BMW acquires and processes your personal data in the following cases, among others:

 

  • When you contact us directly, for example via our website, via BMW Customer Care or the BMW dealerships, and you are interested for example in our products or services or have any other concerns. When you purchase products from us directly (for example in the BMW Lifestyle Shop on our website, in a BMW dealership).
  • When you purchase services from us directly (for example BMW ConnectedDrive in the BMW ConnectedDrive store on our website, maintenance and/or repairs for your vehicle in a BMW dealership).
  • When you request information regarding our products and services (for example mailing of brochures or price lists). When you respond to our direct marketing activities, for example when you complete a reply card or submit your data online on one of our websites (www.bmw.de or landing page).
  • When your personal data is sent to us by BMW partners or third parties where and to the extent that the requirements in compliance with data protection legislation necessary for this are met, for example you have granted consent or in full awareness of your right of objection have not objected to the forwarding of your data to BMW for the purpose of customer care (for example recognizing you if you contact BMW Customer Care) and contact in writing (for example sending the BMW welcome package following a vehicle purchase).
  • When you send us your vehicle data (with the vehicle identification number) within the framework of the service process and maintenance / repair services of our BMW and/or BMW i contracted workshops and BMW dealerships.
  • When other BMW Group companies as well as our business partners provide data about you in a manner that is permitted.
  • When third parties (for example certified address vendors) provide personal data about you in a manner that is permitted.

 

Please help us to keep your details up to date by notifying us regarding changes to your personal data – in particular your contact data.

The following categories of personal data can be collected via the numerous services and contact channels described in this data protection information:

 

  • Contact data: Name, address, telephone number, e-mail address.
  • Interests: Information you have provided regarding areas that interest you, for example vehicles you find interesting, preferred BMW partners or BMW dealerships, hobbies and other personal preferences.
  • Other personal data: Information you have provided regarding date of birth, education, size of household or professional situation.
  • Contract data: Customer number, contract number, booked BMW ConnectedDrive services.
  • Online account data: Account information regarding My BMW, BMW ConnectedDrive, customer and potential customer portals, payment information you have set (for example credit card number)
  • Use of websites and communication: Information on how you use the website and whether you open or forward messages from us, including data gathered via cookies and other tracking technologies. More information on his can be obtained here in our BMW cookie policy.
  • Transaction and interaction data: Information on purchases of products and services, interactions with BMW Customer Care (your requests and complaints), and BMW partners or BMW dealerships as well as participation in market research surveys.
  • Creditworthiness and identity details: Data to determine your identity, for example driver's license or certificate of registration, part 1; also information regarding transactions, payments that might not have been made to us; including information on cases of fraud, punishable offenses, suspicious transactions, politically prominent persons, and lists of sanctions that contain your data. Use of BMW apps and services: Information on your use of BMW apps (on your mobile user device) and the services of BMW ConnectedDrive.
  • Details of vehicle functions and settings: Information on the functions and current settings of your vehicle (identified on the basis of the vehicle identification number), for example BMW TeleServices, BMW ConnectedDrive services with BMW Online and My Info or BMW CarData. Technical data of the vehicle: Data created and/or processed in the vehicle.

 

Operating data in the vehicle

Control unit data processed for operation of the vehicle.


This includes, for example:

  • Vehicle status information (for example speed, deceleration, lateral acceleration, wheel speed, display of fastened seat belts)
  • Ambient conditions (for example temperature, rain sensor, distance sensor).

As a rule, these data are volatile and are not saved beyond the operating time; they are only processed in the vehicle itself. Control units contain data memories (among other things, also the vehicle ignition key). These are deployed to be able to document information regarding the vehicle condition, component stress, maintenance requirements, as well as technical events and faults temporarily or permanently.


The following are stored depending on the technical equipment:

  • Operating states of system components (for example fill levels, tire pressure, battery status)
  • Malfunctions and defects in important system components (for example light, brakes)
  • Reactions of the systems in special driving situations (for example activation of an airbag, deployment of the stability control systems)
  • Information regarding events that damage the vehicle
  • In the case of electric vehicles, state of charge of the high-voltage battery, estimated range
  • In special cases (for example if the vehicle has detected a failure), it can be necessary to save data which would normally only be volatile.

