Data protection notice

Applicants
and Internal Further Developments

This Data Protection Notice pursuant to Art. 13, 14 EU GDPR provides information on the
processing of your personal data by AUDI AG, Auto-Union-Strasse 1, 85057 Ingolstadt,
Germany, (hereinafter referred to as “we”) in connection with applications and internal
continued development.

The term employees is to be understood in a broad sense and includes members of staff,
those employed in their vocational training, participants in work experience schemes and
in clarification of their professional suitability or in trial working (those undergoing
rehabilitation), persons who are to be regarded as near-employees in view of their
economic independence (e.g. homeworking employees and their like) as well as
applicants and persons whose employment relationship has ended. If an employment
relationship is established, you will be informed separately about the further processing
of your personal data.
Personal data include all information related to an identified or identifiable natural
person. An identifiable natural person is one who can be identified, directly or indirectly,
in particular by reference to an identifier such as a name, an identification number,
location data, an online identifier or to one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of that natural
person. Processing means any operation or set of operations which is performed on
personal data or on sets of personal data, whether or not by automated means, such as
collection, recording, organization, structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination, restriction, erasure or destruction.

1. Who is responsible for data processing and who can I contact about this?

The responsible party for processing your personal data is:

AUDI AG, Auto-Union-Strasse 1, 85057 Ingolstadt

If you have concerns about data protection, you can also contact our company’s data
protection officer:

AUDI AG, Data Protection Officer, 85045 Ingolstadt,

E-Mail: datenschutz@audi.de

If you would like to assert your data protection rights, please use the contact options at

www.betroffenenrechte.audi.de
You will find more information there about how you can assert your data protection
rights.

2. What data do we process and where do we get them from?

We process personal data that we receive from you within the framework of your
application (e.g. your accompanying letter, CV, certificates and references) as well as any
other data we collect from or about you in the process (e.g. e-mails, meeting notes,
internal assessments, the outcomes of security checks, where applicable, information
from job interviews and from the assessment center). We also process personal data
that we obtain legally from publicly accessible sources (e.g. web pages, press reports
and social networks) and are permitted to process. Furthermore, we process information
available to us internally which is regarded as necessary in relation to internal further
development measures within non-pay-scale staff and/or management in accordance
with the process. In addition to this, there are data which have been generated in relation
to an external check of the applicants by a service provider (see below) for hirings in
upper management or hirings and appointments in top management.
Relevant personal data includes:
Master data (e.g. name, title, academic title, gender, date and place of birth, nationality,
private contact data (address, telephone number, e-mail address), marital status,
residence and work permits, copies of official identification, photos, language skills,
next of kin and their contact data),
Application data (e.g. application and CV, references, results of security checks (where
applicable), information from an interview, references for specific groups (e.g.
vocational training, dual training), test results or assessment center information),
Health data (e.g. occupational health checks, illnesses, illness-related aids, disabilities)
if provided by you within the context of your application,
Data protection declarations (e.g. declarations of consent to process personal data,
revocations of consent you have given, objections to the processing of personal data and
declarations asserting your rights to information, correction, erasure, restricted
processing and data portability, including the information you provide us when asserting
your rights),
Fiscally relevant information about religious affiliation from which religious and
philosophical persuasions may be inferred, where provided by you within the context of
your application,
Information on marital status (marriage or civil partnership) from which sexual
orientation may be inferred, where provided by you in the context of your application.

