Privacy.

BMW M GmbH (hereinafter referred to as "BMW M" or "we"), Daimlerstr. 19, 85748 Garching-Hochbrück, Germany, registered office and court: Munich HRB 44621, is the data controller within the meaning of the EU General Data Protection Regulation ("GDPR") for the processing of your personal data described in this notice. BMW M is based in Garching-Hochbrück, Germany; it is a subsidiary of BMW AG.

BMW M is responsible for your data collected and processed in connection with the BMW M Sports Trophy, in particular through the website and portal www.bmw-sports-trophy.com. For other BMW M offers (e.g. www.bmw-m.com, the BMW M Drivers Community or AREA M), the privacy policy of the respective offer applies.

BMW M collects and processes your personal data in the following cases:

• When you register as a driver or team for the BMW M Sports Trophy via the portal, confirm your participation for a new season, or update your profile.
• When you contact us directly, e.g. via the contact form on this website or by e-mail.
• When you subscribe to the BMW M Sports Trophy newsletter.
• When you upload photos, portraits or logos in the portal.
• When you race a BMW in a series evaluated for the BMW M Sports Trophy: we receive the official results lists of the race organizers via our timing-data service provider. This also applies to drivers and teams who have not registered in the portal.

Please help us keep your information up to date by informing us of any changes to your personal data – especially your contact details.

The following categories of personal data may be collected through the services and contact channels described in this data protection notice:

• Contact details ► Salutation, first and last name, address, country, phone number, e-mail address, preferred language.
• Participant data ► Date of birth, racing licence number and a copy of your racing licence, FIA driver categorisation, team name; for teams: name of the contact person.
• Portal account ► Portal ID, e-mail address, password (stored only in encrypted, hashed form), registration and approval status, date of participation confirmation, profile change requests.
• Race results ► Name and nationality as stated in the official results, team, vehicle, start number, class, event, session, finishing positions, trophy category, points, standings and championship history.
• Photos and media ► Driver portraits, team logos and photos that you upload in the portal.
• Communication ► Content of your enquiries via the contact form or by e-mail, and our correspondence with you (e.g. registration approval, winner notification).
• Technical data ► IP address, date and time of access, requested page, browser type and version, as well as the cookies described in our Cookie Policy.

A. Organisation and evaluation of the BMW M Sports Trophy (Art. 6 para. 1 lit. b) GDPR)

To run the BMW M Sports Trophy in accordance with the Terms of Participation, we process your contact details, participant data and portal account. This includes checking and approving your registration, evaluating the official results lists of the race organizers, calculating points and standings, determining the trophy winners, notifying winners and inviting them to the award ceremony.

B. Publication of results and standings (Art. 6 para. 1 lit. b, f) GDPR)

The standings of the BMW M Sports Trophy are published on this website. They show the name, team, vehicle, results and points of the drivers and teams. For registered participants, this publication is part of the trophy (lit. b). For drivers and teams who have not registered, we process the results from the official, publicly available results lists on the basis of our legitimate interest in a complete and transparent evaluation of all BMW competitors (lit. f). You can object to this at any time (see "Right to object").

C. Customer support (Art. 6 para. 1 lit. b, f) GDPR)

We use your personal data to handle a request you have made (e.g. via the contact form) and to communicate with you about your participation. For all aspects of handling your participation or request, we will contact you without separate consent, e.g. in writing, by phone, via messenger services or by e-mail, depending on the contact media you have provided.

D. Newsletter based on consent (Art. 6 para. 1 lit. a) GDPR)

If you have separately given your consent, we will send you the BMW M Sports Trophy newsletter to the e-mail address you provided, in your preferred language. We use the double opt-in procedure: after signing up you receive an e-mail with a confirmation link, and you are only added to the newsletter once you have confirmed. As proof of your consent we store the time of your sign-up and of your confirmation together with the consent text you agreed to. You can revoke your consent at any time with effect for the future, e.g. via the unsubscribe link in every newsletter.

