A. Privacy Notice of INNOCEAN Worldwide Europe GmbH for the Website eu.drivingexperience.hyundai.com
B. Privacy Notice of We.eM Projektgesellschaft mbH and INNOCEAN Worldwide Europe GmbH for the Hyundai Driving Experience booking process
A. Privacy Notice of INNOCEAN Worldwide Europe GmbH for the Website eu.drivingexperience.hyundai.com
1. Name and address of the controller
The controller within the meaning of the General Data Protection Regulation (GDPR), other data protection laws applicable in the Member States of the European Union and other provisions of a data protection nature is:
INNOCEAN Worldwide Europe GmbH
60314 Frankfurt am Main
Tel.: +49 (0) / 89 91 05 93 77
2. Name and address of the data protection officer
The external data protection officer of the controller is:
Mr. Jens Engelhardt
c/o NOTOS Xperts GmbH
Heidelberger Str. 6
The data protection information of INNOCEAN Worldwide Europe is based on the definitions which have been used by the European directive in formulating the General Data Protection Regulation (GDPR). The data protection information of INNOCEAN Worldwide Europe GmbH (hereinafter referred to as IWE) should be easily read and understood not only by the general public but also by our customers and business partners. In order to ensure this, we would like to clarify in advance the definitions used.
In this data protection information and on our website, we use - amongst others - the following terms:
3.1 Personal data
Personal data is any information relating to an identified or identifiable natural person (hereafter "data subject"). Defined as identifiable is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
3.2 Data subject
Data subject is each identified or identifiable natural person, whose personal data is processed by the controller for the processing.
Processing means any operation or set of operations which is carried out in connection with personal data - whether or not by automated means - such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
3.4 Restricting of the processing
Restricting of the processing is the marking of personal data as stored with the objective of restricting its processing in the future.
Profiling is each type of the automated processing of personal data, which consists of this personal data being used to permit particular personal aspects relating to a particular natural person, and here in particular aspects in respect of work performance, economic situation, health, personal likes, interests, reliability, behaviour, place of residence or change of place of residence of this natural person to be evaluated, analysed or forecast.
Pseudonymization is the processing of personal data in such a way that the personal data can no longer be assigned to a specific data subject without the use of additional information, in so far as this additional information is kept in a special way and subjected to technical and organizational measures which ensure that the
personal data cannot be assigned to an identified or identifiable natural person.
3.7 Controller or party responsible for the processing
Controller or party responsible for the processing (hereafter controller) is the natural person or legal entity, authority, institution or other post, which alone or together
with others decides on the purposes and means of the processing of personal
data. If the purposes and means of the processing are laid down in European
Union legislation or the legislation of the member states, then the controller or the particular criteria of the appointment of this controller in accordance with European
Union legislation or the legislation of the member states can be provided.
Processor is a natural person or legal entity, authority, institution or other post, which processes the personal data on the instructions of the controller.
Recipient is a natural person or legal entity, authority, institution or other post to which personal data are disclosed regardless of whether this is a third party or not. However, authorities, which receive within the framework of a particular investigation order in accordance with European Union legislation or the legislation of the member states data which possibly may be/contain personal data, do not hold good as recipients.
3.10 Third party
Third party is a natural person or legal entity, authority, institution or other post with the exception of the data subject, the controller, the order processor and those persons which are authorized under the direct responsibility of the controller or of the order processor to process the personal data.
Consent is each declaration of will given voluntarily by the data subject for the definite case in an informed and unambiguous manner in the form of a declaration or other unambiguous confirmatory action, with which the data subject makes clear that he/she agrees to the processing of personal data relating to himself/herself.
4. General information on data processing; legal basis, purposes of processing, duration of storage, objection and possibility of erasure
4.1 General information on the legal basis
Where we obtain the consent of the data subject for the processing of personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.
Art. 6 para. 1 lit. b GDPR serves as the legal basis for the processing of personal data required for the performance of a contract to which the data subject is a party. This also applies to processing operations that are necessary for the implementation of pre contractual measures.
Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para. lit. c GDPR serves as the legal basis.
Art. 6 para. 1 lit. d GDPR serves as a legal basis in the event that vital interests of the data subject or another natural person necessitate the processing of personal data.
If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and fundamental freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for the processing.
4.2 General information on data erasure and storage duration
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. In addition, the data may be stored if the European or national legislator has provided for this in EU regulations, laws or other provisions to which the person responsible is subject. The data shall also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless it is necessary for further storage of the data for the conclusion or performance of a contract.
4.3 General information on processing on our website
Data protection, data security and secrecy protection have high priority for IWE. The permanent protection of your personal data, your company data and your trade secrets is particularly important to us.
