Privacy Policy for BMW Connected Drive Services
The high standard that you associate with the features of our products and services are the guideline we use in handling your data. In doing so, we seek to create and maintain an environment conducive to a trustworthy business relationship with our customers and interested parties. The confidentiality and integrity of your personally identifiable data is especially important to us.
Who is the authority responsible for data processing?
Data processing takes place together with the authorized dealer in your jurisdiction (hereinafter “The Dealer”), and Bayerische Motoren Werke Aktiengesellschaft, Petuelring 130, 80788 Munich, Germany, headquarters, and court of registration: Munich HRB 42243 (hereinafter “BMW”).
The Dealer provides to the customer certain vehicle-based information and assistance services (hereinafter “services”) under the designation “BMW ConnectedDrive” (hereinafter “ConnectedDrive Agreement”) and is the
contractual and operational point of contact for the customer. BMW is responsible for technical provision of the services. Data is transmitted to BMW from the Dealer to provide the services and support for the customer.
What data about you is processed and for what purpose?
Data collected in the course of concluding an agreement or rendering services is processed for the purposes listed below:
A. Conclusion of agreement
As part of concluding the agreement, the categories of data listed below are processed:
Contact data (last name, first name, address, e-mail address, etc.)
Account data (ConnectedDrive or myBMW login account, bank account, etc.)
The agreement data is deleted automatically 1 year after the agreement expires; financial transactions are deleted after 10 years as stipulated by law.
B. Fulfillment of the contractual obligation for performance of the ConnectedDrive Agreement
For the purposes of fulfilling the ConnectedDrive Agreement concluded between you and the Dealer, BMW renders a variety of services, such as BMW Intelligent eCall, information services, real-time traffic information, TeleServices, etc.
For performance of these services, the following—potentially personally identifiable—information from the vehicle is processed and optionally stored by BMW and commissioned service providers for such performance:
Vehicle status information (mileage, battery voltage, door and hatch status, etc.)
Position and movement data (time, position, speed, etc.)
Vehicle service data (due date of next service visit, oil level, brake wear, etc.)
Dynamic traffic information (traffic jams, obstacles, signs, parking spaces, etc.)
Environmental information (temperature, rain, etc.)
User profile (personal profile picture/ avatar, settings as navigation, media, communication, driver’s position, climate/light, driver assistance, etc.)
Sensor information (radar, ultrasonic devices, gestures, voice, etc.)
The provision of this data is not actually necessary for concluding the ConnectedDrive Agreement. Without your provision of such data and the processing of such data, BMW is, however, unable to provide the respective service for you.
The processed personal data is deleted automatically after 4 weeks if it is not needed longer for provision of the specific service. The ConnectedDrive Account is assigned personally to you. Therefore, your driver profile (if it’s mapped with a ConnectedDrive Account) can just be activated within one vehicle.
BMW Group login
To use the Service, you must register in the App / portal. When you register, you will receive an online customer account that gives you access to other BMW Group portals and offers. In order to provide you the BMW Group login service, your data is passed on to the BMW Group company that acts as a provider of the applications in use by you. Storage of the data from your customer account is handled by BMW and is separate from any other (even potentially identical) data about your person that may be available to BMW Group.
C. Securing product quality and developing new products
Beyond mere performance of service, the data collected under B. is also processed for quality assurance in products and services offered by BMW Group and for developing new products and services by BMW. This processing is used for the legitimate interests of BMW to meet the high customer standard placed on existing products and services and to allow the company to fulfill the future requests of its customers through new products and services that have not yet been developed. In order to protect the privacy of our customers, data is processed solely in a manner that cannot be traced back to the customer/vehicle directly.
D. Fulfillment of the sales, service and administrative processes of the Dealer
In order to optimize the customer experience and collaboration with BMW Distributors and Dealers continuously, we create evaluations and reports based on information from agreements and we share these evaluations and reports with the applicable BMW distributors and Dealers. These evaluations are predominantly used for introducing appropriate measures (e.g. training courses for sales personnel) to improve the request and sales process. We will create the aforementioned reports only in an aggregated and anonymized form; this means that the recipients of the reports will be unable to draw any conclusions about you personally.
