We treat your data in accordance with the same high standards that you expect from our products and services. Our aim is to create and maintain the basis for a trusting business relationship with our customers and prospective customers. The confidentiality and integrity of your personal data is of particular concern to us.

BMW M GmbH Gesellschaft für individuelle Automobile (hereinafter "BMW M"), Daimlerstr. 19, 85748 Garching-Hochbrück , registered office and register court Munich HRB 44621 (hereinafter "BMW M") is responsible for the processing of your personal data according to the EU General Data Protection Regulation ("GDPR"). BMW M is based in Munich; it is a subsidiary of BMW AG. 

BMW M is responsible for your data collected and processed via the website www.bmw-m.com, in the context of the BMW M Drivers Community, in the context of newsletter registration or other marketing measures or the BMW M Driving Experience. BMW M is also responsible for your data collected and processed within the framework of vehicle usage contracts with BMW M or as part of ticket sales for BMW M events such as Moto GP events. BMW M will also process your data for customer service purposes, for example for the order form for retrofitting of the M Driver's Package, where such data is provided to it by partners of BMW M, if and insofar as the necessary data protection requirements are met.

BMW M is not responsible for the sale of BMW and BMW M vehicles, original BMW and BMW M parts, accessories, and related services. These sales are controlled by BMW AG and the respective foreign subsidiaries and dealerships (hereinafter referred to as partners of BMW M). If you require further information on data protection related to BMW AG or the respective foreign subsidiaries, you can find it on the website of the national distribution company in your country.

BMW M partners are responsible for processing personal data provided by the partners themselves in connection with your concerns and customer service in the areas of sales and service. BMW M partners will also process your data as independent Controllers, where such data is provided to them by BMW M, if and insofar as the necessary data protection requirements are met.

This data protection notice also describes some of the processing of your data by partners of BMW M. However, BMW M partners may collect additional personal data and have their own data protection notices. In this case, you can find out how your data will be used from the data protection notices of the respective BMW M partner. 

BMW M provides the customer with certain services under the designation "BMW M services." The data collected in connection with the conclusion of the contract or the provision of these services is processed for the following purposes:

For example, the following data categories are processed within the framework of the conclusion of a contract:

BMW M Driving Experience customer portal:

• Contact details: Last name, first name, address data, e-mail address, etc.
• Registration: BMW M Driving Experience customer portal
• Credentials:  E-mail address, password

Vehicle usage contract:

• Contact details: Last name, first name, address data, e-mail address
• More information: Driving license classes, driving license number, issuing authority, issue date

Ticket sales for Moto GP events or other BMW M events:

• Contact details: Title, last name, first name, address data, country, telephone number, e-mail address, identification number, company address, tax number

The contract data is automatically deleted 1 year after the contract has expired; posting documents for financial transactions are deleted after 10 years in accordance with legal provisions.

For example, the following data categories are processed within the framework of BMW M services:

BMW M Driving Experience Customer Portal:

• Contact details: Surname, first name, address data, e mail address etc.
• Registration: BMW M Driving Experience Customer Portal
• Registration data: E-mail address, password
  

Vehicle usage contract:

• Contact details: Surname, first name, address data, e-mail address
• Further information: Driving license categories, driving license number, issuing authority, date of issue
  

Ticket purchase for Moto GP Events or other BMW M Events:

• Contact details: Title, surname, first name, address data, country, telephone number, e-mail address, ID number, company address, tax number
  
  

Website www.bmw-m.com and BMW M Drivers Community (community.bmw-m.com)

Online account of the BMW M Drivers Community:

• Contact details: Title, surname, first name, community user name (nickname), telephone number, date of birth, address data, country, chassis number
• Registration: BMW M Drivers Community
  Logon data: E-mail address, password
  

Submission of order form for retrofitting M Driver's Package, provided it has been submitted by BMW M partners:

• Contact details: Last name, first name, chassis number, vehicle specification, vehicle model, km reading

To fully benefit from the BMW M Drivers Community and the BMW M Driving Experience customer portal, you must register online. After registering, you will receive an online customer account that also gives you access to other portals of the BMW Group. The master data of the online customer account is stored by BMW AG. 

Beyond the actual provision of services, the above-mentioned data is also processed to ensure the quality of the BMW Group's products and services and to develop new products and services. This kind of processing serves the legitimate interest to meet high customer demand for existing products and services and for the company to be in a position to satisfy the future wishes of our customers with new products and services still to be developed. For the protection of our customers' privacy, the data is processed exclusively in a form that cannot be directly traced back to the customer or the vehicle. 

BMW M is a company of the BMW Group. We process your data partly to ensure that the various companies within the BMW Group are managed as efficiently and successfully as possible. This applies, for example, to joint group accounting in accordance with international accounting principles for companies (e.g. the International Financial Reporting Standards – IFRS).

