Privacy Policy for the IAA Mobility Website
The protection of your personal data is very important to us. The following information provides you with an overview of the processing of your personal data by us and your rights under data protection law.

You can find more information about video surveillance at the Open Space during the IAA here.

1. Contact information
The data controller is:
German Association of the Automotive Industry (VDA)
Behrenstr. 35
10117 Berlin
Phone:+49 30 897842-0
Fax:+49 30 897842-600
Email: [email protected]

If you have any questions about data protection and how to exercise your rights under data protection (see section 7), please contact our data protection officer.

You can contact our data protection officer as follows:

Postal address:
Data protection officer of the German Association of the Automotive Industry (VDA)
Behrenstr. 35
10117 Berlin
[email protected]

During the IAA, certain event areas will be under video surveillance. These areas are marked accordingly. The recording serves to protect vital interests, to guide visitors, to coordinate rescue operations, to safeguard domiciliary rights, to prevent and investigate criminal offences and to enforce civil law claims. The legal basis is the legitimate interest pursuant to Art. 6 (1) (f) GDPR, in particular in the protection of life, health and freedom (prevention of overcrowding scenarios), in ensuring sufficient escape routes, compliance with the Ordinance on Places of Assembly, the preservation of evidence and the protection of property.

The recordings will be deleted after one hour during opening hours and outside by 12:00 noon of the following day at the latest. An evaluation is only carried out if a criminal offence is suspected. In such cases, it may be passed on to law enforcement authorities, courts or lawyers. In civil law proceedings, relevant data is stored until the legally binding conclusion.

Service providers are used in the context of order processing in accordance with Art. 28 GDPR. Only authorized employees have access to the data. Data will not be transferred to third countries.

It is not possible to enter the monitored areas without detection by video surveillance.

We only process the personal data that is necessary for the respective purpose of the processing (see Section 3). This is data that we have received directly from you (e.g. data you entered to sign up for a newsletter).

Your personal data is processed in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The VDA organizes the IAA to promote the interests of the German automotive industry. This also includes a functioning website that supports the smooth implementation of the trade fair. The legal basis is the legitimate interest in accordance with Art. 6 (1) (f) GDPR.

Web Server Log Files
When you visit our website, access data (e.g. file name, date/time, IP address, browser type) is automatically stored in server log files. These are used for technical safety and statistical evaluation. The legal basis is Art. 6 para. 1 lit. f GDPR.

Cookies
Our website uses cookies to provide functionality and improve the user experience. Both technically necessary cookies and – after your consent – optional cookies are used (e.g. for web analysis or personalized content).

When you first visit our website, a cookie banner will appear that allows you to set your preferences. Your selection is stored in a cookie so that the banner does not reappear on subsequent visits.

You can revoke your consent at any time with effect for the future and adjust your settings via the following link:

Technically necessary cookies are excluded from this.

Alternatively, you can control the storage of cookies through your browser settings. Please note that if individual cookies are disabled, the functionality of the website may be limited.

Social media and external content (plugins)

"Share" function
Our website offers the possibility to share content via links to Facebook, TikTok, Instagram and LinkedIn. Only when you click on a corresponding symbol do you leave our site and reach the respective platform. This may result in data transmission to the respective provider. We have no influence on the scope and purpose of the data processing there.

YouTube
Our website uses plugins from YouTube (Google Inc., USA). When visiting corresponding pages, a connection to YouTube is established and, if necessary, your usage behavior is associated with your YouTube account when you are logged in to your YouTube account. You can prevent this by logging out of your YouTube account. YouTube is used in the interest of an appealing presentation of our online offerings. This constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. For more information on the handling of user data, please refer to YouTube's privacy policy at: https://www.google.de/intl/de/policies/privacy.

Podigee Podcast
For the provision and analysis of our podcasts, we use the service Podigee (Podigee GmbH, Germany). IP addresses and device information are processed, sometimes anonymized or a. Data will not be transferred to third countries. Legal basis: Art. 6 para. 1 lit. f GDPR (interest in a secure and efficient provision, analysis and optimization of our podcast offer). Further information and objection options can be found in Podigee's privacy policy: https://www.podigee.com/de/about/privacy/.

AidaForm
To transmit stand construction data, we use the form service AidaForm (Komorebi GmbH, Germany). IP address, pages visited and times are stored. Legal basis: The processing is carried out for the processing of contractual relationships and in the legitimate interest of the VDA for the simple transmission of stand construction data for the purpose of design and technical examination as well as the approval of your stand construction as part of the processing of your contractual relationship in accordance with Art. 6 (1) (b) and (f) GDPR. More information can be found in the privacy policy of aidaform:
https://de.aidaform.com/privacy-policy.html

Analysis Tools
We use analysis tools to improve our website and to design content in line with needs. The processing of personal data is carried out on the basis of Art. 6 (1) (f) GDPR – the VDA's legitimate interest in optimising its digital offerings, measuring reach and displaying the content in a user-friendly manner.