Portions of the vehicle-specific data collected under B. are used for performance of the service processes (e.g. repair, warranty, goodwill) of the Dealer. This processing is within the legitimate interests of the Dealer to provide our customers with the best possible service process. Processing sometimes also takes place in connection with legal requirements (e.g. repair and maintenance information due to the provisions of anti-trust regulations). Technical data is always processed in relation to the vehicle and without direct connection to the customer in order to protect the privacy of our customers.
The following data categories are used for this:
Vehicle master data (vehicle type, color, equipment, etc.)
Vehicle service data (due date of next service visit, oil level, brake wear, etc.)
Vehicle status information (mileage, battery voltage, door and hatch status, etc.)
The technical vehicle data is deleted at the end of the vehicle life cycle.
In part, we process your data in order to make the administration of the various companies within BMW Group as efficient and successful as possible. One of the areas this affects is common group accounting in accordance with international accounting regulations for companies (such as the International Financial Reporting Standards (IFRS)).
E. Customer support
Dealers, BMW branches and BMW partners use your personal data for communication as part of concluding contracts, see above (e.g. booking BMW Digital services) or for the transaction of a request formulated by you (e.g. inquiries and complaints to BMW Customer Support). We contact you regarding all aspects of concluding a contract or processing a request without special permission e.g. in writing, by phone, by messenger services, by e-mail, depending on which contact data you have specified.
F. Marketing communications and market research due to consent
If you have given your consent to any further use of your personal data, your personal data may be used and, if necessary, passed on to third parties in accordance with the scope outlined in the consent form, such as for promotional purposes (e.g. for selected products and services of the BMW Group and promotional partners) and/or market research. The details in this regard can be found on the respective consent form, which may be withdrawn at any time.
G. Fulfillment of legal obligations of Dealer
Dealer will also process personal data if there is a legal obligation to do so. This could be the cause if we needed to contact you because your vehicle is subject to a vehicle recall or repair request.
Collected data is also processed as part of safeguarding the operation of IT systems (back-end and vehicle systems). Safeguarding in this context includes, but is not limited to, the following actions:
Backup and restoration of data processed in IT systems
Logging and monitoring transactions to check the specific functionality of IT systems
Detecting and protecting against unauthorized access to data to guarantee the integrity and security of IT systems Incident and problem management for resolving problems in IT systems.
Collected data is also processed as part of internal compliance management, wherein we review aspects such as whether you have received sufficient advising as part of concluding an agreement and whether dealers have complied with all legal requirements.
Dealer is subject to a number of additional legal obligations. In order to comply with these obligations, we process your data to the extent needed and pass on this data to the responsible authorities if necessary as part of legal reporting requirements.
H. Data transfer to selected third parties
The data collected under B. can be passed on to a third party electronically at your request. This is used in the fulfillment of other purposes in the relationship between you and the third party, such as concluding a usage-related insurance policy for your vehicle.
You can find more information at www.bmw-connecteddrive.de/app/index.html#/portal/cardata.
Dealer provides the data collected under B. to third parties in anonymized form for the purposes of using resources such as mobility services, maps and tools, especially in combination with highly automated, fully automated and autonomous driving.
How long do we store your data?
We save your personal data only for as long as the specific purpose requires. If the data is processed for several purposes, the data is deleted automatically or saved in a form that cannot be traced directly back to you once the last specified purpose has been met.
How is your data stored?
We store your data in accordance with the state of the art of technology. The following security measures serve as an example of the measures applied to protect your personal data from misuse or other unjustified processing:
The availability of access to personal data is restricted to just a limited number of authorized persons for the specified purposes.
Collected data is transferred only in encrypted form.
Sensitive data is also saved only in encrypted form.
The IT systems for processing the data are compartmentalized from other systems, e.g. to prevent hacking.
In addition, access to these IT systems is monitored continuously in order to ward off and detect misuse early.
To whom is the data passed and how do we protect it along the way?
BMW is a global company. Personal data is processed by Dealer’s employees, BMW’s employees, national sales companies, and by service providers we have commissioned, with preference given to those within the EU.
If data is processed in countries outside your jurisdiction or the EU, Dealer uses standard agreements, including suitable technical and organizational measures, to ensure that there is an adequate level of protection for your rights and freedoms in relation to the processing of your personal data . If you want to access the actual protections for data transfer to other countries, please contact us using the communications channels specified below.
