providers of these referred services.  

Insofar as the services also incorporate services of other providers in order to offer you certain content or functions, you can find corresponding explanations in the Specific Privacy Policy and the further Special Data Protection Notices of the respective service. 

18. Status 

The most up-to-date version of this Privacy Policy shall apply.  

Status: 01.02.2023 

Specific Privacy Policy 

Porsche Sales & Marketplace Canada, Ltd Websites 

You can use My Porsche, Porsche Connect Store, Online Marketplace and Porsche Drive Rental via our website (hereinafter also referred to as "website").  

You can book My Porsche services, Porsche Connect services and Functions on Demand (FoD) and activate the corresponding licenses in My Porsche and the Porsche Connect Store. You can rent vehicles under Porsche Drive Rental. This requires you to be registered with My Porsche and have a Porsche ID user account. Depending on the service, you can use and manage the aforementioned services via our website, via various Porsche apps and, if available for your vehicle, in your vehicle via wireless network connection. 

In addition, you can use the Online Marketplace to access the extended range of products and services offered by our Group companies and third-party providers. Customers with a Porsche ID user account can use the Marketplace sections Porsche Finder and Porsche Store. 

Some features on our websites are also available without registration. For further details, see Point 2.3.  

1. Special notes on the use of our website  

1.1 Provision of our website 

To a certain extent, it is possible to use this website without logging in. Even if you use the website without registration, personal data may still be processed. Below you will find an overview of the type, scope, purposes of and legal grounds for automated data processing that takes place when using our website. For information on the processing of personal data when using the individual specific features and services, please refer to Point 2 below. 

The following data will be processed by us when you access our website with your device: 

• Date and time of access, 
• Duration of visit, 
• Type of device, 
• Operating system used, 
• The features you use, 
• Amount of data transmitted, 
• Type of event, 
• IP address, 
• Referrer URL, 
• Domain name. 

We process this data on the basis of the GDPR Article 6 Paragraph 1 (b) and (f) and applicable Canadian privacy laws for the purpose of providing the website, safeguarding its technical operation and identifying and resolving malfunctions. In doing so, we also pursue the aim of permanently ensuring the technical functionality of the website, improving performance and optimizing the user experience. This data is processed automatically when you access our website. Without the provision of data, you cannot use our website. We do not use this data for the purpose of drawing conclusions about your person or your identity. 

1.2 Cookies and comparable technologies 

We use cookies and similar technologies within the framework of the website, which serve to communicate with your terminal device and to exchange stored information (hereinafter collectively "cookies"). These cookies are primarily used to make the functions of the website usable. General examples in which the use of cookies is technically necessary in this sense are the storage of a language selection, login data or a shopping or watch list. Accordingly, technically necessary cookies may be used by us to enable the processing operations described above and to ensure the proper and secure operation of the website. Data processing takes place on the basis of the GDPR Article 6, Paragraph 1 (b) and (f) and applicable Canadian privacy laws, as this is necessary for implementation of the functions that you select and in order to safeguard our legitimate interest in the functionality of our website.  

If we also use cookies to analyze the use of the website and to target it to your interests and, if applicable, to provide you with interest-based content and advertisements, this will only be done on the basis of your voluntary consent in accordance with Article 6 Paragraph 1 (a) GDPR and applicable Canadian privacy laws. You then have the option of making your corresponding settings via the consent management at https://connect-store2.porsche.com/ca/en/cookiepolicy. You can revoke your consent at any time with effect for the future. Further information on the cookies and their function in detail, as well as on setting and revocation options, is available directly in the corresponding areas of the consent management. Please note that we only provide consent management as part of the website if consent-based cookies are to be used in addition to the technically required cookies mentioned above.  

If you do not wish to use cookies in general, you can also prevent any storage by means of the relevant settings on your device. Stored cookies can be erased at any time using the system settings of your device. Please note that blocking certain types of cookie may result in impaired use of our website. 

1.3 Device access permissions 

When using individual features such as "Closest Porsche Drive Rental location", you may be asked to grant access to your location. 

Granting permissions is voluntary. However, if you wish to use the relevant features, you must grant the corresponding permissions, otherwise you will not be able to use these features. 

Permissions remain active unless you revoke them in your device and/or Internet browser by deactivating the relevant setting. 

2. Special services and features 

You can voluntarily provide personal information or register for services or features when using our website. When registering and using the services and features described below, personal data will be collected, processed and used by us as shown below. 

It is necessary to register in advance and to create a Porsche ID user account in order to use the services and features described in Point 2.2. The services and features described in Point 2.3 can be used without prior registration. 