In principle, you can visit our website without providing any personal information. However, if you make use of the services of our company via our website, this requires the disclosure of your personal data. In general, we use the data communicated by you and collected by the website and the data stored during use exclusively for our own purposes, namely for the implementation and provision of our website and for the initiation, implementation and processing of the services offered via the website (contract performance) and do not pass these on to outside third parties, unless there is an officially ordered obligation to do so. In all other cases, we will obtain your separate consent.
Your personal data will be processed in accordance with the requirements of the General Data Protection Regulation and in accordance with the country-specific data protection regulations applicable to IWE. By means of this data protection note, we would like to inform you about the type, scope and purpose of the personal data processed by us. In addition, we will inform you of your rights by means of this data protection information.
IWE has implemented technical and organizational measures to ensure adequate protection of personal data processed via this website. Nevertheless, Internet-based data transmissions can in principle have security gaps, so that absolute protection cannot be guaranteed.
5. Collection of general data and information
The website of IWE collects a series of general data and information with each call-up of the website by a data subject or automated system. This general data and information is stored in the log files of the server. The following data may be collected: (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system accesses our website (so-called referrer), (4) the sub-websites that are accessed via an accessing system on our website, (5) the date and time of an access to the website, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system and (8) other similar data and information that serve to avert danger in the event of attacks on our information technology systems.
When using these general data and information, IWE does not draw any conclusions about the data subject. Rather, this information is needed (1) to deliver the contents of our website correctly, (2) to optimize the contents of our website and the advertising for these, (3) to ensure the long-term functionality of our information technology systems and the technology of our website, and (4) to provide law enforcement authorities with the information necessary for prosecution in the event of a cyber attack. Therefore, the IWE analyzes anonymously collected data and information on one hand, and on the other hand, with the aim of increasing the data protection and data security of our enterprise, to ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from any personal data submitted by a data subject.
Art. 6 para. 1 lit. f GDPR (legitimate interest)
The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.
In the case of storage of data in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment of the calling client is no longer possible.
Objection / opportunity for elimination
No, since mandatory for operation of the website.
If you wish to contact us, you can do so via the channels provided on our website. These include the contact forms and the specified hotline.
For details regarding processing for contacting purposes, please refer to section 5 of the booking process privacy notice below
7. Newsletter; advertising
The newsletter is sent based on your application at the website in the modus of the double-opt-in process whereby at the time of the application for the newsletter the following data from the input mask is transmitted to us:
- First name*
- Last name*
- E-mail address*
In addition, the following data will be collected at registration:
For the processing of the data your consent will be obtained within the framework of the registration process by way of the Double-Opt-In procedure whereby reference is made to this data protection information.
In addition we will also inform you about Hyundai Products and Events, if you have given your consent for this purpose of processing.
In addition, we reserve the right to store your first name and surname, your postal address and - in so far as we have received this additional information from yourself within the framework of the contractual relationship - your title, academic degree, year of birth and professional title, sector or business designation and to store this information for our own adverting purposes, e.g. for the sending of similar, interesting offers and information on our training offers per mail or per e-mail if you have stated your e-mail address.
7.3 Passing on to third parties
If you have consented to the processing of your data for the purpose of receiving a general newsletter, your data (e-mail address and name) will be shared with Hyundai Motor Europe and its associated distributors (e.g. Hyundai Motor Deutschland) until further notice in order to provide you with information about our products.
7.4 Right of objection and right of withdrawal
We draw explicit attention to your right of withdrawal (newsletter) and your right of objection (advertising) in accordance with sections 15.7 and 15. of this data protection information.
Legal foundation for the processing of the data following the user requesting sending of the newsletter is - when the consent of the user is held - Article 6 Para. 1 lit. a GDPR.
The collection of the e-mail serves to permit the newsletter to be sent.
The collection of other personal data within the framework of the application process serves to prevent misuse of the services or of the e-mail used. The collection of other persona data within the framework of the application process serves to prevent abuse of the services or of the e-mail address used.
The date is deleted as soon as it is no longer necessary for achieving the purpose of their collection.
Accordingly, the e-mail address of the user is kept stored for as long as the subscription for the newsletter is active.
The other personal data collected within the framework of the application process is deleted as a rule after a period of seven days.
Objection / opportunity for elimination
The subscription for the newsletter can be terminated at any time by the relevant user. For this purpose, there is an appropriate deactivation link in each issue of the newsletter.
Terminating the subscription represents at the same time a revocation of the consent to the storing of personal data collected during the application process.
