DATA PROTECTION DECLARATION WEBSITE

We, the Porsche Lizenz- und Handelsgesellschaft mbH & Co. KG (hereafter "we" or "PLH"), appreciate your visit of our website and your interest in our company and our products. Your privacy is extremely important to us. We therefore take the protection of your personal details very seriously, and treat them in strictest confidence. Your personal data is processed only within the scope of the legal provisions of the European Union's data protection law, in particular the General Data Protection Regulation (hereafter "GDPR"). In this privacy policy we provide you with information about the processing of your personal data and your rights as a data subject within the scope of the use our website. For information on other products and services offered by other companies in the Porsche Group, please consult the respective privacy policy for these services or companies.

1. CONTROLLER AND DATA PROTECTION OFFICER FOR DATA PROCESSING; CONTACT

Controller for data processing within the meaning of the data protection legislation is:

Porsche Lizenz- und Handelsgesellschaft mbH & Co. KG
Grönerstrasse 5
71636 Ludwigsburg
Deutschland
Tel: (+49) 0711 911-0
contact@porsche-design.com

Please do not hesitate to contact us if you have questions or ideas relating to data protection.

You can contact our data protection officers at the following address:

Porsche Lizenz- und Handelsgesellschaft mbH & Co. KG
Beauftragter für Datenschutz
Grönerstrasse 5
71636 Ludwigsburg
Deutschland
E-Mail: datenschutz@porsche-design.de
datenschutz@porsche-design.de

2. SUBJECT MATTER OF DATA PROTECTION

The subject matter of data protection is personal data. This is all the information that relates to an identified or identifiable natural person (known in the legislation as the data subject). This covers, for example, information such as name, postal address, e-mail address, or telephone number as well as information that necessarily originates during the use of our website, such as details about the start, end, and scope of use, and the communication of your IP address.

3. TYPE, SCOPE, PURPOSES OF, AND LEGAL BASIS FOR AUTOMATED DATA PROCESSING

In general, it is possible to use our website without registering. Even if you use our website without registering, personal data can still be processed.

An overview of the type, scope, purposes of, and legal basis for data processing within the scope of our website is provided below.

3.1 Provision of our website
When you access our website using your device, we automatically process the following data:

• type of device
• operating system used
• type of browser,
• domain name of internet service provider
• IP address
• referrer URL
• date and time of access
• duration of your visit
• access country of origin
• the functions that you use
• the pages that you access
• type of event

We process this data on the basis of Article 6 (1) (f) GDPR to provide the service, to ensure the technical operation, and to identify and rectify faults. In this way, we pursue the interest of facilitating and ensuring the long-term use of our website and its technical functional capability. When our website is accessed, this data is automatically processed. You cannot use our services unless this data is provided. We do not use this data for the purpose of drawing conclusions about you or your identity.

3.2 Cookies
When you visit our website "cookies", which are small files, may be stored on your device in order to provide you with a comprehensive scope of functions, make it easier to use our service, and optimize our offerings. If you do not wish to allow the use of cookies, you can prevent them from being stored on your device by configuring the relevant settings in your Internet browser or using the specific opt-out options. Please note that the functional capability and functional scope of our offering could be restricted as a result. Please refer to our Cookie Policy. for details on the type, scope, purposes of, legal basis for, and opt-out options for data processing in relation to cookies.

4. INDIVIDUAL SERVICES AND FUNCTIONALITIES

You can voluntarily enter personal data or register for services and functions at several locations on our website, e.g., through the use of the webshop by user account or guest order, newsletter registrations, requests for information, contact requests, etc. When you register for and use the services and functions described below, we record, process, and use personal data as outlined here.

4.1 USER ACCOUNT

4.1.1 Registration process
Registration with an individual profile is required to use the user account.

(a) Mandatory data when registering

When registering for the user account, the following mandatory information, which is flagged with a "*", is requested:

• email address
• password
• title
• first name
• family name
• date of birth
• street and house number
• postal code and city
• country

It is not possible to register unless this mandatory data is specified.

(b) Voluntary data when registering

When registering, you also have the option of voluntarily entering other information: additional name and address information, company contact details, other phone numbers. Please note that this information is not required for registration and you alone must decide whether you wish to provide us with this data.

