Data Protection and Privacy Statement
Privacy Policy
We, Porsche Korea (hereinafter referred to as 'we' or 'PKO'), are pleased about your use of the Porsche Digital Service Infrastructure and our other digital offers (hereinafter individually or jointly also referred to as 'services' and jointly 'Porsche Digital Service Infrastructure'). This Privacy Policy provides information about the processing of your personal data and your privacy rights as a data subject in connection with your use of the Porsche Digital Service Infrastructure and our services. For information on the individual services, please refer to the further Special Data Protection Notices of the respective service.
1. Data controller and data protection officer
Unless otherwise expressly stated in this Privacy Policy and, if applicable, in the further Special Data Protection Notices of the respective service, the entity responsible for data processing is:
Porsche Korea Ltd.Department in charge of personal data protection and handling related complaints (Legal & Compliance Department)
26F Parnas Tower, 521 Teheran-ro,
Gangnam-gu, Seoul 06164
Republic of Korea
E-mail: privacy@porsche.co.kr
You can reach our chief privacy officer at the above address with the addition of 'Chief Privacy Officer', or at privacy@porsche.co.kr
2. Subject matter of Data Privacy
The subject matter of Data Privacy is the protection of personal data. This is any information that relates to an identified or identifiable natural person (so-called data subject). This includes, for example, information such as the name, postal address, e-mail address or telephone number, but also other information that is generated in the course of using the online offer, in particular information about the start, end and scope of its use as well as the transmission of your IP address.
3. Purposes and legal bases
This Privacy Policy hereinafter provides you with an overview of the purposes and legal bases of data processing in the context of registering, creating and using your Porsche ID user account as well as of other data processing during your customer relationship. We process your personal data in particular if this is necessary for the performance of a contract to which you are a party or for the performance of pre-contractual measures that take place at your request.
We also process your personal data, insofar as this is necessary, to comply with legal obligations to which we are subject.. The obligations may result, for example, from commercial, tax, money laundering, financial or criminal law. The processing generally serves the purpose of complying with state obligations with regard to monitoring and duty of disclosure.
The provision of personal data by you may be required by law or contract when using the services or may be necessary for the conclusion of a contract. We will inform you separately if you are obliged to provide personal data and what the possible consequences of not doing so would be (e.g. a loss of claims, or we might have to inform you that we cannot provide the requested service without being provided with certain details).
We also process location and movement information that is necessary in order to display location-related content in the vehicle.
We shall automatically record and retain data in the location information system confirming the collection, use, and provision of location information for at least six (6) months in accordance with the Location Information Act.
In the event you withdraw, in whole or in part, the consent in accordance with the Article 6 of ‘Terms of Use of Location Information Business‘, We shall destroy the collected personal location information and any data confirming the collection, use, and provision of personal location information pertaining to you (in the case of a partial withdrawal, however, such destruction shall be limited to personal location information affected by such withdrawal) without delay. Moreover, we normally destroy personal location information after 13 months; however, in exceptional cases, We destroy such information immediately after the purpose ceases to exist; provided, however, such data shall be preserved in cases where you provide your separate consent or if it is necessary to preserve such data in order to process your complaint, resolve a dispute with you, or if otherwise required under the Framework Act on National Taxes, Corporate Tax Act, Value-added Tax Act, and other relevant laws and regulations. When we destroy personal location information, we safely destroy it in an irrevocable manner. Personal location information stored in electronic form will be safely deleted using a technical method that prevents recovery, and any personal location information in physical, hard copies will be shredded or incinerated.
If we provide personal location information to a third party designated by you, we shall immediately notify you via the communications device used to collect personal location information of the recipient(s) of personal location information, the date of provision, and the purpose for providing personal location information each time such personal location information is provided; provided, however, the foregoing immediate notice requirement shall not apply to the third party provision of simple location data which does not constitute personal location information. Notice shall be provided to a communications device or e-mail address specified in advance by you in the following circumstances:
- If the communications device that collected personal location information is not capable of receiving text messages, voice messages, or video messages; or
- If you have requested in advance that notice be provided through an online post or some other method.
3.1 Provision of the website
To a certain extent, it is possible to use this website without logging in. Even if you use the website without logging in, personal data may still be processed. Below you will find an overview of the type, scope, purposes of and legal grounds for automated data processing that takes place when using our website. For information on the processing of personal data when using the individual specific features and services, please refer to the points below.
The following data will be processed by us when you access our website with your device:
- Date and time of access,
- Duration of visit,
- Type of device,
- Operating system used,
- The features you use,
- Amount of data transmitted,
- Type of event,
- IP address,
- Referrer URL,
- Domain name.
In processing this data, we also pursue the aim of permanently ensuring the technical functionality of the website, improving performance and optimising the user experience. This data is processed automatically when you access our website. Without the provision of data, you cannot use our website. We do not use this data for the purpose of drawing conclusions about your person or your identity.
We normally delete this data after 13 months, unless by way of exception we need it for the purposes set out above. In such cases, we will delete the data immediately after the purpose ceases to exist.