How can you view and modify your data privacy settings?
You can change your settings for the use of your data in BMW online accounts at any time using the corresponding options in your My BMW online account (if available), in your BMW ConnectedDrive account or in the My BMW App.
You can access the following data and, if possible, change it:
Consent in advertising communication – here you can (if available) choose your desired communication channels (post, email etc.) and agree to the use of statistical procedures to create an individual customer profile in order to offer you personalized offers for products and services.
BMW CarData – here you can view and download or transfer your vehicle data.
BMW ConnectedDrive Account – here you can view and change your detailed settings for BMW ConnectedDrive. Some BMW ConnectedDrive settings can only be changed via the My BMW App or only in the vehicle. We kindly ask you to use the corresponding options in the App or in the vehicle.
However, the settings for the use of your data by BMW Partners cannot be changed in the data protection portal of BMW in your online account. For such a change or if you have any questions about the use of your data, you must therefore contact the relevant BMW Partner directly.
Contact details, your rights as a data subject and your right to lodge complaints with a supervisory authority.
In the event of questions regarding our use of your personal data, please start by contacting customer support of the authorized dealership in your jurisdiction.
As persons affected by the processing of your data, you can assert certain rights in accordance with applicable data protection laws. The following section contains explanations regarding your rights as a data subject:-
Rights as a data subject
In accordance with applicable data protection laws, you specifically have the following rights as a data subject in relation to the Dealer:
Right of access by the data subject: At any time, you can request information about the data that we have about you. This information includes the data categories processed by us, the purposes for which we process it, the source of the data if we did not collect it from you directly and, where applicable, the recipients to which we have transferred your data. You can obtain a free copy of your data from us. If you are interested in additional copies, we reserve the right to charge you for any additional copies.
At any time, you can access the data stored at BMW in accordance with the statements under B over the My BMW portal at www.bmw-connecteddrive.de/app/index.html#/portal/cardata. There you can also exert your right to data portability.
Right to rectification: You can request that we rectify your data. We will take appropriate measures to maintain, based on the latest information available to us, the correctness, completeness and timeliness of the data we have and continue to process regarding you.
Right to data portability: Instead of receiving a copy of your data, you can also request that we transfer the data directly to another data controller that you specify. Where technically feasible, the data will be directly transmitted to the other data controller in a structured, commonly used and machine-readable format, at your request. This right shall be available to you only insofar as data processing is based on your consent or is necessary in performance of an agreement.
Right to prevent processing (DPA section 11): You can, on any of the grounds set out below, at any time by notice in writing, require us to cease, or not to begin processing, or processing for a specified purpose or in a specified manner, any of your personal data. The grounds are:-
- the processing of the personal data, or the processing of the personal data for that purpose or in that manner, is causing or is likely to cause, substantial damage or substantial distress to you or to another person, and that the damage or distress caused or likely to be caused (as the case may be) is unwarranted;
- the personal data is incomplete, or irrelevant, having regard to the purpose of the processing;
- the processing of the personal data, or the processing of the personal data for that purpose or in that manner, is prohibited under any law; or
- the personal data has been retained by the data controller for longer than the period of time for which it may be retained by the data controller under any law.
We will cease processing of your data in such a case. The latter shall not apply if we can demonstrate that the processing is necessary for the performance of the contract with you, for compliance with any legal obligation, to protect your vital interests, for the administration of justice or the exercise of any other functions of a public nature exercised in the public interest or the processing is necessary for the purpose of our legitimate interests.
Periods for fulfillment of rights as a data subject
We always make an effort to comply with all requests within 30 days. This period, however, may be prolonged for any reason relating to the specific right of a data subject or the complexity of your request.
Information restriction for fulfillment of rights as a data subject
In certain situations, we may be unable to provide you with any information about any of your data due to legal requirements. If we are required to decline a request for information in such a case, we will promptly notify you of the reasons for the refusal.
Complaints to supervisory authorities
If you feel that your complaint or concern has not been adequately addressed, you have the right to lodge a complaint with the relevant regulatory or supervisory authority in your jurisdiction.