We process the data collected on the basis of Article 6 (1) (b) and (f) GDPR in order to create your profile for you for the user account and to identify you each time you log in.

4.1.2 Use of user account
When you use the user account, the following categories of personal data are processed:

• email address
• password
• title
• academic title
• first name
• family name
• date of birth
• street and house number
• postal code and city
• country
• further voluntary information

This is voluntary information. However, if you do not provide this data, we may not be able to respond in full to your needs when using the user account in certain circumstances.

We process this data on the basis of Article 6 (1) (b) GDPR, to provide you with the required services in this regard and to implement the contractual relationship with you.

4.2. GUEST ORDER

4.2.1 Registration process
Registration with an individual profile is required to use the guest order.

(a) Mandatory data when registering

When registering for the guest order, the following mandatory information, which is flagged with a "*", is requested:

• email address
• password
• title
• first name
• family name
• date of birth
• street and house number
• postal code and city
• country

It is not possible to register unless this mandatory data is specified.

(b) Voluntary data when registering

When registering, you also have the option of voluntarily entering other information: additional name and address information, company contact details, other phone numbers. Please note that this information is not required for registration and you alone must decide whether you wish to provide us with this data.

We process the data collected on the basis of Article 6 (1) (b) and (f) GDPR in order to create your profile for you for the guest order and to identify you each time you log in.

4.2.2 Use of guest order
When you use the guest order, the following categories of personal data are processed:

• email address
• password
• title
• academic title
• first name
• family name
• date of birth
• street and house number
• postal code and city
• country
• further voluntary information

This is voluntary information. However, if you do not provide this data, we may not be able to respond in full to your needs when using the guest order in certain circumstances.

We process this data on the basis of Article 6 (1) (b) GDPR, to provide you with the required services in this regard and to implement the contractual relationship with you.

4.3 CONTACT REQUEST

4.3.1 Submission process
On order to use the contact request form, input is required to process your inquiry.

(a) Mandatory data when submitting

When submitting via the contact request form, the following mandatory information (depending on the type of request), which is flagged with a "*", is requested:

• type of inquiry
• first name
• family name
• street and house number
• postal code and city
• country
• phone number
• email address
• product description
• order code
• model code
• article code
• name of dealer
• country of dealer
• date of purchase
• message for contact request
• file attachment (image, proof of purchase, etc.)
• reCAPTCHA code

It is not possible to register unless this mandatory data is specified.

(b) Voluntary data when registering

When registering, you also have the option of voluntarily entering other information: additional name and address information, serial code, further attachments. Please note that this information is not required for submission and you alone must decide whether you wish to provide us with this data.

We process the data collected on the basis of Article 6 (1) (b) and (f) GDPR in order to provide you with the required services in regard to your inquiry.

4.3.2 Use of contact request
When you use the contact request form, the following categories of personal data are processed:

• email address
• title
• academic title
• first name
• family name
• street and house number
• postal code and city
• country
• phone number
• further voluntary information

This is voluntary information. However, if you do not provide this data, we may not be able to respond in full to your needs when using the contact request form.

We process this data on the basis of Article 6 (1) (b) GDPR, to provide you with the required services in this regard and to implement the contractual relationship with you.

4.3.3 Access authorizations on the device
The contact request supports the uploading of images and videos from the device. The contact request form may therefore request to authorize access to the camera or picture library on your device. Giving this authorization is voluntary. However, if you want to upload an image file, you will need to give this authorization as otherwise you will not be able to use the function.

We require this authorization on the basis of Article 6 (1) (b) GDPR, to provide you with the required services in this regard and to implement the contractual relationship with you.

The authorization remains active until you switch it off on your device.

4.4 NEWSLETTER

4.4.1 Registration process
On order to receive the Newsletter, registration is required.

(a) Mandatory data when registering

When registering for the Newsletter, the following mandatory information, which is flagged with a "*", is requested:

• email address
• first name
• family name
• country

It is not possible to register unless this mandatory data is specified.

(b) Voluntary data when registering

When registering, you also have the option of voluntarily entering other information: additional name information, date of birth. Please note that this information is not required for registration and you alone must decide whether you wish to provide us with this data.

