Privacy Policy

Porsche Inter Auto CZ spol. s r.o. 

CZ version

We, Porsche Inter Auto CZ spol. s r.o. (hereinafter referred to as "we" or "PIA CZ" or “Porsche Centre”), are happy about your interest in our products and services. We take the protection of your personal data very seriously. Your personal data will be processed exclusively in accordance with the statutory provisions of data protection law, in particular the General Data Protection Regulation (hereinafter referred to as "GDPR"). With this Privacy Policy, we inform you about the processing of your personal data and about your rights as a data subject. Further information regarding the processing of your personal data can be found in other service-specific privacy policies.

1. Controller and data protection officer

Unless expressly stated otherwise in this Privacy Policy or other specific privacy policies for specific services, responsible for the data processing as controller in terms of data protection law is:

Porsche Inter Auto CZ spol. s r.o.
IDNr: 47124652
Registered seat at Vrchlického 18/31, Košíře, 150 00 Praha 5
Registered with the Municipal Court in Prague under file No. C/12339
Phone: +420 257 107 107
Email: gdpr@porsche.cz

If you have any questions or suggestions regarding data protection, please feel free to contact us. You can reach our data protection officer as follows:

MOSS Advisory s.r.o.
IDNr: 07070951
Phone: +420 257 107 107
Email: gdpr@porsche.cz

2. Subject of data protection

The subject of data protection is the protection of personal data. This is all information relating to an identified or identifiable natural person (so-called data subject). This includes information such as name, surname, date of birth, postal address, email address or telephone number, but also other information about your person that arises in the course of our interaction with you, in particular:

3. Purposes and legal basis of data processing

In the following, you will find an overview of the purposes and legal basis of data processing. In any case, we process personal data in accordance with the legal requirements, even if in individual cases a different legal basis should be relevant than that stated below.

The provision of personal data by you may be required by law or contract or may be necessary for the conclusion of a contract. We will point it out separately if you are obliged to provide personal data and what possible consequences the non-supply would then have (e.g. a loss of claims or our position not to provide the requested service without providing certain information).

We may process your personal data for the below-mentioned purposes: 

• Performance of a contractual relationship (e.g. for entering into a purchase of a car, a service contract or future purchase contract for a vehicle, service, loan contract)
• User account management (e.g. entering personal data in electronic forms available on the website)
• Sending commercial communications and the offer of products and services (e.g. sending commercial communications and offer products and services via email, SMS, phone call and mail)
• Accounting and tax purposes
• Fulfilment of other legal obligations (e.g. providing information to law enforcement authorities or other public authorities)

3.1          Performance of a contract and pre-contractual measures

We process your personal data if this is necessary for the performance of a contract to which you are a party or for the implementation of pre-contractual measures taken in response to your request. The data processing is based on Article 6 paragraph 1 letter b) GDPR. The purposes of processing depend on the specific contract and include in particular e.g. purchase of motor vehicles and services contract including preparation and processing of offers, support and services. Further details on the purposes of data processing can be found in the respective contractual documents, which are not necessarily specific to data protection. 

3.2          Compliance with legal obligations

We process your personal data to comply with legal obligations to which we are subject. The data processing is based on Article 6 paragraph 1 letter c) GDPR. These obligations may arise, for example, from commercial, tax, money laundering, financial or criminal law. The purposes of the processing result from the respective legal obligation; as a rule, the processing serves the purpose of complying with state control and information obligations. 

3.3          Safeguarding of legitimate interests

We also process your personal data to pursue the legitimate interests of ourselves or third parties, unless your rights, which require the protection of your personal data, outweigh these interests. The data processing is based on Article 6 paragraph 1 letter f) GDPR. The processing to safeguard legitimate interests is carried out for the following purposes or to safeguard the following interests.

• Further development of products, services and support offers as well as other measures to control business transactions and processes;
• Improvement of product quality, elimination of errors and malfunctions, among other things by means of analysis of vehicle data and customer feedback;
• Processing of data in a central prospective customer and customer care platform as well as upstream and downstream systems for customer retention and sales purposes;
• Needs analysis and customer segmentation, e.g. calculation and evaluation of affinities, preferences and customer potential;
• Handling of warranty and goodwill cases, handling of non-contractual inquiries and concerns;
• Risk management and coordination of recall actions;
• Ensuring legally compliant actions, prevention of and protection against legal violations (especially criminal offences), assertion of and defence against legal claims, internal and external compliance measures;
• Safeguarding of the householder’s right, among other things by means of video surveillance and other measures for building and plant security within the legally permissible framework;
• Ensuring availability, operation and security of technical systems as well as technical data management;
• Answering and evaluation of contact requests and feedback.

