The data acquired in the context of contract conclusion or the provision of services are processed for the purposes stated below. An explanation of the area of application of the available legal basis can be found here.

A. Compliance with contractual duties within the framework of the sale, maintenance, and repair of vehicles (Article 6, Paragraph 1, b) of basic EU data protection regulations)

BMW, BMW dealerships, and BMW partners acquire, process, and use personal data within the framework of the sales processes or maintenance and/or repair in the dealership.

Within the framework of the sales processes, personal data are used at BMW contracted dealers, BMW i agents, and BMW dealerships to manage the purchasing agreement, to carry out test drives, and to transfer information related to your vehicle purchase.

Within the framework of these activities, the data categories stated below are processed:

• Contact data (last name, first name, address, e-mail address etc.)
• Account data (BMW ConnectedDrive or My BMW account, bank details, etc.)

BMW, BMW dealerships, and BMW partners use your personal data for contract administration (for example vehicle ordering, workshop / repair order, booking BMW ConnectedDrive services) or to handle any request you have submitted (for example offer, test drive request). Regarding all aspects of contract administration or dealing with a concern, we will contact you without separate consent, for example in writing, by telephone, per messenger service, per e-mail, depending on which contact data you have specified.

Within the framework of the maintenance and repair processes and/or services at BMW and/or BMW i contracted workshops and BMW dealerships, special diagnosis units are used to read technical data relevant to vehicle service from the electronic control units fitted in the vehicle. These data are processed and used in the workshop by trained technicians for the diagnosis and rectification of any malfunctions. These technical data regarding the vehicle essentially consist of:

• Vehicle master data (for example vehicle identification number, type of vehicle, date of manufacture, vehicle equipment)
• Vehicle condition data (measured values, for example mileage)
• Error memory entries (for example failure of turn indicator)
• Load duty spectrums
• Software versions and
• Service and workshop data (for example service requirements, work performed, fitted spare parts, cases of warranty, workshop reports)

BMW can access the above information in order to support BMW and/or BMW i contracted workshops and BMW dealerships with technical or other challenges they face in providing their services.

Over and above this, the persons responsible mentioned above possibly receive to a limited extent data regarding the location of the vehicle where this is required for the purpose of contract fulfilment (for example within the framework of BMW Roadside Assistance). The data are used exclusively in line with the security precautions for location data.

B. Compliance with contractual duties for the provision of digital vehicle-based services (Article 6 Paragraph 1 b) of basic EU data protection regulations)

In order to execute any ConnectedDrive contract concluded between you and BMW, BMW provides various services, for example BMW Intelligent Emergency Call, Concierge Service, Real Time Traffic Information (RTTI), TeleServices etc. For the provision of these services, the following personal information from the vehicle is processed by BMW and commissioned service providers:

• Vehicle status data (mileage, battery voltage, door and flap status, etc.)
• Position and movement data (time, position, speed, etc.)
• Vehicle maintenance date (due date of next service, oil level, brake wear, etc.)
• Dynamic traffic information (traffic jams, obstacles, signs, parking spaces, etc.)
• Environmental information (temperature, rain, etc.)User profile (configured news, e-mail, audio providers, etc.)
• Sensor information (radar, ultrasonic signal, gestures, voice, etc.)

The processed personal data are automatically deleted after 4 weeks unless they are required for a longer period for the provision of the special service.

You can have the services and functions (some of which are subject to charges) – and in some cases also the entire mobile phone network connection of the vehicle – enabled or disabled. Excluded from this – where technically possible – are legally prescribed functions and services such as an emergency call system.

For provision of the BMW Connected app services, the following personal data are processed:

• Vehicle status data (mileage, battery voltage, door and flap status, etc.)
• Position and movement data of the vehicle and mobile user device (time, position, speed, etc.)
• Vehicle maintenance date (due date of next service, oil level, brake wear, etc.)
• Dynamic traffic information (traffic jams, obstacles, signs, parking spaces, etc.)
• Environmental information (temperature, rain, etc.)
• User profile (configured news, e-mail, audio providers, etc.)
• Sensor information (radar, ultrasonic signal, gestures, voice, etc.)

