Data Protection Policy

Data Protection Policy

VDA QMC data protection information

The protection of your personal data is very important to us. The following information provides an overview of how we process your personal data and your data protection rights. 

  1. Contact details 

The controller responsible for data processing is:

Verband der Automobilindustrie e. V. (VDA)
10117 Berlin

Tel.:+49 30 897842-0
Fax:+49 30 897842-600

You can contact our data protection officer at the above address or by e-mail: datenschutz(at)

  1. Sources and data we use

We process only the personal data that is required for the relevant purpose of processing (cf. section 3 below). This is data we have received directly from you (e.g. data you have entered into a contact form) while fulfilling the purpose of the Association, or data that has been transmitted to us by third parties permitted to do so (e.g. certification bodies).

  1. Purpose for which we process your data and legal basis for processing

We process the personal data specified above in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The VDA represents and promotes the interests of the entire German automotive industry, in particular the common interests of its members. This includes ensuring quality management in the automotive industry by the VDA Quality Management Center (VDA QMC). The activities range from developing systems and methods all the way to shaping the future of quality management systems in the automotive industry.

To this end, the VDA QMC undertakes the following types of processing:

  • Committee work: The VDA QMC organizes its work and other matters through committees (e.g. specific committees and working groups) on various quality management themes in the automotive industry. Committees are composed of members’ representatives whose data is processed for this purpose on the basis of performance of a contract in accordance with Art. 6(1)(b) GDPR. To this end, and on the same legal basis, information on all aspects of quality management in the automotive industry is communicated and transmitted to the committee members.
  • Cooperation with the International Automotive Task Force (IATF): The VDA QMC Oversight Office represents the Verband der Automobilindustrie e.V. in the IATF. Its tasks include the introduction and monitoring of the IATF 16949 Certification Scheme. For the purpose of quality assurance in the certification procedure and for the purpose of documenting the audit result, the data (master data) of the certified auditors are stored, along with the results of the audits they have performed. The legal basis for the processing is the performance of contractual obligations in accordance with Art. 6(1)(b) GDPR.
  • Monitoring the VDA QMC regulations: The German automotive industry has further developed the requirements enshrined in ISO 9001 and documented them in the Volumes VDA 6.1, VDA 6.2 and VDA 6.4. Upon presentation of evidence of conformity with these standards, certificates may be issued by approved certification bodies. The VDA QMC monitors the certification activities. These include the monitoring and management of Volumes VDA 6.x. For this purpose, the master data of certified auditors and the results of the audits they have performed are processed on the legal basis of performance of a contract in accordance with Art. 6(1)(b) GDPR. 
  • Public relations/communication: The VDA QMC sends information and communications to customers and member companies (e.g. specialist QM articles to the trade press). The legal basis for the processing is a balancing of interests (Art. 6(1)(f) GDPR).
  • Services: The VDA QMC offers all interested parties various services on its websites:
    • Trainings: The VDA QMC’s training and professional development activities include forwarding the curriculum contents prepared in the working groups as industry-specific quality management trainings and examinations to the employees in the automotive industry, both in Germany and worldwide, through the licensees of the VDA QMC in the form of training and professional development. The great advantage is that under the umbrella of the VDA QMC, the curriculum contents are prepared by experts with practical experience who are also engaged as trainers and examiners at the VDA QMC. Potential participants for these trainings can apply for courses via the QMC websites by filling out a contact form. In the case of training events booked by a company for its employees, the company will make the participants’ data available to the VDA QMC. The data is processed for the purpose of performing a contract (in particular for issuing a certificate) in accordance with Art. 6(1)(b) GDPR.
    • Organization of professional events, forums and information events: For professional and political discussion, the VDA QMC organizes professional events and information events on all aspects of QM in the automotive industry, for which participants can register. To this end, participants must enter the required data into a contact form. The data is processed for the purpose of performance of a contract (Art. 6(1)(b) GDPR).
    • Ordering information material on all aspects of automotive industry topics (e.g. publications, recommendations, training materials, training information): The data required for this purpose must be entered into a contact form. The data is processed for the purpose of performance of a contract (Art. 6(1)(b) GDPR).
    • Operational activities: The VDA QMC maintains business contacts (e.g. with suppliers, caterers) for the purpose of conducting the Association’s activities. This includes the communication with and information provided to such business partners of the VDA QMC. Their data is processed for the purpose of performance of a contract (Art. 6(1)(b) GDPR).
  • Website: The VDA QMC wishes to achieve optimal service provision on its websites – among other things – in order to represent its interests and fulfill the wishes of customers. This constitutes a legitimate interest in the meaning of Art. 6(1)(f) GDPR for the data processing specified below (insofar as it involves any processing of personal data by the VDA):
    • Server log files: Every visit to our website and every retrieval of a file deposited there is recorded in a protocol. This storage serves internal system-related and statistical purposes. The protocols record the name of the file retrieved, the date and time of retrieval, the quantity of data transferred, notification of successful retrieval, the web browser and the requesting domain. The IP addresses of computers submitting requests are also recorded in a protocol.
    • Cookies: The websites sometimes use “cookies”. They enhance the user-friendliness, efficacy, and security of the websites. Cookies are small text files stored locally in the cache of the internet browser of the visitor to the website. The cookies enable the internet browser to be recognized. You can refuse cookies by adjusting your browser settings. If you choose this option, you might not be able to use all interactive features of our websites or all our services.
    • Session cookies: We use session cookies on these websites to enable fast browsing for you and to ensure that information you enter is stored. Your data remains stored in the cookie file in your browser while you are connected but is deleted when the browser is closed, depending on the setting in your browser program.
    • Other cookies: A cookie for the front-end login page (forum users) stores information about the person visiting the website. e.g. display settings, search terms.
    • The Plug-in tool for the VDA QMC Forum and the VDA QMC application forms function as an interface between (in some cases incompatible) systems during the import and export of data from and to various software systems.
  1. Who receives my data?