9. Information about data processing on our Facebook-Fanpage
We operate a Facebook fan page for the Global Driving Experience at https://www.facebook.com/pg/hyundai.drivingexperience/about/?ref=page_internal. As the operator of this Facebook page we are a joint Controller with the provider of the social network Facebook (Facebook Ireland Ltd.) in the sense of Art. 4 No. 7 of the General Data Protection Regulation (GDPR). When visiting the Facebook page, personal data of the page visitors are processed by both Controllers.
We have entered into a joint Controller agreement with Facebook (Page Controller Addendum). With this agreement, Facebook acknowledges its joint responsibility with regard to so-called Insights data and assumes essential data protection obligations to inform data subjects, to ensure data security or to report data protection violations. In addition, the agreement stipulates that Facebook is primarily the point of contact for the exercise of data subjects' rights (Art. 15 - 22 GDPR). As the provider of the social network, Facebook alone has direct access to the necessary information and can also immediately take any necessary measures and provide information. Should our support nevertheless be necessary, we can be contacted at any time.
9.2 Use of Insights and Cookies
In connection with the
9.3 Comments and messages; participation in competitions
On this Facebook fan page, you can also comment on and rate entries and contact us via private messages or participate in competitions.
This Facebook Page is operated in order to present, interact and communicate with Facebook users and other interested persons and customers who visit the Facebook Page.
The processing of users' personal data is based on legitimate interests in an optimized presentation of the company and its products (Art. 6 para. 1 lit. f) GDPR) as well as in the participation in competitions or the answering of product application questions on the basis of a (preliminary) contractual relationship pursuant to Art. 6 para. 1 lit. b) GDPR.
The processing of the information generated by Insights is intended to enable the operator of the Facebook fan page to obtain statistics that Facebook generates on the basis of visits to the Facebook fan page.
For example, this may allow us to learn about the profiles of visitors who value the Facebook Page or use applications on the Page to provide more relevant content and develop features that may be of greater interest to them.
To help us better understand how our Facebook page can better serve our business goals, the information collected will also be used to create and provide demographic and geographic analyses. We may use this information to serve targeted interest-based advertisements without immediately knowing the identity of the visitor. If visitors use Facebook on several devices, the collection and analysis can also be carried out across devices if the visitors are registered and logged in to their own profile. The created visitor statistics are only transmitted to us in anonymized form. We have no access to the underlying data.
Furthermore, we use our Facebook page to communicate with customers, interested parties and Facebook users and to provide information about them and their products. In this context, we may receive additional information, for example, because of user comments, private messages, or because you follow them or share their content. This information is processed solely for the purpose of communication and interaction with you.
Your data will be erased if the purpose is no longer applicable, provided that there is no obligation to retain them.
Possibility of removal & objection
Under the settings for advertising preferences, Facebook users can influence the extent to which their user behavior may be recorded when visiting the Facebook page. Further options are offered by the Facebook settings or the right of objection form.
9.4 Transfer of data
It cannot be ruled out that some of the information collected may also be processed outside the European Union by Facebook Inc. based in the USA. Facebook Inc. has subjected itself to the standard contractual clauses of the EU Commission and thus guarantees a lawful transfer of data.
We do not share any personal information obtained through our Facebook page.
9.5 Information on contact options
For further information on our contact details, including those of our data protection officer, the rights of data subjects vis-à-vis us and how we process personal data in other respects, please refer to the relevant sections of this data protection declaration.
10. Information about data processing on our Instagram-Fanpage
We operate a Instagram fan page for the Global Driving Experience at https://www.instagram.com/hyundai.driving.experience/. As the operator of this Instagram page, we, together with the provider of the social network Instagram (Instagram Inc.), are responsible within the meaning of Art. 4 No. 7 of the General Data Protection Regulation (GDPR). When visiting our Instagram page, personal data of the page visitors are processed by both controllers.
We have concluded an agreement with Instagram on joint data protection controllership (Page Controller Addendum). With this agreement, Instagram acknowledges its joint responsibility with regard to so-called Insights data and assumes essential data protection obligations to inform data subjects, to ensure data security or to report data protection violations. In addition, the agreement stipulates
that Facebook is primarily the point of contact for the exercise of data subjects' rights (Art. 15 - 22 GDPR). As a provider of the social network, Instagram alone has direct access to the required information and can also immediately take any necessary measures and provide information. Should our support nevertheless be necessary, we can be contacted at any time.
10.2 Use of Insights and Cookies
10.3 Comments and messages; participation in competitions
On our Instagram fan page you also have the opportunity to comment on our contributions, rate them and get in touch with us via private messages or take part in competitions.
