Data protection

We, MAN Financial Services GmbH, Oskar-Schlemmer Str. 19-21, D-80807 Munich (hereinafter‘MFS-D’), are hereby informing you about how we process personal data. In addition to the option of contacting us by post, you can contact us at any time via the e-mail address info.manfs@vwfs.com.

You can reach MFS-D’s data protection officer at: datenschutz.mfs@vwfs.com.

We have compiled the most important information on typical data processing into separate data subject groups below. For certain data processing that only affects specific groups, the information requirements are fulfilled separately. If the term ‘data’ is used in the text, this shall refer exclusively to personal data in the meaning of the General Data Protection Regulation (‘GDPR’).

1. MFS-D’s service providers and business partners, who are not customers, and their respective employees and third parties who come into contact with the performance of the contract

1.1 The purpose of the processing is establishing, implementing and concluding the respective existing contract or order, as well as fulfilling statutory requirements. Another purpose of the processing may be the implementation and optimisation of company processes.

1.2 For contracts with natural persons, the legal bases are Article 6(1)(b) GDPR (contract, order) and for contracts with legal persons and all third parties who come into contact with the performance of the contract, Article 6(1)(f) GDPR (legitimate interest, in particular, communication with contacts pertinent to the contract and implementation of the respective contract), as well as always Article 6(1)(c) GDPR (statutory requirements, in particular tax and commercial provisions, and provisions concerning banking and data protection law). For the implementation and optimisation of company processes, the legal basis is also the legitimate interest (Article 6(1)(f) GDPR, in particular organising the operation in a cost-effective and practicable way). For checking, implementing or dismissing claims, the legal basis is Article 6(1)(f) GDPR (legitimate interest, in particular implementing claims or defending against claims).

1.3 Contact and contract details may be passed on to other service providers, business partners, as well as administrative bodies and authorities if this is necessary for the performance of the contract or order. Companies within the VW Group may also be recipients of your data. Authorities and administrative bodies may also be recipients in the context of their duties if we are required or entitled to pass on data. In individual cases, data may also be passed on to lawyers and courts. We also employ service providers to provide order processing services, in particular for supplying, maintaining and supporting IT systems, as well as for implementing internal procurement processes and for looking after our customer contacts.

1.4 We store your data for as long as it is required for the respective purpose or if a retention requirement exists for the data concerned.

1.5 The processing of contact details by service providers and business partners is necessary for the contract or order to be implemented. If the data is not made available, communication in the implementation may be considerably disrupted.

1.6 If data is not collected from the data subject in question, in principle, the source is a third party that is connected to the processing of the underlying purpose. This may affect the following data categories: Master data, contact details, payment data, photographs, work data, settlement data, usage data from IT systems, identification data in IT systems and order data.

2. Journalists

2.1 The purpose of the data processing is the management of press contacts and contacting press representatives.

2.2 The legal basis is Article 6(1)(f) GDPR (legitimate interest, in particular to inform the press of events in the public interest).

2.3 The data is passed on internally to the relevant employees who are responsible for making decisions. Service providers are used to process data in the context of order processing according to Article 28 GDPR.

2.4 The data is erased three months after the respective contact has changed.

2.5 It is not necessary to provide personal data. However, by not providing personal data, the data subject may not be sent information.

2.6 If data is not collected from the data subject in question, in principle, the source is a third party that is connected to the processing of the underlying purpose. This may affect the following data categories: Master data, contact details.

3. General information and data subject rights

3.1 You have the right to request access at any time to all of your personal data that we process.

3.2 Should your personal data be incorrect or incomplete, you have a right to rectification and completion.

3.3 You may request that your personal data is erased at any time if we are not legally required or entitled to continue to process your data.

3.4 If the legal prerequisites exist, you may request a restriction of the processing of your personal data.

3.5 You have the right to object to the processing if the data processing is carried out for the purposes of direct marketing or profiling. If the processing is carried out based on the balancing of interests, you may object to the processing on grounds which relate to your particular situation.

3.6 If the data processing is carried out based on your consent or in the context of a contract, you have a right to portability of the data you have provided as long as this does not affect the rights and freedoms of other people.

3.7 If we process your data based on a declaration of consent, you have the right to withdraw this consent at any time and with future effect. The processing carried out before a withdrawal shall remain unaffected by the withdrawal.

3.8 You also have the right to lodge a complaint with a supervisory authority at any time if you consider data processing to be in breach of the applicable laws.