Privacy.

BMW M GmbH (hereinafter “BMW M”), Daimlerstr. 19, 85 748 Garching-Hochbrück, seat and court of registry: München HRB 44 621 (hereinafter “BMW M”) is the controller within the meaning of the EU General Data Protection Regulation (“GDPR”) for the processing of your personal data. The BMW M is headquartered in Munich; It is a subsidiary of BMW AG.

BMW M collects and processes your personal data in the following cases, among others:

• If you contact us directly, e. g. when registering to participate in the BMW M Sports Trophy via the website https://www.bmw-motorsport.com or by direct access at https://www.bmw-sports-trophy.com
• If you request information about our products and services (e. g. newsletters or brochures).
• When you respond to our direct marketing activities, such as filling out a response card during an event or submitting your information online on one of our websites.

Please help us to keep your information up to date by informing us of any changes to your personal data – in particular to your contact details.

The following categories of personal data may be collected through the many services and contact channels described in this Privacy Notice:
Contact details ► Name, address, telephone number, e-mail address, language,
Interests ► Information provided by you about the race vehicles you are using (vehicle type) and race participation planned by you
Use of websites and communication ► Information about how you use the Site and whether you open or forward communications from us, including information collected through cookies and other tracking technologies. For more information, please refer to the link below in our BMW Cookie Policy.
Transaction and interaction data ► Interactions with BMW M Sports Trophy Customer Service (your inquiries and complaints).
Driver/team information ► Driver classification, team classification, race results, championship stands, driver/team history.
Film/photomaterial ► Please only upload pictures and movies to our portal that are free of third party rights. This material may, after your consent, be used by us for communication /to be used for marketing.

The data collected in connection with the provision of the services are processed for the following purposes:

A.Fulfillment of the contractual agreement for the provision of event services (Art. 6 para. lit . b ) GDPR)
In order to determine the 25 best drivers and the 10 best teams among the participants, BMW provides various services, such as evaluating the official results lists of the race organizers. For the provision of these services, the following personal information, if applicable, is processed by BMW M and commissioned service providers::

• Contact details (name, first name, address, e-mail address, etc.)
• Business contact data (name, first name, company, company address, business e-mail address etc.)

B. Customer service (Art. 6 (1) lit. b, c , f ) GDPR)
BMW M, BMW M Motorsport uses your personal data to address a concern you have formulated (e. g. inquiries and complaints to BMW M, BMW M Motorsport Customer Service) or to provide information about technical changes, EVO packages, updates, new products.

For all aspects of the processing of a request, we will contact you without separate consent, e. g. in writing, by telephone, by messenger services, by e-mail, depending on the contact media you have specified.

C. Fulfillment of legal obligations to which BMW is subject (Art. 6 para. c , f ) GDPR)
Data collected is also processed in the context of ensuring the operation of IT systems. Ensuring includes following activities:

• Backup and recovery of data processed in IT systems,
• Logging and monitoring of transactions in order to check the correct functioning of IT systems
• Detection and prevention of unauthorised access to personal data
• Incident and problem management for troubleshooting in IT systems.

BMW is subject to a variety of other legal obligations. In order to comply with these obligations, we process your data to the extent necessary and, where appropriate, pass it on to the responsible authorities in accordance with statutory reporting obligations.

D. Data transmission to selected third parties
Data shall be forwarded to the following companies, if and insofar as the necessary data protection requirements are met:

• To BMW Partner (e. g. your request for a test drive or a service to fulfil the service and to be able to submit specific offers). Your enquiries will be forwarded prioritized to your preferred BMW partner, the BMW partner from whom you have purchased products or services, and the partner with whom you are in contact. If you have not yet contacted a BMW Partner, we will forward your request to a BMW Partner in your region.
• To BMW Partner, to update data, e. g. your contact details. The data for the data update will be forwarded to all BMW partners who will keep you in the address book.
• To carefully selected and audited service providers and business partners with whom we work in order to be able to offer you products and services. We do this on behalf of BMW M GmbH only in the context of the strict requirements of data processing on behalf of or on the basis of your express consent
• When selling one or more business units of BMW AG to a company to which we transfer our rights, in compliance with any agreements with you.
• To other third parties (e. g. public bodies) insofar as we are legally obliged to do so.

We secure your data according to the state of the art. The following are examples:
Safeguards applied to protect your personal data from misuse or other unauthorized processing:

• Access to personal data is restricted to a limited number of authorized persons for the purposes indicated.
• Data collected is only transmitted in encrypted form.
• Sensitive data is only stored on high-security servers.
• The IT systems used to process the data are technically closed off from other systems in order to prevent unauthorized access e. g. by hacking.
• In addition, access to these IT systems is constantly monitored in order to detect and prevent misuse at an early stage.

Your data will be deleted as soon as you unsubscribe from participation in the BMW M Sports Trophy. If you request deletion of your data directly after the end of the season, your data will only be deleted after 2 weeks (after expiry of the objection period for evaluating the ranking of the Sports Trophy ranking).

To ensure that all your data is deleted in line with the principle of data minimization, BMW has developed an internal deletion concept. The basic principles according to which this deletion concept provides for the deletion of your Personal Data are set out below.

