BMW Italia Retail S.r.l. Privacy Policy

BMW Italia Retail S.r.l., with main offices in Rome (RM), Via Salaria 1268, and subsidiaries in Rome and Milan, is a company controlled by BMW Italia S.p.A ("BMW Italia") providing for sales and assistance services in relation to BMW, MINI, BMW Motorrad and Rolls Royce vehicles, and is the owner of the data collected within the scope of such activities, as well as the data collected in its websites (including but not limited to miniroma.mini.it, bmwroma.it, bmwmilano.it, minimilano.it, milano.bmwmotorrad.it, roma.bmwmotorrad.it, rollsroycemotorcars-roma.it, rolls-roycemotorcars-milano.it, usato-roma.bmw.it, usato-milano.bmw.it, bmwroma.store, bmwmilano.store) or applications.

BMW Italia promotes BMW brands in Italy (including BMW i sub-brand), MINI and BMW Motorrad brands ("BMW brands"), finds sales and assistance dealers, authorized garages and agents, and deals with offering second-level support as well as solving customers’ technical issues.

Moreover, it manages bmw.it, mini.it, bmw-motorrad.it internet sites, MyBMW and MyMINI online accounts and the ConnectedDrive service.

Therefore, BMW Italia is the owner of the processing of personal data collected through its internet sites (bmw.it, mini.it, bmwmotorrad.it), MyBMW and MyMINI accounts, ConnectedDrive services (customer contact point for operational and contractual issues), while performing second-level support activities or resolving technical issues.

BMW AG is the enterprise heading BMW Group and provides for most IT infrastructures and associated services.

Within the scope of said activities, it plays the data processor role.

BMW AG is also the owner of the personal data received through the use of Connected Apps, for research and development activities, as well as the data processing co-owner for the provision of ConnectedDrive services (technical provision of the services).

The contact details of the data processing owner of BMW Italia Retail and the Data protection owner can be found [here].

In this Privacy Statement, with the term "We" it is only referred to BMW Italia Retail S.r.l.

We process your personal data within the following and other circumstances:

• If you contact us directly, for example through our internet sites, via email or by calling our direct line, to request information on our products and services.
• If you buy one of our products or services.
• If you answer our marketing campaigns, e.g., by an answer form, or entering details in one of our internet sites.
• If your contact details, prior to your consent, are communicated to us by BMW Italia Spa to perform marketing activities.
• If your vehicle details (including the chassis number) are communicated to BMW AG, should your vehicle be serviced or repaired, for example, by sales and assistance dealers or authorized garages.
• If other BMW Group companies or business partners legally transfer your personal data to us.
• If we acquire your personal data from other sources (e.g., intermediaries), in full regulatory compliance.
• If you take part in an event organized by BMW Italia Retail S.r.l.
• If you provide personal data on behalf of someone else, as it is your responsibility first to make sure that the interested party has read this Privacy Statement.
• If you are younger than 16, as you should not provide us with any personal details.
• If you visit our internet sites. For more information, you can visit the “cookie” page, that can be reached from the footer in our websites.

We kindly ask you to help maintain and update your personal data, and inform us of any changes.

The following categories of your personal data are examples of data typologies than can be collected through the different contact services and channels described in this Privacy Statement:

• Contact details – information such as name, address, phone number, email address.
• Interests – information you provide on your interests, including the type of vehicles you are interested in.
• Other personal details – information you provide on your birth date, education or occupational situation.
• Contract data – customer and contract numbers, ConnectedDrive active services.
• Use of the website and communications – information on how you use our website, open or submit our communications, including the information collected by cookies and other tracking technologies (you can find our Cookie Statement [here]).
• Online account data - information on any accounts created in our websites.
• Sales and assistance information – information on purchases, support and assistance, including complaints.
• Vehicle configuration details – information on your vehicle's functions and current settings (identified by the chassis number).
• Vehicle’s technical information – information on how the engine and the systems inside the vehicle are or have been working.
• Pictures – pictures of you, collected with photos and/or videos taken at events organized by BMW Italia Retail S.r.l.