2.1 Registration process and creation of a Porsche ID user account 

Information on the registration process and the creation of your Porsche ID user account can be found in Point 4.1 of the Porsche Digital Service Infrastructure / Porsche ID General Privacy Policy. 

2.2 Using the individual features with registration/login 

The features within the framework of our offering on our website and the relevant processed personal data, purposes and legal bases are described below. 

2.2.1 Booking and activating services, handling payment information, identity verification 

For information about how to book services via our website and how payment information is handled, see Point 5.1 of the Porsche Digital Service Infrastructure / Porsche ID General Privacy Policy. 

The laws in some countries may require an identity check based on identification documents in order to book certain telecommunications services. In relation to data processing when carrying out such identity checks, we are jointly responsible with  

• IDnow GmbH, Auenstr. 100, 80469 Munich, Germany.  

You can access the Privacy Policy of our cooperation partner IDnow GmbH via https://idnow.io/privacy/. 

There are two methods available for performing identity verification. One method is that you can be redirected to the external page or app of the service provider, IDnow, as part of the service booking procedure. As part of the process, we will, at your request, transmit the information to be verified (your name, your address and your date of birth) as well as a reference number to the service provider that will allow us to assign the test result at a later point. As part of the identity check, the service provider will compare the aforementioned data with your identification document and store the data, as well as an optoelectronic copy of the identification document, a photo of the verified person and an audio record of the session. The service provider will then inform us of the result of the identity check, using the reference number. 

Your other option is to have identity verification performed at a participating Porsche Centre. This involves staff at the Porsche Centre verifying your identity on the basis of an identification document and sending the verified information (your name, address and date of birth) and a reference number to the service provider via a Porsche system. By entering this reference number, you can use the service provider's app to submit an optoelectronic copy of your identification document to the service provider at your convenience. The service provider will then inform us of the result of the identity check, using the reference number. 

Personal data resulting from this identity check will only be shared with third parties if we are legally obliged to do so. Only in such cases will we obtain access to a copy of your identification document from the service provider, for the purpose of fulfilling our legal obligations.  

The legal basis for our processing of your personal data in order to carry out an identity check is GDPR Article 6 [1] (c) and/or (f) and applicable Canadian privacy laws, as the identity check is the fulfilment of a legal obligation by which we are bound, or reflects to our legitimate interest in complying with legal requirements. 

As the jointly responsible party together with IDnow GmbH, we have determined in an agreement according to GDPR Article 26 and applicable Canadian privacy laws how the respective functions and relationships in the processing of personal data are to be structured and who is to satisfy which data protection obligations, in particular with regard to ensuring an adequate level of security, the implementation of your rights as a data subject, the fulfilment of data protection obligations, as well as the monitoring of potential data protection incidents, including the assurance of reporting or notification obligations (as required). You can use the contact details provided in Point 1 (of the General Privacy Policy) to request further information about this agreement; we shall then supply you with the key provisions.  

You are welcome to contact either of the jointly responsible parties with questions or to exercise your rights as a data subject. In the spirit of the aforementioned agreement, we will consult with IDnow GmbH in accordance with GDPR Article 26 and applicable Canadian privacy laws in order to answer your inquiry and, if necessary, to fulfil your wish to exercise your rights as a data subject.  

The exchange of personal data between the jointly responsible parties takes place on the basis of GDPR Article 6 (1) (f) and applicable Canadian privacy laws, in other words our legitimate interest in the effective implementation of identity checks in cooperation with IDnow GmbH. 

If necessary, we supply further information about the processing of personal data for our bookable services in the additional special data protection provisions for the relevant services. 

2.2.2 Using the My Porsche services and Porsche Connect services  

Information on the use of My Porsche services and Porsche Connect services via our website can be found in Point 5.2 of the Porsche Digital Service Infrastructure / Porsche ID General Privacy Policy. 

2.2.3 Provision of service and warranty information 

Prior registration and creation of a Porsche ID user account is required to use this feature.  

In order to provide you with information about your vehicle, current warranties and recall campaigns in the "My Porsche" section of our website, we process equipment and vehicle master data such as the vehicle identification number shown on the proof of ownership, current warranties, the model year and a model picture.  

Pursuant to GDPR Article 6 [1] (b) and applicable Canadian privacy laws, the legal basis for the processing of your personal data is the fulfilment of the contract between you and us. 

2.2.4 Service appointment request 

Prior registration and creation of a Porsche ID user account are required to use this feature.  