We operate this Instagram Page to present, interact and communicate with Instagram users, other interested persons and our customers who visit our Instagram Page. The processing of users' personal data takes place on the basis of our legitimate interests in an optimized company and product presentation (Art. 6 Para. 1 lit. f GDPR) as well as when participating in competitions or answering product application questions on the basis of a (pre-)contractual relationship pursuant to Art. 6 Para. 1 lit. b) GDPR.
The processing of the information generated by Insights is intended to enable us, as the operator of the Instagram fan page, to obtain statistics that Instagram generates on the basis of visits to our Instagram fan page. The purpose of this is to control the marketing of our activities. For example, it allows us to learn about the profiles of visitors who value our Instagram Page or use applications on the Page to provide them with more relevant content and develop features that may be of greater interest to them.
To better understand how our Instagram page can help us better achieve our business goals, we also use the information we collect to create demographic and geographic reports that we provide to us. We may use this information to serve targeted, interest-based advertisements without immediately obtaining knowledge of the visitor's identity. If visitors use Instagram on several end devices, the recording and evaluation can also be carried out across devices if they are registered visitors logged into their own profile.
The visitor statistics created are transmitted to us exclusively in anonymous form. We do not have access to the underlying data.
We also use our Instagram page to communicate with our customers, prospects and Instagram users and to inform them about us and our products.
In this context we may receive further information, e.g. from user comments, private messages or because you follow us or share our content. The processing takes place exclusively for the purpose of communication and interaction with you.
Your data will be deleted if it is not used for the purpose for which it was collected, as long as there is no obligation to retain it.
Objection / opportunity for elimination
Instagram users can influence the extent to which their user behavior is captured when they visit our Instagram page under Advertising Preference Settings. Further possibilities are offered by the Instagram settings or the right of objection form.
It cannot be ruled out that some of the information collected may also be processed outside the European Union by Instagram Inc. based in the USA.
Instagram Inc. has subjected itself to the standard contractual clauses adopted
by the EU Commission and thus undertakes to comply with European data
We ourselves do not pass on any personal data that we receive via our
For further information on our contact data, including our data
protection officer, the rights of data subjects vis-à-vis us and how we process
personal data, please refer to the relevant sections of this data protection
11. YouTube channel
We link YouTube videos on our website. We have no influence on the data
We use a YouTube channel under the address: https://www.youtube.com/channel/UCxuJhEiEcaW5iRwOG8fMAig/about?view_as=subscriber owned by Google Ireland Limited, Gordon House, Barrow St, Dublin, D04 E5W5, Ireland. We would like to point out that you use the YouTube channel offered here and its functions on your own responsibility.
We have no influence on the type and scope of the data
processed by Google, the type of processing and use or the transfer of this data to third parties. We also have no effective means of control in this respect. When you use Google, your personal data will be collected, transferred, stored, disclosed and used by Google and, in doing so, transferred to, stored and used in the United States, Ireland and any other country in which Google does business, regardless of where you live. It is transferred to
Google's affiliated companies and other trusted companies or individuals who process it on Google's behalf.
On the one hand, Google processes your voluntarily entered data such as name and username, e-mail address, telephone number. Google also processes the content that you create, upload or receive from others when using the services. This includes, for example, photos and videos that you store, documents and spreadsheets that you create, and comments that you post to YouTube videos. Google also evaluates the content you share based on what topics you are interested in, stores and processes confidential messages that you send directly to other users, and can determine your location based on GPS data, wireless network information, or your IP address to send you advertising or other content. Google may use analysis tools such as Google Analytics for evaluation purposes. We have no influence on the use of such tools by Google and have not been informed about such potential use. If tools of this type are used by Google for our YouTube channel, we have not commissioned or otherwise supported this in any way.
Nor are the data obtained from the analysis made available to us. Furthermore, we have no way of preventing or stopping the use of such tools on our YouTube channel. Finally, Google also receives information when you view content, for example, even if you have not created an account. This so-called "log data" may include your IP address, browser type, operating system, information about the website and pages you previously visited, your location, your mobile operator, the device you are using (including device ID and application ID), the search terms you used, and cookie
information. You can limit the processing of your information by going to the
general settings for your Google Account. In addition to these tools, Google also offers specific privacy settings for YouTube. You can learn more about this in Google's Privacy Guide for Google products: https://policies.google.com/technologies/product-privacy?hl=en-US.
Privacy Help Center: https://support.google.com/policies/troubleshooter/757578 visit_id=637054532384299914-2421490167&hl=en&rd=2.
