Data protection IAA App

Data protection information for digital services offered as part of IAA TRANSPORTATION

The protection of your personal data, such as your registration and profile information, is very important to us. That is why we provide various digital services for IAA TRANSPORTATION in Hanover in accordance with the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). The digital services available include a web application and the "IAA TRANSPORTATION App". The IAA TRANSPORTATION app can be downloaded from the App Store and the Play Store.

Overview of digital services and data processing

The use of our digital services and the conclusion of user agreements are voluntary. The aim of the digital services is to enrich your visit to the IAA and make it clearer and safer. You can visit the IAA without using the digital services or digitally mediated services. If you use the digital services, some functions require you to register a user account and create a profile in which you can store your personal data or which you must store in order to use certain services (e.g. , bicycle rental ).

Below you will find explanations of how we handle your personal data in this context.

1. Who is responsible and who is the data protection officer?

The German Association of the Automotive Industry (Verband der Automobilindustrie e.V.), Behrenstraße 35, 10117 Berlin, is responsible for the digital services offered. Further information can be found in the imprint of the German Association of the Automotive Industry: imprint

You can contact the data protection officer of the German Association of the Automotive Industry at the following postal address: Data Protection Officer of the German Association of the Automotive Industry, Behrenstraße 35, 10117 Berlin
Email: [email protected]

2. What do we do with your personal data?

When you register for digital services (app, web application):
You can download the app from the relevant platforms and are free to register in the app. The web application does not need to be downloaded.

When you use the digital services:
The digital services enable users to access all relevant information about exhibitors, products, events and experiences. For example, they can access individual exhibitor and product pages, find out about events and individual programme items, or navigate the event site independently using the map function. Trade visitors and ticket holders also have the option of using the matchmaking function as part of the digital services, i.e. they can send contact requests to other trade visitors and, once a request has been accepted, both parties can chat with each other. To do this, trade visitors must log in with the email address used to purchase the ticket (more on matchmaking below).

(1) Legal basis
We process your personal data for the purpose of initiating, implementing and executing the corresponding app or web application usage agreement (Art. 6 (1) (b) GDPR). The processing of your personal data is also based on our overriding legitimate interest (Art. 6 (1) (f) GDPR) in ensuring the security and stability of digital services. This includes, in particular, protection against technical malfunctions, misuse, unauthorised access and the optimisation of system performance and user experience.

(2) Categories of recipients and third country transfers
We use service providers in the context of operating our digital service offerings. We transfer personal data to these service providers for this purpose. These service providers are contractually obliged by us to exercise the same care in handling personal data as we do ourselves. We may also transfer personal data to service providers in third countries (see the section "Data transfer to third countries" below).

(3) Access to other applications on your device
If you wish to add a picture to your profile after registering, you will be asked whether the app or the website server may access the following functions of your device:

Camera

Photo gallery

Access will only be granted if you expressly consent to it. Your image data will only be used for the visual design of your profile in the service application. The "selfie camera" is a function that allows you to take and save photos locally on your device. Your image data will only be shared if you actively share it via your social media accounts.

When you create your profile:
After you have downloaded the app or accessed the web application, you can create your own profile. You can also use the basic functions of the digital services without creating a profile. When creating your profile, you will be asked to provide certain mandatory and voluntary information. This includes, for example, your own interests, which you can also edit later in the "My IAA" menu item.

(1) Legal basis
Your mandatory information is processed for the purpose of initiating, implementing and executing the corresponding user agreement for the digital services (Art. 6(1)(b) GDPR). Your optional profile data is processed on the basis of your consent (Art. 6(1)(a) GDPR). Your consent can be revoked at any time with future effect.

(2) Categories of recipients and third-country transfers
We transfer your profile data to an IAA exhibitor if you register for an event organised by the respective IAA exhibitor or if you have given your consent to the exchange of contact data through interaction with the exhibitor (e.g. by actively scanning the exhibitor's QR code or by confirming in the app). We use service providers as part of our digital service offerings. We transfer personal data to these service providers for this purpose. These service providers are contractually obliged by us to exercise the same care in handling personal data as we do ourselves. We may also transfer personal data to service providers in third countries (see the section below on "Data transfer to third countries").

When you create and manage appointments with your profile:
You can create and manage your appointments via your profile. This makes it easier for you to find events that are of particular interest to you, for example.

(1) Legal basis
Your personal data is processed for the purpose of initiating, implementing and executing the relevant app/web application usage agreement (Art. 6(1)(b) GDPR). The transfer of your profile data (optional) to IAA exhibitors is based on your consent (Art. 6 (1) (a) GDPR). Your consent can be revoked at any time for the future.

(2) Categories of recipients and third country transfers
We use service providers in the context of providing digital services. We transfer personal data to these service providers for this purpose. These service providers are contractually obliged by us to exercise the same care in handling personal data as we do ourselves. We may also transfer personal data to service providers in third countries (see the section "Data transfer to third countries" below).