To request service appointments with Porsche dealers and service companies in the "My Porsche" section of our website and app, we may provide customer and vehicle data to companies of your choice at your request. If you wish, we will provide your name, address, telephone number, e-mail address, Porsche ID, vehicle identification number shown in the proof of ownership, vehicle model, the service dates you have selected, the scope of service you desire, and a supplementary message to your request, as well as the desired contact channels for the dealer or service company chosen by you for the relevant request (the dealer or service company that will be carrying out the work).  

The transmission of your personal data takes place within the framework of the respective service request on the legal basis of GDPR Article 6(1) (b) and applicable Canadian privacy laws as a precontractual measure at your request. We store your respective service request in order to fulfil the contract between you and us in accordance with GDPR Article 6(1) (b) and applicable Canadian privacy laws. 

2.2.5 Event Booking  

With the Event Booking function, you can register for selected Porsche events in the app and via the My Porsche portal. 

For this purpose, we process the following personal data in particular: master data, contact data and data requested for the implementation of the event. We process the above personal data on the legal basis of GDPR Article 6 Paragraph 1 (b) and applicable Canadian privacy laws to fulfil the contract with you to provide the app and its functions as well as on the legal basis of GDPR Article 6 Paragraph 1 (f) and applicable Canadian privacy laws to fulfil our justified interest in providing services. The responsibility for the implementation of the respective event and thus for the further data processing required for the implementation of the event lies with the organizer named in the registration form for the respective event.   

2.2.6 My Porsche News 

The My Porsche News function lets you call up news in the app as well as via the My Porsche portal. This usually entails information relevant to the contract in connection with the purchase and/or the use of your account, your vehicle or digital content from Porsche. 

For this purpose, we process the following personal data in particular: master data, contact data, contract data, dealership data and vehicle data. 

We process the above personal data on the legal basis of GDPR Article 6 Paragraph 1 (b) and applicable Canadian privacy laws to fulfil our contract with you to provide the app and its functions as well as on the basis of the legal basis of GDPR Article 6 Paragraph 1 (f) and applicable Canadian privacy laws to fulfil our justified interest in providing services in connection with your contract. 

2.2.7 Collection of vehicle, service and product data for product and service development and improvement 

In connection with the use of services, in the event of error messages or as part of defined data evaluation measures, certain vehicle, service and product data from the vehicle, from services or from other Porsche products may be transferred by Porsche Sales & Marketplace Canada, Ltd. (“PSMC Ltd.”) to Porsche Smart Mobility GmbH to Porsche AG in order to be available there for evaluation of the aforementioned purposes. 

You can consent to this on the "My Porsche" website.  

The vehicle, service and product data comprise identification, basic, usage, analysis, environmental, traffic, location and movement data.   

Some data cannot be deleted retroactively, as they are stored without concrete vehicle identification. In this case the data will be deleted after 5 years at the latest. 

2.2.8 Reservation and purchase of services and products via the "Online Marketplace" section 

As part of the Online Marketplace, we offer you a central platform where you can book or purchase services and products from us, our group companies and third-party providers (hereinafter also referred to as "participants"). The respective participant is provided with an area on our platform to present and offer their products and services (hereinafter referred to as "shop").  

Customers with a Porsche ID user account can use the "Marketplace" sections "Porsche Finder" and "Porsche Store". Customers without an existing Porsche ID contract can also use the Marketplace section "Porsche Store" via the "Guest access" feature. 

Processing within the framework of the Online Marketplace is carried out partly by us, partly by the respective participant and partly under joint responsibility.  

2.2.8.1 Processing under the responsibility of PSMC Ltd.  

For information on the data processing (e.g. processing of master data) carried out by us under our sole responsibility, please refer to the other sections of this and other privacy policies of Porsche Sales & Marketplace Canada, Ltd. .  

2.2.8.2 Processing under the responsibility of Marketplace participants 

For information on data processing carried out by marketplace participants under their sole responsibility (e.g. processing for creating invoices, providing products, rescinded transactions in the event of a return etc.), please refer to the privacy policies of the respective companies. The responsible participant is indicated on the respective page of the product or service. 

PSMC Ltd also acts as a marketplace participant in certain cases. Further information about processing your personal data within the processing of the contract in the online marketplace can be found under Item 5.1 of the "Porsche Digital Service Infrastructure/Porsche ID" general privacy policy.  