Personal data processing, in compliance with the European regulations on data protection, should be made legitimate by any of the different expected legal conditions; we are bound to indicate such conditions for each of the processing cases described in this Statement. An insight into such possible conditions can be found here. You will find the indication of the condition on the basis of each processing purpose in the respective footnote.

For the purposes describe below, your personal data shall be in any case primarily processed with IT tools, also by using the different channels available depending on the vehicle configuration or its default equipment (such as the in-car communication channels).

A. Purpose: Customer retention and marketing – to provide you with news and offers.

BMW Italia Retail S.r.l. uses personal data as referred to in "Contact details", "Interests", "Other personal data", "Use of the website and communications", "Sales and assistance" categories, in order to contact you for general business offers or offers respecting your preferences, to invite you to promotional events, and perform market research.

Data processing condition: consent [link]

Option: the consent can be revoked at any time through the Customer Interaction Center

B. Purpose: Communication to BMW Italia for customer retention and marketing – to meet your requirements and provide you with news and offers, with your consent, BMW Italia Retail S.r.l. can submit BMW Italia S.p.A. your personal data as referred to in "Contact details", "Interests", "Other personal data", "Use of the website and communications", "Sales and assistance" categories, so that it can contact you for general business offers or offers respecting your preferences.

Data processing condition: consent [link]

Option: the consent can be revoked at any time through the Customer Interaction Center

C. Purpose: Fulfilment of a customer’s request – to follow up your requests (e.g. test drive, also with further subscriptions of loan contracts, estimates, requests for contact or participation in public events, driving courses, service executions, e-commerce, business card contacts, etc.). BMW Italia Retail S.r.l. collects the data as referred to in "Contact details" and "Other personal data" categories, also through the internet sites, in order to answer your requests, i.e. it receives/transmits it from/to BMW Italia S.p.A. to perform said activities.

Data processing condition: execution of pre-contractual measures [link]

Option: –

C1. Personal data collected for the purpose of "Fulfilment of a customer’s request" can also be processed for the further purpose of Review of the feedback to your requests, so as to improve the service to customers.

Data processing condition: Legitimate interest: this data processing is based on the legitimate interest [link] of BMW Italia Retail S.r.l. in assessing the degree of effectiveness of the feedback to the customer’s requests, so as to check that the quality standards of the services are compliant to those of BMW Group, and adopt any improvement measures that should be appropriate, also in the customer's interest.

Option: objection in case of a legitimate interest, if conditions apply

D. Purpose: Vehicle sales and assistance - to manage the sales, configure your vehicle and provide for the associated services. BMW Italia Retail S.r.l. collects the "Contact details", "Vehicle configuration details", "Vehicle’s technical information" and "Sales and assistance information", should you purchase the vehicle online as well, and be assisted or have the vehicle repaired by us as part of the sales or assistance, and we will use it to provide for the services requested by you and inform you in case of any issues or works to be carried out on your vehicle. Such information can be accessed by BMW Italia and BMW AG, providing for the IT infrastructure, also to identify and resolve any technical or other issues on the provision of the indicated services, as well as to complete any tasks necessary to finalize the sales process (e.g. in case of a car ordered from the catalogue and made in the factory). Finally, BMW Italia Retail could process such data also for ordinary administrative or accounting purposes.

Data processing condition: fulfilment of contractual obligations; legitimate interest as regards administrative or accounting purposes [link]

Option: -

E. PersonaI data collected for the purpose of "Vehicle sales and assistance" could also be processed for the further purpose of carrying out “Customer satisfaction surveys”. BMW Italia Retail could process the data received by BMW Italia S.p.A concerning surveys intended to rate the customer satisfaction with the provided services. BMW Italia S.p.A. can share your Contact details and the survey results with BMW Italia Retail providing you with the service, so that it can get in touch with you again should you express dissatisfaction, complaints or grievances. If you do not wish to be contacted again, it will be sufficient to anonymize the survey carried out by BMW Italia S.p.A., by following the instructions that will be given to you along with the relevant questionnaire.