Access to your data within the VDA is restricted to those persons/bodies who require access in order to satisfy the purpose of the processing. In some cases the VDA deploys service providers who receive data for that purpose. We deploy these service providers only if they comply with our written data protection directives and guarantee compliance with the requirements of the GDPR and the German Federal Data Protection Act (BDSG). 

  1. How long will my data be stored?

The period for which your data will be stored depends on the purpose of the data processing. Accordingly, we store your data only for as long as necessary for the purposes for which it is processed.

If the data is no longer required in order to satisfy the purpose, as a rule it will be erased unless further processing is necessary in order to comply with retention obligations under commercial or tax law, or to preserve evidence under the statute of limitations.

  1. Your data privacy rights

Information, rectification, erasure, restriction of processing, right to object, data portability, complaint

According to Art. 15 GDPR, you are entitled to obtain information at any time and free of charge about the origin, recipient(s) and purpose of your stored personal data. In addition, you have the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restrict the processing under Art. 18 GDPR, the right to object to the processing under Art. 21 GDPR and the right to data portability under Art. 20 GDPR. The restrictions in accordance with Sections 34 and 35 of the German Federal Data Protection Act (BDSG) apply to the rights to information and to erasure. You may direct questions about your data privacy rights and other issues concerning personal data at any time to the controller responsible and/or the VDA’s data privacy officer (see the contact details in section 1 above). In the case of breaches of data privacy you are entitled to submit a complaint to a competent data protection supervisory body, pursuant to Art. 77 GDPR in conjunction with Section 19 BDSG.


The consent you granted us to process your data can be revoked by you at any time by sending us an informal e-mail message (see the contact details in section 1 above). Your revocation applies only to the future. The processing of your data on the basis of your consent up to the time of revocation remains lawful.


Right to object under Art. 21 GDPR

You are entitled to object to the processing of your personal data for advertising purposes – including profiling relating to direct marketing – at any time without stating reasons. 

You also have a general right to object (cf. Art. 21(1) GDPR. In this case the reasons for objecting to the data processing must be stated.