Welcome to BMW.

Legal information on data privacy.

The high standards that you set for the characteristics of our products and services are our guideline for handling your data. Our aim is to create and maintain the basis for a trusting business relationship with our customers and prospects. The confidentiality and integrity of your personal data is very important to us.


Who is responsible for data processing?

The Bayerische Motoren Werke Aktiengesellschaft, Petuelring 130, 80788 München, Sitz und Registergericht: München HRB 42243 (subsequent BMW) is the provider of the BMW Classic Shop and is responsible for data processing in this context.

What data do we process about you and for what purpose?

The data collected in connection with the conclusion of the contract are processed for the following purposes :


A. Conclusion of contract and fulfillment of contractual obligations (Art 6 (1) (b) GDPR

As part of the conclusion of the contract and for the purpose of fulfilling a purchase contract concluded via the BMW Classic Shop, the following data categories are processed:

- contact information (name, first name, address, email address, etc.)
- Identification data (e.g., Q number, name / username, password)
- Payment information
- Basic contract data (for example, type of contract, interest in products or conclusion of a contract)
- Customer history or profile (for example, order history)
- Vehicle identification number (VIN)

Financial transactions will be canceled within 10 years.

Without a provision of the data by you and their processing, the BMW Classic Shop cannot provide the respective purchase contract for you.


B. BMW Group Login

For the full use of the BMW Classic Shop you have to register. By registering, you will receive an online customer account that allows you access to other portals of the BMW Group with consistent access data.


C. Customer care (Article 6 (1) (b) (f) GDPR)

We use your personal data to address in the context of contract execution or for processing a request you have made (e.g. inquiries and complaints to BMW Classic Shop customer service). For all aspects of the contract or the settlement of a concern we speak to you without separate consent in writing, by telephone, via messenger services, by e-mail, depending on the contact media you have specified.

D. Marketing communication and market research based on consent (Article 6 (1) (a) GDPR))

If you have separately given your consent to further use of your personal data, your personal data may be used in accordance with the scope described in the consent, for example for advertising purposes and / or market research, and may be passed on to third parties. Details on this can be found in the respective declaration of consent, which is revocable at any time.

E. Performance of legal obligations to which the BMW operation is subject (Article 6 (1) (c) DSGVO)

Collected data is processed as part of ensuring the operation of IT systems. Under certainty, u.a. following activities understood:

- Backup and recovery of data processed in IT systems,
- Logging and monitoring of transactions to verify proper functioning of IT systems,
- Detection and prevention of unauthorized access to personal data,
- Incident and problem management for troubleshooting IT systems.

BMW is subject to a large number of other legal obligations. In order to comply with these obligations, we process your data to the required extent and, if necessary, pass these on to responsible authorities within the scope of legal obligations.


How long do we save your data?

We store your personal data only as long as the purpose requires. If data is processed for multiple purposes, the data will be automatically deleted or stored in a form that you cannot directly trace back to as soon as the last specified purpose has been met.


How are your data saved?

We secure your data according to the state of the art. For example, the following safeguards are used to protect your personal information from misuse or other unauthorized processing:

- Access to personal data is restricted to a limited number of beneficiaries for the purposes stated.
- Collected data will only be transmitted in encrypted form.
- Sensitive data is stored only in encrypted form.
- The IT systems for processing the data are technically isolated from other systems to prevent unauthorized access, e.g. to prevent by hacking.
- In addition, access to these IT systems is permanently monitored in order to detect and ward off abuse at an early stage.


To whom do we share information and how do we protect it?

Personal data are preferably processed within the European Union by employees of the BMW operation and service providers commissioned by us.

If necessary for the purpose of fulfilling the contract with you, data will also be passed on to third parties outside the European Union, for example if this is necessary for the shipment of the ordered goods to you.


Contact details, your data subject rights and your right to complain to a supervisory authority.

If you have any questions about the use of your personal data by us, it is best to first contact the customer service of the BMW Classic Shop) - either by e-mail at classic-shop@bmw.de or by calling the number hours +49 (0)800 - 60 70 700 (monday-friday 8 am - 8 pm).

In addition, you can contact the responsible data protection officer:

Stefan Winkler
BMW AG
Petuelring 130
80788 München
datenschutz@bmw.de

As persons affected by the processing of your data, you can claim certain rights under the EU Data Protection Regulation (GDPR) as well as other relevant data protection regulations. The following section contains explanations of your rights under the GDPR.


Affected rights

According to the GDPR, you are entitled to the following rights in particular as affected person:

Right to information (Art. 15 GDPR): You can request from us at any time information about your data that we hold about you. This information includes, but is not limited to, the categories of data we process for which purposes we process them, the source of the data if we have not collected it directly from you, and, if applicable, the recipients to whom we have submitted your information. You can get a free copy of your data from us. If you are interested in further copies, we reserve the right to charge you further copies.

Right to correction (Art. 16 GDPR): You can demand the correction of your data from us. We will take reasonable steps to keep the information we hold about you, and process them, accurate, complete and up-to-date, based on the most up-to-date information we have.

Right to cancellation (Art. 17 GDPR): You can demand the deletion of your data from us, provided that the legal prerequisites exist. This may be the case under Art. 17 GDPR if

- the data is no longer required for the purposes for which it was collected or otherwise processed;
- You revoke your consent, which is the basis of data processing, and lack any other legal basis for processing;
- You object to the processing of your data and there are no legitimate reasons for processing, or you object to the processing of data for direct marketing purposes;
- the data was processed unlawfully;

unless processing is necessary,

- to ensure compliance with a legal obligation that requires us to process your data;
- especially with regard to statutory retention periods;;
- to assert, exercise or defend legal claims.

Right to restriction of processing (Art. 18 GDPR): You may demand that we restrict the processing of your data if

- you deny the accuracy of the data for the period we need to verify the accuracy of the data;
- the processing is unlawful and you refuse the deletion of your data and instead demand the restriction of use;
- we no longer need your information, but you need it to enforce, exercise or defend your rights;
- You have objected to the processing, as long as it is not certain that our legitimate reasons outweigh yours.

Right to data portability (Art. 20 GDPR): At your request, we will transfer your data - as far as this is technically possible - to another person in charge. However, you are only entitled to this right if the data processing is based on your consent or is required to carry out a contract. Instead of receiving a copy of your data, you may also ask us to submit the data directly to another person in charge who you specify.

Right to objection (Article 21 GDPR): You may object to the processing of your data at any time for reasons that arise from your particular situation, if the data processing is based on your consent or on our legitimate interests or those of a third party. In this case, we will no longer process your data. The latter does not apply if we can prove compelling legitimate reasons for the processing that outweigh your interests or we need your data to assert, exercise or defend legal claims.


Time limits for the fulfillment of data subject rights

We make every effort to comply with all requests within 30 days. However, this period may be extended for reasons relating to the specific right or complexity of your request.


Restriction of information in the fulfillment of data subject rights

In certain situations, we may be unable to provide you with information about all of your information due to legal requirements. If we have to decline your request for information in such a case, we will inform you at the same time about the reasons for the refusal.


Complaints to regulating authorities

BMW takes your concerns and rights very seriously. However, if you believe that we have not adequately complied with your complaints or concerns, you have the right to lodge a complaint with a competent data protection authority.