Position and movement data are used exclusively in line with the security precautions for location data.

If you do not want this processing of your personal data, you can – where technically possible – cancel your consent within the BMW Connected app or remove the BMW Connected app from your mobile user device.

C. Ensuring product quality, research and development of new products (Article 6, Paragraph 1 f) of basic EU data protection regulations)

BMW uses the data (including location data) acquired as a result of the provision of services by BMW or BMW dealerships or BMW partners in a depersonalized form to ensure the quality of products and services as well as for the purposes of research and development. "Depersonalized" means that the data can no longer be traced directly to you or your vehicle.

This processing is based on the legitimate interest of BMW in meeting the high expectations of our customers with regard to high-quality products and services and taking account of the customer wish to have newly developed, innovative solutions. To protect your interests – alongside de-personalization – additional security precautions and controls are implemented as required, for example strict data access restrictions, restrictions in data use, security measures, retention periods, as well as data economy principles such as exclusively gathering relevant data.

D. Compliance of sales, service, and administration processes of BMW (including BMW dealerships), the national distribution company and BMW partners (Article 6, Paragraph 1 f) of basic EU data protection regulations)

In order to continuously optimize the customer experience and cooperation with BMW partners and customer care by BMW dealerships, we create evaluations and reports on the basis of contract information and share these with the BMW partners responsible. The main purpose of these evaluations is to initiate corresponding measures (for example training courses for Sales and Service personnel) to improve application and sales processes. We will create the reports described above in an aggregated and anonymized form , i.e. the recipients of the reports are unable to draw any conclusions regarding you as a person from the data they contain.

Parts of the acquired vehicle-specific data are also processed - where required - for compliance with the service processes (for example repair, warranty, goodwill) of BMW, BMW dealerships as well as BMW and/or BMW i contracted workshops and national BMW Group sales companies (including their branch offices) in the European economic area and other countries named in the BMW quality letter (Char. Pilakoutas Ltd.) This processing is within the legitimate interest of BMW to offer our customers the best possible service process. The processing also occasionally takes place in the context of legal specifications (for example repair and maintenance information based on specifications from the point of view of competition). As a general principle, to protect the private sphere of our customers, the processing of technical data is vehicle-based and without a direct link to the customer.

The following data categories are used for this:

• Vehicle master data (for example vehicle identification number, type of vehicle, date of manufacture, vehicle equipment)
• Vehicle condition data (measured values, for example mileage)
• Error memory entries (for example failure of turn indicator)
• Load duty spectrums
• Software versions andService and workshop data (for example service requirements, work performed, fitted spare parts, cases of warranty, workshop reports)

The technical vehicle data are deleted at the end of the lifecycle of the vehicle.

Muscats Motors Limited is a company of the BMW Group. In some cases, we process your data to ensure that the different companies within the BMW Group are managed as efficiently and successfully as possible. This concerns, for example, joint consolidated accounting in line with International Financial Reporting Standards (IFRS) for companies.

E. Customer care (Article 6 Paragraph 1 b, g, f) of basic EU data protection regulations)

BMW, BMW dealerships, and BMW partners use your personal data for contract administration (for example vehicle ordering, workshop / repair order, booking BMW ConnectedDrive services) or to handle any request you have submitted (for example offer request, test drive request, queries and complaints to BMW Customer Care). Regarding all aspects of contract administration or dealing with a concern, we will contact you without separate consent, for example in writing, by telephone, per messenger service, per e-mail, depending on which contact data you have specified.

We will also contact you if your vehicle is affected by a so-called technical campaign or recall. As technical campaigns are usually measures of great importance (for example avoiding danger to vehicle occupants, avoiding damage to the vehicle), we contact you directly or indirectly through our BMW partners or our BMW dealerships using the contact data you have specified in order to comply with our legally required duty to inform. 