 

If you use services (for example repairs, maintenance work), the stored operating data can be read out and used together with the vehicle identification number, if required. Employees of the BMW partner or BMW dealership or third parties (for example breakdown services) can read the data from the vehicle. The same applies to cases of warranty and quality assurance measures.


As a rule, the data are read using the legally prescribed connection for OBD (On-Board Diagnosis) in the vehicle. The operating data that are read document technical states of the vehicle or individual components and help with diagnosis, adherence to warranty obligations, and improvements in quality. These data, particularly information regarding component stress, technical events, incorrect operation, and other errors, are transferred together with the vehicle identification number to BMW, if necessary. Over and above this, BMW is subject to product liability. BMW also uses operating data from vehicles for this, for example for recall campaigns. These data can also be used to check customer warranty claims and claims for subsequent improvement.


Error memories in the vehicle can be reset at your request by a service center within the framework of repairs or servicing.


Comfort and infotainment functions


You can save comfort settings and individualization in the vehicle and change or reset them at any time. These include, depending on the respective equipment:

  • Settings of the seat and steering-wheel positions
  • Chassis and climate control setting
  • Individualizations such as interior lights.

 

Within the framework of the selected equipment, you can enter data yourself in the infotainment functions of the vehicle. These include, depending on the respective equipment:

  • Multimedia data such as music, films or photos for playback in an integrated multimedia system
  • Address book data for use in conjunction with an integrated hands-free system or an integrated navigation system
  • Entered navigation destinations
  • Data regarding the use of internet services

 

These data for comfort and infotainment functions can be stored locally in the vehicle or they are on a device you have connected to the vehicle (for example smartphone, USB stick or MP3 player). If you have entered data yourself, you can delete them at any time.

 

These data are only transferred from the vehicle at your request, particularly within the framework of using online service in line with the settings you have chosen.


Smartphone integration, for example Apple car play


If your vehicle has the corresponding equipment, you can connect your smartphone or another mobile user device to the vehicle and operate it using the operating elements integrated in the vehicle. The images and sound of the smartphone can be output via the multimedia system. At the same time, certain information is transferred to your smartphone. Depending on the type of integration, this includes for example position data, daytime / nighttime mode and other general vehicle information. Please consult the "Infotainment Systems" section of the vehicle owner's manual for more information.

 

The integration enables the use of selected apps of the smartphone, for example navigation or music playback. There is no other interaction between a smartphone and the vehicle, in particular no active access to vehicle data. The way other data is processed is determined by the provider of each app that is used. Whether you can make any settings and, if so, which settings you can make, depends on the respective app and the operating system of your smartphone.

 

Online services

If your vehicle has a mobile phone network connection,this enables the exchange of data between your vehicleand other systems. The mobile phone networkconnection is enabled by the vehicle's own transmitterand receiver unit or a mobile user device (for examplesmartphone) that you take into the vehicle. Onlinefunctions can be used across this mobile phone networkconnection. These include online services andapplications / apps provided by the manufacturer or other providers.

 

BMW online services

 

In the case of BMW online services, the respectivefunctions are described at suitable points by BMW (forexample Owner's Manual, BMW Driver's Guide App,BMW websites) and the associated information incompliance with data protection legislation. Personaldata can be used to provide online services. The dataexchange for this takes place across a protectedconnection, for example with the BMW IT systemsspecifically designed for the purpose. Any data acquisition, processing, and use of personal data that goes beyond the provision of services takes placeexclusively on the basis of legal permission, for examplein the case of a legally prescribed emergency callsystem, a contract, or consent that has been granted.

 

You can have the services and functions (some of whichare subject to charges) – and in some cases also theentire mobile phone network connection of the vehicle –enabled or disabled. Excluded from this – wheretechnically possible – are legally prescribed functionsand services such as an emergency call system.