Google Analytics

Our website uses Google Analytics, a web analysis service provided by Google Inc. (USA), for the statistical evaluation of user behaviour. The aim is to improve our online offering technically and in terms of content, to increase user-friendliness and to analyse the reach and effectiveness of our content and communication measures. This processing is carried out on the basis of Art. 6 (1) (f) GDPR – the VDA's legitimate interest in effective and targeted public relations work and in the optimization of its digital infrastructure.

Google Analytics uses cookies that are stored on your device and collect information about your use of the website. This includes, but is not limited to, pages visited, dwell time, technical characteristics of your device and your IP address. To ensure the protection of your data, we have activated the IP pseudonymization function. This shortens your IP address within the EU or EEA before it is transmitted to Google servers in the US. Only in exceptional cases will the full IP address be transmitted.

Google processes the collected data on behalf of the website operator in order to compile reports on website activity and to provide other services in connection with website use. The transmitted IP address will not be merged with other data held by Google.

You can object to data processing by disabling the storage of cookies in your browser (this may limit the functionality of the website) or by installing the browser plugin to disable Google Analytics:https://tools.google.com/dlpage/gaoptout?hl=de.

Matomo (formerly Piwik)

To analyse and optimise our website, we use the privacy-friendly web analysis service Matomo (open source). The processing is carried out on the basis of Art. 6 (1) (f) GDPR – the VDA's legitimate interest in understanding the use of its website, designing content in line with requirements and improving technical functionality and reach.

Unlike other analysis tools, Matomo does not use cookies. Instead, so-called "fingerprinting" is used, in which automatically transmitted technical information such as IP address, screen resolution, page URL and browser settings are evaluated. The IP address is pseudonymised directly, so that no conclusions can be drawn about individual persons.

This form of analysis allows us to record page views and visit histories without compromising user privacy. Since no information is stored or read out on end devices, the use of Matomo does not fall under Section 25 (1) TTDSG.

Users can also prevent the recording of their visits by activating the "Do Not Track" function in the browser. In addition, we offer an opt-out option on our website, which is controlled by a corresponding cookie:

SalesViewer
On our website, we use SalesViewer® technology from SalesViewer® GmbH to collect company-related information for marketing, market research and optimization purposes. The processing is carried out on the basis of Art. 6 (1) (f) GDPR, i.e. the VDA's legitimate interest in analysing the reach and impact of its services and improving them in a targeted manner.

It uses JavaScript code that collects company-related data. These are encrypted by a so-called one-way function (hashing) and immediately pseudonymised. There is no identification of individual website visitors. The data will be deleted as soon as it is no longer required for the stated purpose and there are no statutory retention obligations to the contrary.

Users can object to the collection of data at any time with effect for the future by using the following link: https://www.salesviewer.com/opt-out. An opt-out cookie is set that must be reactivated when the browser cookies are deleted.

Trade Desk Retargeting Cookies
With your consent (Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TTDSG), we use retargeting cookies from the Trade Desk advertising network on our website. These cookies remember which products or pages you have viewed on our website in order to show you targeted advertisements for that content on other websites.

The purpose of the data processing is to make our advertising measures more efficient and user-oriented. The following data is processed, among others:

• IP address, browser type/version, operating system, referrer URL, date/time, Trade Desk ID (to recognize the browser), usage data such as clicks on ads and dwell time

We only receive information about interactions with our own ads. Data processing is carried out by UK Trade Desk Ltd. (London, UK), which in turn uses Trade Desk Inc. (USA) as a subcontractor. EU standard contractual clauses have been concluded to protect your data, and Trade Desk Inc. is also certified according to the EU-US Data Privacy Framework (Art. 45 GDPR).

The Trade Desk ID is deleted after one year of inactivity. The provision of data is voluntary; no retargeting takes place without consent.

You can deactivate your consent at any time via our cookie board. You can also object to retargeting via this link: 
https://www.adsrvr.org/?AspxAutoDetectCookieSupport=1.

Adform
On our website, we use the Adform tool from Adform A/S (Denmark) to analyse and optimise our marketing measures in a targeted manner. The processing is carried out on the basis of Art. 6 para. 1 lit. a and lit. f GDPR as well as § 15 para. 3 TMG. Our legitimate interest lies in the efficient use of our advertising budget, the monitoring of the success of our campaigns and the improvement of the user approach.