We will also contact you in carefully considered cases with promotional communication (for example mailing the welcome package following a vehicle purchase or a letter indicating the end of the warranty period and offer of a vehicle check) if and to the extent that the requirements in compliance with data protection legislation necessary for this are met and in full awareness of your right of objection you have not objected to the use of your data for the purpose of written communication.

BMW also processes your personal data on this basis to optimize your experience with BMW Customer Care, e.g. to identify you correctly if you make contact with us.

F. Promotional communication as well as market research based on consent (Article 6, Paragraph 1 a) of basic EU data protection regulations)

Insofar as you have separately given your consent to further use of your personal data, your personal data may be used in accordance with the scope described in the consent, for example for promotional purposes (selected offers of products and services),and/or market research and, if necessary, forwarded to certain subsidiaries of BMW and selected BMW partners. Details are included in the respective declaration of consent, which you can revoke at any time.

Contact information, for example Name, address, e-mail, telephone number

Supplementary personal details / preferences, e.g.

Company name, your relationship with this company if you use a company car or are our contact person for this companyA possible point in time at which you need a new vehicle and your interest in BMW and/or BMW i vehicles and services as well as your requests for information and test drives etc.Preferred and/or current BMW partner or BMW dealershipVehicle identification number and other attributes linked to thisInterests and hobbiesStatus of your data protection declaration of consent and selected and/or preferred communication channel

Identification data, for example customer number, contract number

Customer history, for example

• Vehicle purchase data, including model, configurations, purchase date, date of 1st registration, license plate number, purchase order date, delivery date, holder, list price
• Data acquired at BMW partners and BMW dealerships (such as point in time of contact and contact type, service history)
• Campaign history and resonance (customer and potential customer care program and direct marketing measures
• Participation in events
• Inquiry and complaint history at BMW Customer Care

Vehicle use data, e.g.: Contract data for BMW ConnectedDrive, for example booking online entertainment

App / website / social media data

If you have registered or logged in, your account data, for example at My BMW or BMW ConnectedDrive.

BMW uses the sales and customer care data acquired in this way

• To determine which information and offers are most likely to be of interest to you
• To make contact with you in the context of this information and these offers
• To send promotional communication (e.g. product launches or invitations to events) in line with your data protection declaration of consent.

In the data protection declaration of consent, you also lay down the communication channels (e.g. post, telephone, e-mail) we are permitted to use to contact you.

As a rule, data processing for promotional purposes takes place in Malta; under no circumstance are personal data transferred to a country outside the EU.

G. Compliance with legal obligations to which BMW is subject (Article 6, Paragraph 1 c, f) of basic EU data protection regulations)

BMW will also process personal data if there is a legal obligation to do so. This can be the case, for example, if we contact you if your vehicle is affected by a technical campaign or recall.

Gathered data are also processed within the framework of ensuring the operation of IT systems. Ensuring operation involves the following activities:

• Backup and restore of data processed in IT systems
• Logging and monitoring of transactions to check the correct function of IT systems
• Detection and defense against unauthorized access to personal data
• Incident and problem management to remedy malfunctions in IT systems.

Gathered data are also processed within the framework of internal compliance management in which we, for example, check whether you have been advised to an adequate extent within the framework of concluding a contract and that the BMW partner has complied with all legal obligations.

BMW is subject to a large number of other legal obligations. In order to fulfill these obligations, we process your data to the required extent and, if necessary, pass them on to the authorities responsible within the framework of legal obligations of notification.

We also process your data in the event of legal conflicts if the legal conflict makes processing the data necessary.