We process the data collected on the basis of Article 6 (1) (b) and (f) GDPR in order to create your profile for you for the guest order and to identify you each time you log in.

4.4.2 Registration process
When you use the Newsletter function, the following categories of personal data are processed:

• email address
• first name
• family name
• country
• further voluntary information

This is voluntary information. However, if you do not provide this data, we may not be able to respond in full to your needs when using the Newsletter function.

We process this data on the basis of Article 6 (1) (b) GDPR, to provide you with the required services in this regard and to implement the contractual relationship with you.

5. RECIPIENTS OF PERSONAL DATA

Internal recipients: Within PLH the only people who have access are those who need it for the purposes named in Sections 3 and 4.

External recipients: We only forward your personal data to external recipients outside PLH if this is necessary for the administering or processing of your issue, if another legal authorization exists, or if we have your consent to forward the data.

External recipients can be:

a) Processors
Group companies in der Dr. Ing. h.c. F. Porsche AG or external service providers that we use to provide services, for example in the areas of technical infrastructure and maintenance or the provision of content. We carefully select and regularly inspect these processors to make sure that your privacy is protected. The service providers may use the data only for the purposes we have specified and in accordance with our instructions.

b) Public bodies
Authorities and public institutions, such as public prosecutors, courts, or financial authorities to which we must transfer personal data for legal reasons. The data is transferred on the basis of Article 6 (1) (c) GDPR.

c) Private bodies
Dealers, cooperation partners, or support staff to whom the data is transferred on the basis of consent, to implement a contract with you or to safeguard legitimate interests, for example Porsche Dealerships, financing banks, providers of other services or transport service providers. The data is transferred on the basis of Article 6 (1) (a), (b) and/or (f) GDPR.

6. DATA PROCESSING IN THIRD COUNTRIES

If data is transferred to bodies whose headquarters or whose place of data processing is not located in a member state of the European Union or in another country outside of the European Union who is a signatory to the treaty, we ensure before forwarding the data that, outside of legally permitted exceptional cases pertaining to the recipient, either an appropriate level of data protection exists (e.g., through an adequacy decision of the European Commission, through suitable guarantees such as self-certification by the recipient for the EU-US Privacy Shield, or the agreement of EU standard contractual clauses between the European Union and the recipient) or you give sufficient consent for the transfer of the data.

We can provide you with an overview of the recipients in third countries and a copy of the specifically agreed regulations to ensure the appropriate level of data protection. To obtain these, please contact the address specified in Section 1.

7. DURATION OF STORAGE, DELETION

We store your personal data only for the length of time necessary to fulfill the purposes stated in this document or in the general contract documents drawn up between you and ourselves, or – in the case of consent – until you withdraw your consent. In addition, we store your data as required under commercial law and tax law retention requirements.

We delete your personal data immediately

• after the legal grounds cease to apply and provided that no other legal grounds apply. If the latter is the case, we delete the data once the other legal grounds cease to apply.
• if we no longer need the data for the purposes of preparing and implementing a contract and no other legal grounds apply. If the latter is the case, we delete the data once the other legal grounds cease to apply.
• if you object, unless further processing is permitted according to the relevant legal provisions.
• if we are obliged to do so for other legal reasons.

8. RIGHTS OF DATA SUBJECTS

As the data subject affected by the data processing, you have several rights. Specifically,

Right of access: You have the right to obtain information from us about the data that we have stored about you.

Right of rectification and erasure: You have the right to demand that we rectify incorrect data and – provided the legal requirements are met – that we delete your data.

Restriction of processing: You have the right – provided the legal requirements are met – to demand that we restrict the processing of your data.

Data portability: If you have provided us with data on the basis of a contract or consent, you have the right, in accordance with the legal requirements, to obtain the data you have provided in a structured, standard, and machine-readable format or you can demand that we transfer this data to another controller.

Objection to the processing of data on the legal basis of "legitimate interests": You have the right to object at any time, on grounds relating to your particular situation, to our processing of your data, provided this objection is based on the legal basis of "legitimate interests". If you exercise your right to object, we will cease the processing of your data unless we can – pursuant to the legal requirements – prove compelling legitimate reasons for the further processing, which override your rights.