Data processing condition: legitimate interest [link]

Legitimate interest: this data processing is based on the legitimate interest of BMW Italia Retail in improving the sales and assistance service.

Option: - objection in case of a legitimate interest, if conditions apply

E.1 PersonaI data collected for the purpose of "Vehicle sales and assistance" could also be processed for the further purpose of “Sending communications of interest to the customers”. BMW Italia Retail could process such data for sending communications with a content of exclusive interest to customers (such as notices of overhaul period expiration for cars, or communications about new functionalities added to the purchased services or products), as well as for customer relationship management purposes, in case customers have to be contacted again because of issues or inconveniences experienced by them (the so-called “sorry activities” or “caring activities”). For such communications, BMW can use the available contact channels (e.g., email, phone/messaging service, in-car, mail).

Data processing condition: legitimate interest [link]

Legitimate interest: this data processing is based on the legitimate interest of BMW Italia Retail in improving the sales and assistance service, as well as maintaining a high-quality standard in the customer relationship.

Option: objection in case of a legitimate interest, if conditions apply

F. Purpose: Promotion of BMW Brands – to promote BMW Brands on social channels or other media. At events with video and filming services, BMW Italia Retail S.r.l. could collect the personal data connected with the “Picture” of yourself, without acknowledging you any compensation, in order to promote BMW Brands by posting such a Picture on any medium or disseminating it by any means, including social channels (e.g., Facebook, Twitter, Instagram) or having it published on local, national or international newspapers and in any other forms or transmission media, existing or future.

Data processing condition: consent [link]

Option: the consent can be revoked at any time, through our Customer interaction Center [link in the “Contacts” section], subject to posting on social channels.

G. Purpose: Insurance claims handling – to protect one’s own interests, fulfil legal and contractual obligations or measures by the Judicial Authority. BMW Italia Retail, during events organized for the promotion of BMW Brands or for its vehicle fleet management, needs to be covered in terms of insurance. Therefore, your Contact details could be processed by the company for such purposes and communicated to BMW AG, the insurance companies and, in case of incidents, the third-party companies in charge of valuing the amount of expenses or damage.

Data processing condition: legal obligations, fulfilment of contractual obligations and legitimate interest

Legitimate interest: this data processing is based on the legitimate interest of BMW Italia Retail in protecting its assets and image.

Option: - objection in case of a legitimate interest, if conditions apply

H. Purpose: Defence of rights in the course of judicial, administrative or extra-judicial proceedings and within disputes arising from the offered services - your personal data could be processed by BMW Italia Retail S.r.l. to defend its rights or take legal action or otherwise lodge claims against you or third parties.

Data processing condition: legitimate interest

Legitimate interest: this data processing is based on the legitimate interest of BMW Italia Retail in safeguarding and defending its own rights.

Option: - objection, if conditions apply

I. Purpose: fulfilment of obligations provided for by law, regulations or the Community legislation, by provisions/authority requests made legitimate by the law and/or supervision and control entities - BMW Italia Retail S.r.l. can process your personal data to fulfil the obligations it is bound to, including the obligations connected with any recall actions that can involve the car owned by you.

Data processing condition: legal obligations

Option: -

L. Purpose: Account management for the access to the websites managed by BMW Italia Retail S.r.l. – in order to provide for digital services connected with the different internet sites managed by BMW Italia Retail S.r.l., that you can access. BMW Italia Retail S.r.l. shall process the "Account data" in order to enable the access to the different internet sites managed by it. As regards the data collected from the other internet or portal sites managed by the other Group companies, we refer you to the statements published there.

Data processing condition: fulfilment of contractual obligations [link]

Option: erasing of the online account

M. Purpose: Online sales – to manage the online sales of spare parts, accessories, BMW lifestyle. BMW Italia Retail will collect "Contact details", "Contract data", "Sales and assistance information", should you purchase spare parts, accessories and/or BMW lifestyle, through the dedicated online portal accessible from shop.bmw.it and shop.mini.it websites, and use them for purposes of operational management, which is strictly functional for the online sales contract conclusion and execution, as well as for purposes strictly connected and linked with them, and derived and instrumental purposes. Such information can be accessed by BMW Italia and BMW AG, providing for the IT infrastructure, also to identify and resolve any technical or other issues on the provision of BMW products, including communications about recall and product improvement actions.