Use for the performance of a contract
In order to fulfil contractual obligations, data collected by you may be retained for as long as the contract is in force, depending on the nature and scope of the contract, for 6 or 10 years beyond that period in order to comply with statutory retention obligations and to clarify any requests or claims after the contract has expired.

In addition, there are contracts for the supply of products and services that require longer retention periods, see also below “Use for the examination of claims”.

Use for the examination of claims
Data that, in our sole discretion, will be necessary to investigate, defend against or initiate criminal proceedings against you, us or third parties or to make claims against you, us or third parties may be retained by us for as long as appropriate proceedings may be initiated.

Used for customer service and marketing purposes
For customer service purposes, the data collected by you may be stored 3 to 10 years after the collection, unless you wish the deletion of this data and there are no contractual or statutory retention obligations to prevent such deletion.

Personal data is processed preferably within the EU by us, as well as by commissioned service providers. In the context of IT services, in particular for support purposes, it may be necessary for commissioned service providers based outside the EU to access personal data. We select these service providers carefully and ensure an adequate level of data protection through contractual as well as technical and organizational measures. As a rule, we agree on the EU standard contractual clauses, possibly with additional contractual rules.


If you would like to take a look at the specific safeguards for the transfer of data to other countries, please contact us using the communication channels listed below. For some countries outside the EU, such as Canada and Switzerland, the EU has already established a comparable level of data protection. Due to the comparable level of data protection, the transfer of data to these countries does not require any specific authorization or agreement.

If you have any questions about our use of your personal data, please contact us at BMW M Customer Service – either by e-mail at customer.service@bmw-m.com or by phone at 0049 89 1250 160 16.

In addition, you can contact the responsible data protection officer of BMW M:

BMW M GmbH
Datenschutzbeauftragter
Daimlerstr. 19
85748 Garching-Hochbrück
datenschutz@bmw.de

As a person affected by the processing of your data, you can assert certain rights with us under the GDPR and other relevant data protection regulations. The following section provides explanations of your data subject rights under the GDPR.

Rights of the persons concerned
According to the GDPR, you have in particular the following rights vis-à-vis BMW M as a data subject:

Right to information (Art. 15 GDPR) :You may at any time request information from us about your data that we hold about you. This information includes the categories of data processed by us, the purposes for which we process them, the origin of the data, if we have not collected it directly from you, and, if applicable, the recipients to whom we have transmitted your data. You can receive a free copy of your data from us. Should you be interested in further copies, we reserve the right to charge you for further copies.

Right to rectification (Art. 16 GDPR) :You can ask us to correct your data. We will take reasonable steps to keep the information we hold about you and process on an ongoing basis accurate, complete and up-to- ate, based on the most up-to-date information available to us.

Right to erasure (Art. 17 GDPR): You can request the erasure of your data if the legal requirements for this are met. According to Art. 17 GDPR, this may be the case, for example, if

• the data are no longer necessary for the purposes for which they were collected or otherwise processed;
• you withdraw your consent, which is the basis of the data processing, and there is no other legal basis for the processing;
• you object to the processing of your data and there are no overriding legitimate grounds for the processing, or object to the processing of data for direct marketing purposes;
•  the data has been processed unlawfully unless the processing is necessary to ensure compliance with a legal obligation that requires us to process your data;
• in particular with regard to statutory retention periods;
• to assert, exercise or defend legal claims.

Right to restriction of processing (Art. 18 GDPR):
You may request that we restrict the processing of your data if:

• you dispute the accuracy of the data for the period we need to verify the accuracy of the data;
• the processing is unlawful and you refuse to delete your data and instead request the restriction of its use;
• we You no longer need your data, but you need it to assert, exercise or defend legal claims;
• You have lodged an objection to the processing as long as it has not yet been determined whether our legitimate reasons outweigh yours.

Right to data portability (Art. 20 GDPR) : At your request, we will transfer your data – insofar as this is technically possible – to another controller. However, you only have this right if the data processing is based on your consent or is necessary to perform a contract. Instead of receiving a copy of your data, you can also ask us to transfer the data directly to another controller specified by you.

Right to object (Art. 21 GDPR): You may object to the processing of your data at any time for reasons arising from your particular situation, provided that the data processing is based on your consent or on our legitimate interests or those of a third party. In this case, we will no longer process your data. The latter shall not apply if we can demonstrate compelling legitimate grounds for processing that outweigh your interests or if we need your data to assert, exercise or defend legal claims.

Time limits for the fulfilment of rights of data subjects
As our matter of principle, we strive to respond to all requests within 30 days. However, this period may be extended for reasons relating to the specific rights of the data subject or the complexity of your request.

Restriction of information in the exercise of rights of data subjects
For certain situations, we may not be able to provide you with information about all of your data due to legal requirements. If we have to reject your request for information in such a case, we will also inform you of the reasons for the rejection.

Complaint to supervisory authorities
BMW M takes your concerns and rights very seriously. However, if you believe that we have not adequately addressed your complaints or concerns, you have the right to lodge a complaint with a competent data protection authority.