Privacy statement

Severs Breeman BMW & MINI considers the protection of personal data important. Therefore, we process your data with the utmost care and according to the guidelines of the General Data Protection Regulation (AVG), which will be enforced from 25 May 2018. You can read more about this in this privacy statement.

Who we are
This privacy statement applies to the following entities:

• Severs Breeman Alphen aan den Rijn b.v. kvk: 28108674
• Severs Breeman Gouda b.v. kvk: 29008626
• Severs Breeman Rotterdam Noord b.v. kvk: 24009186
• Severs Breeman Rotterdam Zuid b.v. kvk: 24346406
• Severs Breeman Services b.v. kvk: 24117156
• Severs Breeman Woerden b.v. kvk: 30025926

This Privacy Statement applies only to the above-mentioned entities and does not apply to BMW Group Netherlands and its affiliated entities BMW Nederland B.V., BMW Financial Services B.V. and BMW Holding B.V. Rijswijk or to other BMW, MINI and Motorrad contract partners. The websites of these companies have their own privacy policies.

What is personal data
Personal data is any information about an identified or identifiable natural person. You can think of your name and address. However, data like your license plate or the chassis number of your car are also (indirect) personal data, because they can be traced back to you as a person.

Basis of processing
The General Data Protection Regulation states in Article 6 that there must be a basis for the processing of personal data. Without a basis, no personal data may be processed. The General Data Protection Regulation has the following bases:

• The execution of an agreement
• A legal obligation
• A legitimate interest
• Permission
• Vital importance
• Fulfilment of task of general interest/public authority

When executing a contract, the recording of personal data is permitted if, for example, there is a test drive, the purchase or maintenance of a vehicle, the ordering of spare parts, the execution of warranty work, the handling of damage or the changing of winter/summer tyres. Participation in an event for which you have registered is also covered by the agreement.

A legal obligation includes, for example, the registration of a vehicle, the obligation to report technical recalls or the financial obligation to retain invoices for 7 years.

We speak of a legitimate interest in the case of, for example, a quotation for a new vehicle or for maintenance (if you are not yet one of our customers), marketing or an invitation to an event (if you are one of our customers), but this also includes camera surveillance (theft prevention).

Consent is used if no other legal basis applies. Consent is also requested, for example, for the transmission of personal data to BMW Group Netherlands (importer).

The processing of personal data in the case of vital interest occurs when there is a serious risk to the health of the customer or third parties.

The fulfilment of a task in the public interest, for example, public health or social protection, does not apply to us. The same applies to the fulfilment of a task of public authority, which refers to government agencies or public bodies.

Purpose and personal data
The General Data Protection Regulation states in Article 5.1.b that there must be a purpose for collecting and processing personal data.

There are various purposes for which we may process your personal data. These include:

• You test drive or hire a vehicle from us (contract basis)
• You are having an offer made for the purchase of a vehicle (basis of legitimate interest).
• You buy a vehicle from us (contract basis).
• You have a vehicle serviced by us (contract basis).
• You have damage to your vehicle repaired (contract basis).
• You order spare parts from us (contract basis).
• You have winter and summer tyres changed by us (contract basis).
• You participate in a survey about our services (basis justified interest).
• You want information about our services and products (basis justified interest).
• You want to receive our newsletter (basis legitimate interest).
• You want to be invited to events (basis legitimate interest).
• You participate in an event for which you have registered (contract basis).

If you have an agreement with us or we are in the pre-contractual phase of an agreement (offer), we have the justified interest to send you information about our products and services (direct marketing) and organisation (newsletter). We may also invite you to events, whereby we select the appropriate event for you based on the targeted information you provide. If you do not wish to receive this information, you can lodge an objection with us (see Right of Objection).)

If we do not have an agreement with you or if we are not in the pre-contractual phase of an agreement, we may only send you information about our products or services (direct marketing) or company (newsletter) with your consent. We also invite you to events only on the basis of consent. If you do not wish to, you can withdraw your consent at any time (see withdrawal of consent).