3. For what purposes and on what legal grounds do we process your data?

General handling of applicant data:

We process your personal data primarily to conduct the application process and decide
on the establishment of an employment relationship on the basis of Section 26(1)(1) of
the German Federal Data Protection Act (BDSG). Where necessary, we process personal
data to assess your capacity for work on the basis of Section 22(1)(1)(c) BDSG. Where
applicable, we process other special categories of personal data (i.e. information from
which racial and ethnic origin, political opinions, religious or philosophical convictions
may be inferred, as well as heath data or data from which sexual orientation may be
inferred) to exercise rights or to fulfill legal obligations arising from employment law
(e.g. the employer’s right to ask) pursuant to Section 26(3) BDSG.
In order to improve our application process, we use and process your data to conduct a
survey. Therefor you will receive a link to participate. The results of the survey will be
saved completely anonymously.
Sanction list comparison:
Furthermore, at the end of the application procedure and before establishing a pay-scale
employment relationship, we perform an internal comparison of your personal data
with existing sanction lists (e.g. financial sanctions and terrorist lists).
Background check:
For hirings and (internal) appointments to management, hirings and (internal)
appointments to upper management and for hirings and (internal) appointments of
non-pay-scale staff (hereinafter referred to as employment groups), we perform a so-
called background check, in order to ensure the highest compliance and integrity
standards for business activities and transactions. The aim is to ensure that potential
holders of responsible functions within AUDI AG pursue their duties without conflicts of
interest and in compliance with high ethical standards and conscientiously commit to
the company’s principles, in order to minimize legal risks and reputational damage.
The background check and its result are part of the decision for the establishment or
further development of an existing employment relationship. AUDI AG only performs the
background check shortly before the decision-making regarding the establishment of
an employment relationship for a limited group of applicants.
Your data which are collected for this purpose will not be stored, processed or used for
other applications.
A justification for the processing of personal data as part of the background check arises
for the above-mentioned groups of employees from Section. 26(1) of the German
Federal Data Protection Act (BDSG). Section 26 BDSG regulates the processing of
personal data in an employment relationship and privileges such earmarked data
processing, provided that they are necessary, inter alia, for the decision regarding the
establishment of an employment relationship. Applicants for an employment
relationship in accordance with Section 26(8)(2) BDSG are put on equal terms as
employees. The processing of your personal data for the purpose of establishing an
employment relationship is necessary within the meaning of Section 26(1)(1) BDSG,
because AUDI AG has a legitimate interest in filling the above-mentioned management
positions with people who have integrity and act in accordance with the valid law. This
will be ensured by the background check prior to your appointment or hiring.

Scope of the check for non-pay-scale staff, hirings and internal appointments to
management, as well as internal appointments to upper management:
The check of personal data comprises your master data (name, date of birth, address),
qualifications and/or your degrees, your professional experience and in the case of an
already-existing employment relationship, possible regulatory violations against legal
and official requirements and/or possible violations of (Group) requirements, unless
they have already been checked at a previous time. Furthermore, we also check your
previous employment if you were not employed in a VW Group company for longer than
3 years ago. For this, personal data are requested from the personnel file, the
whistleblower system, as well as Internal Audit and the security database. To check for
possible conflicts of interest, you will also be asked for a self-assessment questionnaire
in relation to shareholdings and/or mandates – if activity-relevant – and PEP lists
(Politically Exposed Person).

Scope of the check for hirings in upper management and management:

In addition, previous employers and other referees can be questioned. To check security-
relevant incidents, such as criminal violations (e.g. hiring fraud, economic crime,
organized crime), competition-law or cartel-law violations, violations of other legal
requirements or ordinances, insolvencies, as well as existing conflicts of interest, your
master data will also be compared to sanction and other public lists and registers, inter
alia, terrorism and embargo lists, as well as PEP lists (Politically Exposed Person) and
national and international press and media, are evaluated. This can also include Internet
research – incl. social media (limited to professional networks) – and publicly accessible
databases for the check. For this in-depth research, AUDI AG uses an external service
provider for these groups of employees.
The background check is performed by the respective responsible Human Resources, the
(Group) Clarification Office, the (Group) Security and (Group) Internal Audit and the
service provider appointed for this purpose. Your personal master data (name, date of
birth, address) will therefore be initially sent to the service provider. In connection with
the background check, it prepares an information source about you on the basis of the
above-mentioned contents, without this leading to a conclusive assessment of you
personally. No automated decision-making takes place on the basis of these data. The
collected information is passed on by the service provider to a central office at AUDI AG
within Germany.
For all cases of the background check, only a limited group of people – process
participants in the background check – will have an internal access right to your data
which have been compiled in this way. This group will ensure compliance with the
deletion period shown below.
You can request from us a copy of the specifically applicable or agreed regulations on
ensuring the appropriate level of data protection. Please use the details provided in the
“Contact” section for this purpose.
If we reject your specific application but wish to continue to store your application
documents in order to contact you with regard to other positions to be filled, we will
obtain your consent for this.
Should we become involved in a judicial or extrajudicial dispute with rejected applicants,
we will also process personal data to uphold our legitimate interests on the basis of Art.
6(1)(1)(f) of the General Data Protection Regulation (GDPR). In this, our legitimate
interest lies in the establishment, exercise or defense of legal claims. If, for this
purpose, special categories of personal data have to be processed, this will take place on
the basis of Art. 9(2)(f) GDPR.

4. Am I obliged to provide personal data?

In the context of carrying out the application or internal development process, you are
only obliged to provide the personal data that is needed for the decision on the
establishment of an employment relationship or internal further development or that
we are legally required to collect. Where you are required to provide us with personal
data under a legal or contractual obligation, we point this out to you when collecting the
data, referring to the obligation in question. If you do not provide us with the relevant
data, we may not be able to continue with the application process and will be unable to
appoint you.

5. Who gets my data?

Due to the scope and complexity of data processing at AUDI AG, it is not possible to
individually list every recipient of your personal data in this data protection notice, which
is why we typically just name categories of recipients.
Within AUDI AG, only the departments that need your data as part of their activities (e.g.
HR administration, legal services, IT) receive your data.
Service providers hired by us (so-called “contract processors”) may also receive data for
these purposes. These include:
• Companies within the Volkswagen Group that provide services (e.g. IT services)
for AUDI AG (VW AG),
• Service providers for the background check,
• Hosting service providers,
• IT service providers.

In addition, we pass on your personal data to the following recipients and/or recipient
categories who act as controllers as defined under data protection law:
• Companies within the Volkswagen Group
• External consultants of AUDI AG (e.g. lawyers, tax consultants and auditors),
• Authorities within the framework of their responsibilities (e.g. the tax office,
police or public prosecutors),
• Courts,
• Other third parties that you instruct us to transfer data to or consent to us doing
so.
 6. Are data transferred to third countries?

We typically do not transmit your application data to third countries (countries that are
members neither of the European Union nor of the European Economic Area).
However it is possible that we transfer your personal data to contract processing
partners in third countries. Please note that not all third countries have a level of data
protection recognized as adequate by the European Commission. In the event that data
is transferred to third countries that do not afford an adequate level of data protection,
we ensure before transferring the data that either the recipient affords an appropriate
level of data protection (e.g. through an Adequacy Decision established by the EU
Commission or through an agreement on EU standard contractual clauses with the
recipient) or we have explicit consent.
You can obtain from us a copy of the specific applicable or agreed provisions to ensure
an adequate level of data protection. To do so, please use the information in the contact
section.

7. How long are my data stored?

General Principles
The length of time for which your personal data are stored depends on the outcome of
the application process.
If an employment relationship is established, we process and store your personal data
for the duration of your employment relationship, which also includes the winding up of
the employment relationship. We will inform you separately about further processing in
this event.
If we reject your application, the application documents will be automatically erased at
the latest six months after notification of the rejection decision. This serves to meet the
obligation to provide evidence in proceedings under the German General Act on Equal
Treatment (AGG) or other legal disputes. Should a judicial or extrajudicial dispute
actually arise, we will store your personal data for at least the duration of the
proceedings as well as thereafter in order to comply with various retention and
documentation obligations that arise out of the German Commercial Code (HGB) and
Fiscal Code (AO), amongst others. These prescribe retention and documentation periods
of up to ten years.
Should we store your personal data on the basis of your consent so that we can contact
you if other positions become vacant, we will store your data until you revoke your
consent or we no longer consider their storage to be necessary. In the latter case, we will
notify you about the erasure thereof.