Data processing condition: fulfilment of contractual obligations [link]

Option: -

BMW AG’s PURPOSES

For more transparency, we inform you that BMW AG can access your personal data, for the below specific and other purposes; BMW AG will make sure to provide its Privacy statement as soon as possible each time.

N. PURPOSE: Connected App – in order to provide for digital services about the vehicle through a mobile device. BMW AG will obtain the Contact details, and the Device and vehicle localization data through the provision of said services, processed by it in compliance with what has been provided for in detail for each service, as described [here] and with the Localization data protection [link]. Should you use a third-party application, such as Amazon Echo or Spotify, you will be subject to their terms of service and privacy statement even before being able to use the application. This third-party application operator shall be the owner of the processing of any of your personal data that will be given access to or that is entered through that application. We are not responsible for that use.

Data processing condition: fulfilment of contractual obligations, consent

Option: uninstalling the App from the device, denying the consent through the App

O. Purpose: Account management for the access to the BMW Group portals – in order to provide for digital services to the different portals you can access. BMW AG shall process the Account data in order to enable the access to the different portals managed by it. The specific information on the data processing carried out by BMW AG concerning the single portals shall be available in the same. For more information or to consult BMW AG’s privacy statement, please see www.bmw.de or contact this email address: datenschutz@bmw.de. Other than the use of the BMW Group ID, it is also possible to log in by the preferred social network. In case you choose to log in by a social network, the requested personal data (name, email, etc.) shall be transferred from the social network account to BMW AG. The social network provider shall request the consent for this communication. Further details will be available in the social network privacy statement.

Data processing condition: fulfilment of contractual obligations

Option: erasing of the online account

P. Purpose: Quality control, research and development – in order to improve our products and services. BMW AG can use any information received within the services provided to the BMW Group (including the Vehicle and device localization data) in an anonymised form for the quality control and for product and service development purposes. Before starting this data processing, your information shall be anonymised so that it cannot be associated with you.

Data processing condition: legitimate interest [link]

Legitimate interest: this data processing is based on the legitimate interest of BMW in meeting the high expectation of its customers concerning the quality of our current premium products and services, as well as their requirement for new innovative solutions.

Option: objection in case of a legitimate interest, if conditions apply, through the Customer Interaction Center [link]

Q. Purpose: Obligations provided for by law, regulations or the Community legislation, by provisions/authority requests made legitimate by the law and/or supervisory and control bodies - Finally, BMW AG can process the Vehicle’s technical data (limited to the vehicle’s fuel consumption according to the Commission Implementing Regulation (EU) 2021/392 of 4 March 2021), to fulfil the obligations it is bound to.

Data processing condition: fulfilment of a statutory obligation

Option: the Vehicle’s technical data processing under the Regulation (EU) 2021/392 of 4 March 2021 is based on the Manufacturer’s legal obligation to collect such data, however you can expressly decline to put it at the Manufacturer’s disposal, by reporting it to the sales and assistance dealer or the authorized garage where maintenance has been planned, before any intervention starts.

We use a large number of security measures, including encryption and authentication tools, in order to improve the protection and maintenance of security, integrity and accessibility of your personal data.
Although it is not possible to ensure an intrusion-proof security for data being transmitted over the internet and in websites, we along with our suppliers and business partners make efforts to ensure the physical, electronic and procedural protection intended to safeguard your personal data in compliance with the data protection requirements. We adopt the following and other measures:

• rigorously restricted access to your personal data, according to needs and for the communicated purposes only;

• collected data transfer, when deemed appropriate for specific needs, only in an encrypted form;

• storage of highly confidential information (e.g., credit cards) only in an encrypted form;

• firewall IT systems to prevent unauthorized access;

• permanent monitoring of access to IT systems to identify and stop personal data misuse.