3.2 Porsche ID user account
Registration and creation of a Porsche ID user account on My Porsche are required to make full use of the Porsche Digital Service Infrastructure and the services offered under it. Here, personal data is processed and, if necessary, transmitted to third parties as described below in order to fulfil our contractual obligations in this context.
3.2.1 Registration for Porsche ID
You can choose to register and create your Porsche ID user account either through your authorised dealer or as part of the self-registration process.
(a) Mandatory data when registering and creating a Porsche ID user account
Both in the case of self-registration and of registration through an authorised Dealer, your e-mail address, a password, your name and name suffixes, contact and address data, mobile phone number, and, if applicable, the language in which you want to communicate with us are processed. This personal data is required to set up and manage your Porsche ID user account for you so that you can use the full range of our services as part of the Porsche Digital Service Infrastructure. In selected countries, you can also use our offer as an interested party. In this case, you only need to provide your name, e-mail address and a password. Last but not least, we also need this and possibly other personal data in order to be able to respond to requests, questions and criticism. We also save the time of your last log-in. When you register and create your Porsche ID user account, we check your name and address data by means of a plausibility check.
If you want to use services that require vehicle ownership, you must also submit a copy of an identification document and proof of ownership and, in the event you are not the owner of the vehicle, a power of attorney from the vehicle owner after entering your vehicle identification number. These documents are forwarded to Porsche Connect Support or, in countries where the official language is not supported by Porsche Connect Support, directly to the dealer selected by you and are then checked locally using our verification criteria. As proof of successful verification, we also save the names, dates and places of birth and addresses shown in the relevant identification documents along with the validity dates of the documents, as well as the vehicle identification numbers, owner names and addresses shown in the proof of ownership. After verification is complete, the copies of the documents will be deleted. Alternatively, you can use the video identification procedure for verification via our Porsche Connect Support.
Self-registration requires uploading images from your device. You will therefore be asked to grant permission for the app to access your device's camera or photo library. The permissions can be revoked at any time by changing the respective system settings.
(b) Voluntary data when registering and creating a Porsche ID user account
When registering and creating your Porsche ID user account, you also have the option of entering additional voluntary details such as additional name information (e.g. academic title, etc.), company contact details, date of birth, additional telephone numbers, credit card information (this is only stored by the payment service provider), your vehicle license plate number and a personal vehicle name. In addition, you can provide information about your interests, preferences and the contact channels you would like to use. Please note that this information is not required when registering and creating your Porsche ID user account and that you alone decide whether you want to disclose this personal data to us. Our interest lies in achieving the best possible alignment of our offers with your preferences and interests, as well as in providing the most comprehensive range of functions possible for our offers.
3.2.2 Use of the Porsche ID
After registering for a Porsche ID, you have the option of using various services that require a Porsche ID, such as our online portal or functions within your vehicle. For authentication within the scope of these services, you must always log in with your Porsche ID and your password. We process this data in order to be able to provide you with the services you desire..
3.2.3 Integration of the Porsche ID into third-party offers
In some cases, we also enable cooperation partners to offer a registration and login procedure involving the Porsche ID. This means that you do not have to remember any new login data for the third-party offer. If you decide to use the registration and login procedure involving the Porsche ID as part of the third-party offer, you will be redirected to the PKO login/registration screen for the Porsche ID. Here you log in with your user name and password for the Porsche ID. We will then send a message to our cooperation partner that you have successfully registered. As part of the registration and login process, you can confirm to us that the cooperation partner may access the profile data of your Porsche ID user account. This then also applies to the payment data stored there, if applicable. This means that you do not have to re-enter or maintain your profile data and, if applicable, payment data (e.g. if your address changes) in order to create your user profile for the third-party offer. Conversely, changes to the profile data in the user account of the third-party offer are then also synchronised accordingly in your user account for the Porsche ID.
Data processing within the scope of the registration and login procedure involving the Porsche ID is carried out in order to register you for the third-party offer using your user account or to identify you when you register. In addition to carrying out your desired procedure, we are interested in making the registration and application process efficient and convenient.
3.3 Booking and handling of payment information
You can book individual or several My Porsche Services and Porsche Connect Services and activate service licences. When selecting the respective service or service package, you can also view the respective information on the processing of personal data within the scope of the services concerned under the offer details. In order to carry out and fulfil a booking and the associated contractual relationship, we process, in addition to the respective booking information, your personal data collected during registration and creation of your Porsche ID user account as well as data that you provide in the course of booking the service (for example your date of birth, a security question for verification in the event of theft, your vehicle's colour or your licence plate number). You can change your billing address before completing the booking process. In this case, we use the address data provided by you for invoicing and processing.
We use a payment service provider to process payments for our paid services and products within the scope of My Porsche, Porsche Connect and the online marketplace. For this purpose, we and the payment service provider used will process your credit card information and the respective payment information. The payment service provider's systems are used to manage your credit card information and to process payments. When you enter your credit card information, it is done directly via an input field of the payment service provider which encrypts, stores and uses this information independently for your payments. The encrypted information is then transferred by Porsche / by us to the payment service provider, where it is stored and used for your payment.