We also process your data when you communicate with us via YouTube. The processing is carried out for the purposes of customer retention, customer information and advertising (Art. 6 para. 1 lit. f GDPR).
The recipient of the data is initially Google, where they may be passed on to third parties for their own purposes and under the responsibility of Google.
The recipient of publications is also the public, i.e. potentially everyone.
12. Google Analytics
We have integrated the Google Analytics component (with anonymization function) on this website. The operating company of the Google Analytics component is Google Inc, 160 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. Google Analytics is a web analysis service. Web analysis is the collection, storage and analysis of data about the behavior of website visitors. The purpose of the Google Analytics component is to analyze the traffic of visitors to our website. Google uses the data and information obtained to, among other things, evaluate the use of our website, to compile online reports for us showing the activities on our website and to provide other services related to the use of our website.
Google Analytics sets a cookie on the information technology system of the data subject. Setting the cookie enables Google to analyze the use of our website. Each time one of the individual pages of this website operated by us and on which a Google Analytics component has been integrated is called up, the internet browser on the information technology system of the data subject is
automatically caused by the respective Google Analytics component to transfer data to Google for the purpose of online analysis. As part of this technical process, Google obtains knowledge of personal data, such as the IP address of the data subject, which Google uses, among other things, to track the origin of visitors and clicks and subsequently to enable commission settlements.
By means of the cookie, personal information, for example the access time, the location from which an access originated and the frequency of visits to our website by the data subject, is stored. Each time the data subject visits our
website, this personal data, including the IP address of the internet connection used by the data subject, is transferred to Google in the United States
of America. This personal data is stored by Google in the United States of America. Google may share this personal data collected via the technical process with third parties.
We use the addition "_gat._anonymizeIp" for web analysis via Google Analytics. This means that the IP address of the internet connection of
the data subject is shortened and anonymised by Google if access to our website is from a member state of the European Union or from another state party to the Agreement on the European Economic Area.
and at https://marketingplatform.google.com/about/analytics/terms/us/.
Google Analytics is explained in more detail under this link https://marketingplatform.google.com/intl/en_uk/about/analytics/.
13. Google Tag Manager
14. Google My Business
We also use the Google My Business feature of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google") to provide a business listing for the Global Driving Experience. Google My Business is a platform provided by Google that aggregates various services from the Google Group and provides users with direct access to them via a dashboard. These include Google Analytics, Google Maps and YouTube. With the product Google My Business, companies can present
themselves in Google search and Google Maps.
Google My Business can recognize the location of a user by means of the IP address. This data processing is carried out in accordance with Art. 6 Para. 1 S. 1 lit.f GDPR on the basis of the legitimate interests of Google.
For the purpose and scope of data collection and the further processing and use of data by Google, as well as your rights and setting options for the protection of your privacy, please refer to Google's data protection information.
15. Vimeo (Livestream „Dare to dream“)
On our website, we operate a livestream of a 24H race of the Hyundai Driving Experience under the name "Dare to dream". For this purpose, we use the services of the video platform Vimeo, which is provided by Vimeo, LLC, headquartered at 555 West 18th Street, New York, New York 10011, USA. With the help of a code snippet, we can thus make the video material of the event directly available to you. In the process, your personal data is transferred to vimeo servers in the USA. We have concluded standard contractual clauses with Vimeo and therefore have a legal basis for the transfer.
The stream is available on the Vimeo platform, but at the same time also on our website through an embedded iFrame. When an embedded vimeo video is called up on our website, your browser connects to the servers of vimeo. This results in a data transfer. This data is stored and processed on the vimeo servers, regardless of whether you have a vimeo account or not. The personal data processed includes IP address, technical info about the browser type, operating system or basic device information. Furthermore, vimeo stores information on which web site the vimeo service is used and which actions (web activities) are performed on the web site. These web activities include, for example, session duration, bounce rate or which button you clicked on. These actions can be tracked and stored by vimeo using cookies and similar technologies.
If you are logged in to vimeo as a registered member, more data can usually be collected because more cookies may have already been set in your browser. In addition, the actions on the website are directly linked to your vimeo account. To prevent this, you must log out of vimeo while "surfing" the website.
16. Your rights
If personal data is processed by you, you are the data subject within the meaning of the GDPR and you are entitled to the following rights towards the data controller:
16.1 Right of access
You can obtain confirmation from the data controller as to whether or not personal data concerning you will be processed by us.
In the event of such processing, you may request the following information from the data controller:
(1) the purposes of the processing;
(2) the categories of personal data concerned;
(3) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
(4) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
(5) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
(6) the right to lodge a complaint with a supervisory authority;
(7) where the personal data are not collected from the data subject, any available information as to their source;
(8) the existence of automated decision-making, including profiling, referred to in Article2 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of
such processing for the data subject.
