Privacy Policy on the processing of personal data in the context of the documentation of traffic accidents with autonomous test vehicles.

With this privacy policy, we inform you about the collection, processing and use of your personal data by Volkswagen ADMT Hannover GmbH, Mecklenheidestraße 74, c/o Volkswagen Commercial Vehicles, mailbox 2570/0, 30419 Hannover, registered in the commercial register of the Hanover District Court under the number HRB 222201 ("Volkswagen ADMT Hannover GmbH") in the context of the documentation of traffic accidents with autonomous test vehicles.

Volkswagen ADMT Hannover GmbH processes your data in accordance with the applicable data protection regulations. These requirements result in particular from the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

During the (test) operation of autonomous vehicles, in the event of a traffic accident with an injured third party, the location data, contact data, vehicle data, insurance data and other data required for accident documentation of the respective policyholder are recorded by the safety driver (AD vehicle) and by the injured party with the help of the standardised European accident report. The accident report is signed by all parties involved in the accident. The contact details and driver's license data of the respective driver are also recorded. The exchange of the personal details of all those involved in the accident takes place within the framework of § 34 of the Road Traffic Regulations (StVO) and serves to settle the claim by the respective insurance company. For this purpose, the data is shared with Volkswagen AG as the vehicle owner, Volkswagen Insurance Brokers GmbH as the claims handler and the insurance company commissioned with the insurance. In addition, Volkswagen Group Accident Research will be commissioned as a processor to support the accident recording and analysis.

We receive the data directly from you and store it in internal systems. If we have not collected your data processed for the aforementioned purposes directly from you, we collect it from internal sources, such as Microsoft 365 or VIB "online".

The data obtained, such as

• Contact details, driver's license details
• Vehicle
• Insurance data
• Location data and
• Other according to standardized, European accident report

we process, among other things, in connection with the documentation of accidents with autonomous (test) vehicles for the following specific purposes:

Accident documentation

• Internal claims settlement with Volkswagen AG as vehicle owner
• Claims settlement with the car insurance companies of the parties involved in the accident
• Communication with those involved in the accident and/or witnesses, if necessary
• Claims settlement with the responsible accident insurance company, if necessary
• Investigation of the accident by VW Accident Research, if necessary
• Communication with authorities, if necessary

Under certain conditions, the private contact details of witnesses (including occupants of the vehicles involved) are recorded in order to be able to fall back on them in the context of the pursuit of claims as parties to the accident.

Your personal data will only be collected, processed and transmitted for the specific purpose and only if there is a relevant legal basis for doing so. The following legal bases are the basis for the purposes described above:

• The exchange of the personal details of all parties involved in the accident takes place within the framework of § 34 of the Road Traffic Regulations (StVO) in accordance with Art. 6 para. 1 lit. c GDPR
• Legitimate interest of the parties involved in the accident in accordance with Art. 6 para. 1 lit. f GDPR in the data processing of private contact details of witnesses (including occupants of the vehicles involved) in the context of the possible prosecution of claims as parties to the accident

Your data will be processed by ADMT-GR and, if necessary, passed on to the entities mentioned in section E. The data will only be passed on to third countries if it is necessary for the execution of the process. If this is necessary, the data transfer is protected by data protection law. In individual cases, we will pass on your data to authorised third parties. These can be, for example:

• Group companies of Volkswagen AG
• Motor vehicle insurance companies of the parties involved in the accident
• Authorities
• Accident insurance(s)

As a matter of principle, the data will not be passed on to third countries.

If a transfer of the data to third countries is necessary for the execution of the process, the controllers will conclude EU standard contractual clauses to ensure an adequate level of protection for the personal data with recipients in unsafe third countries. The EU Standard Contractual Clauses used can be downloaded in the EU languages via the URL https://eur-lex.europa.eu/legal-content/de/TXT/?uri=CELEX%3A32021D0914.

The written accident reports are digitized and temporarily stored in the internal system until they are transmitted to the Group office for claims settlement. The originals are disposed of in a data protection container in accordance with data protection regulations. The processing of the data ends with the handover of the accident documentation to the Group office for claims settlement (so-called deletion event).

The following is an overview of the most important deadlines after which we delete your personal data:

90 days from creation for all data fields / accident report

In the event of a possible legal dispute, the data will be stored in accordance with statutory retention periods for the assertion of or for the defence against legal claims.

You can assert your following rights against Volkswagen ADMT Hannover GmbH at any time free of charge.

Right of access: You have the right to obtain information from us about the processing of your personal data.

Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data concerning you.

Right to erasure: You have the right to request the deletion of your data if the conditions specified in Art. 17 GDPR are met. After that, you can, for example, request the deletion of your data if it is no longer necessary for the purposes for which it was collected. You can also request erasure if we process your data on the basis of your consent and you withdraw this consent.

Right to restriction of processing: You have the right to request the restriction of the processing of your data if the requirements of Art. 18 GDPR are met. This is the case, for example, if you dispute the accuracy of your data. For the duration of the verification of the accuracy of the data, you can then demand the restriction of processing.

Right to object: You have the right to object to the processing of your personal data in the following cases:

• When the processing is carried out for direct marketing purposes (including profiling for direct marketing purposes).
• Where the processing (including profiling) is based on one of the following legal bases:
  – The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
  – The processing is necessary for the purposes of the legitimate interests pursued by us or by a third party.

In the event of such an objection, we ask you to inform us of your reasons for objecting to the data processing. We will no longer process your data in the event of your objection, unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Right to data portability: If the data processing is based on consent or the performance of a contract, and if it is also carried out using automated processing, you have the right to receive your data in a structured, commonly used and machine-readable format and to transmit it to another data processor.

Right of revocation: If the data processing is based on consent, you have the right to revoke the data processing at any time free of charge within the framework of consent with effect for the future.

Right to lodge a complaint: You also have the right to complain to a supervisory authority (e.g. the State Commissioner for Data Protection of Lower Saxony) about our processing of your data.

Contact person for exercising your rights

The contact persons for exercising your rights and further information can be found on the following website https://www.volkswagen-nutzfahrzeuge.de/AD.

Data protection officer

Our data protection officer is available to you as a contact person for data protection-related concerns:

Data Protection Officer of Volkswagen ADMT Hannover GmbH
Berliner Ring 2
38440 Wolfsburg
dataprivacy@volkswagen.de