If we have provided you (or you have chosen to be provided) with a password enabling the access to some sections of our website or other portals, applications or services provided by us, you shall be responsible for maintaining this password secret and observing any other security procedure we would make you aware of. We kindly ask you not to share your access credentials (including your password) with anyone.

Localization data protection.

Some services can only be offered if you reveal the location of yourself or your vehicle. We take the localization data confidentiality very seriously.

The security measures applied to the Localization data (including the information accessible within the vehicle assistance process) are described as follows:

• such data is retained, in a form associated with you or your vehicle, only for the time necessary to fulfil the allowed purposes;
• such data is collected, retained or accessible in a form necessary to provide for the requested service, i.e., according to the law;
• the Vehicle localization data and the Device localization data are not connected together unless this is necessary to provide for the requested service;

for any other use of the Vehicle localization data and the Device localization data for purposes of statistical analyses, only irreversibly anonymised data shall be used.

In some specific cases, BMW Italia Retail can access the Vehicle localization data and BMW AG the Device localization data, too, through its provided services (e.g. ConnectedDrive).

You shall be provided with a detailed description of the Localization data necessary to offer a service based on such Data, at the time of purchasing the vehicle or when you have activated or configured the service or application (e.g. ConnectedDrive or Connected App).

However, please consider that BMW AG will not be able to provide you with certain functionalities of some services, should you limit your Localization data collection.

We retain your personal data only for the time necessary to achieve the purposes for which it was collected or for any other connected legitimate purpose (e.g., where relevant for a defence from claims lodged against us or if there is a legitimate interest). Therefore, if personal data is processed for two or more different purposes, we will retain such data up to the expiration date of the longest-term purpose; however, we will cease to process personal data for a purpose whose retention period has already expired.

We limit access to your information for those with an explicit need to use it for relevant purposes.

Your personal data that is no more necessary, or for whose retention there are no longer legal conditions, is irreversibly anonymized (and thus retained) or permanently erased. To this purpose, personal data shall be retained for the time necessary to achieve the purposes for which it was collected. For more clarity, the retention periods with reference to the main purposes are described below:

Marketing purposes: personal data processed for marketing purposes can be retained for 10 years from the date when we obtained your latest consent for such purpose (except for the objection to receive further communications).

Fulfilment of contractual obligations: data processed to fulfil any contractual obligation with you can be retained for the duration of the contract, beyond the following 10 years after the end of the tax year following the current one, to be ready for any tax verification and/or litigation.

In case of litigations: if we need to defend ourselves or take action or, otherwise, lodge claims against you or third parties, we could retain the personal data we will deem reasonably necessary to process for such aims, for the period of time this claim can be prosecuted.

Picture processing: picture data will be retained in the databases of BMW Italia Retail S.r.l. for a period of 24 months, after which time it will be erased.

Fulfilment of a customer’s request: your data provided to us for a request by you (e.g. estimates, brochures or test drives), shall be retained for max. 3 months. Such data can also be processed, for max. 12 months, for the further purpose of review of the feedback to your requests, so as to improve the service to customers.

Your personal data can be accessed by our personnel, agents and suppliers (where External data processors have been appointed), also the ones located in countries outside the European Economic Area (EEA), for any of the determined purposes, whose data protection laws could have lower standards than those in EEA. In this case, we will ensure that all of your personal data accessible outside EEA is processed with the appropriate protection standards.

A few countries outside EEA, like Canada and Switzerland, have been authorized by the European Commission, as they provide for a protection standard similar to EEA data protection and, therefore, no additional protection clauses are necessary. In the case of companies with main offices in foreign countries that have not obtained such an authorization, like India or Japan, you will be asked for your consent to the transfer, or your personal data will be transferred by using the contractual clauses approved by the European Commission. Such clauses enforce similar obligations to protect data directly on the recipient, unless we are granted by the applicable data protection law to transfer data without such formalities.

We kindly ask you to contact us [here], if you wish to request and examine a copy of the specific protection standards applied to your data exporting.

