Legal information on data protection.

The Bayerische Motoren Werke Aktiengesellschaft (Bavarian Motor Works plc), Petuelring 130, 80788 Munich, headquarters and register court: Munich HRB 42243 (hereinafter “BMW” or “We”) provides customers online with certain services, for example: 

• Ticket Purchase
• Competition
• Event Services 

And we are responsible for data processing in this context.

BMW collects and processes your personal data in the following cases (amongst others):

• If you contact us directly, for example, via our website or via BMW customer care and you are interested in our products or services or have any other concerns.
• If you buy services directly from us (e.g. admission tickets).
• If you request information about our products and services (e.g. newsletters or booklets).
• If you respond to our direct marketing activities, such as filling out a response card during events or if you enter your details online using one of our websites. 
• If your personal details are transferred to us by BMW partners or third parties, if and insofar as the necessary data protection requirements are met, e.g. you have given your consent or you have not objected to the disclosure of your data to BMW for the purpose of customer service (e.g. to identify you in the case of contacting BMW customer service) and written discourse (e.g. sending newsletter/information) in the knowledge of a right of objection.
• If other BMW Group companies and our business partners provide us with data about you.
• When you take part in simulation racing organised by BMW on a racing platform (including but not limited to: iRacing, rFactor2).
• When you register for the BMW Motorrad Race Trophy.
• When you register for the BMW Motorrad Esports Challenge.
  

Please help us to keep your information up-to-date by informing us about changes in your personal data – your contact details, in particular.

The following categories of personal information may be collected through the many services and contact channels described in this data protection notice: 

• Contact details ► Name, Address, Telephone Number, Email Address.
• Interests ► Information provided by you about your areas of interest, such as vehicles you are interested in, your preferred BMW partner or branch, hobbies, and other personal preferences.
• Contract data ► Contract number.
• Online Account Data ► Account information for ordering and purchasing tickets.
• Use of websites and communication ► Information about how you use the website and whether you open or forward communications from us, including information collected through cookies and other tracking technologies. Further information can be found in our BMW Cookie Policy (see link below).
• Transaction and interaction data ► Information on purchases of products and services, interactions with BMW Customer Care (your inquiries and complaints).
• Rider information (for example for taking part in the BMW Motorrad Race Trophy) ► Name, nationality, date of birth, racing series, rider standings, rider performance, team standings, race results, start positions, championship standings, track records, rider history.
• Data on race analysis and survey of race performance on racing platforms ► The name of the relevant person stated in the game, the unique identification data for the game (iRacing ID, nickname, etc.), IP address, race performance, telemetry data during use of games, setup configuration of vehicles.

Cookie policy

Data collected in connection with the conclusion of the contract or the provision of services will be processed for the following purposes. Data collected in connection with the conclusion of the contract or the provision of services will be processed for the following purposes.

LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA.

We only process your data if an applicable law permits us to do so. We process your data on the basis of Art. 6 and Art. 9 GDPR in particular, as well as on the basis of consent pursuant to Art. 7 GDPR. Among other things, we will base the processing of your data on the following legal bases. Please note that this is not a complete nor exhaustive list of legal bases, but merely examples that are intended to make the legal basis more transparent.

• Consent (Art. 6 Para. 1 S. 1 lit. a), Art. 7 GDPR, or Art. 9 Para. 2 lit. a), Art. 7 GDPR): We will process certain data only on the basis of your previously given explicit and voluntary consent. You have the right to revoke your consent at any time with future effect.
• Fulfilment of a contract/pre-contractual measures (Art. 6 Para. 1 S. 1 lit. b) GDPR): In order to initiate or execute your contract with BMW, BMW branches, and BMW partners, we need access to certain data.
• Fulfilment of a legal obligation (Art. 6 Para. 1 S. 1 lit. c) GDPR): BMW is subject to a number of statutory requirements. To meet these requirements, we must process certain data.
• Preservation of legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR): BMW will process certain data in order to safeguard its interests or those of third parties. However, this only applies if your interests do not dominate in individual cases.

A. Fulfilment of the contractual obligation to provide Event Services (Art 6 Para. 1 lit. b) of GDPR)

For the purpose of fulfilling the contract for Event Services concluded between you and BMW, BMW provides various services such as Event tickets, BMW Lounge access.

For the provision of these services, the following personal information is processed by BMW and commissioned service providers:

• Contact details (surname, first name, address, email address etc.)
• Business contact information (surname, first name, company, company address, business email address, etc.)