BMW M uses your personal data to contact you in connection with the processing of contracts, see above (e.g. BMW M Driving Experience) or to process a request formulated by you (e.g. inquiries to BMW M exclusive customer care). For all aspects of processing of contracts or requests, we will contact you without obtaining separate consent, e.g. in writing, by telephone, messenger services, or email, depending on the contact media you specified.

We will process and use your data with care and in accordance with the legaland use them in accordance with the legal provisions on data protection. The personal data youpersonal data will be processed for the purpose of registering for the Newsletter / the processing your contact enquiry / your order and, if necessary, forwarded to a BMW partner forwarded to a BMW partner if necessary. Further information on the processing of your personal data by BMW AG, e.g. for the purpose of general customer service customer support as well as detailed information on your rights as a data subject can be found online (www.bmw.de/datenschutz) in the BMW data protection information.

If you have separately given your consent to the further use of your personal data, your personal data may be used in accordance with the scope described in the consent, e.g. for advertising purposes and with your separate consent also with high personalization on the basis of an individual customer profile and/or market research, and may be passed on to third parties. Details on this can be found in the respective declaration of consent, which can be revoked at any time.

Due to legal obligations, certain fuel consumption data (so-called OBFCM data, such as lifetime fuel consumption and kilometers travelled, for PHEV vehicles also distribution in different electric modes) are transmitted from your vehicle during certain workshop services to us and from there (BMW AG) to the EU Commission. You can refuse the data transmission for this purpose at BMW's authorised workshops and BMW branches.

In addition, BMW M also processes personal data if there is a legal obligation to do so. The data collected is also processed, for example, to ensure the operation of IT systems. Smooth operation is ensured with the following actions, among others:

• Backup and recovery of data processed in IT systems
• Logging and monitoring of transactions to check the correct functioning of IT systems
• Detection and prevention of unauthorized access to personal data
• Incident and problem management for troubleshooting IT systems

BMW M is subject to a variety of other legal obligations. In order to fulfill these obligations, we process your data to the required extent and, if necessary, pass it on to the responsible authorities in accordance with legal reporting requirements. 

How long do we store your data for?

We store your personal data only for as long as the relevant purpose requires it. If data is processed for multiple purposes, the data will be automatically deleted or stored in a form that cannot directly be traced back to you, as soon as the last specified purpose has been fulfilled. 

How is your data stored?

We store your data based on the state of the art.  For example, the following safeguards are used to protect your personal information from misuse or any other unauthorized processing:

• Access to personal data is restricted to a limited number of authorized persons for the stated purposes only.
• The data collected will only be transmitted in encrypted form.
• Sensitive data is stored only in encrypted form.
• The IT systems for processing the data are technically isolated from other systems to prevent unauthorized access, e.g. through hacking.
• In addition, access to these IT systems is continuously monitored to detect and ward off misuse at an early stage.

In certain situations, we write or read information to or from your terminal equipment. This occurs, for example, in the form of cookies when you use websites or the MyBMW APP, or as part of a software update for your vehicle. This storage or access is based on your consent in accordance with Section 25 (1) TTDSG, or, if this is absolutely necessary in accordance with Section 25 (2) TTDSG in order to provide you with a service expressly requested by you, without your consent. The subsequent processing is based on the GDPR in accordance with the purposes described above.

How long do we store your data for?

We store your personal data only for as long as the relevant purpose requires it. If data is processed for multiple purposes, the data will be automatically deleted or stored in a form that cannot directly be traced back to you, as soon as the last specified purpose has been fulfilled.

How is your data stored?

We store your data based on the state of the art. For example, the following safeguards are used to protect your personal information from misuse or any other unauthorized processing:

• Access to personal data is restricted to a limited number of authorized persons for the stated purposes only.
• The data collected will only be transmitted in encrypted form.
• Sensitive data is stored only in encrypted form.
• The IT systems for processing the data are technically isolated from other systems to prevent unauthorized access, e.g. through hacking.
• In addition, access to these IT systems is continuously monitored to detect and ward off misuse at an early stage.

BMW M GmbH Gesellschaft für individuelle Automobile is part of the BMW Group. In some cases, after careful verification, we send your data to other BMW Group companies, which further process them as own controllers. Such a transfer of data may occur under the following circumstances and for the following purposes:

Please note that this is not a complete or exhaustive list of data transfer processes within the BMW Group, but is only examples that are intended to make data transfers more transparent.

• If you have previously given us your explicit consent to share your data with other BMW Group companies for advertising or marketing purposes. This concerns BMW M GmbH Gesellschaft für individuelle Automobile und BMW Driving Experience, Garching-Hochbrück. The contact details and information about a possible data protection officer can be found here.