H. Data transfer within the BMW Group

Muscats Motors Limited is a company of the BMW Group. In some cases, after a careful check, we send your data to other companies of the BMW Group, who are then responsible for further processing. Such a data transfer can occur under the following circumstance and for the following purposes:

Please bear in mind that this is not a complete or conclusive list of the data transfer operations within the BMW Group, rather only examples intended to make the data transfers more transparent.

- If you have given us your express consent beforehand to share your data with other companies of the BMW Group for promotional or marketing purposes. This concerns:

BMW M GmbH, Company for Individual Automobiles and BMW Driving Experience, Garching-Hochbrück

The contact data as well as information about any data protection officers is: Muscats Motors Limited ((+356) 23264000 / info@mml.mizzi.com.mt)

• For compliance with the sales, service, and administration processes of BMW, cf. point G.
• In the course of group reporting, we might transfer data, for example we transfer invoice-relevant information for the respective vehicle identification numbers in the case of leased vehicles for assessment of the residual values.

I. Data transfer to selected third parties

Data are forwarded to the following companies, among others, if and to the extent that the requirements in compliance with data protection legislation necessary for this are met:

- To BMW partners (for example in order to be able to comply with your request for a test drive or a service and submit specific offers). Your requests are forwarded with priority to your preferred BMW partner, the BMW partner where you purchased products or services, the partner with whom you are in contact. If you have not yet had any contact with a BMW partner that we are aware of, we forward your inquiry to a BMW partner in your region.

To BMW partners for data updates, for example of your contact data. The data for a data update are forwarded to all BMW partners that keep you in their address list.

- To carefully selected and checked service providers and business partners with whom we cooperate to be able to offer you products and services. We do this for BMW only within the framework of the strict conditions of data processing on your behalf or on the basis of your express consent (for example transfer to the insurance provider of BMW accident and breakdown cover, if you so wish).- In the event of the sale of a business unit or several business units of BMW to a company to which we assign our rights in compliance with all agreements that exist between us.- To other third parties (for example public authorities) to the extent that we are legally obliged to do so. Via our BMW CarData platform, you also have the possibility to instruct us when personal data we have gathered within the framework of providing ConnectedDrive services is to be forwarded to authorized third parties you have selected (for example your motor vehicle insurance company). This occurs exclusively based on your consent, which you can revoke at any time. 

To use our Services, you might be asked to register for a BMW Group ID. With the BMW Group ID, you will receive an online customer account that gives you access to other BMW Group portals and offers. In order to provide you the BMW Group ID login service, your data is passed on to the BMW Group company that acts as a provider of the applications in use by you. Storage of the data from your customer account is handled by BMW AG and is separate from any other (even potentially identical) data about your person that may be available to BMW Group.

We deploy various security measures such as encryption and authentication tools in line with the current state of the art to protect and maintain the security, integrity, and availability of your data.

100% protection against unauthorized access in the case of data transfers across the internet or a website cannot be guaranteed, but we and our service providers and business partners do our utmost to protect your personal data in line with the prevailing data protection regulations by means of physical, electronic, and process-oriented security precautions in line with the current state of the art. Among other things, we use the following measures:

• Strict criteria for authorization to access your data according to the "need-to-know principle" (restriction to as few people as possible) and exclusively for the specified purpose
• Transfer of acquired data exclusively in encrypted form
• Storage of confidential data, for example credit card data, exclusively in encrypted form
• Firewall safeguarding of IT systems to provide protection against unauthorized access, for example by hackers
• Permanent monitoring of accesses to IT systems to detect and prevent the misuse of personal data

If you have received a password from us or have assigned one yourself to gain access to certain areas of our website or other portals, apps, or services that we operate, you are responsible for keeping this password confidential and for compliance with all other security procedures of which we make you aware. We ask you in particular not to tell anyone your password.

Security precautions for location data

Certain services can only be offered if you reveal your location or the location of your vehicle. We take the confidentiality of these location data very seriously.