What personal data
The following categories of personal data are recorded from you:

• Contact details: Gender, name, address, postcode, city, telephone number(s), e-mail address.
• Contract data: customer number, Teleservices contract data, payment data.
• Transaction and interaction data: information on purchases of products and services, surveys and customer satisfaction data.
• Other personal data: date of birth, hobbies and other personal preferences.
• Website usage and communication: information about how you use the website including information collected through cookies and other tracking technologies (see Cookie Policy).
• Vehicle functions and settings data: information on the functions and current settings of your vehicle (identified by its vehicle identification number, such as BMW Teleservices and BMW ConnectedDrive services).

Copy of identity document
Sometimes it is necessary for us to ask you for a copy of your identity document. In this case, we apply the following agreements:

• For a test drive or for renting out a vehicle, we will ask you for a copy of your driving licence. We will keep this copy for the duration of the test drive or rental. Afterwards we will return the copy or destroy it.
• In order to register a vehicle, we may ask you for your proof of identity. We will check this, but will not make a copy. Without access to your proof of identity, we cannot register the vehicle.
• For legal reasons, such as the Wwft, we may need to make a copy of your identity document and keep it for the statutory period.

Camera surveillance
Our locations are equipped with cameras. We consider this important for the safety of you and your vehicle, our employees and our vehicles. The camera images are deleted after 4 weeks. We retain the camera images for longer if this is necessary, for example, for a police investigation following a theft or other incident.

Data about your vehicle
We store the following data about your vehicle:

• License plate
• Chassis number
• Brand and model
• Options and accessories
•  Maintenance history
• Ownership history (registration)

Data in your vehicle
Data is also present in your vehicle. Below are the categories of these data, followed by a description of each category.

• Operational vehicle data
• Comfort and infotainment features
• Smartphone integration, e.g. Apple Carplay
• Online services
• Online services from BMW
• Third-party services
• Data for localisation of the vehicle

Operational vehicle data
These data include:

• Control unit data. This data is processed for the operation of the vehicle and includes, among other things
  • Vehicle specific data (e.g. speed, deceleration, wheel speed, seat belt warning)
  • Ambient conditions (e.g. temperature, rain sensor, distance sensor).
    These data are not stored outside of the vehicle's operating hours but are only processed in the vehicle itself. The control units contain data memories, including the vehicle ignition key. These data memories are activated to document information relating to vehicle condition, component loads, maintenance requirements and temporary or permanent technical events and faults.

• Depending on the technical means, storage
  • Operating states of system components (filling levels, tyre pressure, battery status)
  • Faults and defects in important system components (brakes, lights)
  • Response of systems in special driving situations (airbag activation,
    stability control activation)
  • Information on events causing damage to the vehicle
  • For electric cars: state of charge of high-voltage battery, estimated range

This data is stored in the following cases:

• In special situations, for example when the vehicle has detected a fault;
  • During repairs and maintenance, the stored operational data can be read out by employees of Hans Severs BMW & MINI or third parties (breakdown service)
  • In case of warranty and quality control measures, stored operational data can also be read and used.

As a rule, this data is read out using the legally prescribed connection for On-Board Diagnosis (OBD) in the vehicle itself. The operational data that is read out documents the technical condition of the vehicle or the individual components. This data helps with diagnostics, warranty compliance and quality improvements. This information, as well as information regarding component loads, technical events, malfunctions and other errors, is transmitted together with the chassis number to the importer BMW Group Nederland and the manufacturer BMW AG in Munich (Germany).

BMW is also liable for its products. For this purpose, the operational data of the vehicles are also used, e.g. for recall campaigns. This data can also be used to verify warranty claims and retrofit claims from customers.

Function memories in the vehicle can be reset at your request during repairs or maintenance.