• To fulfill BMW M's sales, service and administrative processes

• As part of group reporting, we may transfer data, e.g. in the case of leased vehicles, as part of the assessment of residual values, we transmit invoice-relevant information on the respective vehicle identification numbers.

BMW M is a company with an international presence. Personal data is preferably processed within the EU, both by us and by contracted service providers.
If data is processed in countries outside the EU, EU-standard agreements, including the appropriate technical and organizational measures ensure that your personal data is processed in accordance with European data protection standards. If you would like to see the specific safeguards for the transfer of data to other countries, please contact us using the communication channels listed below.

For certain countries outside the EU, such as Canada and Switzerland, the EU has already determined a comparable level of data protection. Given the comparable level of data protection, data transmission to these countries does not require any special approval or agreement.

How can you view and change your data protection settings?

You can view and change data protection settings in the BMW M Drivers Community or the BMW M Driving Experience customer portal or request the changes yourself at any time.

Contact details, subject rights, and your right to complain to a supervisory authority.
If you have any questions about the way BMW M uses your personal data, please contact BMW M customer service, either by email at customer.service@bmw-m.com or by calling 0049 89 1250 160 16.

You can also contact the responsible BMW M data protection officer:

BMW M GmbH Gesellschaft für individuelle Automobile

Datenschutzbeauftragter
Daimlerstraße 19
85748 Garching bei München
datenschutz@bmw.de

As an individual whose data is subject to processing, you may assert certain rights against us in accordance with the GDPR and other relevant data protection regulations.

The following section contains explanations of your rights under the GDPR.

Rights of affected persons:
In accordance with the GDPR and in relation to BMW M, you, as an affected person, are entitled to the following rights in particular:

Right of access by the data subject (Art. 15 GDPR):

You may request information about the data we hold about you at any time. This information includes, but is not limited to, the categories of data we have processed, the purposes for which we have processed this data, the origin of the data if we did not collect it from you directly, and, if applicable, the recipients to whom we have transferred your data. You can request a copy of your data free of charge. If you are interested in obtaining additional copies, we reserve the right to charge you accordingly. 

Right to rectification (Art. 16 GDPR):

You can ask us to rectify your data. We will take reasonable measures to keep the information we hold and process about you accurate, complete, and up to date, based on the most current information available to us. 

Right to erasure (Art. 17 GDPR):

You can request the deletion of your data, provided there are legal requirements in place to support this. This may be the case under Art. 17 GDPR if:

• The data is no longer required for the purposes for which it was collected or otherwise processed;
• Your consent, which is the basis of data processing, is revoked and there is no other legal basis for the processing;
• You object to the processing of your data and there are no overriding legitimate grounds for processing, or you object to the processing of data for direct marketing purposes;
• The data was processed unlawfully,

unless processing is necessary

• to ensure compliance with a legal obligation that requires us to process your data;
• particularly with regard to legal retention periods;to enforce, exercise, or defend legal claims.

Right to restriction of processing (Art. 18 GDPR):

You may require us to restrict the processing of your data if

• You dispute the accuracy of the data for the period of time that we need to verify the accuracy of the data;
• The processing is unlawful but you refuse the deletion of your data and instead demand a restriction of use;
• We no longer need your information but you need it to enforce, exercise, or defend legal claims;
• You have lodged an objection against processing as long as it is not clear whether our justified reasons outweigh yours. 

Right to data portability (Art. 20 GDPR):

At your request, we can transfer your data to another person in charge as far as technically possible. However, you are entitled to this right only if the data processing is based on your consent or is necessary to execute a contract. Rather than receive a copy of your data, you may also ask us to transfer the data directly to another person in charge specified by you. 

Right to object (Art. 21 GDPR):

You may object to the processing of your data at any time for reasons that arise from your particular situation, if the data processing is based on your consent or on our legitimate interests or those of a third party. In this case, we will no longer process your data. The latter does not apply if we can provide compelling legitimate reasons for the processing that outweigh your interests or we need your data to enforce, exercise, or defend legal claims.

Time limits for the fulfillment of subject rights:

We make every effort to comply with all requests within 30 days. However, this period may be extended for reasons relating to the specific right of the affected person or complexity of your request.

Restriction of information in the fulfillment of subject rights:

In certain situations, we may be unable to provide you with information about all your data owing to legal requirements. If we have to refuse your request for information in such cases, we will inform you at the time of the reasons for the refusal. 

Complaints to supervisory authorities:

BMW M takes your rights and concerns very seriously. However, if you believe that we have not adequately addressed your complaints or concerns, you are entitled to file a complaint with a competent data protection authority.