Your location data (including data accessed within the framework of vehicle maintenance) are therefore protected with the following security precautions:

• They are only stored in a form that can be traced to you or your vehicle as required to fulfill the intended purpose to which you have agreed.
• Data are only gathered and accessed in this form when they are required to provide the requested service.
  Data are also gathered and accessed in this form to the extent that we are legally obliged to store or pass on the data.
• Data for localization of the vehicle and data for localization of a / of your mobile user device are only linked if this is necessary to provide the requested service.
• Any other use of location data for the purpose of analysis takes place using data records that have been anonymized beforehand.

We, your BMW dealership, and your BMW partner might have access to the data for localization of the vehicle and BMW AG might have access to the data for localization of the / of your mobile user device via the services provided (for example BMW ConnectedDrive).

On purchasing the vehicle or activating or configuring the BMW ConnectedDrive services or the BMW Connected App, you receive a detailed description of the location data that are transferred to provide location-specific services.

Via the BMW ConnectedDrive portal, the BMW Connected app or directly in the vehicle – where technically possible – you can set whether we are permitted to continue gathering and processing these data, thus preventing future data acquisition. Please bear in mind that we might no longer be able to provide certain aspects of our services if you have restricted the gathering of location data.

In line with article 17 of the basic EU data protection regulations, we will keep your data only as long as necessary for the respective purposes for which we process your data. If we process data for a number of purposes, they are automatically deleted or stored in a format that does not permit conclusions to be drawn directly as regards your person as soon as the last specific task has been performed. To ensure that all of your data are deleted in line with the principle of data minimization and article 17 of the basic EU data protection regulations, BMW has created an internal deletion concept. The fundamental principles by which this deletion concept envisages the deletion of your personal data are described below.

Use for compliance with a contract

To comply with contractual obligations, data acquired from you can be kept for as long as the contract is in force and - depending on the nature and scope of the contract - for 6 or 10 years beyond this point in order to comply with legal requirements for preservation and to ensure clarification of any queries or claims after the end of the contract.

Over and above this, there are contracts for the delivery of products and services that necessitate longer retention periods, see also "Use for the assessment of claims" below.

Use for the assessment of claims

Data that in our opinion will be necessary to assess and avert claims against us or to initiate criminal proceedings or assert claims against you, us or third parties can be kept by us for as long as corresponding proceedings could be initiated.

Use for customer care and marketing purposes

For customer care and marketing purposes, the data acquired from you can be kept for 3 to 10 years, unless you wish to have these data deleted and there are no contractual or legal requirements for preservation that prevent this request for deletion.

BMW is a company that operates globally. Personal data are processed by BMW employees, national sales companies, BMW partners, and by service providers we have commissioned, preferably within the EU.

If data are processed in countries outside of the EU, BMW uses EU standard contracts, including suitable technical and organizational measures, to ensure that your personal data are processed at the same level as European data protection.

In some countries outside the EU, for example Canada and Switzerland, the EU has already determined a level of data protection comparable with that in Europe. The comparable level of data protection means that data transfer into these countries does not require any special permission or agreement.

Contact us (info@mml.mizzi.com.mt) if you wish to see the specific security precautions for the transfer of your data to other countries.

To support the provision of the services and intended purposes listed above, BMW uses a number of service providers that are commissioned by BMW AG within the framework of the strict conditions of data processing in compliance with data protection legislation.

You can change the settings for the use of your data in BMW online accounts in the corresponding options in your online account "My BMW", in your BMW ConnectedDrive account or in the BMW Connected app at any time.

You can access the following data and, if possible, also change them:

• Consent to promotional communication – here you can choose the communication channels you wish to have (communication by mail, e-mail etc.)
• BMW CarData – here you can view and download and/or transfer your vehicle data
• BMW ConnectedDrive account – here you can view and change your detailed settings for BMW ConnectedDrive. Some settings for BMW ConnectedDrive can only be changed using the BMW Connected app or only in the vehicle; please use the corresponding options in the app or in the vehicle.