E. Photos, portraits and logos (Art. 6 para. 1 lit. a, b) GDPR)

Driver portraits and team logos are used for the trophy, e.g. at the award ceremony. Photos that you upload in the portal may be used for communication and marketing purposes in accordance with the consent you gave when uploading them.

F. Fulfilment of legal obligations and IT security (Art. 6 para. 1 lit. c, f) GDPR)

BMW M will also process personal data when there is a legal obligation to do so. Collected data will be processed, for example, in the context of ensuring the operation of IT systems. Ensuring includes, among other things, the following activities:

• Securing and restoring data processed in IT systems,
• Logging and monitoring transactions to check the correct functioning of IT systems,
• Detecting and preventing unauthorised access to personal data and misuse of our forms (e.g. spam),
• Incident and problem management to resolve disruptions in IT systems.

BMW M is subject to a variety of other legal obligations. To comply with these obligations, we process your data to the necessary extent and may pass it on to the responsible authorities in the context of legal reporting obligations. Furthermore, we may process your data in the event of a legal dispute if the legal dispute necessitates the processing of your data.

G. Storage of and access to information on your end devices (§ 25 TDDDG)

When you use this website, we store cookies on your device. We only use cookies that are absolutely necessary to provide the service you have explicitly requested (e.g. logging in to the portal, securing forms, remembering your language); this is done without your consent in accordance with § 25 para. 2 no. 2 TDDDG. We do not use cookies or similar technologies for analytics, advertising or tracking. Details can be found in our Cookie Policy.

Within BMW M, only the persons responsible for the BMW M Sports Trophy have access to your data. In addition, we use carefully selected service providers who process data on our behalf and in accordance with our instructions (Art. 28 GDPR):

• the agency that runs the BMW M Sports Trophy office on our behalf (e.g. handling registrations and contact enquiries),
• the service provider responsible for developing and operating the website and portal,
• a hosting provider whose servers are located in Frankfurt am Main, Germany,
• an e-mail service provider for sending system e-mails (e.g. registration, password reset, winner notification) and the newsletter,
• our timing-data service provider, from whom we receive the official results lists of the race organizers.

Results and standings are published on this website (see B.). We only pass on data to other third parties (e.g. public authorities) if we are legally obliged to do so.

Personal data is preferably processed by us and commissioned service providers within the EU. Should data be processed in countries outside the EU, EU standard contracts including appropriate technical and organisational measures ensure that your personal data is processed in accordance with the European data protection level. If you would like to see the specific protective measures for the transfer of data to other countries, please contact us using the communication channels provided below. For some countries outside the EU, such as Canada and Switzerland, the EU has already determined a comparable level of data protection. Due to the comparable level of data protection, the transfer of data to these countries does not require special approval or agreement.

We will only retain your data for as long as is necessary for the respective purposes for which we process your data. If we process data for multiple purposes, it will be automatically deleted or stored in a format that does not allow direct conclusions about your person as soon as the last specific purpose has been fulfilled.

Your portal data will be deleted as soon as you unsubscribe from participation in the BMW M Sports Trophy. If you request deletion of your data directly after the end of the season, your data will only be deleted after 2 weeks (after expiry of the objection period for the evaluation of the Sports Trophy ranking).

Results and standings of past seasons, including the list of trophy winners, are kept as part of the history of the BMW M Sports Trophy.

Server log files and data backups are deleted automatically on a rolling basis. Data that we need to assess, defend against or assert claims may be retained for as long as a corresponding procedure could be initiated. Statutory retention obligations remain unaffected.

We implement various security measures such as encryption and authentication tools according to the current state of technology to protect and maintain the security, integrity, and availability of your data.

A hundred percent protection against unauthorised access cannot be guaranteed for data transmissions over the Internet or a website, but we and our service providers strive to protect your personal data in accordance with applicable data protection regulations through physical, electronic, and procedural security measures according to the current state of technology. Among other things, we implement the following measures:

• Strict criteria for access authorisation to your data based on the "need-to-know principle" (limiting access to as few people as possible) and exclusively for the specified purpose,
• Transmission of collected data exclusively in encrypted form,
• Storage of passwords exclusively in encrypted, hashed form,
• Firewall protection of IT systems to prevent unauthorised access, e.g. by hackers, and
• Continuous monitoring of access to IT systems to detect and prevent the misuse of personal data.

