Privacy Policy

1. Introduction

Thank you for your interest in our website. The protection of your personal data is important to us. Below you will find information on the handling of your data that is collected through use of our website. Your data will be processed in accordance with the legal data protection regulations, in particular the General Data Protection Regulation (“GDPR”) and other applicable laws (via opening clauses) and, in the event of an adequacy decision by the EU-Commission for your home country, the laws that regulate data protection in your home country at a level equivalent to that of the GDPR.

Insofar as links are provided to other websites, we have neither influence nor control over the linked contents and the data protection regulations there. We recommend checking the privacy policies on the linked websites to determine whether and to what extent personal data is processed and made available to third parties.

If anything in this Policy seems unclear or gives rise to doubts, please contact us under the contact details below.

2. Contact information

Controller in the sense of Art. 4 lit. 7 GDPR
BMW AG
Petuelring 130
80788 Munich
Germany

info@bmwstartupgarage.com
Phone: +49 89 1250-16000

Contact Details for our Data Protection Officer: datenschutz@bmw.de

3. Definitions of terms

In principle, our privacy policy should be simple and understandable for everyone our privacy policy generally uses the official terms of the GDPR. The official definitions are explained in Art. 4 GDPR.

4. Data processing by visiting our website

When you visit our website, it is technically necessary that data is transmitted to our web server via your internet browser.
The following categories of data can be processed when using the website:

• visited domain
• date and time of the request
• time zone difference from Greenwich Mean Time
• page from which the file was requested
• access status (file transferred, file not found, etc.)
• web browser, system language, operating system and device type used
• IP address of the requesting device (computer, laptop, tablet, smartphone, etc.)
• amount of data transferred

The Legal basis for the temporary storage of data or log files is Art. 6 para. 1 Sentence 1 lit. f GDPR (legiamate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the you as the data subject which require protecaon of personal data). Our legitimate interest is to ensure a smooth connection to the website and to enable a comfortable use of our website by the users. In addition, the log file serves the purpose of evaluating system security and stability, as well as providing administrative functions.

5. General data processing on the website

5.1 Contact via contact form or via e-mail

If you send us enquiries via contact form or e-mail, your details from the enquiry form or e- mail, including the contact data you have provided there, will be stored for the purpose of processing the enquiry and in the event of follow-up questions. A data processing for any other purpose does not take place. You are required to provide your name and an e-mail address to contact us. Your company is optional. Under no circumstances we will pass on this data without your consent.
The legal basis for processing the aforementioned data is our legitimate interest in responding to your request pursuant to Art. 6 para. 1 lit f GDPR. Your data will be deleted after final processing of your inquiry, provided that there are no legal storage obligations to the contrary. Due to Art. 21 para. 1 Sentence 1 GDPR, you can object to the processing of your personal data at any time, on grounds relaang to your situaaon. In the event of an objecaon, we will no longer process the personal data unless we demonstrate compelling legiamate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims (Art. 21 para. 1 GDPR). Furthermore, we refer to Art. 21 para. 2 to 6 GDPR for the handling of your personal data in case of an objecaon by you.

5.2 Contact via application form

You have the possibility to apply to partner with us on our website. We collect and use the following personal data during application:
• Name
• E-Mail address

In addition, voluntary information can be provided (e.g. company presentation). Mandatory data provided for the purpose of registration are marked with an asterisk in the input mask as a mandatory field. By submitting the application, you express your interest in becoming a candidate for our BMW Startup Garage program. The data is required to create a short company profile and evaluate if your company fulfills the requirements for the BMW Startup Garage Program. If consent is given within the context of submission, the legal basis for data processing is Art. 6 para. 1 lit. a GDPR (given consent) or Art. 6 para 1 lit. b GDPR (performance of a contract with you/ steps at your request prior to entering into a contract). Your data will be deleted as soon as there are no legal storage obligations. Subject to legal obligations (paracularly but not exclusively retention periods or the need to keep your personal data in order to establish a claim against you or defend a claim you have against us – the statutory limitaaon periods are then decisive). You are enatled to withdraw your consent at any ame by contacang us by e-mail or post using the contact details given above in secaon 2 of this Privacy Policy. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

6. Social Media Links

Social networks (e.g. Facebook, Twitter and Linkedin) are only integrated on our website as links to the corresponding services. After clicking on the integrated text/image link you will be redirected to the page of the respective provider. Only after forwarding personal data of you is transmitted to the respective provider. For information on the handling of your personal data when using these websites, please refer to the respective data protection regulations of the providers you use.