(3) Access to other applications on your device
If you grant the appropriate authorisation, the following applications will be accessed:

Calendar function

If you store your ticket in your account in the app or web application:
As a trade visitor, you can store your IAA ticket digitally in the app or web application, provided you purchased it through the IAA ticket shop. If you wish to purchase an IAA ticket, you will be redirected to the ticket shop website via a link. Please note that separate data protection information applies to the ticket shop . Once you have saved your IAA ticket in your account, you can digitally manage your trade fair access and access to individual events at the exhibition grounds.

(1) Legal basis
Your ticket data is processed for the purpose of initiating, executing and processing the corresponding user agreement (Art. 6 (1) (b) GDPR).

(2) Categories of recipients
We use service providers in connection with our ticket shop. We transfer personal data to these service providers for this purpose. These service providers are contractually obliged by us to exercise the same care in handling personal data as we do ourselves.

Note: IAA tickets are purchased outside the digital service offering (via the ticket shop).
You do not need to save your IAA ticket in your digital service profile. You can also visit the IAA if you have an IAA ticket without using the digital services. Trade visitors can purchase IAA Summit/Conference tickets via the app or web application. As a trade visitor, you can log in to the app or web application with the email address used to purchase the ticket. This gives you the opportunity to participate in matchmaking, i.e. you can interact with other trade visitors (e.g. send contact requests, use chat, see below for more details).

If you allow the use of your location – location-based services:
You can also use location-based services and information when using the digital service offering if you share your location. The location-based functions can be switched on and off at any time in the settings. The purpose of data processing is to provide you with relevant content and to improve our services. Your location data (GPS data), timestamps and device identification are used in several contexts:

Location-based notifications:
Another context involves location-based notifications, i.e. you receive a notification when you arrive at a specific location. Technically, this works by means of geofences, i.e. locations that have been defined using geo-coordinates. When you enter such a defined geofence, you receive a notification, which may be for advertising purposes.

If you allow the use of notifications:
If you activate the notification function, you will receive messages for various purposes – e.g. based on your interests, your location or independently of these factors. These may be informative, organisational (e.g. in the event of overcrowding on the premises) or promotional.

(1) Legal basis
Your consent is the legal basis for the respective data processing (Art. 6(1)(a) GDPR). This can be revoked at any time.

(2) Recipient categories and third country transfers
When you give your consent, you will be informed about possible recipients (e.g. IAA exhibitors). In the case of recipients outside the EU/EEA, a third-country transfer will take place in accordance with the GDPR (see the section "Data transfer to third countries" below).

(3) Access to other applications on your smartphone
The app requires access to your device's notification function.

If you participate in matchmaking (including chat):
Trade visitors with a valid ticket can activate matchmaking to get in touch with other trade visitors. Interests are matched and suitable contacts are suggested. Visible profile data includes, for example, name, company and position.

(1) Legal basis
Your consent is the legal basis for data processing in the context of networking (Art. 6(1)(a) GDPR).

(2) Categories of recipients
Other matchmaking participants will have access to your personal data.

(3) Profile creation
An algorithm creates a matching profile based on your interests in order to suggest suitable contacts.

If you allow exhibitors or other IAA visitors to scan you (known as a lead scan):
When you register in the app, the data you provide in your profile is stored in a QR code, which you can access under "My QR code". This QR code can be scanned by exhibitors at the trade fair or other third parties. If you allow the exhibitor or third party to scan the QR code, we will transfer your data (first and last name, company, position, email address, postal address, interests) to the respective exhibitor for marketing purposes with your consent.

(1) Legal basis
The legal basis for data processing is your express consent (Art. 6(1)(a) GDPR). By allowing scanning, you expressly consent to the described data transfer and data processing. You can revoke your consent at any time.

(2) Categories of recipients
The recipient of your personal data is only the respective visitor or IAA exhibitor whose product or event QR code you scan. The data will not be passed on to third parties.

When we statistically evaluate your use of the digital service offering (Google Analytics):
To improve the app and web application, we analyse your usage behaviour with Google Analytics on a pseudonymous basis. For example, page views, length of stay, click behaviour, device type and approximate location are recorded. Your IP address is only used to determine your location and is then deleted.

(1) Legal basis
The processing of your personal data is based on your consent (Art. 6 (1) (a) GDPR).

(2) Categories of recipients
Google Ireland Ltd. (with data transfer to the USA). Google is contractually obliged to comply with the GDPR.

(3) Storage
User-related data (with random user ID) is deleted after 14 months; aggregated data is stored for longer.