2.2.8.3 Processing under joint responsibility of PSMC Ltd. and Marketplace participants 

With regard to the following processing, we are jointly responsible with the respective participants of the Online Marketplace who have placed the offer on the respective page and with whom you may book services or products: 

• Data processing as part of the visit and the booking, application or reservation process in the respective shop of the Marketplace participant, but not the downstream service processing outside the platform; 
• Automated data collection, data processing to improve our online service, storage of cookies and data analysis (see Point 1.1 of this Privacy Policy); 
• Data processing within the scope of advertising, communication and marketing features of the platform, especially cross-selling modules; 
• Payment processing for paid bookings, applications and reservations within the framework of the respective shop of the Online Marketplace; 
• Customer support with regard to the respective shop in the Marketplace. 

In relation to these data processing activities, we determine the purposes and means of processing personal data in cooperation with the respective Marketplace participants. 

In an agreement with the relevant Marketplace participants on joint responsibility, we have defined, pursuant to GDPR Article 26 and applicable Canadian privacy laws, the respective tasks and responsibilities in the processing of personal data and the responsible parties to fulfil data protection obligations. In particular, we have defined how an appropriate level of security and your rights as a data subject can be ensured, how we can jointly comply with data protection information obligations and how we can monitor potential data protection incidents. This also includes ensuring that we can fulfil our reporting and notification obligations.  

PSMC Ltd. is at your disposal as your central point of contact with regard to the aforementioned processing in joint responsibility. You can assert your rights in relation to processing operations under joint responsibility but also vis-à-vis a jointly responsible Marketplace participant. Insofar as you contact us in relation to these processing operations, we will consult with the relevant Marketplace participant in accordance with the aforementioned agreement under GDPR Article 26 and applicable Canadian privacy laws in order to answer your enquiry and to guarantee your data subject rights. In this case, the statements in Section 13 of the General Privacy Policy apply. 

This joint responsibility does not affect, in particular, the processing operations mentioned in the General Privacy Policy, including those for master data administration (Porsche ID) and data processing on the platform, which are carried out under the sole responsibility of PSMC Ltd.. In particular, the service processing of the purchase, booking, application or reservation contract as well as invoicing does not take place under joint responsibility, but under the sole responsibility of the relevant Marketplace provider.  

2.2.9 Formation and processing of the rental agreement within the framework of Porsche Drive Rental 

This feature enables you to rent a Porsche vehicle.  

In order to conclude a rental contract, you must provide us with the personal data listed below. You can save this personal data in your Porsche ID user account at any time, thus speeding up processing at the rental location. If you do not save this personal data in your Porsche ID user account in advance, you will be required to provide this personal data by completing this personal data in your Porsche ID user account at the rental location (possibly by our service provider). An appropriate device will be made available to you at the location for this purpose if necessary. 

In order for a valid rental contract to be created, the following mandatory data must be saved in your Porsche ID user account: 

• Gender, 
• First and last name, 
• Date of birth, 
• Nationality, 
• E-mail address, 
• Mobile phone number, 
• Address (street and house number, postcode and town/city), 
• Payment details for the rental charge (name, credit card number, issuing institution, card security code), 
• Details of the driving license (license number, date and place of issue), 
• Details of the ID card (ID number, date and place of issue), 
• Payment details for the security deposit (name, credit card number, issuing institution, card security code). 

If this data is not provided, it is not possible to draw up a rental contract and the vehicle cannot be collected.  

We shall process the gathered data on the basis of GDPR Article 6 [1] (b) and (f) and applicable Canadian privacy laws in order to provide you with the services you require in this connection, and to implement the associated contractual relationship with you. 

In order to establish your identity before you sign the rental contract, you will be asked by our service provider to identify yourself. In addition, to ensure the correctness of the data (for example no typographical errors, reversal of first and last name, the spelling of foreign street names and house numbers, etc.) and for security reasons (for example disclosure of the card number to the competent authorities in the event of a criminal offense or misdemeanour relating to the rented vehicle) a copy is generally made of your ID card. Unnecessary information (such as your height or eye colour) will be blacked out. Your personal data will be processed on the basis of GDPR Article 6 [1] (b), (c) and (f) and applicable Canadian privacy laws, in order to provide you with the services you require in this connection, to implement the associated contractual relationship with you and to meet our legal obligations. Our legitimate interest derives from the purposes set out at the beginning of this paragraph. 

We do not process any payment data on this website. Billing uses your Porsche ID user account. For more information on the handling of payment information, please refer to Point 5.1 of the Porsche Digital Service Infrastructure / Porsche ID General Privacy Policy. 