The payment service provider commissioned will process your customer and contact information (for example name, address, email address, Porsche Connect customer number, and if applicable, company and affiliates) and the vehicle identification number shown in the proof of ownership for the sole purpose of accounts receivable management (including compliance checks, where legally required) and to carry out credit checks.
When purchasing through online shops, our payment service provider determines the fraud risk using customer data (e.g. name and identifier, sales history, etc.). The transaction data is checked and examined for abnormalities (e.g. frequency of password changes, delivery address differing from the invoicing address).
After completing the booking, you can activate the services. This saves the authorisation for use on the system side and updates the list of available services accordingly.
3.4 Proof of identity
The laws in some countries may require an identity check based on identification documents in order to book certain telecommunications services. In relation to data processing when carrying out such identity checks, we are jointly responsible with
- IDnow GmbH, Auenstr. 100, 80469 Munich, Germany.
You can view the privacy policy of our cooperation partner IDnow GmbH via the following link: https://idnow.io/privacy/
There are two methods available for performing identity verification. One method is that, as part of the service booking procedure, you can be redirected to the external page or app of the above-mentioned service provider, who supports us in performing the person verification. As part of the process, we will, at your request, transmit the information to be verified (your name, your address and your date of birth) as well as a reference number to the service provider that will allow us to assign the test result at a later point. As part of the identity check, the service provider will compare the aforementioned data with your identification document and store the data, as well as an optoelectronic copy of the identification document, a photo of the verified person and an audio record of the session. The service provider will then inform us of the result of the identity check, using the reference number.
Your other option is to have identity verification performed at a participating Porsche Centre. This involves staff at the Porsche Centre verifying your identity on the basis of an identification document and sending the verified information (your name, address and date of birth) and a reference number to the service provider via a Porsche system. By entering this reference number, you can use the service provider's app to submit an optoelectronic copy of your identification document to the service provider at your convenience. The service provider will then inform us of the result of the check, using the reference number.
Personal data resulting from this identity check will only be shared with third parties if we are legally obliged to do so. Only in such cases will we obtain access to a copy of your identification document from the service provider, for the purpose of fulfilling our legal obligations.
3.5 Provision of Information via the website
With the help of functions such as the provision of service and warranty information as well as My Porsche messages, we provide you with the information you need in a clear form. It is necessary to register in advance and create a Porsche ID user account in order to use these functions.
In order to provide you with information about your vehicle, current warranties and recall campaigns in the 'My Porsche' section of our website, we process equipment and vehicle master data such as the vehicle identification number shown on the proof of ownership, current warranties, the model year and a model picture.
In addition, with the My Porsche Messages function, we offer you the option of calling up your messages both in the app and via the My Porsche Messages portal. This usually entails information relevant to the contract in connection with the purchase and/or use of your account, your vehicle or digital content from Porsche. For this purpose, we process the following personal data in particular: master data, contact data, contract data, dealership data and car data.
3.6 Customer and prospect management
3.6.1 Contact via contact forms
You can use various communication channels to contact us, in particular the service hotline if you wish to contact us by telephone, but also e-mail or live chat. If you contact our contact centre, we process personal data to the extent necessary to provide the contact centre service and to process your request. We may ask you to provide personal data that is necessary for the preparation and implementation of the contact to process your respective request. Without this data, we will not be able to process your request or fulfil your request. The purposes of processing arise specifically from your request and the services you have booked. These encompass, in particular, the processing of requests from interested parties, customers and dealers in relation to products and services from PKO. This includes, for example,
- Technical support services
- Assistance when purchasing services or products
- Answering general questions about sales & marketplace
- Technical support for customers and dealers, in particular through the provision of a service hotline for telephone contact.
We also process your personal data in order to comply with legal obligations to which we are subject. Obligations may arise, for example, from commercial, tax, telecommunications, money laundering, financial or criminal law. The purposes of processing arise from the respective statutory obligation; the processing generally serves the purpose of complying with state obligations with regard to monitoring and duty of disclosure.
If we collect data on the basis of a legal obligation or in the public interest, you need to provide the personal data that is required to comply with the legal obligation. Without this, we might not be able to process your request or fulfil these obligations.
If you use support services in a Porsche Centre, your dealer can also retrieve this data. To facilitate this service, we also transmit the aforementioned data to the relevant dealer
3.6.2 Customer and prospect management
In the following, we would like to provide you with further information on data protection in the context of the implementation of customer and prospect management at Porsche. The purpose of the measures is to safeguard customer and prospect-oriented management.
Joint customer and prospect management at Porsche
The measures mentioned in this section within the scope of customer and prospect management (in particular service and support, implementation of legal requirements, needs analyses, individual support via the desired communication channels) are not, in principle, carried out by the person responsible alone. In addition to PKO, the parties involved in customer and prospect management under the Porsche brand include Dr. Ing. h.c. F. Porsche AG as manufacturer, the responsible Porsche centres, the responsible importer and other companies affiliated with Porsche in the areas of financial and mobility services, digital services and lifestyle products.