 

Third-party services

 

If you use the possibility to have online services of otherproviders (third parties), these services are theresponsibility of the respective provider and are subject to their data protection conditions and terms of use. BMW has no influence on the content exchanged here.

You should therefore obtain information from therespective service provider regarding the nature, scope,and purpose of the collection and use of personal datawithin the framework of third-party services.

 

Data for localization of the vehicle: Details of thelocation of your vehicle or mobile user device. BMW canreceive these data in the course of providing BMWConnectedDrive services and the BMW Connected appand uses these data in line with the detailed servicedescriptions of the respective services as well as thesecurity precautions for location data. 

The data acquired in the context of contract conclusion or the provision of services are processed for the purposes stated below. An explanation of the area of application of the available legal basis can be found here.


A. Compliance with contractual duties within the framework of the sale, maintenance, and repair of vehicles (Article 6, Paragraph 1, b) of basic EU data protection regulations)


BMW, BMW dealerships, and BMW partners acquire, process, and use personal data within the framework of the sales processes or maintenance and/or repair in the dealership.

 

Within the framework of the sales processes, personal data are used at BMW contracted dealers, BMW i agents, and BMW dealerships to manage the purchasing agreement, to carry out test drives, and to transfer information related to your vehicle purchase.


Within the framework of these activities, the data categories stated below are processed:

  • Contact data (last name, first name, address, e-mail address etc.)
  • Account data (BMW ConnectedDrive or My BMW account, bank details, etc.)

 

BMW, BMW dealerships, and BMW partners use your personal data for contract administration (for example vehicle ordering, workshop / repair order, booking BMW ConnectedDrive services) or to handle any request you have submitted (for example offer, test drive request). Regarding all aspects of contract administration or dealing with a concern, we will contact you without separate consent, for example in writing, by telephone, per messenger service, per e-mail, depending on which contact data you have specified.


Within the framework of the maintenance and repair processes and/or services at BMW and/or BMW i contracted workshops and BMW dealerships, special diagnosis units are used to read technical data relevant to vehicle service from the electronic control units fitted in the vehicle. These data are processed and used in the workshop by trained technicians for the diagnosis and rectification of any malfunctions. These technical data regarding the vehicle essentially consist of:

  • Vehicle master data (for example vehicle identification number, type of vehicle, date of manufacture, vehicle equipment)
  • Vehicle condition data (measured values, for example mileage)
  • Error memory entries (for example failure of turn indicator)
  • Load duty spectrums
  • Software versions and
  • Service and workshop data (for example service requirements, work performed, fitted spare parts, cases of warranty, workshop reports)

 


BMW can access the above information in order to support BMW and/or BMW i contracted workshops and BMW dealerships with technical or other challenges they face in providing their services.


Over and above this, the persons responsible mentioned above possibly receive to a limited extent data regarding the location of the vehicle where this is required for the purpose of contract fulfilment (for example within the framework of BMW Roadside Assistance). The data are used exclusively in line with the security precautions for location data.

 

B. Compliance with contractual duties for the provision of digital vehicle-based services (Article 6 Paragraph 1 b) of basic EU data protection regulations) 

In order to execute any ConnectedDrive contract concluded between you and BMW, BMW provides various services, for example BMW Intelligent Emergency Call, Concierge Service, Real Time Traffic Information (RTTI), TeleServices etc. 

For the provision of these services, the following personal information from the vehicle is processed by BMW and commissioned service providers:

 

  • Vehicle status data (mileage, battery voltage, door and flap status, etc.)
  • Position and movement data (time, position, speed, etc.) Vehicle maintenance date (due date of next service, oil level, brake wear, etc.)
  • Dynamic traffic information (traffic jams, obstacles, signs, parking spaces, etc.)
  • Environmental information (temperature, rain, etc.)
  • User profile (configured news, e-mail, audio providers, etc.)
  • Sensor information (radar, ultrasonic signal, gestures, voice, etc.)

 

The processed personal data are automatically deleted after 4 weeks unless they are required for a longer period for the provision of the special service.