The vehicles have a device for tracking the location and condition of the vehicle (especially current mileage). Using this device, it is possible for a limited number of employees to keep track of the contractually agreed mileage and current location of the vehicle. 

Your personal data will be processed on the basis of GDPR Article 6 [1] (c) and (f) and applicable Canadian privacy laws in order to safeguard our legitimate interest, to provide you with the support you require and to prevent uses contrary to the contract and potential damage as well as to fulfil official and/or legal requirements or obligations, such as official, public prosecutor or judicial requests. 

For the fulfilment of the contract in Canada, PSMC Ltd. uses selected service providers who can be chosen in the booking process on the Porsche Drive Rental website (under the following link: https://www.porsche.com/canada/en/accessoriesandservices/porschedrive/). Service providers are Porsche Centres within the Canadian dealer organization or affiliated. These service providers are carefully selected by PSMC Ltd. 

At the end of the rental period you will receive a summary of your trip data by e-mail. You can save this summary as you wish, or send it to third parties, independently of our offers, via your own terminal device or the third-party services you use.  

After the end of the rental period, you also have the option of informing us by e-mail via an online dialogue (e.g. by awarding stars) how you enjoyed the rental. We process the data we collect on the basis of Article 6(1) (b) of GDPR and applicable Canadian privacy laws in order to further improve the services based on your feedback. 

2.3 Using the individual features without registration/login 

The features within the framework of our website and the relevant processed personal data, purposes and legal bases are described below. 

2.3.1 Contact via Live Chat 

No prior registration and creation of a Porsche ID user account is required to use this feature.  

In certain sections of our website we offer contact and advice via Live Chat. Live Chat allows you to communicate with one of our consultants via text messages. When you access and use Live Chat, your browser automatically transmits the following data at the beginning of use for technical reasons. We store this data separately from other data that you may transmit to us: 

• Date and time of access 
• Duration of website visit 
• Type of web browser including version 
• Operating system used 
• Amount of data transmitted 
• Type of event 
• IP address. 

We process this data on the basis of GDPR Article 6 Paragraph 1 (b) and (f) and applicable Canadian privacy laws for the purpose of providing the function, safeguarding its technical operation and identifying and clearing up malfunctions. In doing so, we also pursue the aim of permanently ensuring the technical functionality of the function, improving performance and optimizing the user experience. When you call up the function, this data will be processed automatically. Without the provision of data, you will not be able to use the function. We do not use this data for the purpose of drawing conclusions about your person or your identity. 

The legal basis for this data processing is GDPR Article 6 [1] (f) and applicable Canadian privacy laws, whereby our legitimate interest is directed towards guaranteeing and maintaining the operation and security of our services and the elimination of faults. Within this framework, data is also processed by us for analysis purposes, without allocation to a specific person. 

If you provide us with additional personal data via Live Chat, you do so on a voluntary basis. If personal data is required to clarify your request, we will point this out to you and ask you for your personal data. The texts you enter into the input mask during the Live Chat session are stored on our behalf on an external service provider's server. The legal basis for this data processing is GDPR Article 6 [1] (b) and applicable Canadian privacy laws. 

2.3.2 Guest access for reservation and purchase of services and products via the "Online Marketplace" section 

In addition to using the Online Marketplace with Porsche ID, customers can use the Porsche Store Marketplace section without prior registration and creation of a Porsche ID user account via the "Guest access" feature. For information on data processing in this context, please refer to Point 2.2.6. 

2.3.3 Closest Porsche Drive Rental location 

No prior registration and creation of a Porsche ID user account is required to use this feature. 

This feature allows you to find the closest Porsche Drive Rental location with your device. 

When this feature is used, the following categories of personal data will be processed: 

• Location data of your device. 

This is provided voluntarily. If you do not provide this data, however, we may not be able to fully comply with your wishes in relation to using this feature. 

We shall process this data on the basis of GDPR Article 6 [1] (b) and applicable Canadian privacy laws in order to provide you with the services you require in this connection, and to implement the associated contractual relationship with you.  

2.3.4 Non-binding reservation inquiry via Porsche Drive Rental 

No prior registration and creation of a Porsche ID user account is required to use this feature. 

This feature allows you to contact us using a contact form to make a non-binding reservation inquiry. The data gathered here will be used solely to process your inquiry and to send you a non-binding offer. 

(a) Mandatory data when making a reservation inquiry 

When using this feature, the following categories of personal data, marked with an "*", will be processed as mandatory data: 

• Title, 
• First and last name, 
• Date of birth, 
• E-mail address, 
• Mobile phone number, 
• Address (street and house number, postcode and town/city), 
• Required number of vehicles in the respective class, 
• Required rental location, 
• Required rental period. 

