Let's be realistic here - you're dealing with a German company here, and privacy laws in Germany are rather strict for historical reasons (think of attitudes to the Stasi and you'll see why there is lot of resistance in Germany to mass data collection), to the extent that services that people in the UK take for granted like Google Streetview and use of dash cams are greatly restricted
I did look at the privacy statement in the app and the data collector/processor is Volkswagen AG itself, so you'd think the app and use of data would be compliant with the latest GDPR data protection directives
It will use GPS to log journey information in the app, and it can access Photos if you choose to change the profile picture of the car in the app and Phone if you need to use the emergency call functions or breakdown recovery from within the app. Bluetooth is a given, as the dongle itself connects via Bluetooth, and WiFi/Mobile data because you can interact with the app when not driving. Nothing nefarious, one might say.
If that bothers you, then either don't install it in the first place, or tweak the privacy settings