You can have the services and functions (some of which are subject to charges) – and in some cases also the entire mobile phone network connection of the vehicle – enabled or disabled. Excluded from this – where technically possible – are legally prescribed functions and services such as an emergency call system.


For provision of the BMW Connected app services, the following personal data are processed:

  • Vehicle status data (mileage, battery voltage, door and flap status, etc.)
  • Position and movement data of the vehicle and mobile user device (time, position, speed, etc.)
  • Vehicle maintenance date (due date of next service, oil level, brake wear, etc.)
  • Dynamic traffic information (traffic jams, obstacles, signs, parking spaces, etc.)
  • Environmental information (temperature, rain, etc.)
  • User profile (configured news, e-mail, audio providers, etc.)
  • Sensor information (radar, ultrasonic signal, gestures, voice, etc.)

 

Position and movement data are used exclusively in line with the security precautions for location data.


If you do not want this processing of your personal data, you can – where technically possible – cancel your consent within the BMW Connected app or remove the BMW Connected app from your mobile user device.

 

C. Ensuring product quality, research and development of new products (Article 6, Paragraph 1 f) of basic EU data protection regulations)


BMW uses the data (including location data) acquired as a result of the provision of services by BMW or BMW dealerships or BMW partners in a depersonalized form to ensure the quality of products and services as well as for the purposes of research and development. "Depersonalized" means that the data can no longer be traced directly to you or your vehicle.


This processing is based on the legitimate interest of BMW AG in meeting the high expectations of our customers with regard to high-quality products and services and taking account of the customer wish to have newly developed, innovative solutions. To protect your interests – alongside de-personalization – additional security precautions and controls are implemented as required, for example strict data access restrictions, restrictions in data use, security measures, retention periods, as well as data economy principles such as exclusively gathering relevant data.


D. Compliance of sales, service, and administration processes of BMW AG (including BMW dealerships), the national distribution company and BMW partners (Article 6, Paragraph 1 f) of basic EU data protection regulations)


In order to continuously optimize the customer experience and cooperation with BMW partners and customer care by BMW dealerships, we create evaluations and reports on the basis of contract information and share these with the BMW partners responsible. The main purpose of these evaluations is to initiate corresponding measures (for example training courses for Sales and Service personnel) to improve application and sales processes. We will create the reports described above in an aggregated and anonymized form , i.e. the recipients of the reports are unable to draw any conclusions regarding you as a person from the data they contain.

 

Parts of the acquired vehicle-specific data are also processed - where required - for compliance with the service processes (for example repair, warranty, goodwill) of BMW, BMW dealerships as well as BMW and/or BMW i contracted workshops and national BMW Group sales companies (including their branch offices) in the European economic area and other countries named in the BMW quality letter (Char. Pilakoutas Ltd.) This processing is within the legitimate interest of BMW to offer our customers the best possible service process. The processing also occasionally takes place in the context of legal specifications (for example repair and maintenance information based on specifications from the point of view of competition). As a general principle, to protect the private sphere of our customers, the processing of technical data is vehicle-based and without a direct link to the customer.


The following data categories are used for this:

 

  • Vehicle master data (for example vehicle identification number, type of vehicle, date of manufacture, vehicle equipment)
  • Vehicle condition data (measured values, for example mileage)
  • Error memory entries (for example failure of turn indicator)
  • Load duty spectrums
  • Software versions and
  • Service and workshop data (for example service requirements, work performed, fitted spare parts, cases of warranty, workshop reports)

 


The technical vehicle data are deleted at the end of the lifecycle of the vehicle.


BMW AG is a company of the BMW Group. In some cases, we process your data to ensure that the different companies within the BMW Group are managed as efficiently and successfully as possible. This concerns, for example, joint consolidated accounting in line with International Financial Reporting Standards (IFRS) for companies.