By using a central platform, we avoid situations in which information about your products, contact details and interests is not available to your contact person at Porsche, which would result in you being referred to another company involved. This also applies if the operating company of your respective Porsche Centre changes. By exchanging and comparing data, we ensure that you receive optimal support and advice. Of course, only the companies involved have access to your data, which they also need for operational purposes.
Individual customer and prospect management
Insofar as you have given voluntary consent to the individual customer and prospect management, your data – contact data, support and contract data (e.g. on purchase, leasing or financing), service information and data on interests, vehicles and the services and products that you use from the companies participating in the joint customer and prospect management – is used to send you personally tailored information and offers about vehicles, services and other products from Porsche, invitations to events and surveys on satisfaction and expectations via the desired communication channels and to create an individual customer profile.
The specific data used for this purpose depends on what data was collected on the basis of assignments, orders and consultations or made available by you (e.g. in the consultation at the Porsche Centre or as part of your activities under your Porsche ID at My Porsche). The data can also come from assignments or orders that are processed in collaboration with cooperation partners (e.g. insurance companies) and from whom we may then receive the information. If appropriate approvals have been granted, other data sources may also be included. This can be data from the vehicle (e.g. on your driving behaviour) or on the use of digital media (e.g. on website use). You will receive further information on the merging of the data with the corresponding release.
To offer you an inspiring brand and support experience with Porsche and to make our communication and interaction with you as personal and as relevant as possible, the data mentioned is used for needs analyses and customer segmentation. On this basis, it is possible to determine affinities, preferences and potentials within the scope of the individual customer and prospect management by the participating companies. Key figures regarding your probable product interests and your level of satisfaction are examples of such measures to individualise support. The corresponding information and analysis results are stored in your customer profile and are then available for designing the customer and prospect management. The personal evaluation and assignment in a customer profile only takes place if you have given your voluntary consent to the individual customer and prospect management. We do not offer individual customer and prospect management without these optimisation and personalisation measures.
If you do not give your consent, we only use the data mentioned in the context of customer and prospect management to carry out general evaluations on the basis of aggregated data from customers and prospects, with the aim of optimising our offers and systems and aligning them with overarching interests. Please note that your data may also be evaluated outside the scope of customer and prospect management; this is then based on your specific consent or another legal basis.
When we send e-mails within the context of the individual customer and prospect management, we may use commercially available technologies such as tracking pixels or click-through links. This allows us to analyse which or how many e-mails are delivered and/or rejected and/or opened. The latter is carried out in particular by tracking pixels. If you have deactivated the display of images in your e-mail program, it is not possible to measure the opening rate of our e-mails in full using tracking pixels. In this case, the e-mail will not be displayed completely. It is nevertheless still possible for us to determine whether an e-mail has been opened if you click on the text or graphic link in the e-mail. Using click-through links, we can analyse which links have been clicked in our e-mails and determine the interest in certain topics. If you click on the corresponding link, you will be guided through our separate analysis server before accessing the target page. Based on the analysis results, we can make e-mails more relevant within the scope of the individual customer and prospect management, send them in a more targeted manner or prevent e-mails from being sent. We only send e-mails to you and evaluate their use if you have given your voluntary consent to the individual customer and prospect management. We do not offer individual customer and prospect management without the described evaluation for optimisation.
3.7 Product improvement
In connection with the use of services, in the event of error messages or as part of defined data evaluation measures, certain vehicle, service and product data from the vehicle, from services or from other Porsche products may be transferred by PKO to Porsche AG in order to be available there for evaluation of the aforementioned purposes.
You can consent to this on the 'My Porsche' website.
The vehicle, service and product data comprise identification, basic, usage, analysis, environmental, traffic, location and movement data.
Some data cannot be deleted retroactively, as they are stored without specific vehicle identification. In this case the data will be deleted after 5 years at the latest.
4. Change of purpose
Where we process your personal data for a purpose other than that for which it was collected, beyond appropriate consent or a compelling legal basis, we will take into account, the compatibility of the original purpose and the purpose now pursued, the nature of the personal data, whether the additional use or provision of personal data is reasonably foreseeable, in light of circumstances in which the personal data was collected or out personal data processing practices, the possible consequences for you of further processing and the guarantee of the protection of the personal data.
We shall determine with care whether to use and provide personal data by comprehensively taking into account various circumstances, including applicable laws and regulations such as the Personal Information Protection Act, purpose of use and provision of personal data, method of use and provision of personal data, items of personal data to be used and provided, details of consent given or matters notified or disclosed to the data subject, impact of use and provision on the data subject, and measures taken to protect the data subject.
5. Access authorisations in the end device
Some functions of our online offer require you to grant access to your end device (e.g. access to location data). Granting permissions is voluntary. However, if you wish to use the corresponding functions, you must grant the corresponding authorisations, otherwise you will not be able to use these functions. Permissions remain active unless you revoke them in your device by deactivating the relevant setting.
6. Cookies and comparable technologies
We use cookies and similar technologies within the scope of the website, which serve to communicate with your terminal device and to exchange stored information (hereinafter collectively 'cookies'). These cookies are primarily used to make the functions of the website usable. General examples in which the use of cookies is technically necessary in this sense are the storage of a language selection, login data or a shopping or watch list. Accordingly, technically necessary cookies may be used by us to enable the processing operations described above and to ensure the proper and secure operation of the website.