Deletion periods for background checks

For hirings of external candidates, nominations and appointments, the underlying data
of the background check (date, type and findings yes or no) are recorded as a personal
entry in the Human Resources administration system and remain there in accordance
with the deletion period for relevant human resources documentation and data (see
above). For external applications which do not lead to hiring, the underlying data are
stored for a period of 6 months. The full reports of the background check are deleted
after six months for external candidates who are not hired and for all other cases, after
three months of retention.

8. Technical framework for the application process

The online application tool does not use permanent cookies. In storing Internet protocol
addresses, we comply with the legal provisions and we do not create individual user
profiles. We protect the data by means of data security measures that are in line with
the current legal requirements and the current state of technological knowledge.
Applicant data is transmitted in encrypted form using a suitable procedure.

The use of cookies

Cookies are text files that contain information used to identify returning visitors
exclusively for the duration of their visit to our web pages. Cookies are stored on your
computer’s hard drive, where they do no harm. The cookies used by our web pages do
not contain any personal data whatsoever regarding you.
Cookies eliminate the need for you to enter information multiple times, make it easier
for you to transmit specific content and help us to identify especially popular areas of
our website. This allows us to do various things, including aligning the content of our
web pages precisely to your needs.
Most web browsers are set up to automatically accept cookies. You can object to the use
of cookies at any time with effect for the future by setting your browser so that it does
not accept cookies or only accepts certain cookies, or so that you are notified as soon as
cookies are sent. The result may be that you cannot make full use of all the functions of
our website. Please use your Internet browser’s help functions to find out how to change
these settings. You will find further information in our cookies policy.
We also use analysis cookies in connection with web analysis (see also the section on user
tracking).

User tracking
This website uses a web analysis tool in the form of Adobe Analytics provided by Adobe
Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Campus, Dublin 24,
Republic of Ireland (including Omniture Site Catalyst, Omniture Genesis, Omniture
Discover, Omniture TagManager and Omniture SaintBernard) to optimize our services in
line with your needs so that our web pages are always up to date, focused on user needs
and complete. Adobe Analytics uses cookies that can track your preferences when you
visit our web pages. This provides functions such as facilitating navigation and allows us
to make our services even more user-friendly. Data is processed for the purpose of the
needs-based design of our website (pursuant to section 15 (3) of the German Telemedia
Act). The information (including your IP address) that is generated is anonymized by
default before being saved so that it cannot be used to identify you. This website has also
been adapted to ensure that IP addresses are only recorded in anonymized format
(known as IP masking). The information stored on the Adobe servers cannot be
connected directly with persons because Adobe Analytics is used with the settings
“Before Geo-Lookup: Replace visitor’s last IP octet with 0” and “Obfuscate IP-Removed”.
The setting “Before Geo-Lookup: Replace visitor’s last IP octet with 0” ensures that prior
to this geolocation the IP address is anonymized by replacing the last octet of the IP
address with zeros. For the purpose of statistical analysis, the user’s approximate
location is added to the tracking package that still includes the complete IP address.
Then, before the tracking package is stored, the IP address is replaced by a single, fixed
IP address – what is called a generic IP address – if the setting “Obfuscate IP-Removed”
is configured. This means that the IP address is no longer included in a stored data set.
The data is only analyzed for reports after anonymization. The information generated by
these cookies is normally transferred to an Adobe server within the European Union.
However, it cannot be ruled out that, in the event of a technical emergency, this data will
be transmitted to the United States and stored there; for this purpose, an appropriate
EU model contract (providing suitable safeguards for data processing in non-European
countries) has been concluded. You have the right to be informed about this model
contract as part of your right of access.
As a user of our web pages, you can of course opt out of the use of cookies by changing
your browser settings at any time. The default settings of most browsers allow cookies
to be saved. If you change these settings, you may not be able to use all the features of
our website. With effect for the future, you can object to the data generated by the
cookie and related to your use of the website being collected and processed by Adobe at
any time by setting the opt-out cookie, which is specifically designed for this purpose.
To do so, please use the opt-out button at http://www.adobe.com/en/privacy/opt-
out.html. Please note that your objection in the form of an opt-out cookie will only work
if your browser is set to allow the use of cookies. If you delete this cookie, use a different
browser or switch to another device, you will need to renew your objection to the use of
Adobe Analytics. We wish to draw your attention to the fact that if you delete all your
cookies, the above cookie will also be deleted and will have to be installed again.