7. Cookies

We use cookies on our website. These are small files that your browser creates automaacally and that are stored on your end device (computer, laptop, tablet, smartphone, etc.) when you use the website. Cookies do not damage your end device and do not contain viruses, trojans or other malware.
Informaaon is stored in the cookie that arises in connecaon with the specific end device used. However, this does not mean that we get informaaon about your idenaty.
On the one hand, the use of cookies serves to make the use of our website more pleasant for you. We use so-called session cookies to recognize that you have already visited individual pages or sub- applicaaons of our website. These are automaacally deleted ajer leaving the website.
In addiaon, we also use temporary cookies to opamize user-friendliness, which are stored on your end device for a specific period of ame. If you visit our website again, it is automaacally recognized that you have already been with us and what inputs and sekngs you have made so that you do not have to enter them again.
On the other hand, we use cookies to staasacally record the use of our website and to evaluate it for the purpose of opamizing our offer for you. These cookies are automaacally deleted ajer a defined period of ame. This period is a maximum of 2 years.
The data processed by cookies are based on your consent given via our Cookie Consent Tool due to Aracle 6 para. 1 Sentence 1 lit. a GDPR or are required for the stated purposes to protect our legiamate interests and those of third paraes in accordance with Aracle 6 para. 1 Sentence 1 lit. f GDPR.
In the event that we need your consent to set a cookie, you are enatled to withdraw your consent at any ame by contacang us by e-mail or post using the contact details given above in secaon 2 of this Privacy Policy or by changing the sekngs in our Cookie Consent Tool, that you can re-access via the link in the footer of our website. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
You can also configure your browser in such a way that you are informed about the settings of cookies and only allow cookies in individual cases, excluding the acceptance of cookies for certain cases or in general deactivating cookies and activating the automatic deletion of cookies when closing the browser. The cookie settings can be managed using the following links for the respective browser.

• Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
• Internet Explorer: http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
• Chrome: http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
• Safari: https://support.apple.com/kb/ph21411?locale=de_DE
• Opera: https://help.opera.com/en/latest/web-preferences/#cookies

You can also individually manage the cookies of many companies and features used for advertising.
Use the corresponding user tools, available at https://www.aboutads.info/choices/ or http://www.youronlinechoices.com/uk/your-ad-choices
Most browsers also offer a so-called “Do-Not-Track function” with which you can specify that you do not want to be “tracked” by websites. When this feature is enabled, your browser tells advertising networks, websites and applications that you do not want to be tracked for behavior-based advertising. Information and instructions on how to edit this function are available from the links below, depending on the provider of your browser:

• Google Chrome: https://support.google.com/chrome/answer/2790761?co=GENIE.Platform%3DDesktop&hl=de
• Mozilla Firefox: https://www.mozilla.org/de/firefox/dnt/
• Internet Explorer: https://support.microsoft.com/de-de/help/17288/windows-internet-explorer-11-use-do-not-track
• Opera: http://help.opera.com/Windows/12.10/de/notrack.html
• Safari: https://support.apple.com/kb/PH21416?locale=de_DE

You can also prevent scripts from being loaded by default. NoScript allows you to run JavaScripts, Java and other plug-ins only on trusted domains of your choice. For information and instructions on how to edit this feature, contact your browser vendor. Please note that when cookies are deactivated, the functionality of this website may be limited.