Objection to cookies: You can also object to the use of cookies at any time. For details on how to object, please refer to our Cookie Policy.

Withdrawal of consent: If you have given us consent to process your data, you can withdraw this consent at any time with effect for the future. The lawfulness of the processing of your data remains unaffected up until the time of the withdrawal of consent.

Right to lodge a complaint with a supervisory authority: You can also submit a complaint to the competent supervisory authority if you believe that the processing of your data is in breach of the legislation. To do so, you can apply to the data protection authority that is responsible for your town/city or country or the data protection authority that is responsible for us.

Contacting us: Please do not hesitate to contact us if you have any questions regarding the processing of your personal data, your rights as a data subject, and any consent that you may have given. To exercise all of these above-mentioned rights, please contact datenschutz@porsche-design.de or by post at the address specified above in Section 1. In doing so, please ensure that it is possible for us to uniquely define you.

9. LINKS TO THIRD-PARTY OFFERINGS

Websites and services delivered by other providers that are linked to by our website have been and are structured and provided by third parties. We do not have any influence over the structure, content, or role of these third-party services. We explicitly distance ourselves from all content in all linked third-party offerings. Please note that the third-party offerings linked to from this website may install their own cookies on your device or collect personal data. We have no influence over this. Please contact the providers of these linked third-party offerings as required for the relevant information.

10. GOOGLE ANALYTICS

To collect "clickstream" data (such as IP address, date and time of the visit, reference URL, the pages visited on our website, and information about the browser being used) we use Google Analytics, a web analysis service from Google Inc. (“Google”). Google uses cookies, text files that are stored on users' devices and which allow an analysis of the use of the website. The information generated by the cookie and the use of the website by users are generally transferred to a Google server in the USA and stored there.

Google uses this information on our behalf to evaluate the use of the website by users in order to compile reports on the activities within the website and to provide additional services related to the use of the website as well as Internet usage. Pseudonymous usage profiles of the users can therefore be created from the processed data.

We only use Google Analytics with IP anonymization enabled. This means that the IP addresses of the users are abbreviated by Google within the member states of the European Union or in other contracting states of the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the US and abbreviated there.

The IP address transmitted by the user's browser is not merged with other data from Google. Users can prevent the storage of cookies by setting their browser software accordingly; users may also block the collection of data generated by the cookie and related to their use of the website for Google, as well as the processing of such data by Google by downloading and installing the browser plug-in available using the following link: https://tools.google.com/dlpage/gaoptout?hl=en. For further information on Google's use of the data for advertising purposes, settings and opportunities to raise objections, please refer to Google's website: https://www.google.com/intl/en/policies/privacy/partners/ (“How Google uses data when you use our partners’ sites or apps”), http://www.google.com/policies/technologies/ads (“Data usage for advertising purposes”) http://www.google.com/settings/ads ("Control the information Google uses to show you ads") and http://www.google.com/ads/preferences/ ("Make the ads you see more useful to you"). Please note that this website uses additional the code „gat._anonymizeIp();“ for Googly Analytics to ensure the anonymous collection IP-addresses ( IP-Masking).

11. GOOGLE MAPS

This website uses Google Maps to display a map. Google Maps is operated by Google Inc. ("Google"). By using this website, you agree to the collection, processing and use of the data collected automatically and the data you have entered by Google, one of its representatives or third-party providers. You can find the terms of use for Google Maps here: https://www.google.com/intl/en_US/help/terms_maps.html.

12. GOOGLE PRIVACY POLICY

Details of Google's privacy policy can be found at https://www.google.de/intl/en/policies/privacy/ You can use the Google Privacy Checkup at https://myaccount.google.com/privacycheckup to check and change your privacy settings on Google products.

13. DOUBLECLICK

We also use DoubleClick's cookies to measure the effectiveness of our advertising campaigns, to limit the frequency with which you receive a particular ad and to only display ads that are relevant to you and your interests. In particular, information is collected and anonymously stored at the time of your visit, on the advertising you clicked on and on your previous user behaviour on third party websites. This information is not passed on to third parties, but only used for campaign management and campaign control. In addition, user profiles are created which are used for own market research purposes - in particular on the basis of the identified interests. For further information, please visit https://www.google.com/policies/privacy/ads/ orhttps://www.google.com/settings/u/0/ads/authenticated.