If we also use cookies to analyse the use of the website and to target it to your interests and, if applicable, to provide you with interest-based content and advertisements, this will only be done on the basis of your voluntary consent. You can revoke your consent at any time with effect for the future. Further information on the cookies and their function in detail, as well as on setting and revocation options, is available directly in the corresponding areas of the consent management. Please note that we only provide consent management as part of the website if consent-based cookies are to be used in addition to the technically required cookies mentioned above.
If you do not wish to use cookies in general, you can also prevent any storage by means of the relevant settings on your device. Stored cookies can be erased at any time using the system settings of your device. Please note that blocking certain types of cookie may result in impaired use of our website.
We also use other technologies that, like cookies, serve to ensure the secure and user-friendly usability of the website (e.g. by protecting against misuse or evaluating usage). Technically, these other technologies differ from cookies, as they do not store any information on your end device or access information already stored there. Insofar as data falling under the data protection law (e.g. IP addresses) is processed using these additional technologies, we process this data for the purpose of providing the website, safeguarding its technical operation and identifying and resolving malfunctions. In doing so, we also pursue the aim of permanently ensuring the technical functionality of the website, improving performance and optimising the user experience. This data is processed automatically when you access our website. Without the provision of data, you cannot use our website. We do not use this data for the purpose of drawing conclusions about your person or your identity.
7. Integrated third-party services
Insofar as we integrate services of other providers within the scope of our online offer in order to provide you with certain content or functions (e.g. playing videos or route planning) and we process personal data in the process. This is because the data processing is then necessary to implement the functions you have selected or to safeguard our legitimate interest in providing an optimum range of functions in the online offer. Insofar as cookies may be used within the scope of these third-party services, the explanations under section 6 apply. Please also consult the privacy policy of the respective provider with regard to the third-party services.
Services of other providers that we include or to which we refer are provided by the respective third parties. Third-party services generally also include services offered by other group companies of Porsche AG and by Porsche Centres. As a matter of principle, we have no influence over the content and function of third-party services and are not responsible for the processing of your personal data by their providers, unless the third-party services are designed entirely on our behalf and then integrated by us under our own responsibility. Insofar as cookies are also to be set on the basis of your consent, you will receive further information on the responsibility for setting these cookies or any associated third-party services in the corresponding areas of the consent management.
Unless otherwise stated, profiles on social media are only integrated into our online offer as links to the corresponding third-party services. After clicking on the embedded text/image link, you will be redirected to the service of the respective social media provider. After being redirected, personal data may be collected directly by the third-party provider. If you are logged into your user account of the respective social media provider during this time, the provider may be able to assign the collected information of the specific visit to your personal user account. If you interact via a 'Share' button of the respective social media provider, this information may be stored in the personal user account and possibly published. To prevent the collected information from being directly assigned to your user account, you must log out before clicking on the embedded text/image link.
8. Sources and data categories in the collection of data by third parties
We also process personal data that we receive from third parties or from publicly available sources. Below is an overview of the relevant sources and the categories of data obtained from these sources.
- Group companies, Porsche sales companies, Porsche centres and service companies: information about your products, services and interests
- Cooperation partners and service providers: for example, creditworthiness data from credit agencies.
9. Data recipient
Within our company, the only people who have access to your personal data are those who need it for the purposes indicated above. We only pass on your personal data to external recipients if a legal licence exists or if we have your consent. Below you will find an overview of the corresponding recipients:
Porsche AG and PKO are part of the Porsche group of companies. Within the scope of our business, we have outsourced certain processing operations within the group of companies. In certain circumstances, data may therefore be transferred within our group of companies, for example in the context of customer relationships, for analysis and market research purposes or in the area of marketing.
This also applies to the exchange of data with the Porsche Centres, insofar as this is necessary for maintaining active customer relationships as part of customer and prospect management or for processing support cases.
We transmit data from our customer relationship to the following recipients in particular:
- Processors: Porsche AG and its group companies or external service providers, for example in the areas of technical infrastructure and maintenance, who are carefully selected and checked. The processors may only use the data in accordance with our instructions.
- Public bodies: authorities and public institutions, such as public prosecutors, courts or tax authorities to which we (must) transfer personal data, e.g. to fulfil legal requirements or to safeguard legitimate interests.
- Private entities: Porsche AG and its group companies, Porsche sales companies, dealerships and service companies, cooperation partners, service providers (not bound by instructions) or authorised persons such as Porsche Centres and Porsche Service Centres, financing banks, credit agencies or transport service providers.
