ADAC Data Protection Information concerning the Carnet de Passages

1) Overview and scope of application

The following Data Protection Information applies to the Carnet de Passages. The Carnet de Passages is an internationally recognised border and customs document. Its issue is based on international UN customs conventions of 1954 and 1956 on the temporary import of private and commercial road vehicles. The conditions were last revised by the Istanbul Convention of 1992. The Carnet de Passages is issued by the Federation Internationale de l’Automobile ("FIA") and the Alliance Internationale de Tourisme ("AIT"). As a rule, an application for issue of a Carnet de Passages is processed by the respective local automobile club, in Germany by the Allgemeiner Deutscher Automobil-Club e.V., among others. This Data Protection Information contains the information required in accordance with Art. 13 and Art. 14 General Data Protection Regulation 2017/679/EU (“GDPR”) and explains how your personal data is processed. All content addresses and applies to all genders (f/m/o). Where grammatically masculine, feminine or neutral personal designations are used, this serves solely to improve readability

2) Name and contact details of the Controller

The Controller within the meaning of the GDPR is:
Allgemeiner Deutscher Automobil-Club e.V. (“ADAC”)
Hansastrasse 19
80686 Munich
Telephone: +49 (0)89 7676 0
Email: adac(at)adac.de

3) Name and contact details of the Data Protection Officer

You can contact the ADAC Data Protection Officer at:
Hansastrasse 19
80686 Munich
Email: dsb-mail(at)adac.de

4) Processing of your personal data (data categories, data source, purposes, legal bases, storage period)

a) Issue of the Carnet de Passages

ADAC processes the following categories of your personal data, among others:

  • From the applicant, vehicle owner if applicable and authorised signatory of a company:
    - contact details
    - information concerning ADAC membership or membership of another automobile club
    - date and place of birth
    - nationality
    - copy of the passport/identity card (issued on, issuing authority/place, ID number)
    - details concerning the vehicle (VIN/vehicle number plate); copy of the vehicle registration document
    - copy of the residence permit/visa, if applicable (valid until, issued by (authority))

  • For an alternative delivery address:
    - contact details for the recipient of the delivery

  • When applying for a extension to the Carnet de Passages
    - the number of the current document.

  • with regard to the Carnet de Passages, the preferred validity period and area of validity (country categories, travel destination/region)

  • application or contract details, correspondence for processing a Carnet de Passages

ADAC processes this personal data in order to provide you with the Carnet de Passage. This includes the issue, delivery and processing of a Carnet de Passages in connection with the journey (including enquiries, customs complaints, extensions, scrapping and other customs processes relating to the Carnet (e.g. corrections in the document; loss of the document). Once issued, the Carnet de Passages is presented to the customs authorities by the document holder or the traveller when crossing the border and serves as customs security.

Processing is carried out on the legal basis of Art. 6 para. 1 point b) GDPR (performance of a contract) and Art. 6 para. 1 point e) GDPR (performance of a task carried out in the public interest).
This personal data is stored for a period of 3 years after the purpose of processing no longer applies.

b) Anonymised evaluation

ADAC processes the following personal data to perform anonymised evaluation

  • age details, vehicle type, vehicle make, vehicle year of manufacture and country categories

The legal basis for processing is Art. 6 para. 1 point f) GDPR. The improvement of ADAC services constitutes an overriding legitimate interest.

c) Verification requirements

ADAC processes the following personal data to prove that the Carnet de Passages was issued lawfully:

  • type of ID document, date of issue, place of issue, authority, ID number

  • In the case of a visa/residence permit: validity date, issuing authority

  • first and surname, date of birth and address

The personal data of the border document holder and vehicle details are processed for the purposes of fraud prevention and the exercise of legal claims.

The data is also processed to protect the ADAC against other types of financial and white collar crime.

ADAC has an overriding legitimate interest in holding evidence that ADAC has complied with all obligations vis-à-vis other automobile clubs abroad, customs authorities, the reinsurer and FIA, and in safeguarding the legal interests of ADAC.