9. What rights do I have?

As a data subject, you are entitled to the following data protection rights:
Information: You have the right to request information about the data stored
about you by AUDI AG and the scope of the data processing and
forwarding carried out by AUDI AG, and to receive a copy of the
personal data stored about you.
Rectification: You have the right to request immediate rectification of
information related to you that is incorrect as well as to the
completion of incomplete personal data that AUDI AG has on file
for you.
Erasure: You have the right to request immediate deletion of the
personal data about you stored at AUDI AG if there are no
reasons for the continued storage of that data.
Restriction of Under certain conditions, you have the right to request that the
processing: processing of your personal data be restricted (i.e. the
designation of stored personal data with the aim of limiting
future processing). These conditions are:
- the accuracy of the personal data is disputed by you and AUDI
AG must review the accuracy of the personal data;
- the processing is unlawful, but you reject the erasure of your
personal data and instead request restricted use be made
thereof;
- AUDI AG no longer needs your personal data for the purpose of
processing, but you need the data to establish, exercise or
defend legal claims;
- You have objected to the processing of your personal data, but
it is still not clear whether the legitimate interests of AUDI AG
outweigh your interests.
If processing is restricted, aside from being stored, your
personal data is allowed to be processed only with your consent
or for the establishment, exercise or defense of legal claims or
to protect the rights of another natural person or legal entity or
for reasons of an important public interest on the part of the
European Union or an EU Member State.
Data portability: If personal data that you have provided us on the basis of your
consent or a contract (including your employment contract) is
processed by us in an automated manner, you have the right to
receive the data in a structured, standard and machine-readable
format, and to transmit this data to another controller without
being prevented from doing so by AUDI AG. You also have the
right to have the personal data transferred directly by AUDI AG
to another controller if this is technically feasible and the rights
and freedoms of other persons are not affected by this.
Objection: If the processing of your personal data is necessary for the
performance of a task carried out in the public interest or in the
exercise of official authority vested in AUDI AG or on the basis of
a balance of interests, you have the right to object to processing
on grounds relating to your particular situation. We will
continue processing the personal data in question only if we can
demonstrate compelling legitimate grounds for the processing
that override your interests, rights and freedoms or the
processing serves the purpose of the establishment, exercise or
defense of legal claims. Insofar as we process your personal data
based on a balance of interests, we generally assume that
compelling legitimate grounds can be demonstrated but will of
course attempt to validate every individual case.
Withdrawal of If you have granted consent for the processing of your personal
consent: data, you can withdraw this consent at any time. Please note
 that revocation applies only to future processing. Any
processing carried out before consent is withdrawn remains
unaffected by the revocation.
Complaints: You also have the right to lodge a complaint with a data
protection supervisory authority if you believe that your
personal data are being processed unlawfully. You have the
right to lodge such a complaint irrespective of any other
administrative or judicial remedies. The address of the data
protection supervisory authority responsible for AUDI AG is:

Bayerisches Landesamt für Datenschutzaufsicht

Promenade 18
D-91522 Ansbach
Germany