- Third parties to whom processing is outsourced / Details of outsourced tasks
- Porsche Dealers in South Korea (Porsche Financial Services Korea, Ltd., Stuttgart Sports Cars, Ltd., Autostadt Ltd., Deutsche Auto, Ltd., Yongsan Sports Automobile Ltd., Seyoung Mobility Co., Ltd.) / Provision of service, Customer support, Customer communication, Reporting
- SK Networks (re-outsourced processor of Dr. Ing. h.c. F. Porsche AG) / Porsche assistance service and bCall support
- NHN KCP Corp. / Support as payment gateway
- KT Corp. (re-outsourced processor of Dr. Ing. h.c. F. Porsche AG) / Provision of content for point of interest, parking, charging, fuel
- Munhwa Broadcasting Corporation (re-outsourced processor of Dr. Ing. h.c. F. Porsche AG) / RTTI
※ Please see Section 10 below to view details on the outsourcing of processing to third parties located abroad.
10.Transfer to a third country
Personal data will be transferred abroad as below (the data recipients other than Dr. Ing. h.c. F. Porsche AG are the re-outsourced processors of Dr. Ing. h.c. F. Porsche AG).
# | Data recipient (company name, contact, place of data processing), Time and method of transmission | Processed data category (Items of Information to be Transferred) | Purpose of data transferred | Retention/Use Period of data recipient |
1 | Dr. Ing. h.c. F. Porsche AG, Germany, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | All items of personal information collected by PKO | To deal with the processing of personal information indicated in this privacy policy as PKO’s outsourced processor To improve the performance of Porsche Digital Service Infrastructure Analysis of the use behavior of the Platform visitors
| In case of outsourcing, data will be deleted when the purposes of processing have been achieved or upon the expiration/termination of the outsourcing agreement. In case of provision, data will be deleted when the purposes of processing have been achieved or when you terminate your registration for the My Porsche and Porsche Connect Service. |
2 | Gracenote Inc. privacy.department@nielsen.com USA, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | First time registration, Client ID, Device token | Provision of content for the Gracenote service and collection of statistical data. | Data will be deleted upon the expiration/termination of the outsourcing agreement |
3 | Nielsen privacy.department@nielsen.com USA, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | First time registration, Client ID, Device token | Provision of content for the Gracenote service and collection of statistical data. | Data will be deleted upon the expiration/termination of the outsourcing agreement |
4 | MHP Germany, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | Customer, usage and content data in the context of Porsche Connect services (e.g. IT-usage data, contact and identification data, vehicle identification number, vehicle data, vehicle state information, vehicle protocols, technical vehicle data, position and movement data, communication data, SIM and speech data) | Support services - e.g. analysis / research of error cases during operations | Data will be deleted upon the expiration/termination of the outsourcing agreement |
5 | UDG Germany, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | Customer, usage and content data in the context of Porsche Connect services (e.g. IT-usage data, contact and identification data, vehicle identification number, vehicle data, vehicle state information, vehicle protocols, technical vehicle data, position and movement data, communication data, SIM and speech data) | Support services - e.g. analysis / research of error cases during operations | Data will be deleted upon the expiration/termination of the outsourcing agreement |
6 | IC Consult datenschutz@icconsultgroup.com Germany, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | Customer, usage and content data in the context of Porsche Connect services (e.g. IT-usage data, contact and identification data, vehicle identification number, vehicle data, vehicle state information, vehicle protocols, technical vehicle data, position and movement data, communication data, SIM and speech data) | Support services - e.g. analysis / research of error cases during operations | Data will be deleted upon the expiration/termination of the outsourcing agreement |
7 | Valtech GmbH, Germany, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | Customer, usage and content data in the context of Porsche Connect services (e.g. IT-usage data, contact and identification data, vehicle identification number, vehicle data, vehicle state information, vehicle protocols, technical vehicle data, position and movement data, communication data, SIM and speech data) | Incident- and problem-handling in the context of customer support | Data will be deleted upon the expiration/termination of the outsourcing agreement |
8 | Iteratec Germany, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | Customer, usage and content data in the context of Porsche Connect services (e.g. IT-usage data, contact and identification data, vehicle identification number, vehicle data, vehicle state information, vehicle protocols, technical vehicle data, position and movement data, communication data, SIM and speech data) | Incident- and problem-handling in the context of customer support | Data will be deleted upon the expiration/termination of the outsourcing agreement |
9 | MSG-Systems Germany, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | Customer, usage and content data in the context of Porsche Connect services (e.g. IT-usage data, contact and identification data, vehicle identification number, vehicle data, vehicle state information, vehicle protocols, technical vehicle data, position and movement data, communication data, SIM and speech data) | Incident- and problem-handling in the context of customer support | Data will be deleted upon the expiration/termination of the outsourcing agreement |
10 | Sulzer GmbH Germany, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | Log data and trace data | System testing | Data will be deleted upon the expiration/termination of the outsourcing agreement |
11 | Audi AG Germany, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | Customer, usage and content data in the context of Porsche Connect services (e.g. IT-usage data, contact and identification data, vehicle identification number, vehicle data, vehicle state information, vehicle protocols, technical vehicle data, position and movement data, communication data, SIM and speech data) | Technical set up and operation of backend services | Data will be deleted upon the expiration/termination of the outsourcing agreement |
12 | Bertrandt AG Germany, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | Log data and trace data | Technical support | Data will be deleted upon the expiration/termination of the outsourcing agreement |