E. Customer care (Article 6 Paragraph 1 b, g, f) of basic EU data protection regulations)


BMW, BMW dealerships, and BMW partners use your personal data for contract administration (for example vehicle ordering, workshop / repair order, booking BMW ConnectedDrive services) or to handle any request you have submitted (for example offer request, test drive request, queries and complaints to BMW Customer Care). Regarding all aspects of contract administration or dealing with a concern, we will contact you without separate consent, for example in writing, by telephone, per messenger service, per e-mail, depending on which contact data you have specified.


We will also contact you if your vehicle is affected by a so-called technical campaign or recall. As technical campaigns are usually measures of great importance (for example avoiding danger to vehicle occupants, avoiding damage to the vehicle), we contact you directly or indirectly through our BMW partners or our BMW dealerships using the contact data you have specified in order to comply with our legally required duty to inform. 
 

We will also contact you in carefully considered cases with promotional communication (for example mailing the welcome package following a vehicle purchase or a letter indicating the end of the warranty period and offer of a vehicle check) if and to the extent that the requirements in compliance with data protection legislation necessary for this are met and in full awareness of your right of objection you have not objected to the use of your data for the purpose of written communication.


BMW also processes your personal data on this basis to optimize your experience with BMW Customer Care, e.g. to identify you correctly if you make contact with us.

 

F. Promotional communication as well as market research based on consent (Article 6, Paragraph 1 a) of basic EU data protection regulations)


Insofar as you have separately given your consent to further use of your personal data, your personal data may be used in accordance with the scope described in the consent, for example for promotional purposes (selected offers of products and services),and/or market research and, if necessary, forwarded to certain subsidiaries of BMW AG and selected BMW partners. Details are included in the respective declaration of consent, which you can revoke at any time.

 

Contact information, for example Name, address, e-mail, telephone number


Supplementary personal details / preferences, e.g.

 

  • Company name, your relationship with this company if you use a company car or are our contact person for this company
  • A possible point in time at which you need a new vehicle and your interest in BMW and/or BMW i vehicles and services as well as your requests for information and test drives etc.
  • Preferred and/or current BMW partner or BMW dealership
  • Vehicle identification number and other attributes linked to this
  • Interests and hobbies
  • Status of your data protection declaration of consent and selected and/or preferred communication channel


Identification data, for example customer number, contract number


Customer history, for example

 

  • Vehicle purchase data, including model, configurations, purchase date, date of 1st registration, license plate number, purchase order date, delivery date, holder, list price
  • Data acquired at BMW partners and BMW dealerships (such as point in time of contact and contact type, service history)
  • Campaign history and resonance (customer and potential customer care program and direct marketing measures
  • Participation in events
  • Inquiry and complaint history at BMW Customer Care

 

Vehicle use data, e.g.: Contract data for BMW ConnectedDrive, for example booking online entertainment


App / website / social media data
If you have registered or logged in, your account data, for example at My BMW or BMW ConnectedDrive.


BMW uses the sales and customer care data acquired in this way

  • To determine which information and offers are most likely to be of interest to you
  • To make contact with you in the context of this information and these offers
  • To send promotional communication (e.g. product launches or invitations to events) in line with your data protection declaration of consent.

 


In the data protection declaration of consent, you also lay down the communication channels (e.g. post, telephone, e-mail) we are permitted to use to contact you.

 

As a rule, data processing for promotional purposes takes place in Germany; under no circumstance are personal data transferred to a country outside the EU.

 

G. Compliance with legal obligations to which BMW is subject (Article 6, Paragraph 1 c, f) of basic EU data protection regulations)


BMW will also process personal data if there is a legal obligation to do so. This can be the case, for example, if we contact you if your vehicle is affected by a technical campaign or recall.


Gathered data are also processed within the framework of ensuring the operation of IT systems. Ensuring operation involves the following activities:

 

  • Backup and restore of data processed in IT systems
  • Logging and monitoring of transactions to check the correct function of IT systems
  • Detection and defense against unauthorized access to personal data
  • Incident and problem management to remedy malfunctions in IT systems.

 

Gathered data are also processed within the framework of internal compliance management in which we, for example, check whether you have been advised to an adequate extent within the framework of concluding a contract and that the BMW partner has complied with all legal obligations.