You have the right to request information as to whether the personal data concerning you will be transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate guarantees pursuant to Art. 46 GDPR in connection with the transfer.
16.2 Right to rectification
You have the right to have your personal data rectified and/or completed by the data controller if the personal data processed concerning you is inaccurate or incomplete. The data controller must carry out the rectification immediately.
16.3 Right to restriction of processing
Under the following conditions, you may request that the processing of your personal data be restricted:
(1) if you dispute the accuracy of the personal data concerning you for a period which enables the person responsible to verify the accuracy of the personal data;
(2) the processing is unlawful and you refuse to delete the personal data and instead request that the use of the personal data is to be restricted;
(3) the controller no longer needs the personal data for the purposes of the processing, but you need them for the assertion, exercise or defence of legal claims, or
(4)if you have objected to the processing pursuant to Art. 21 para. 1 GDPR and it has not yet been established whether the legitimate reasons of the data controller outweigh your reasons.
Where the processing of personal data concerning you has been restricted, such data may not be processed, with the exception of their storage, without your consent or for the purpose of asserting, exercising or defending rights or protecting the rights of another natural or legal person or for reasons of an important public interest of the Union or of a Member State.
If the processing restriction has been limited in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.
16.4 Right to erasure
16.4.1 Obligation to erase personal data
You may request the data controller to delete the personal data concerning you immediately and the data controller is obliged to delete this data immediately if one of the following reasons applies:
(1) The personal data relating to you are no longer necessary for the purposes for which they were collected or otherwise processed.
(2) You withdraw your consent on which the processing pursuant to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR was based and there is no other legal basis for the processing.
(3) You object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate reasons for the processing or you object to the processing pursuant to Art. 21 para. 2 GDPR.
(4) The personal data have been processed unlawfully.
(5) The erasure of your personal data is necessary to fulfil a legal obligation under Union law or the law of the Member States to which the controller is subject.
(6) The personal data relating to you have been collected in relation to information society services offered pursuant to Article 8(1) GDPR.
16.4.2 Information to third parties
If the data controller has made the personal data concerning you public and is obliged to delete them in accordance with Art. 17 para. 1 GDPR, he shall take appropriate measures, also of a technical nature, taking into account the available technology and the implementation costs, to inform the data controllers who process the personal
data that you as the data subject have requested them to delete all links to this personal data or copies or replications of this personal data.
The right to erasure does not apply if the processing is necessary
(1) for exercising the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the
(3) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or
statistical purposes in accordance with Article 89(1) GDPR in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(5) for the establishment, exercise or defence of legal claims.
16.5 Notification obligation
If you have exercised your right to rectify, erase or limit the processing of your personal data against the controller, the latter is obliged to notify all recipients to whom the personal data concerning you have been disclosed of such rectification, erasure or limitation, unless this proves impossible or involves a disproportionate effort.
You have the right to be informed of such recipients by the data controller.
16.6 Right to data portability
You have the right to receive the personal data concerning you that you have provided to the data controller in a structured, common and machine-readable and interoperable format. In addition, you have the right to communicate this data to another controller without being hindered by the controller to whom the personal data was provided, provided that
(1) the processing is based on a consent pursuant to Art. para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR and
(2) the processing is carried out by automated means.
In exercising this right, you also have the right to request that the personal data be transferred directly from one controller to another controller, insofar as this is technically feasible. Freedoms and rights of other persons must not be affected by this.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
16.7 Right to object
You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data on the basis of Art. 6 para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions.
The data controller will no longer process the personal data concerning you unless he can prove compelling grounds for processing worthy of protection which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
If the personal data concerning you are processed for the purpose of direct marketing, you have the right to object at any time to the processing of the personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is connected with such direct marketing.
If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes.
You have the possibility to exercise your right of objection through automated procedures using technical specifications in connection with the use of Information Society services, notwithstanding Directive 2002/58/EC.
16.8 Right to withdrawal of the data protection declaration of consent
You have the right to withdrawal
of your declaration of consent under data protection law at any time and without stating reasons. In the event of revocation, we will immediately delete your personal data and no longer process it. The withdrawal
of your consent does not affect the legality of the processing carried out on the basis of your consent until you withdrew your consent.
16.9 Automated individual decision-making, including profiling
You have the right not to be subject to any decision based solely on automated processing, including profiling, that has any legal effect on you or similarly significantly affects you. This does not apply if the decision
(1) is necessary for the conclusion or performance of a contract between you and the controller,
(2) is authorised by legislation of the Union or of the Member States to which the controller is subject and contains appropriate measures to safeguard your rights and freedoms and your legitimate interests; or
(3) with your express consent.