13 | Cubic Telecom Limited Ireland, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | Customer and usage data in the context of Porsche Connect services (e.g. IT-usage data, contact and identification data, vehicle identification number, vehicle data, communication data, SIM and speech data) | Providing connectivity | Data will be deleted upon the expiration/termination of the outsourcing agreement |
14 | AW Europe Belgium, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | Position data and location information, search request | Provision of content for navigation services | Data will be deleted upon the expiration/termination of the outsourcing agreement |
15 | Cerence Inc. USA, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | phone number, vehicle position, vehicle identification number, IT-usage data, contact and identification information, speech data | Providing Connected Speech services | Data will be deleted upon the expiration/termination of the outsourcing agreement |
16 | Adyen N.V. German Branch Germany, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | Payment data | Payment | Data will be deleted upon the expiration/termination of the outsourcing agreement |
17 | AXA Germany, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | Phone number, vehicle position, technical vehicle information, vehicle identification number, contact and identification information, speech data | Breakdown call | Data will be deleted upon the expiration/termination of the outsourcing agreement |
18 | radio.de GmbH Germany, at the time of the user’s consent to the cross-border transfer of personal information, via network (processed with security protocol) | Usage information; login times; | Access to internet radio stations, information’s on current radio station list | Data will be deleted upon the expiration/termination of the outsourcing agreement |
* The addresses indicated above represent the work location of the Data Protection Officer for each outsourced processor. As such, please direct your inquiries to one of the foregoing addresses or e-mail addresses to get in touch with the Data Protection Officer of the relevant outsourced processor.
You may choose not to transfer your personal information overseas by deleting your Porsche ID user account. In such an event you will not be able to use Porsche Digital Service Infrastructure.
11. Storage duration & deletion
The following shall apply if the description of the individual services does not include information about the specific duration of storage or the deletion of the personal data:
We store your personal data, if a legal permission exists for this, only as long as necessary to achieve the purposes pursued or as long as you have not revoked your consent. In the event that you object to the processing, we will delete your personal data unless further processing is permitted by the legal provisions. We will also delete your personal data if we are obligated to do so for other legal reasons. Pursuant to these general principles, we will usually delete your personal information immediately
- after the legal basis ceases to exist and unless another legal basis (e.g. commercial and tax retention periods) applies. If the latter is the case, we will delete the data once the other legal basis ceases to apply;
- if your personal data is no longer required for our purposes, and if no other legal basis (for example, commercial and tax retention periods) is applicable. If the latter is the case, we will delete the data once the other legal basis ceases to apply.
The specific retention periods based on the relevant statutes have been indicated below.
- Records on contents of the contracts and execution thereof in connection with electronic commerce transactions Under the Act on the Consumer Protection in Electronic Commerce, etc.
- Records related to cancellation of contracts or subscriptions, etc.: Five (5) years (retention under relevant statues), Ten (10) years (retention and use based on your consent)
- Records related to payment for and supply of goods, etc.: Five (5) years (retention under relevant statues), Fifteen (15) years (retention and use based on your consent)
- Records related to resolution of consumer complaints or disputes: Three (3) years (retention under relevant statues), Ten (10) years (retention and use based on your consent)
- Records related to cancellation of contracts or subscriptions, etc.: Five (5) years (retention under relevant statues), Ten (10) years (retention and use based on your consent)
- Trade books, other important documents relating to business and slips under the Electronic Financial Transactions Act
- Trade books, other important documents relating to business: Ten (10) years (retention under relevant statues and retention and use based on your consent)
- Slips or documents similar thereto: Five (5) years (retention under relevant statues and retention and use based on your consent)
- Trade books, other important documents relating to business: Ten (10) years (retention under relevant statues and retention and use based on your consent)
- Account books and documentary evidence related to all transactions under the Framework Act on National Taxes and Corporate Tax Act: Five (5) years (retention under relevant statues), Ten (10) years (retention and use based on your consent)
- Account Books, tax invoices and receipts under the Value-Added Tax Act: Five (5) years (retention under relevant statues), Ten (10) years (retention and use based on your consent)
- Records on collection, processing, use of credit information under the Credit Information Use and Protection Act: Three (3) years (retention under relevant statues), Ten (10) years (retention and use based on your consent)
We will also delete your personal data if we are obligated to do so for other legal reasons. Pursuant to these general principles, we will usually delete your personal data immediately
- after the legal basis ceases to exist and unless another legal basis (e.g. commercial and tax retention periods) applies. If the latter is the case, we will delete the data once the other legal basis ceases to apply;
- if your personal data is no longer required for our purposes, and if no other legal basis (for example, commercial and tax retention periods) is applicable. If the latter is the case, we will delete the data once the other legal basis ceases to apply.
Personal data is immediately destroyed to an un-restorable state with the approval of the Chief Privacy Officer of PKO once the purpose of collecting and storing personal data is fully served, which includes the user’s membership cancellation, service termination, and/or expiration of the personal data storage period that was approved by the user.
Personal data stored pursuant to applicable law(s) is immediately destroyed to an un-restorable state with the approval of the Chief Privacy Officer of PKO once the legally prescribed storage period expires.