14. BING ADS

This website uses Bing Ads, a service of Microsoft Online, Inc, 6100 Neil Road, Reno, NV 89511 USA ("Microsoft"). Bing Ads allows us to track your actions on our site after you click on an ad of Microsoft's Bing Ads service and get to our site through that ad. A cookie will be placed on your device as soon as you reach our website via Bing Ads. A Bing tag is integrated on our website. This is a code used in conjunction with the cookie to store some non-personal information about your use of the website (such as information about how you viewed our website, how long you stayed on the website and which areas of the website were viewed, website loading times, browser and screen settings). In addition to this data, your IP address is also transmitted to a Microsoft server for technical reasons, but the last octet of the IP address is encrypted with a hash code before transmission. You can object to the use of Bing Ads here: https://account.microsoft.com/privacy/ad-settings/signedout?ru=https:%2F%2Faccount.microsoft.com%2Fprivacy%2Fad-settings.

15. FACEBOOK REMARKETING

On our websites, we use the “Vanilla Custom Audiences Pixel”, a service provided by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). With the help of this service we can reach you with targeted advertisements by showing “Facebook ads” to visitors of our website when they visit the social network Facebook.

To this end we use the Facebook “remarketing pixel”. This involves code snippets which are able to identify your browser via the browser ID – your browser’s individual fingerprint – and detect that you visited our website and what exactly you viewed there. A direct connection to the Facebook servers is made when you visit our website. Facebook is able to identify you using your browser-ID, as this is linked to other data saved to your Facebook user account. Facebook then shows customised advertisements that are matched to your needs on your Facebook timeline or in another place on Facebook.

We at Porsche Design are not able to personally identify you via the Facebook pixel, because we do not save any personal data other than your browser ID using the Facebook remarketing pixel. More information about Facebook custom audiences, the particulars of data processing using this service and Facebook’s data policy can be found at https://www.facebook.com/about/privacy/.

16. REMARKETING OR "SIMILAR TARGET GROUP" FUNCTION OF GOOGLE INC.

The provider uses the remarketing or "similar target group" function of Google Inc. ("Google") on the website. This feature enables the provider to target visitors of the website with advertisements by placing personalized, interest-based advertisements for visitors to the provider's website if they visit other websites on the Google Display Network. Google uses cookies to analyze website usage, which forms the basis for creating interest-based advertisements. Google stores a small file with a sequence of numbers in the browsers of the visitors to the website. This number is used to record visits to the website and anonymised data on the use of the website. No personal data of the visitors of the website is stored. If you subsequently visit another website in the Google Display Network, you will see ads that are very likely to include previously accessed product and information areas. You can permanently deactivate the use of cookies by Google by using the following link to download and install the plug-in provided there: https://www.google.com/settings/ads/plugin. Alternatively, you can disable the use of cookies by third parties by implementing the additional opt-out information provided on the deactivation page of the Network Advertising Initiative at http://www.networkadvertising.org/choices/. For more information about Google Remarketing and Google's privacy policy, please visit: http://www.google.com/privacy/ads/.

17. GOOGLE ADWORDS CONVERSION-TRACKING

We use the online advertising program "Google AdWords" and conversion tracking as part of Google AdWords. The Google Conversion Tracking is an analysis service of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). When you click on an ad served by Google, a conversion tracking cookie is placed on your computer. These cookies lose their validity after 30 days, do not contain any personal data and are therefore not used for personal identification.

If you visit certain pages of our website and the cookie has not yet expired, Google and we can recognize that you clicked on the ad and were redirected to this page. Each Google AdWords customer receives a different cookie. This means that it is not possible to track cookies on the websites of AdWords customers. The information collected using the conversion cookie is used to generate conversion statistics for AdWords customers who use conversion tracking. Customers can see the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, you will not receive any information that personally identifies users. If you do not wish to participate in tracking, you can object to this use by preventing the installation of cookies by setting your browser software accordingly (deactivation option). You are then no longer included in the conversion tracking statistics. Further information and Google's privacy policy can be found at: http://www.google.com/policies/technologies/ads, http://www.google.at/policies/privacy/.