B. Customer care (Art. 6 Para. 1 lit. b, f) of GDPR)

BMW, BMW branches and BMW partners use your personal data to address the contract settlement (e.g. postponement of pick-up day or pick-up time) or handling of a request you have made (e.g. inquiries and complaints to BMW Customer Service). For all aspects of the contract or the settlement of a concern, we will speak to you without separate consent either in writing, by telephone, via messenger services, or by email, depending on the contact media you have specified.

C. Advertising communication and market research based on consent (Art. 6 Para. 1 lit. a) of GDPR)

If you have separately given your consent to further use of your personal data, your personal data may be used in accordance with the scope described in the consent, for example for advertising purposes and/or market research, and may be passed on to third parties. Details on this can be found in the respective declaration of consent, which is revocable at any time.

D. Fulfilment of legal obligations to which BMW is subject (Art. 13 Para. 1 lit. c, 6 Para. 1 lit. c) of GDPR)

BMW will also process personal data if there is a legal obligation to do so. This may be the case if we need to contact you because your vehicle is affected by a recall or a technical action.

Collected data is also processed in the course of securing IT systems operations. Securing is understood as the following activities:

• Back-up and recovery of data processed in IT systems
• Logging and monitoring of transactions to verify proper functioning of IT systems
• Detection and prevention of unauthorised access to personal data
• Incident and problem management for troubleshooting IT systems

Collected data is also processed in the context of internal compliance management, in which we check, for example, whether you have been sufficiently advised in the context of a contract and that the dealer has complied with all legal obligations.

BMW is subject to a variety of other legal obligations. To comply with these obligations, we process your data to the required extent and, if necessary, pass these on to the responsible authorities as part of legal reporting requirements.

If necessary, we will process your data in the event of a legal dispute should the legal dispute require us to do so.

E. Data sharing with selected third parties

Data is forwarded to, or recieved from, the following companies, amongst others, if and insofar as the necessary data protection requirements are met:

• To BMW Partners (e.g. to fulfill your request for a test drive/ride or a service and make specific offers). Your requests will be prioritized to your chosen BMW partner - the one at which you have sourced products or services, the partner with whom you are in contact. If you do not have any known contact with a BMW partner, we will forward your request to a BMW partner in your region.
• To BMW Partners for data to be updated e.g. your contact information. The data for this update will be forwarded to all BMW partners who have you on their address list.
• To carefully selected and audited service providers and business partners with whom we work together to provide you with products and services. BMW plc only does this within the strict data protection requirements on behalf of, or on the basis of, your express consent.
• On the sale of one or more business areas of BMW plc to a company to which we transfer our rights, in compliance with any agreements existing with you.
• To other third parties (e.g. public bodies) insofar as we are legally obliged to.
• To operators of racing platforms (including but not limited to: iRacing, rFactor2) to contact you regarding events in connection with BMW Motorrad Motorsport where necessary, to create event posters, race announcements, live broadcasts, for example, on YouTube and Facebook and/or to publish your race successes on the communication channels of BMW Motorrad Motorsport or partners.
• To third parties and service providers commissioned by BMW Motorrad Motorsport involved in the organisation of the BMW Motorrad Race Trophy, for example to prepare the BMW Motorrad Race Trophy standings, to send welcome packages, to prepare rider profiles on the website bmw-motorrad-motorsport.com (publicly visible), to organise events in connection with the BMW Motorrad Race Trophy and/or to publish your race successes on the communication channels of BMW Motorrad Motorsport or partners.
• To service providers commissioned by BMW Motorrad Motorsport, for example to organise and conduct BMW Motorrad Motorsport events and/or to publish your race successes on the communication channels of BMW Motorrad Motorsport or partners.

We secure your data according to the state of the technology. For example, the following safeguards are used to protect your personal information from misuse or other unauthorized processing:

• Access to personal data is restricted to a limited number of beneficiaries for the stated purposes.
• Collected data will only be transferred in encrypted form.
• Sensitive data is stored only in encrypted form.
• The IT systems for processing the data are technically isolated from other systems to prevent unauthorised access, e.g. to prevent hacking.
• In addition, access to these IT systems is permanently monitored to detect and ward off misuse at an early stage.

We only retain your information for as long as necessary for the purposes for which we process your information. If we process data for multiple purposes, it will be deleted automatically or stored in a format that does not allow for direct conclusions about your person to be drawn once the final specific purpose has been met. To ensure that all your data is deleted in accordance with the principle of data minimisation, BMW has designed an internal deletion concept. The basic principles according to which this deletion concept provides for the deletion of your personal data are shown below.

Use for the fulfilment of a contract

In order to comply with contractual obligations, data collected from you may be kept for as long as the contract is in force and, depending on the nature and scope of the contract, for 6 or 10 years beyond the statutory retention requirements and for any requests after the contract has ended.