BMW is subject to a large number of other legal obligations. In order to fulfill these obligations, we process your data to the required extent and, if necessary, pass them on to the authorities responsible within the framework of legal obligations of notification.


We also process your data in the event of legal conflicts if the legal conflict makes processing the data necessary.

 


H. Data transfer within the BMW Group


BMW AG is a company of the BMW Group. In some cases, after a careful check, we send your data to other companies of the BMW Group, who are then responsible for further processing. Such a data transfer can occur under the following circumstance and for the following purposes:


Please bear in mind that this is not a complete or conclusive list of the data transfer operations within the BMW Group, rather only examples intended to make the data transfers more transparent.


- If you have given us your express consent beforehand to share your data with other companies of the BMW Group for promotional or marketing purposes. This concerns:

BMW M GmbH, Company for Individual Automobiles and BMW Driving Experience, Garching-Hochbrück


The contact data as well as information about any data protection officers is: Pancyprian Toll free number 77771600, Emergency number (till 12.00 midnight), Email: info@pilakoutasgroup.com.cy.

 

  • For compliance with the sales, service, and administration processes of BMW AG, cf. point G.
  • In the course of group reporting, we might transfer data, for example we transfer invoice-relevant information for the respective vehicle identification numbers in the case of leased vehicles for assessment of the residual values.

 


I. Data transfer to selected third parties


Data are forwarded to the following companies, among others, if and to the extent that the requirements in compliance with data protection legislation necessary for this are met:


- To BMW partners (for example in order to be able to comply with your request for a test drive or a service and submit specific offers). Your requests are forwarded with priority to your preferred BMW partner, the BMW partner where you purchased products or services, the partner with whom you are in contact. If you have not yet had any contact with a BMW partner that we are aware of, we forward your inquiry to a BMW partner in your region.


To BMW partners for data updates, for example of your contact data. The data for a data update are forwarded to all BMW partners that keep you in their address list.


- To carefully selected and checked service providers and business partners with whom we cooperate to be able to offer you products and services. We do this for BMW AG only within the framework of the strict conditions of data processing on your behalf or on the basis of your express consent (for example transfer to the insurance provider of BMW accident and breakdown cover, if you so wish).

- In the event of the sale of a business unit or several business units of BMW AG to a company to which we assign our rights in compliance with all agreements that exist between us.

- To other third parties (for example public authorities) to the extent that we are legally obliged to do so. Via our BMW CarData platform, you also have the possibility to instruct us when personal data we have gathered within the framework of providing ConnectedDrive services is to be forwarded to authorized third parties you have selected (for example your motor vehicle insurance company). This occurs exclusively based on your consent, which you can revoke at any time. More information can be found here.

We deploy various security measures such as encryption and authentication tools in line with the current state of the art to protect and maintain the security, integrity, and availability of your data.


100% protection against unauthorized access in the case of data transfers across the internet or a website cannot be guaranteed, but we and our service providers and business partners do our utmost to protect your personal data in line with the prevailing data protection regulations by means of physical, electronic, and process-oriented security precautions in line with the current state of the art. Among other things, we use the following measures:

 

  • Strict criteria for authorization to access your data according to the "need-to-know principle" (restriction to as few people as possible) and exclusively for the specified purpose
  • Transfer of acquired data exclusively in encrypted form
  • Storage of confidential data, for example credit card data, exclusively in encrypted form
  • Firewall safeguarding of IT systems to provide protection against unauthorized access, for example by hackers
  • Permanent monitoring of accesses to IT systems to detect and prevent the misuse of personal data

 


If you have received a password from us or have assigned one yourself to gain access to certain areas of our website or other portals, apps, or services that we operate, you are responsible for keeping this password confidential and for compliance with all other security procedures of which we make you aware. We ask you in particular not to tell anyone your password.

 


Security precautions for location data


Certain services can only be offered if you reveal your location or the location of your vehicle. We take the confidentiality of these location data very seriously.