Reservation inquiries are not possible without providing this mandatory data.  

(b) Optional data when making a reservation inquiry 

As part of your reservation inquiry, you also have the option of providing further data on a voluntary basis, i.e. the following categories of personal data: 

• Your title, 
• Your company, 
• Your telephone number, 
• Your comment. 

Please note that this information is not required for registration inquiries and whether you want to disclose this data to us is completely up to you. 

We shall process this data on the basis of GDPR Article 6 [1] (b) and (f) and applicable Canadian privacy laws in order to provide you with the services you require in this connection, to implement the associated contractual relationship with you and to enable us to draw up an offer or reservation for you. 

2.4 Newsletter  

We send newsletters to people who have registered, i.e. with your consent. Insofar as the contents of the newsletter are specifically described when registering, these are decisive for the scope of the consent. In addition, our newsletters contain information about our products, offers, promotions and our company. The party responsible for processing your data is the respective company named in the registration process. Registration takes place by means of the so-called double opt-in procedure, i.e. after your registration you will receive an e-mail in which you will be asked to confirm your registration in order to prevent the misuse of your e-mail address. Registering for the newsletter is recorded by us to be able to prove the registration process and the consent in accordance with the legal requirements. The recording of the registration and the necessary processing of the data entered by you during the registration is carried out accordingly on the basis of our legitimate interests pursuant to Article 6 Paragraph 1 (f) GDPR and applicable Canadian privacy laws. You may revoke your consent to receive our newsletter at any time, e.g. by unsubscribing from the newsletter. An unsubscribe link can be found at the end of every newsletter so you can exercise this right. 

3. Integrated third party services 

Insofar as we integrate services of other providers within the framework of our website in order to offer you certain content or functions (e.g. playing videos or route planning) and we process personal data in the process, this is done on the basis of Article 6 Paragraph 1 (b) and (f) GDPR and applicable Canadian privacy laws. This is because the data processing is then necessary to implement the functions you have selected or to safeguard our legitimate interest in an optimal range of functions. Insofar as cookies may be used within the scope of these third-party services, the explanations under section 1.1.3 apply. Please also inform yourself about the privacy policy of the respective provider with regard to the third-party services. 

Services of other providers that we include or to which we refer are provided by the respective third parties. Third-party services generally also include services offered by Porsche AG and other group companies. As a matter of principle, we have no influence over the content and function of third-party services and are not responsible for the processing of your personal data by their providers, unless the third-party services are designed entirely on our behalf and then integrated by us under our own responsibility. Insofar as integrating a third-party service leads to our establishing joint processes with the service provider, we establish an agreement with this provider on joint responsibility pursuant to GDPR Article 26 and applicable Canadian privacy laws, defining the respective tasks and responsibilities in the processing of personal data and the responsible parties for fulfilling data protection obligations. Insofar as cookies are also to be set on the basis of your consent, you will receive further information on the responsibility for setting these cookies or any associated third-party services in the corresponding areas of the consent management. 

Unless otherwise stated, profiles on social media are only integrated as links to the corresponding third-party services. After clicking on the embedded text/image link, you will be redirected to the service of the respective social media provider. After forwarding, personal data may be collected directly by the third-party provider.  If you are logged into your user account of the respective social media provider during this time, the provider may be able to assign the collected information of the specific visit to your personal user account. If you interact via a "Share" button of the respective social media provider, this information may be stored in the personal user account and possibly published.  You should refer to the social media provider’s privacy notice” regarding processing and storage of your data. 

To prevent the collected information from being directly assigned to your user account, you must log out before clicking on the embedded text/image link. 

4. Rights of data subjects 

As the person whose data is being processed, you have numerous rights at your disposal. In particular, you may object to the use of cookies or similar technologies at any time. For details please refer to our Porsche Smart Mobility Cookie Policy for Websites, which can be retrieved at https://connect-store.porsche.com/ca/en/t/privacy. 

To find out about your additional rights, please refer to the information in Point 13 of the My Porsche and Porsche Connect Services / Porsche Digital Service Infrastructure General Privacy Policy, which you can access at https://connect-store.porsche.com/ca/en/t/privacy. 

5. Changes to this Privacy Policy and version 

We reserve the right to modify this Specific Privacy Policy. The current version of the Privacy Policy can always be found at https://connect-store.porsche.com/ca/en/t/privacy. 

Date:  01.02.2023