Personal data stored in electronic form is safely deleted using technical methods that prevent their restoration or regeneration. Personal data stored in the form of hard copy documents is deleted through shredding or incineration.
12. Rights of the data subject
- Right of access: you have the right to receive information about your personal data stored by us.
- Permission and deletion right: you may request us to correct incorrect data and – insofar as the legal requirements are fulfilled – to delete your data.
- Limitation of processing: you may require us to restrict the processing of your data, provided that the legal requirements are met.
- Data transferability: if you have provided us with data based on a contract or consent, you may, if the statutory requirements are met, obtain from us the data provided by you in a structured, commonly used and machine-readable format, or require us to transmit it to another responsible party.
- Right to object: you have the right to object at any time, on grounds relating to your particular situation, to our processing of your data, provided this objection is based on the safeguarding of 'legitimate interests.' If you make use of your right to object, we will stop processing your data, unless we can prove compelling legitimate reasons for further processing that outweigh your rights and interests.
- Objection to direct marketing: if we process your personal data for the purpose of direct marketing, you have the right to object to our processing of your data for this purpose at any time. If you exercise your right to object, we will stop processing for this purpose.
- Withdrawal of consent: if you have given us consent to the processing of your personal data, you can revoke this at any time with effect for the future. The withdrawal of consent will not affect the lawfulness of processing before its withdrawal.
- Opposition to cookies: You may also object to the use of cookies at any time. Details can be found in our cookie policy.
- Right of appeal to the supervisory authority: you can also lodge a complaint with the responsible supervisory authority if you believe that the processing of your data violates applicable law. You can contact the supervisory authority responsible for your place of residence or country or the supervisory authority responsible for us.
- Your contact with us and exercising your rights: furthermore, you can contact us free of charge with questions about the processing of your personal data and about your rights as a data subject. Please contact us by e-mail at connect@porsche.co.kr, via the website at http://www.porsche.com/germany/privacy/contact/ or by post at the address provided in Section 1 above. When doing so, please make sure that we can clearly identify you. If you wish to withdraw your consent, you can alternatively use the method of contact that you used when you gave your consent.
- Right of legal guardian of a child eight years or younger, etc.:
- Where the legal guardian of any of the following persons (hereinafter referred to as "child eight years or younger, etc.") gives consent to collecting, using, or providing personal location information regarding the child eight years or younger, etc., for the protection of the latter's health or safety, it shall be deemed that the child, etc. personally consent thereto:
- A child eight years or younger;
- A person under adult guardianship;
- A person with a mental disorder defined in Article 2 (2) 2 of the Act on Welfare of Persons with Disabilities, classified as a person with a severe disability defined in subparagraph 2 of Article 2 of the Act on the Employment Promotion and Vocational Rehabilitation of Persons with Disabilities (limited to those registered as disabled persons under Article 32 of the Act on Welfare of Persons with Disabilities).
- The legal guardian of a child eight years or younger, etc. means any of the following persons who provides de facto protection for the child, etc.:
- The legal representative of a child of eight years old or younger or a guardian under Article 3 of the Act on the Guardianship of Minors in Protective Facilities;
- The legal representative of a person under adult guardianship;
- The legal representative of a person prescribed in paragraph (1) 3, the head of a residential facility for persons with disabilities under Article 58 (1) 1 of the Act on Welfare of Persons with Disabilities (limited to any facility established and operated by the State or a local government), the head of a mental health sanatorium defined in Article 22 of the Act on the Improvement of Mental Health and the Support for Welfare Services for Mental Patients (limited to any facility established and operated by the State or a local government), or the head of a mental health rehabilitation facility defined in Article 26 of the same Act.
- In order to protect, a child eight years or younger, etc., a person who intends to give consent to the collection, use or provision of the personal location information of the child eight years or younger, etc. shall present a written consent with the following documents verifying the person is an obligator for protecting child eight years or younger, etc.
- Name, address and birth date of the child at the age of not more than eight years, etc.;
- Name, address and contact point of the obligator for protection;
- Fact that the purpose of the collection, use or provision of personal location information is limited to the protection of the life or body of the child at the age of not more than eight years, etc.;
- Date of consent.
13. Data security
We implement all organizational measures and state-of-the-art technical measures necessary to ensure a level of protection sufficient to address relevant potential security risk, in compliance with the applicable statutory requirements.
The company takes the following measures to ensure the safety of personal data.
- Organizational measures: establishment of internal management plan, regular employee training, etc.
- Technical measures: management of access authority to the personal data processing system, installation of access control system, encryption of unique identification information, installation of security programs
- Physical measures: access control to IT/computer room, data storage room, etc.
14. Designation of the Chief Location Information Officer
We shall designate as the Chief Location Information Officer a person capable of taking actual responsibility in order to ensure that location information is properly managed and protected, as well as enabling the smooth processing of complaints made by you.
The Chief Location Information Officer designated by Company shall be as follows:
- Affiliation: Director of Product & Marketing, Porsche Korea Ltd.
- Contact Information: 080-8100-911
Date: 02/29/2024