Processing is therefore carried out on the legal basis of Art. 6 para. 1 point f), as well as point b) and point e) GDPR.
This personal data is stored for a period of 3 years after the purpose of processing no longer applies.

d) Invoice data

ADAC processes the following categories of your personal Dita, among others:

  • Concerning the authorised recipient of the security deposit:
    - contact details
    - bank details

  • the contact details of the guarantor where a bank guarantee is provided

If the authorised recipient of the security deposit is different, the personal details and bank details will be used to return the security deposit amount by wire transfer.

ADAC processes this invoice and booking data to comply with statutory retention periods. This is based in particular on the provisions of the German Commercial Code (HGB), the German Fiscal Code (AO) and the German Money Laundering Act (GwG).

Processing is carried out on the legal basis of Art. 6 para. 1 point c) GDPR (compliance with a legal obligation to which the Controller is subject). ADAC processes personal data to the extent and for as long as it is legally obliged to do so.

The storage periods may then be up to 8 or 10 years.

5) Recipients of your personal data

ADAC transfers your personal data to the following recipients to fulfil the purposes described in Clause 4:

  • competent reinsurer

  • other (foreign) automobile clubs if applicable

  • authorities (including but not limited to customs authorities)

  • if applicable, AIT/FIA as the umbrella organisation

  • other ADAC organisations such as ADAC SE and its subsidiaries

  • external service providers (e.g. shipping service providers)

  • if necessary, lawyers, auditors, courts, experts.

6) Duration of data processing

Where Clause 4 does not specify a specific storage period, your personal data will be erased as soon as it is no longer required for the stated purposes.

7) Transfer to third countries

In the course of the Carnet holder's journey and to process the Carnet de Passages, data concerning data subjects (information contained in the Carnet de Passages and any other customs documents (e.g. for customs clearance or scrapping, etc.)) such as first and last name, address, vehicle data, Carnet number, etc., will necessarily be transferred to countries outside the European Economic Area (EEA). The primary purpose in this regard is the fulfilment of contractual obligations towards the applicant or Carnet holder (exception according to Art. 49 para. 1 sentence 1 point b) GDPR).

Data is otherwise transferred to third parties abroad either within the EEA or (i) on the basis of an adequacy decision of the European Commission, (ii) based on appropriate safeguards or (iii) another exceptional circumstance (in particular for the establishment, exercise or defence of legal claims pursuant to Art. 49 para. 1 sentence 1 point e) GDPR).

8) Existence of automated decision-making in individual cases (including profiling)

ADAC does not use purely automated decision-making processes according to Art. 22 GDPR.

9) Your data protection rights

  • Right to information about your personal data stored by us pursuant to Art. 15 GDPR. In particular, you may obtain information about the purposes of processing, the categories of personal data, the categories of recipients, the envisaged storage period and the origin of your data not collected directly from you.

  • Right to rectification of incorrect or completion of incomplete data pursuant to Art. 16 GDPR.

  • Right to erasure of your personal data stored by us pursuant to Art. 17 GDPR, insofar as mandatory compliance with legal or contractual retention periods or other legal obligations or rights to further storage does not apply.

  • Right to the restriction of processing of your personal data pursuant to Art. 18 GDPR.

  • Right to data portability pursuant to Art. 20 GDPR, that is, the right to receive data that you have provided to us and that we have stored about you in a commonly used, machine-readable format or to obtain its transfer to another controller.

  • Right to withdraw your consent pursuant to Art. 7 GDPR.

  • Right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The data protection supervisory authority responsible for ADAC is Bavarian State Office for Data Protection Supervision (BayLDA).

  • Right to object pursuant to Art. 21 GDPR, on grounds relating to your particular situation, concerning the processing of your personal data that takes place on the basis of Art. 6 para. 1 point f) GDPR or Art. 6 para. 1 point e) GDPR. If you object, ADAC will no longer process your personal data unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You may submit your data protection request for exercising your rights without adherence to any formal requirements. To facilitate the exercise of your rights for both you and us, you can ideally contact us by email at datenschutz.ug(at)adac.de, stating your membership or customer number.

As at March 2026