In addition, there are contracts for the supply of products and services that require longer retention periods. See also below: "Use for consideration of claims".

Use for consideration of claims

Any information which we deem necessary to investigate, defend, or prosecute you, us, or any third party, or make any claims, may be retained by us for as long as any such action is in place.

Use for customer care and marketing purposes

For customer care and marketing purposes, the data collected from you may be kept 3 years after the last contact, unless you wish for this data to be deleted and there are no contractual or statutory retention requirements that conflict with this deletion request.

BMW is a globally active company. Personal data is preferably processed by BMW employees, national sales companies, authorized dealers, and service providers commissioned by us within the EU.

If data is processed in countries outside the EU, BMW will ensure through EU Standard Contracts, including appropriate technical and organizational measures, that your personal data is processed in accordance with European data protection standards. If you would like to see the specific safeguards for the transfer of data to other countries, please contact us using the communication channels listed below.

For some countries outside the EU, such as Canada and Switzerland, the EU has already established a comparable level of data protection. Due to the comparable level of data protection, data transfer to these countries does not require any special approval or agreement.

If you have any questions about how we use your personal data, it is best to contact BMW Motorrad customer support first - either by email to motorrad@bmw.de or by phone at +49 89 1250-160200 (Mon.-Fri. 8:00 - 17:00 o'clock).

You can also contact the responsible data protection officer:

Datenschutzbeauftragter
BMW AG
Petuelring 130
80788 Munich
Germany
datenschutz@bmw.de

As persons affected by the processing of your data, you may claim certain rights under the GDPR and other relevant data protection regulations. The following section contains an explanation of your rights according to the GDPR.

Rights of persons affected

According to the GDPR, you are entitled to the following rights in particular as an affected person:

Right of access (Art. 15 of GDPR): You may request information about the data we hold on you at any time. This information includes, but is not limited to, the categories of data we process and for which purposes we process them, the source of the data if we have not collected it directly from you, and, if applicable, the recipients to whom we have submitted your information. You can obtain a free copy of your data from us. If you are interested in further copies, we reserve the right to charge you for these.

Right to correction (Art. 16 of GDPR): You can ask us to correct your data. We will then take reasonable steps to keep your information up-to-date, and process it in a timely, complete, and accurate manner based on the most up-to-date information available to us.

Right to deletion (Art. 17 of GDPR): You can demand that we delete your data, provided that the legal prerequisites exist. This may be the case under Art. 17 GDPR if:

• The data is no longer required for the purposes for which it was collected or otherwise processed
• You revoke your consent, which is the basis of data processing, and lack any other legal basis for processing 
• You object to the processing of your data and there are no legitimate reasons for processing, or you object to the processing of data for direct marketing purposes
• The data was processed unlawfully.

Insofar the procession is not necessary

• To ensure compliance with a legal obligation that requires us to secure your data 
• Especially regarding statutory retention periods
• To assert, exercise, or defend legal claims.

Right to restriction of processing (Art. 18 of GDPR): You may ask that we restrict the processing of your data if:

• You deny the accuracy of the data for the period which we need to check to verify the accuracy of the data
• The processing is unlawful, and you refuse the deletion of your data and instead demand the restriction of its use
• We no longer need your information, but you need it to enforce, exercise or defend your rights
• You have objected to the processing, so long as it is not certain that our legitimate reasons outweigh yours 

Right to data portability (Art. 20 of GDPR): We will transfer your data upon your request - as far as this is technically possible - to another person in charge. However, you are only entitled to this right if the data processing is based on your consent or is required to carry out a contract. Instead of receiving a copy of your data, you may also ask us to submit the data directly to another person in charge who you specify.

Right to objection (Art. 21 of GDPR): You may object to the processing of your data at any time for reasons that arise from your particular situation if the data processing is based on your consent or on our legitimate interests or those of a third party. In this case, we will no longer process your data. The latter does not apply if we can prove compelling legitimate reasons for the processing that outweigh your interests, or we need your data to assert, exercise, or defend legal claims.

Time limits for the fulfilment of the rights of persons affected

We make every effort to comply with all requests within 30 days. However, this period may be extended for reasons relating to the specific right or complexity of your request.

Restriction of information in the fulfilment of the rights of persons affected

In certain situations, we may be unable to provide you with information about all of your data due to legal requirements. If we must decline your request for information in such a case, we will inform you at the same time about the reasons for the refusal.

Complaints to regulators

BMW takes your concerns and rights very seriously. However, if you believe that we have not adequately complied with your complaints or concerns, you have the right to lodge a complaint with a competent data protection authority.