However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para. 1 GDPR, unless Art. para. 2 lit. a or g applies and appropriate measures have been taken to protect the rights and freedoms as well as your legitimate interests.
In the cases referred to in (1) and (3), the controller shall take reasonable steps to safeguard the rights and freedoms and your legitimate interests, including at least the right of the controller to obtain the intervention of a person, to present his or her point of view and to contest the decision.
16.10 Right of appeal to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you shall have the right to complain to a supervisory authority, in particular in the Member State of your residence, place of work or place of presumed infringement, if you consider that the processing of your personal data is in breach of the GDPR.
The supervisory authority with which the complaint was lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.
B. Privacy Notice of We.eM Projektgesellschaft mbH and INNOCEAN Worldwide Europe GmbH for the booking process
On this website you have the possibility to buy tickets for the following events:
- Hyundai Driving Experience (consisting of Track Experience, Winter Experience,
- N TAXI
The following information relates to the process of booking (payment and settlement) of tickets in relation to the Hyundai Driving Experience and N TAXI.
1. Controller and data protection officer
For the processing of personal data within the booking process, We.eM Projektgesellschaft mbH is generally considered the joint controller together with INNOCEAN Worldwide Europe GmbH.
For the payment process under number 5 We.eM and INNOCEAN Worldwide Europe are considered distinct controller.
We.eM Projektgesellschaft mbH
91413 Neustadt a. d. Aisch, Germany
Tel: +49 (0) / 89 91 05 93 77
We.eM has not appointed a data protection officer. However, if you have any questions regarding data protection, you can contact us at any time at the following address: email@example.com
INNOCEAN Worldwide Europe GmbH
60314 Frankfurt am Main, Germany
Tel: +49 (0) / 89 91 05 93 77
The external data protection officer of INNOCEAN Worldwide Europe is:
Mr. Jens Engelhardt
c/o NOTOS Xperts GmbH
Heidelberger Str. 6
2. Account registration
To register an account on the Hyundai Driving Experience website, you must provide personal information. The following information is required:
- First name
- Last name
- E-mail address
Alternatively, you can also register via your Google account. In this case, you will be redirected to a Google login page and log in to your Google account. By logging in, you agree that Google may share your name, email address, language preference and profile picture with us. Google is controller for this processing.
- Art. 6 para. 1 lit. b GDPR (contract fulfillment)
Purposes of processing:
- Registration of a user account (e.g. to place orders)
- Establishment of identity
3. Account management
After successful registration, you can manage your account and the information specified in it. In particular, you can indicate and change your billing address. The following personal data will be processed from you in this context:
- First name
- Last name
- Company (optional)
- Street and house number
- Address suffix (optional)
- ZIP CODE
- City (town)
- Phone number
In addition, you can specify within your account management whether you would like to receive advertising from us by e-mail.
- Art. 6 para. 1 lit. b GDPR (Contract fulfillment) – for order execution
- Art- 6 para 1. lit. a GDPR (Consent) for email-advertisement purposes.
Purposes of processing:
- Management of account information and user preferences
4. Ordering tickets
4.1 Ordering process
On our website you have the possibility to book tickets for the Hyundai Driving Experience. The following events are part of the Hyundai Driving Experience:
- Track Experience
- Winter Experience
Furthermore, you have the possibility to book a ticket for the N TAXI.
Booking is done via a designated button on our website (e.g. "Book your seat"). When you click on such a button, you will be redirected to a booking page where you can make your selection. First, you select the type of event you want. Then you select a route and a date. The available events will be displayed.
You have the possibility to add an event to the shopping cart. You can manage the shopping cart (add or remove events). Afterwards you can go to checkout.
To order your ticket bindingly, you must register participants. The following personal data of the participant will be processed in this context:
- First name
- Last name
- E-mail address
If you do not want the participant to be informed about his registration (gift), you can set an appropriate check mark for this. To make your booking binding, you must confirm the applicability of the following documents:
- Information about travel rights
- Liability notice and disclaimer
- Declaration of Participation
Art. 6 para. 1 lit. b GDPR (Contract fulfillment)
Purposes of processing:
- Execution and processing of the order
4.2 Ordering vouchers
You have the possibility to order vouchers for the Hyundai Driving Experience. The ordering process takes place in the Hyundai Finance rewards store (https://hyundaifinance-pluspunkt.de/), which is operated by Buben & Mädchen GmbH, In der Dalheimer Wiese 20, 55120 Mainz. We have no influence on the processing of your personal data within the rewards store and are not responsible for it. After you have ordered your voucher in the premium store, we receive the voucher as well as a delivery note with your personal data. We send this information to you so that you can book an event on our website.