BMW Italia Retail S.r.l., BMW Italia and BMW AG use a series of suppliers to assist them in the provision of the listed services and processing.

BMW AG provides the other Group companies, as data processing owners, with IT and data retention services in connection with most of the described data processing; therefore, on behalf of the owners, it retains most of your personal data listed above.

Although the data being transmitted over the internet or websites cannot be ensured as intrusion-proof, we and our suppliers, as well as our business partners, make efforts to maintain the physical, electronic and procedural security measures aimed at protecting your personal data, by meeting the requirements enforced by the data protection legislation.

All of your personal data is retained in our protected servers (or safely stored paper copies) or on those of our suppliers or our business partners, and can be accessed and used based on our standards and security policies (or equivalent standards for our suppliers or business partners).

Where available, the personal data we collect can be communicated to third parties, on your behalf and with your consent, only in order to allow the interested parties to offer their services (e.g. insurance).

Should you have questions concerning our processing of your personal data, please contact BMW Italia Retail S.r.l. [here]

Moreover, you can get in touch with the DPO indicated [here].

According to the legislation in force, you are entitled to ask us:

• to access your personal data or the copy of the personal data you provided us,

• to update any imprecisions of our records,

• to delete any data for which legal conditions for its processing would no longer exist,

• to revoke your consent, in case the data processing is based on the consent and refers to direct marketing activities, so that this processing can be terminated,

• to object to any processing [including profiling] on the basis of legitimate interests, unless the grounds on which we were liable for the data processing are stronger than any prejudice to your data protection rights,

• to impose restrictions on how we process your personal data while a complaint is under investigation.

Right to object: other than the rights listed previously, you have the right to object any time, for reasons connected with your particular situation, to your personal data being processed by the Owner for the pursuance of its own legitimate interest. Moreover, you may always object any time your personal data is processed for marketing purposes.

The exercise of such rights is subject to a few exceptions aimed at safeguarding the public interest (e.g. prevention or identification of crimes) and our interests. In case you exercise any of the above-mentioned rights, we will be liable for checking that you are entitled to exercise it and normally give you a feedback within a month.

In the event you, if conditions apply, revoke your consent or exercise the right to erasure, it is necessary to consider that this operation will require a technical processing time that we will take care to minimize, but during which you could still be contacted in the context of marketing activities that have already started. Should you not be satisfied with how we process your personal data, or with our feedback, you will have the right to invoke claims to the control authority [link].

Company and Data Protection Owner contacts.

Should you have any questions concerning our processing of your personal data, you can first contact us directly by using the simplified procedure available at the link to BMW Milano or the link to BMW Roma or at the following addresses:

1. BMW Italia Retail S.r.l.:
   Customer Interaction Center at the e-mail address bmwretail.gdpr@bmw.it
   phone number +39.06.88282.1 or the Italian toll-free number +39 800 811 198 (Monday to Friday 8:30 am to 6:00 pm) Via Salaria 1268, 00138 Rome (RM).
   
   
2. Personal Data Protection Officer (DPO) of BMW Italia Retail S.r.l.:
   E-mail address: rpd.retail@bmw.it
   
   

Legal conditions for the personal data processing.

Your personal data processing as described above is authorized by the European data protection regulation, on the basis of the following legal conditions:

• Consent: if you have agreed to their use by giving your consent, that can be revoked any time through the Customer Interaction Center service by BMW Italia Retail S.r.l.;
• Execution of pre-contractual measures or fulfilment of contractual obligations: if it is necessary to conclude or fulfil a contract with us or implement pre-contractual measures;
• Legal obligations: if it is necessary for us to use your personal data to observe our legal obligations;
• Legitimate interest: if we use your personal data to achieve a legitimate interest and our grounds are stronger than any prejudice to your data protection rights;
• Legitimate interest: as far as may be necessary for us to defend ourselves, take legal actions or lodge claims towards you, us or third parties.

Data processing authorized on the basis of further conditions are possible; in this case we shall take reasonable precautions to identify such a condition and communicate it in the most appropriate way.