Your location data (including data accessed within the framework of vehicle maintenance) are therefore protected with the following security precautions:

 

  • They are only stored in a form that can be traced to you or your vehicle as required to fulfill the intended purpose to which you have agreed.
  • Data are only gathered and accessed in this form when they are required to provide the requested service.
  • Data are also gathered and accessed in this form to the extent that we are legally obliged to store or pass on the data.
  • Data for localization of the vehicle and data for localization of a / of your mobile user device are only linked if this is necessary to provide the requested service.
  • Any other use of location data for the purpose of analysis takes place using data records that have been anonymized beforehand.

 


We, your BMW dealership, and your BMW partner might have access to the data for localization of the vehicle and BMW AG might have access to the data for localization of the / of your mobile user device via the services provided (for example BMW ConnectedDrive).


On purchasing the vehicle or activating or configuring the BMW ConnectedDrive services or the BMW Connected App, you receive a detailed description of the location data that are transferred to provide location-specific services.


Via the BMW ConnectedDrive portal, the BMW Connected app or directly in the vehicle – where technically possible – you can set whether we are permitted to continue gathering and processing these data, thus preventing future data acquisition. Please bear in mind that we might no longer be able to provide certain aspects of our services if you have restricted the gathering of location data.

In line with article 17 of the basic EU data protection regulations, we will keep your data only as long as necessary for the respective purposes for which we process your data. If we process data for a number of purposes, they are automatically deleted or stored in a format that does not permit conclusions to be drawn directly as regards your person as soon as the last specific task has been performed. To ensure that all of your data are deleted in line with the principle of data minimization and article 17 of the basic EU data protection regulations, BMW has created an internal deletion concept. The fundamental principles by which this deletion concept envisages the deletion of your personal data are described below.

 

Use for compliance with a contract


To comply with contractual obligations, data acquired from you can be kept for as long as the contract is in force and - depending on the nature and scope of the contract - for 6 or 10 years beyond this point in order to comply with legal requirements for preservation and to ensure clarification of any queries or claims after the end of the contract.


Over and above this, there are contracts for the delivery of products and services that necessitate longer retention periods, see also "Use for the assessment of claims" below.

 

Use for the assessment of claims


Data that in our opinion will be necessary to assess and avert claims against us or to initiate criminal proceedings or assert claims against you, us or third parties can be kept by us for as long as corresponding proceedings could be initiated.

 

Use for customer care and marketing purposes


For customer care and marketing purposes, the data acquired from you can be kept for 3 to 10 years, unless you wish to have these data deleted and there are no contractual or legal requirements for preservation that prevent this request for deletion.

BMW is a company that operates globally. Personal data are processed by BMW employees, national sales companies, BMW partners, and by service providers we have commissioned, preferably within the EU.


If data are processed in countries outside of the EU, BMW uses EU standard contracts, including suitable technical and organizational measures, to ensure that your personal data are processed at the same level as European data protection.


In some countries outside the EU, for example Canada and Switzerland, the EU has already determined a level of data protection comparable with that in Europe. The comparable level of data protection means that data transfer into these countries does not require any special permission or agreement.


Contact us (emails:grousos@pilakoutasgroup.com.cy, DPOffice@pilakoutasgroup.com.cy) if you wish to see the specific security precautions for the transfer of your data to other countries.


To support the provision of the services and intended purposes listed above, BMW uses a number of service providers that are commissioned by BMW AG within the framework of the strict conditions of data processing in compliance with data protection legislation.

You can change the settings for the use of your data in BMW online accounts in the corresponding options in your online account "My BMW", in your BMW ConnectedDrive account or in the BMW Connected app at any time.


You can access the following data and, if possible, also change them:

 

  • Consent to promotional communication – here you can choose the communication channels you wish to have (communication by mail, e-mail etc.)
  • BMW CarData - here you can view and download and/or transfer your vehicle data
  • BMW ConnectedDrive account – here you can view and change your detailed settings for BMW ConnectedDrive. Some settings for BMW ConnectedDrive can only be changed using the BMW Connected app or only in the vehicle; please use the corresponding options in the app or in the vehicle.