If you participate in the IAA EXPERIENCE (bike rental):
As part of the IAA EXPERIENCE, you can rent bicycles (cargo bikes) provided by exhibitors or sponsors via the digital service offerings. The purpose of data processing is to arrange the rental, document usage and prevent misuse. The VDA acts as an intermediary between users and exhibitors and does not rent out the bicycles itself. Rental is only possible if the borrower has created a user account. The data processed includes your surname, first name, address, email address, date of birth and telephone numbers. The symbol "IAA EXPERIENCE Ready" will then appear for the user. The rental period will be documented.

(1) Legal basis
Data processing is carried out on the basis of Art. 6 (1) b) GDPR (performance of the agency contract) and on the basis of Art. 6 (1) f) GDPR (legitimate interest in security and prevention of misuse).

(2) Categories of recipients
The bicycle rental companies can access the above-mentioned user data via the digital application. On site, your entered data will be manually checked against your identity card or driving licence. Your identity card data will not be stored or transmitted to the rental companies.

If you participate in the digital tours function:
You can take part in various activities as part of the digital tours function . You can get in touch with sponsors and exhibitors at specific locations and find out about their products. You can get in touch with the exhibitors and share your profile data stored in the digital application (surname, first name, address, email address, date of birth, location and usage data) with the exhibitors. This is done with your consent. Data processing is carried out for the purpose of providing product information, establishing contact and sending offers from exhibitors. Interaction with exhibitors requires the registration of a free participant account in the digital services.

(1) Legal basis
Data processing is carried out on the basis of Art. 6 (1) (a) (consent). Consent is obtained when the digital tours function is started for the first time or when initial contact is made. Consent can be revoked at any time.

(2) Categories of recipients
With your express consent, the exhibitor with whom you share your data will receive your data.

3. How long do we store your personal data?

We only store your personal data for as long as is necessary for the respective purposes or as long as there are legal storage obligations. The storage period depends on the type of user:

Trade visitors who have purchased a ticket: until the end of the next IAA.

Trade visitors without ticket purchase: until the end of the next IAA.

Private visitors (without company details): 1 year after the end of the event.

End consumers: 1 year after the end of the event.

Before these periods expire, consent may be obtained for further storage, e.g. for contacting you about future IAA events. After the respective period has expired or if you revoke your consent, your data will be deleted, provided that there are no legal retention obligations to the contrary. If deletion is not possible in individual cases, processing will be restricted. You can manage your profile via the app and in the web application if you have created one. You can delete your profile data via this profile management. If you request the deletion of your data, we will also delete your entire user profile.

4. What are your rights as a data subject?

Please contact us using the contact details above to exercise your rights and withdraw your consent.

You have the right to request information about all personal data that we process about you at any time.

If your personal data is incorrect or incomplete, you have the right to have it corrected and supplemented.

You can request the deletion of your personal data at any time, unless we are legally obliged or entitled to continue processing your data.

You have the right to object to the processing of your data if it is used for direct marketing or profiling purposes. If the processing is based on a balancing of interests, you may object to the processing by stating reasons arising from your particular situation.

If the legal requirements are met, you may request a restriction on the processing of your personal data.

If the data processing is based on your consent or within the framework of a contract, you have the right to transfer the data you have provided, provided that this does not affect the rights and freedoms of other persons.

You also have the right to lodge a complaint with a data protection supervisory authority at any time if you believe that data processing has been carried out in violation of applicable law.

If we process your data on the basis of a declaration of consent, you have the right to revoke this consent at any time, either in whole or in part, with effect for the future. Processing carried out prior to revocation remains unaffected by the revocation.

For technical reasons, revoking consent via your user profile only applies to consent that you have given via the respective digital service offering.

5. Is data transferred to third countries?

If personal data is transferred to recipients outside the European Union (EU) or the European Economic Area (EEA), we ensure that an adequate level of data protection is in place. This is done either by:

an adequacy decision by the EU Commission,

the conclusion of EU standard contractual clauses (you can request a copy using the contact details above),

or – in the case of recipients in the USA – certification under the EU-U.S. Data Privacy Framework.

Data is transferred on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR for the purpose of global technical operation and scalability of the digital infrastructure, in particular if certain services can only be provided economically or technically by providers outside the EU.

6. What measures are taken to ensure data security?

We use appropriate technical and organisational measures to protect your personal data from loss, misuse, unauthorised access or disclosure. These include access restrictions, encryption technologies and regular security checks. All data transfers between your device and our servers are encrypted (transport encryption, e.g. via TLS). Our security measures are regularly reviewed and adapted to the state of the art.

Overview of data categories and the data used in each case

Below you will find an overview of the functions offered and the data used in each case, including the legal basis and data recipients. You can restrict data processing in your privacy settings. If the legal basis is legitimate interest pursuant to Art. 6(1)(f) GDPR, please refer to the above-mentioned processing purpose for a detailed explanation.