If you have chosen a password that gives you access to the portal, you are responsible for keeping this password confidential and for complying with all other security procedures of which we inform you. We particularly ask you not to share your password with anyone.

You can view your profile data in the portal at any time and change it or request a change there. You can unsubscribe from the newsletter at any time via the link in every newsletter. For all other requests, please use the contact details below.

If you have questions about the use of your personal data by us, you can contact BMW M Customer Support – either by e-mail at customer.service@bmw-m.com or by phone at 0049 89 1250 160 16.

Additionally, you can contact the responsible data protection officer of BMW M:

BMW M GmbH
Data Protection Officer
Daimlerstraße 19
85748 Garching-Hochbrück
datenschutz@bmw.de

As a data subject affected by the processing of your data, you can assert certain rights against us under the GDPR and other relevant data protection regulations. The following section contains explanations of your rights as a data subject under the GDPR. Depending on the nature and scope of your request, we will ask you to submit it in writing to us.

Rights of data subjects
Under the GDPR, you have the following rights against BMW M as a data subject:

Right to access (Art. 15 GDPR):
You can request information from us at any time about your data that we hold about you. This information includes, among other things, the categories of data we process, the purposes for which we process them, the source of the data if we did not collect it directly from you, and, if applicable, the recipients to whom we have transmitted your data. You can receive a free copy of your data from us. If you are interested in additional copies, we reserve the right to charge you for the additional copies.

Right to rectification (Art. 16 GDPR):
You can request the rectification of your data from us. We will take appropriate measures to ensure that your data, which we hold and continuously process, is accurate, complete, and up to date, based on the most current information available to us.

Right to erasure (Art. 17 GDPR):
You can request the erasure of your data from us, provided that the legal requirements are met. This may be the case under Art. 17 GDPR if:

• the data is no longer necessary for the purposes for which it was collected or otherwise processed;
• you withdraw your consent, which is the basis for the data processing, and there is no other legal basis for processing;
• you object to the processing of your data and there are no overriding legitimate grounds for processing, or you object to the processing of data for direct marketing purposes;
• the data has been unlawfully processed,

and the processing is not necessary to comply with a legal obligation that requires us to process your data, in particular with regard to statutory retention periods, or to assert, exercise, or defend legal claims.

Right to restriction of processing (Art. 18 GDPR):
You can request the restriction of the processing of your data from us if:

• you dispute the accuracy of the data, for the period we need to verify the accuracy of the data;
• the processing is unlawful and you refuse the erasure of your data and instead request the restriction of use;
• we no longer need your data, but you need it to assert, exercise, or defend legal claims;
• you have lodged an objection to the processing, as long as it is not yet clear whether our legitimate grounds outweigh yours.

Right to data portability (Art. 20 GDPR):
At your request, we will transfer your data – to the extent technically feasible – to another controller. However, this right only applies if the data processing is based on your consent or is necessary for the performance of a contract. Instead of receiving a copy of your data, you can also ask us to transmit the data directly to another controller specified by you.

Right to object (Art. 21 GDPR):
You can object to the processing of your data at any time for reasons arising from your particular situation, provided that the data processing is based on your consent or on our legitimate interests or those of a third party. In this case, we will no longer process your data. The latter does not apply if we can demonstrate compelling legitimate grounds for the processing that override your interests or if we need your data to assert, exercise, or defend legal claims.

Deadlines for fulfilment of data subject rights:
We generally strive to respond to all requests within 30 days. However, this period may be extended for reasons related to the specific data subject right or the complexity of your request.

Limitation of information in fulfilment of data subject rights:
In certain situations, we may not be able to provide you with information about all of your data due to legal requirements. If we must deny your request for information in such a case, we will inform you of the reasons for the denial at the same time.

Complaint to supervisory authorities:
BMW M takes your concerns and rights very seriously. However, if you believe that we have not adequately addressed your complaints or concerns, you have the right to lodge a complaint with a competent data protection authority.