 

The settings for the use of your data by BMW partners, however, cannot be changed in your online account, in the area of the data protection portal of BMW AG. To make such a change or if you have any questions regarding the use of your data, you therefore have to contact the respective BMW partner directly.

If you have any questions regarding the use of your personal data by us, it is best to contact BMW Customer Care first – either per e-mail at kundenbetreuung@bmw.de or by telephone at the number +49 89 1250-16000 (daily 08:00 – 20:00 hrs).


Over and above this, you can contact the data protection officer responsible. A list of data protection officers can be found here.

As the person affected by the processing of your data, the basic EU data protection regulations and other relevant data privacy protection regulations enable you to assert certain rights in relation to us. The following section contains explanations of your rights as defined by the basic EU data protection regulations. Depending on the type and scope of your inquiry, we ask you to put the inquiry in writing.


Rights of persons affected

 

In line with the basic EU data protection regulations, as the person affected you have the following rights in particular vis-à-vis BMW:


Right to information (Article 15 of basic EU data protection regulations): You can ask us for information regarding any data of yours that we keep at any time. This information concerns, among other things, the data categories we process, for what purposes we process them, the origin of the data if we did not acquire them directly from you and, if applicable, the recipients to whom we have sent your data. You can obtain a copy of your data from us free of charge. If you are interested in other copies, we reserve the right to charge for the additional copies.


Right to correction (Article 16 of basic EU data protection regulations): You can request that we correct your data. We will initiate appropriate measures to keep the data of yours that we continuously process correct, complete, and up to date, based the latest information available to us.


Right to deletion (Article 17 of basic EU data protection regulations): You can request that we delete your data provided the legal requirements have been met. In accordance with Article 17 of basic EU data protection regulations, this can be the case if

  • The data are no longer required for the purposes they were acquired or otherwise processed
  • You revoke your consent, which is the basis of the data processing, and there is no other legal basis for the processing
  • You object to the processing of your data and there are no legitimate reasons for the processing or you object to data processing for the purposes of direct advertising
  • The data have been processed illegally

 

Where the processing is not necessary

 

  • To ensure adherence to a legal obligation that requires us to process your data
  • In particular with regard to legal retention periods
  • To assert, exercise or defend against legal claims

 


Right to restriction of processing (Article 18 of basic EU data protection regulations): You can request that we restrict the processing of your data if

 

  • You dispute the correctness of the data - for the period of time we need to check the correctness of the data
  • The processing is illegal but you do not wish to have your data deleted and request a restriction of use instead
  • We no longer need your data, but you need them to assert, exercise or defend against legal claims
  • You have filed an objection to the processing, though it has not yet been decided whether our legitimate grounds outweigh yours.

 


Right to data transferability (Article 20 of basic EU data protection regulations): At your request, we will transfer your data – where technically possible – to another responsible entity. However, this right only applies if the data processing is based on your consent or is required to fulfill a contract. Instead of receiving a copy of your data, you can ask us to send the data directly to another responsible entity that you specify.


Right to objection (Article 21 of basic EU data protection regulations): You can object to the processing of your data at any time for reasons that arise from your special situation provided the data processing is based on your consent or our legitimate interest or that of a third party. In this case, we will no longer process your data. The latter does not apply if we are able to prove there are compelling, defensible reasons for the processing that outweigh your interests or we require your data to assert, exercise or defend against legal claims.

 


Time limits for compliance with the rights the persons affected


As a general principle, we make every effort to comply with all requests within 30 days. This time limit, however, can be extended for reasons related to the specific rights of persons affected or complexity of your request.

 

Restriction in the provision of information regarding the rights of persons affected


In certain situations, legal specifications might require us not to provide information regarding all of your data. If we have to refuse your request for information in such a case, we will inform you of the reasons for refusal at the same time.

 

Complaints to supervisory authorities


BMW AG takes your reservations and rights very seriously. However, if you are of the opinion that we have not dealt with your complaints or reservations adequately, you have the right to submit a complaint to the data privacy protection authorities responsible.