When we send emails for customer and prospect management, we may use commercially available technologies such as tracking pixels or click-through links. This enables us to analyse which or how many emails are delivered and/or rejected and/or opened. The latter is done in particular using tracking pixels. It will not be possible to fully measure the opening rate of our emails using tracking pixels if you have deactivated the display of images in your email program. In this case, the email will not be displayed completely. However, we are still able to track whether an email has been opened if you click on text or graphic links in the email. By using click-through links, we can analyse which links in our emails are clicked and derive what interest there is in certain topics. When you click on the corresponding link, you are guided through our separate analysis server before the target page is called up. Based on the results of the analysis, we can make emails more relevant, send them in a more targeted manner or stop them from being sent. If you do not want such data to be collected and tracked, do not click on text or graphic links in emails.

3.4          Consent

We process your personal data on the basis of corresponding consent. The data processing is based on Article 6 paragraph 1 letter a) GDPR. If you give your consent, it is always for a specific purpose; the purposes of processing are determined by the content of your declaration of consent. You may revoke any consent you have given at any time, without affecting the legality of the processing that has taken place on the basis of the consent until revocation.

If you have given your consent, the companies listed in the declaration of consent can use the data on this basis, e.g. for individual customer and prospective customer support and contact you for these purposes via the communication channels you have requested. Your data will be used in this context to offer you an inspiring brand and customer care experience with Porsche and to make communication and interaction with you as personal and relevant as possible. Which of your data is actually used for individual customer and prospective customer support depends in particular on which data has been collected on the basis of orders and consultations (e.g. when buying or servicing Porsche products) and which data you have provided (e.g. your personal interests) at the respective contact points (e.g. at the Porsche Centre).

We send out newsletters by electronic means as commercial communications in sense of Act. 480/2004 Coll., Act on Certain Information Society Services, with your consent which may be given also via registration on the website. If the contents of the newsletter are specifically described in the context of a registration, these are decisive for the scope of the consent. Furthermore, our newsletters contain information about our products, offers, promotions and our company. The entity named in the registration process is responsible for processing your data. The registration is carried out by means of the so-called double opt-in procedure, i.e. after your registration you will receive an email asking you to confirm your registration in order to prevent the misuse of your email address. The registrations for the newsletter are logged by us in order to be able to prove the registration process and the consent contained therein in accordance with the legal requirements. The logging of the registration and the necessary processing of the data entered by you during the registration process is accordingly based on our legitimate interests in accordance with Article 6 paragraph 1 letter f) GDPR. You can revoke your consent to receive our newsletter at any time, e.g. by unsubscribing from the newsletter. You will find an unsubscribe link to exercise this right at the end of each newsletter.

3.5          Change of purpose

If we process your personal data for a purpose other than that for which the data was collected, beyond the scope of a corresponding consent or a mandatory legal basis, we will take into account, in accordance with Article 6 paragraph 4 GDPR, the compatibility of the original and the now pursued purpose, the nature of the personal data, the possible consequences of further processing for you and the guarantees for the protection of the personal data. 

3.6          Profiling

We do not carry out automated decision making or profiling in accordance with Article 22 GDPR. Profiling is only carried out to protect our legitimate interests as described above.

4. Sources and categories of data in case of third-party collection 

We also process personal data that we receive from third parties or from publicly accessible sources. Below you will find an overview of the corresponding sources and the categories of data obtained from these sources.  

Group companies of Porsche AG, Porsche distribution companies (including companies that provide ser-vices in the in the area of Porsche Connect and Smart Mobility), dealerships and service companies (particularly Porsche Centres and Porsche Service Centres):

Cooperation partners and service providers: e.g. in the case of purchase, repair and financing transactions. 