8. Data transfer and categories of recipients

We use external service providers, which we have carefully selected and commissioned in writing, to carry out our services. They are bound by our instructions and are regularly checked by us. With which we have concluded order processing contracts in accordance with Art. Art. 28 para. 1 Sentence 1 GDPR, if necessary. These are service providers for web hosting, sending e-mails and maintaining our IT systems, etc. The service providers will not pass your personal data on to third parties. A transfer to third countries with poor data protection security (no adequacy decision by the EU-Commission) does not take place.

9. Duration of data storage

The duration of the storage of personal data is determined by the relevant legal retention periods (in particular, but not exclusively, from commercial law and tax law). After expiry of the respective period, the corresponding data is routinely deleted. If data is necessary for contract fulfilment or contract initiation, or if we have a legitimate interest in further storage, the data will be deleted if it is no longer necessary for these purposes or if you make use of your right of revocation or objection.

10. Your rights as person concerned

As an individual whose data is subject to processing, you may assert certain rights against us in accordance with the GDPR and other relevant data protection regulations. The following section contains explanations of your rights under the GDPR.

Rights of affected persons
In accordance with the GDPR, you, as an affected person, are entitled to the following rights in particular:

Right of access by the data subject (Art. 15 GDPR):
You may request information about the data we hold about you at any time. This information includes, but is not limited to, the categories of data we have processed, the purposes for which we have processed this data, the origin of the data if we did not collect it from you directly, and, if applicable, the recipients to whom we have transferred your data. You can request a copy of your data free of charge. If you are interested in obtaining additional copies, we reserve the right to charge you accordingly.

Right to rectification (Art. 16 GDPR):
You can ask us to rectify your data. We will take reasonable measures to keep the information we hold and process about you accurate, complete, and up to date, based on the most current information available to us.

Right to erasure (Art. 17 GDPR):
You can request the deletion of your data, provided there are legal requirements in place to support this. This may be the case under Art. 17 GDPR if:

• The data is no longer required for the purposes for which it was collected or otherwise processed;
• Your consent, which is the basis of data processing, is revoked and there is no other legal basis for the processing;
• You object to the processing of your data and there are no overriding legitimate grounds for processing, or you object to the processing of data for direct marketing purposes;
• The data was processed unlawfully, unless processing is necessary
• to ensure compliance with a legal obligation that requires us to process your data;
• particularly with regard to legal retention periods;
• to enforce, exercise, or defend legal claims.

Right to restriction of processing (Art. 18 GDPR):
You may require us to restrict the processing of your data if

• You dispute the accuracy of the data for the period of time that we need to verify the accuracy of the data;
• The processing is unlawful but you refuse the deletion of your data and instead demand a restriction of use;
• We no longer need your information but you need it to enforce, exercise, or defend legal claims;
• You have lodged an objection against processing as long as it is not clear whether our justified reasons outweigh yours.

Right to data portability (Art. 20 GDPR):
At your request, we can transfer your data to another person in charge as far as technically possible. However, you are entitled to this right only if the data processing is based on your consent or is necessary to execute a contract. Rather than receive a copy of your data, you may also ask us to transfer the data directly to another person in charge specified by you.

Right to object (Art. 21 GDPR):
You may object to the processing of your data at any time for reasons that arise from your particular situation, if the data processing is based on your consent or on our legitimate interests or those of a third party. In this case, we will no longer process your data. The latter does not apply if we can provide compelling legitimate reasons for the processing that outweigh your interests or we need your data to enforce, exercise, or defend legal claims.
Time limits for the fulfillment of subject rights
We make every effort to comply with all requests within 30 days. However, this period may be extended for reasons relating to the specific subject right or complexity of your request.

Restriction of information in the fulfillment of subject rights
In certain situations, we may be unable to provide you with information about all your data owing to legal requirements. If we have to refuse your request for information in such cases, we will inform you at the time of the reasons for the refusal.
Complaints to supervisory authorities

BMW takes your rights and concerns very seriously. However, if you believe that we have not adequately addressed your complaints or concerns, you are entitled to file a complaint with a competent data protection authority.

Status of this Privacy Policy: 03 August 2023.