Adform collects data in order to link advertising contacts and clicks with the subsequent use of our website. This allows us to understand whether users visit our website after coming into contact with our advertising and what content interests them there. This enables interest-based advertising to be displayed, e.g. for products that have previously been viewed. It uses pseudonymous online identifiers such as cookie IDs, IP addresses, device IDs, or advertising IDs (e.g., IDFA on mobile devices). No directly personal data such as name or address is stored. Identification is carried out exclusively on a device- or browser-related basis.

Users can object to data collection or deactivate processing at any time – either via the cookie settings on our website or directly via the following links:

• German language: https://site.adform.com/de/privacy-center/platform/widerrufsrecht/
• English Language Version: https://site.adform.com/privacy-center/platform-privacy/opt-out/

Webmetic
With your consent (Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TTDSG), we use the web analysis tool Webmetic from Intent GmbH (Germany). The aim is to analyse user behaviour and measure the reach of our website as well as advertisements in order to improve our offer in a targeted manner.

Webmetic processes pseudonymized data such as:

HTTP data: IP address, browser type/version, operating system, referrer URL, date/time

Endpoint data: Client ID for recognition, technical parameters for controlling the analysis

Visitor behaviour: pages visited, time and duration of visit

The data is automatically provided by the browser and deleted after six months. There are no plans to change the processing purposes.

Users can deactivate the processing at any time – either via the cookie settings or by installing an opt-out plugin: https://webmetic.de/opt-out/

Exhibitor online registration for the IAA
When you access the pages for online registration for exhibitors at the IAA, you leave the general area of www.iaa-mobility.com and enter an area specially designed for registration. The processing of personal data there is carried out on the basis of Art. 6 (1) (f) GDPR, as the VDA has a legitimate interest in the smooth, secure and convenient processing of exhibitor registration. The aim is to organise the trade fair efficiently and to promote the interests of the German automotive industry.

Server Log Files:
When visiting the login pages, technical access data such as file name, date/time, IP address, browser type and referrer URL are automatically logged. This data is used for system security, error analysis and statistical evaluation. The legal basis is also Art. 6 para. 1 lit. f GDPR.

Cookies:

Three technically necessary cookies are used to provide the login services:

Session cookie to recognize the user during the session

Authentication cookie to control access to protected content

Identity cookie to recognize the person during registration

All cookies are encrypted and do not contain any personal information. They are deleted when the browser is closed, unless different settings have been made. The use of the Services is not possible without the acceptance of these cookies.

Google Analytics
Google Analytics is used to analyze the use of the login pages. Data processing is carried out on the basis of Art. 6 (1) (f) GDPR. IP anonymization has been activated, and a contract processing agreement with Google has been concluded. Users can prevent the collection of their data via an opt-out cookie.

More information on the handling of user data by Google Analytics can be found in Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

IAA Services
The VDA offers additional digital services for holding and promoting the IAA via the registration pages. These are based on Art. 6 (1) (b) GDPR (performance of contract):

Exhibitor and co-exhibitor registration:
Interested companies register for the IAA as exhibitors via the exhibitor and co-exhibitor registration. The data required for registration will be submitted by the exhibitor during the online registration. The data is processed for the purpose of fulfilling the contract in accordance with Art. 6 para. 1 b GDPR.

List of exhibitors
Exhibitors and co-exhibitors of the IAA are listed on the IAA website as well as in the official app in the exhibitor directory. The name of the company and the stand number are mandatory. The exhibitor/co-exhibitor can decide whether further information about the company should be published. The legal basis for data processing is Art. 6 para. 1 b GDPR (performance of contract).

List of new products
Exhibitors/co-exhibitors have the opportunity to publish innovations/premieres. Interested exhibitors/co-exhibitors must fill out an online form. The data required for the service of the list of novelties is processed on the legal basis of the performance of the contract in accordance with Art. 6 para. 1 b GDPR.

Press accreditation
Journalists have the opportunity to obtain accreditation for the IAA. The data required for this can be entered into an online registration form. The data will be processed for the purpose of accreditation in accordance with Art. 6 para. 1 b GDPR.

Electronic press boxes
Exhibitors can publish their own press releases on the IAA website. The data entered by the exhibitor will be processed for the purpose of performing this service in accordance with Art. 6 para. 1 b GDPR (performance of contract).

Newsletter
You can subscribe to a free newsletter on our website. Your data is processed on the basis of your consent in accordance with Art. 6 (1) (a) GDPR. You can revoke this consent at any time without affecting the lawfulness of the processing carried out up to that point.

We use the double opt-in procedure for shipping: After registering, you will receive a confirmation e-mail with which you must actively confirm receipt of the newsletter. Your e-mail address and, if applicable, Your name will be deleted from the mailing list after unsubscribing.

By subscribing, you also agree that we may evaluate your usage behaviour in the newsletter (e.g. opening rates, clicks on links). This is done via tracking pixels and individual link URLs. The purpose of data processing is to optimise our content and communication.