The settings for the use of your data by BMW partners, however, cannot be changed in your online account, in the area of the data protection portal of BMW AG. To make such a change or if you have any questions regarding the use of your data, you therefore have to contact the respective BMW partner directly.

If you have any questions regarding the use of your personal data by us, it is best to contact BMW Customer Care first – either per e-mail at info@mml.mizzi.com.mt or by telephone at the number +356 2326 4000 (Opening hours: Monday – Friday 09:00– 18:00
Saturday 09:00 – 12:00).

As the person affected by the processing of your data, the basic EU data protection regulations and other relevant data privacy protection regulations enable you to assert certain rights in relation to us. The following section contains explanations of your rights as defined by the basic EU data protection regulations. Depending on the type and scope of your inquiry, we ask you to put the inquiry in writing.

Rights of persons affected

In line with the basic EU data protection regulations, as the person affected you have the following rights in particular vis-à-vis BMW:

Right to information (Article 15 of basic EU data protection regulations): You can ask us for information regarding any data of yours that we keep at any time. This information concerns, among other things, the data categories we process, for what purposes we process them, the origin of the data if we did not acquire them directly from you and, if applicable, the recipients to whom we have sent your data. You can obtain a copy of your data from us free of charge. If you are interested in other copies, we reserve the right to charge for the additional copies.

Right to correction (Article 16 of basic EU data protection regulations): You can request that we correct your data. We will initiate appropriate measures to keep the data of yours that we continuously process correct, complete, and up to date, based the latest information available to us.

Right to deletion (Article 17 of basic EU data protection regulations): You can request that we delete your data provided the legal requirements have been met. In accordance with Article 17 of basic EU data protection regulations, this can be the case if

• The data are no longer required for the purposes they were acquired or otherwise processed
• You revoke your consent, which is the basis of the data processing, and there is no other legal basis for the processing
• You object to the processing of your data and there are no legitimate reasons for the processing or you object to data processing for the purposes of direct advertising
• The data have been processed illegally

Where the processing is not necessary

• To ensure adherence to a legal obligation that requires us to process your data
• In particular with regard to legal retention periods
• To assert, exercise or defend against legal claims

Right to restriction of processing (Article 18 of basic EU data protection regulations): You can request that we restrict the processing of your data if

• You dispute the correctness of the data - for the period of time we need to check the correctness of the data
• The processing is illegal but you do not wish to have your data deleted and request a restriction of use instead
• We no longer need your data, but you need them to assert, exercise or defend against legal claims
• You have filed an objection to the processing, though it has not yet been decided whether our legitimate grounds outweigh yours.

Right to data transferability (Article 20 of basic EU data protection regulations): At your request, we will transfer your data – where technically possible – to another responsible entity. However, this right only applies if the data processing is based on your consent or is required to fulfill a contract. Instead of receiving a copy of your data, you can ask us to send the data directly to another responsible entity that you specify.

Right to objection (Article 21 of basic EU data protection regulations): You can object to the processing of your data at any time for reasons that arise from your special situation provided the data processing is based on your consent or our legitimate interest or that of a third party. In this case, we will no longer process your data. The latter does not apply if we are able to prove there are compelling, defensible reasons for the processing that outweigh your interests or we require your data to assert, exercise or defend against legal claims.

Time limits for compliance with the rights the persons affected

As a general principle, we make every effort to comply with all requests within 30 days. This time limit, however, can be extended for reasons related to the specific rights of persons affected or complexity of your request.

Restriction in the provision of information regarding the rights of persons affected

In certain situations, legal specifications might require us not to provide information regarding all of your data. If we have to refuse your request for information in such a case, we will inform you of the reasons for refusal at the same time.

Complaints to supervisory authorities

Muscats Motors Limited takes your reservations and rights very seriously. However, if you are of the opinion that we have not dealt with your complaints or reservations adequately, you have the right to submit a complaint to the data privacy protection authorities responsible.