5. Recipients of personal data

Within our company, only those persons who need your personal data for the respective purposes mentioned have access to it. Your personal data will only be passed on to external recipients if we have legal permission to do so or have your consent. Below you will find an overview of the corresponding recipients: 

• Commissioned processors: Group companies or external service providers, for example in the areas of technical infrastructure and maintenance, which are carefully selected and reviewed. The processors may only use the data in accordance with our instructions.
• Public bodies: Authorities and state institutions, such as tax authorities, public prosecutors' offices or courts, to which we (must) transfer personal data, e.g. to fulfil legal obligations or to protect legitimate interests.
• Private bodies: Group companies, Porsche dealers and service companies, cooperation partners, (non-processor) service providers or commissioned persons such as Porsche Centres and Porsche Service Centres, financing banks, credit agencies or transport service providers.

6. Data processing in third countries

If a data transfer takes place to entities whose registered office or place of data processing is not located in a member state of the European Union, another state party to the Agreement on the European Economic Area or a state for which an adequate level of data protection has been determined by a decision of the European Commission, we will ensure prior to the transfer that either the data transfer is covered by a statutory permit, that guarantees for an adequate level of data protection with regard to the data transfer are in place (e.g., through the agreement of contractual warranties, officially recognized regulations or binding internal data protection regulations at the recipient), or that you have given your consent to the data transfer.

If the data is transferred on the basis of Articles 46, 47 or 49 paragraph 1, subparagraph 2 GDPR, you can obtain from us a copy or reference to the availability of the guarantees for an adequate level of data protection in relation to the data transfer. Please use the information provided under Section 1.

7. Storage duration, erasure of data

We store your personal data, if there is legal permission to do so, only as long as necessary to achieve the intended purposes or as long as you have not revoked your consent. In the event of an objection to processing, we will delete your personal data, unless further processing is still permitted by law. We will also delete your personal data if we are obliged to do so for other legal reasons. Applying these general principles, we will usually delete your personal data immediately 

• after the legal permission has ceased to apply and provided that no other legal basis (e.g. commercial and tax law retention periods) intervenes. If the latter applies, we will delete the data after the other legal basis has ceased to apply;
• if your personal data is no longer required for the purposes we pursue and no other legal basis (e.g. commercial and tax law retention periods) intervenes. If the latter is the case, we will delete the data after the other legal basis has ceased to apply.

We store your personal data according to the purpose of processing for the period bellow: 

8. Rights of data subjects

Right to access: You have the right to receive information about your personal data stored by us. 

Right to rectification and erasure: You can demand that we correct incorrect data and, if the legal requirements are met, delete your data. 

Restriction of processing: You can demand that we restrict the processing of your data, provided that the legal requirements are met. 

Data portability: If you have provided us with data on the basis of a contract or consent, you may, if the legal requirements are met, demand that the data you have provided us with are handed over in a structured, common and machine-readable format or that we transfer it to another controller.

Objection: You have the right to object at any time to data processing by us based on the safeguarding of legitimate interests for reasons arising from your particular situation. If you make use of your right to object, we will stop processing the data unless we can prove compelling reasons for further processing worthy of protection which outweigh your rights and interests. 

Objection to direct marketing: If we process your personal data for the purpose of direct marketing, you have the right to object to our processing of your data for this purpose at any time. If you exercise your right to object, we will stop processing your data for this purpose.

Revocation of consent: If you have given us your consent to process your personal data, you can revoke it at any time with effect for the future. The legality of the processing of your data until revocation remains unaffected

Right to lodge a complaint with a supervisory authority: You can also lodge a complaint with the competent supervisory authority if you believe that the processing of your data violates applicable law. You can contact the supervisory authority responsible for us (The Office for Personal Data Protection, https://www.uoou.cz/, at Pplk. Sochora 27170 00 Praha 7 Czech Republic). 

Your contact with us and the exercise of your rights: Furthermore, you can contact us free of charge if you have questions regarding the processing of your personal data and your rights as a data subject. In cases determined by GDPR we may charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested. Please contact us at gdpr@porsche.cz or by letter mail to the address provided under Section 1. Please make sure that we can definitely identify you. If you revoke your consent, you can alternatively choose the contact method that you used when you gave your consent.

9. Third party offers 

Services of other providers to which we refer are provided by the respective third parties.  We have no influence on the content and function of these third-party services and are not responsible for the processing of your personal data by these third-party services. 

10. Effective date

The latest version of this Privacy Policy applies. This version dates from 28.12.2021.