Art. 6 para. 1 lit. b GDPR (Contract fulfillment)
Purposes of processing:
- Execution and processing of the order
- Issuing vouchers
5. Payment processing
For payment processing, we use authorized payment service providers. The various payment options are described below from a data protection perspective.
INNOCEAN Worldwide Europe is the Controller within the meaning of Article 4 no. 7 of the GDPR for the processing of payments relating to orders for "N TAXI" tickets.
We.eM is Controller in the sense of Art. 4 nr. 7 GDPR for processing operations of payments related to orders of tickets for Hyundai Driving Experience (consisting of Track Experience, Winter Experience, N-Experience, E-Experience).
5.1 Credit card payment
Should you choose to pay by credit card (e.g. Visa, Mastercard or American Express), the following information will be collected:
- Card number
- Cardholder (Name)
- Expiration date (MM/YY)
- Check digit
5.2 Shop Pay Payment
5.3 Payment via Apple Pay
5.4 Payment via Google Pay
5.5 Payment by Klarna Sofort (bank transfer)
- Art. 6 para. 1 lit. b GDPR (Contract fulfillment)
Purposes of processing:
- Payment and Order execution
6. Contact form, hotline and e-mail contact
On the booking page there is a contact form, which can be used for electronic contact. If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and stored. These data categories are:
- Email address*
The following data is also stored at the time the message is sent:
- The IP address of the user
- Date and time of dispatch
Alternatively, it is possible to contact us via the provided e-mail address or our hotline. In this case, the data will be stored automatically (e-mail) or recorded by us and stored manually.
In this context, the data will not be passed on to third parties. The data is used exclusively for processing the conversation. However, it may be necessary for us to pass on your data to certain service providers exclusively for a specific purpose and as part of our services for contacting you.
The legal basis for the processing of data in the case of inquiries via e-mail, , the contact form or our hotline is usually Art. 6 para. 1 lit. b. GDPR
(Contract fulfillment; Pre-contractual measures);
Art. 6 para. 1 lit. c. GDPR (fulfillment of a legal obligation, e.g. answering questions about data protection) and
otherwise Art. 6 para. 1 lit. f GDPR
The processing of personal data from the e-mail or from the contact mask or the telephone contact serves us solely to process the contact. This is also the necessary legitimate interest in the processing of the data.
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case when the respective conversation with the user has ended. The conversation is ended when the circumstances indicate that the matter in question has been conclusively clarified.
The foregoing shall not apply if the correspondence is subject to a retention obligation under commercial law..
Objection / elimination possibility
The user has the option to object to the storage of his personal data at any time. In such a case, the conversation cannot be continued.
Controller: We.eM Projektgesellschaft mbH and INNOCEAN Worldwide Europe GmbH as joint controllers pursuant to Art. 26 GDPR
C. Essentials of the joint controllership agreement according to Art. 26 GDPR between We.eM Projektgesellschaft mbH and INNOCEAN Worldwide Europe GmbH
1. Scope of joint controllership
The agreement was concluded to regulate the joint controllership of We.eM and INNOCEAN Worldwide Europe regarding the operation of the "Hyundai Driving Experience" web store. The agreement concerns the following processes:
- Collection of customer data within the scope of user registration
- User account management
- Customer hotline / contact and inquiry handling
- Processing of orders
To process bookings, We.eM and INNOCEAN Worldwide Europe use a joint tool, through which there is shared access to and mutual use of the personal data of customers and users. On the technical side, We.eM is responsible for booking the Hyundai Driving Experience, managing its own customers and offering the customer hotline.
INNOCEAN Worldwide Europe handles the booking processes for the N-Taxi, the customer management of their customers as well as the answering of inquiries via the contact forms. These processing operations are carried out for the purpose of operating a web store for promotional purposes for Hyundai.
The obligations of both parties regarding data processing are outlined below.
2.1 Requests regarding data subject rights
Requests from data subjects regarding data subject rights may be submitted to either party. The parties inform each other about received requests and support each other in the respective fulfillment. The requests are primarily processed by INNOCEAN Worldwide Europe with the support of We.eM.
2.2 Data protection information
The data protection information is made available centrally in the web store. Further information can be deposited elsewhere by agreement of the parties in order to inform the data subjects extensively about the data processing.
2. Contact possibility
You can contact us at any time via the following e-mail address: firstname.lastname@example.org