The technical implementation is carried out by a commissioned service provider for e-mail marketing within the framework of order processing in accordance with Art. 28 GDPR.

Implementation of specialist events and information events
As part of the IAA, we will be holding events on current topics in the automotive industry, for which participants can register. Registration takes place via an online form, whereby the data is processed for the performance of the contract in accordance with Art. 6 (1) (b) GDPR.

At individual events, photo, video and sound recordings can be made. By participating, you agree to the processing and use of these recordings for documentation, press and public relations work relating to the IAA. The storage takes place until a revocation. If you have any questions or objections, please contact: [email protected].

School class action
Teachers can purchase discounted tickets for their school classes – either online in advance or at the box offices with a certificate of participation. The data collected during registration is processed for registration and verification, based on Art. 6 para. 1 lit. b GDPR.

Contact
The VDA offers a contact form for direct communication. The data entered there will be processed on the basis of your consent in accordance with Art. 6 (1) (a) GDPR. The data will remain stored until you request its deletion, revoke your consent or the purpose no longer applies (e.g. after processing has been completed).

Statutory retention obligations remain unaffected.

Interactions at the trade fair: badge and lead scan
As part of the IAA, you have the opportunity to be scanned by exhibitors or other visitors using the so-called lead scan function. When you register in the IAA app, the profile data you provide is stored in a QR code, which you can access under "My QR code". If you have purchased your ticket in a personalised form via the webshop, the surname and first name provided at the time of purchase as well as the company affiliation specified when purchasing the ticket are stored in your badge.

If you allow an issuer or third party to scan your badge, we will transmit the following data to the respective recipient for marketing purposes with your express consent:

First and last name, company, function, professional e-mail address, professional postal address, interests if applicable

The processing is carried out on the basis of your consent in accordance with Art. 6 (1) (a) GDPR. By scanning, you expressly consent to the transmission and processing of data. You can withdraw your consent at any time.

The recipient of your data is exclusively the respective exhibitor or visitor to whom you have allowed the scanning. It will not be passed on to other third parties.

Within the VDA, only those entities that need this access to fulfil the respective processing purposes will have access to your personal data. In addition, the VDA uses external service providers, e.g. for hosting, newsletter dispatch or payment processing. These service providers process data exclusively within the framework of order processing in accordance with Art. 28 GDPR and in strict compliance with our data protection regulations.

Banks and payment service providers
For the processing of payments, especially in the webshop or at on-site events, data is transmitted to banks and payment service providers. One example is PAYONE GmbH, which acts as an independent controller. Data processing by PAYONE is carried out on the basis of Art. 6 (1) (b) and (f) GDPR – for the fulfilment of the contract and in the legitimate interest of secure payment processing. For more information, please refer to PAYONE's privacy policy: https://www.payone.com/DE-de/dsgvo.

Payment data is also stored to defend against possible legal claims for the duration of the statutory limitation period (three years), based on Art. 6 (1) (f) GDPR.

Sale of products at the IAA
In the case of sales at the IAA, the data required for the conclusion of the contract will be processed. The legal basis is Art. 6 (1) (b) GDPR. Here, too, payment processing is carried out via PAYONE. The data is processed for the fulfilment of the contract and to secure payment processes. It is also stored for three years to defend against possible claims.

The VDA takes comprehensive technical and organizational measures to protect your personal data from unauthorized access, loss, or misuse. The security measures are regularly reviewed and adapted to the state of the art.

The storage period of your data depends on the respective purpose of processing. As soon as the data is no longer required, it will be deleted – unless there are statutory retention obligations (e.g. under commercial or tax law) or statutes of limitation require longer storage, such as data relevant to contracts and accounting, which are stored for 10 years or data for legal defence, which is stored for three years (statutory standard statute of limitations).

You have the following rights under the GDPR at all times:

Information about your stored data (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure of your data (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Objection to processing (Art. 21 GDPR)
Data portability (Art. 20 GDPR)

Restrictions on these rights may result from §§ 34 and 35 BDSG.

If you have any questions or would like to exercise your rights, please contact [email protected].

Further contact details can be found under Section 1 of the Privacy Policy.

Withdrawl of consent
You can revoke the consent you have given us to the data processing at any time by informally notifying us by e-mail to [email protected]. Further contact details can be found under section 1). Your withdrawl applies only to future processings. The processing of your data that has already been carried out on the basis of your consent up to the time of revocation remains lawful (Art. 7 para. 3 GDPR).

Right to object according to Art. 21 EU GDPR
You can object to the processing of your data for advertising purposes at any time without giving reasons (Art. 21 para. 2 GDPR).

You can also object to other processing if there are reasons (Art. 21 para. 1 GDPR).

In the event of data protection violations, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR in conjunction with § 19 BDSG.