Functions relating to comfort and infotainment
You can save your settings for comfort and individualisation in the vehicle and change or reset them at any time. These settings are (if available):

• Adjusting the position of the steering wheel and the seat
• Chassis and climate control setting
• Individualisation such as interior lighting

Depending on the possibilities in your vehicle, you can enter the following data in the infotainment functions:

• Multimedia data (music, films, photos in integrated multimedia system);
• Address book data (integrated hands-free system or integrated navigation system);
• Navigation destinations entered;
  Data related to the use of Internet services.

The comfort and infotainment data can be stored locally in the vehicle or on the device you have connected (smartphone, USB stick, MP3 player). You can delete these data yourself at any time. These data can also be transferred from the vehicle. This only takes place at your request and, in particular, when using online services in accordance with the settings you have chosen.

Smartphone integration (e.g. Apple Carplay)
It is possible to connect your smartphone or other mobile devices to the vehicle (if your vehicle is equipped with corresponding devices). You can then operate these devices using the controls integrated in the vehicle. This allows images and sound from the smartphone to be displayed via the multimedia system. In addition, data from the vehicle will also be sent to your Smartphone. Depending on the type of integration, this may include position data, day/night mode and other general vehicle data. You can find more information in the "Infotainment Systems" section of your vehicle's manual. Integration allows the use of selected apps from the Smartphone, such as navigation or music playback. There is no other interaction between Smartphone and vehicle, especially no active access to the vehicle data. The way other data is processed is determined by the provider of each app used. Whether you can choose settings and, if so, which settings you can choose, depends on the respective app and the respective operating system of your Smartphone.

Online services
If your vehicle is connected to a mobile phone network, this connection enables the exchange of data between your vehicle and other systems. The connection to the mobile phone network is made possible by the vehicle's own transmitter and receiver or the mobile device (such as a Smartphone) which you carry in the vehicle. Online functions can be used over this mobile phone network. This includes online services and applications/apps provided by the manufacturer or other providers.

Online services of BMW
With regard to BMW online services, the respective functions are described by BMW at appropriate places (such as the Owner's Manual, BMW Drivers Guide App, BMW websites) with the corresponding information in accordance with data protection legislation. Personal data may be used to provide online services. Data exchange for this purpose takes place via a secure connection. These include BMW IT systems that have been specifically developed for this purpose. Any collection, processing or use of personal data beyond the scope of this service takes place solely on one of the following bases: legal obligation (e.g. statutory emergency call system e-Call), contract or consent.

Third-party services
If you use services of other providers (third parties), these services are the responsibility of the respective provider and are subject to the data protection terms and conditions of use of this provider. We have no influence on the content exchanged via this service. We therefore recommend that you obtain information from this third-party service provider as to the nature, scope and purpose of the collection and use of personal data in the context of these third-party services.

Data on the location of your vehicle or mobile device
BMW may receive this location data in the course of providing BMW ConnectedDrive services and the BMW Connected App. This data is used in accordance with the detailed descriptions of the services and security measures for location data.

Recipients and categories of recipients
These are parties to whom we transfer your personal data. These are government agencies such as:

• Road Traffic Department (RDW)
• Tax Office
• RDC

If you have applied to us for financing and/or insurance, your data will be shared with, among others:

• BMW Financial Services

The importer, BMW Group Netherlands, also receives your personal data for conducting surveys on products and services developed by BMW and for issuing the BMW or MINI Service Card. In the first contact, BMW Group Netherlands will provide you with further information on the processing of your personal data.

Security measures
When we process your data, we always use appropriate technical and organisational measures.

Third countries or international organisations
We are part of the BMW organisation, which operates worldwide. By preference, your personal data is processed within the European Union (EU). If data is processed outside the EU, BMW uses standard contracts and appropriate technical and organisational measures to ensure that your data is processed at the same level of data protection as within the EU. There are also countries outside the EU, such as Switzerland for example, where the EU has determined that the level of data protection is equivalent to that of the EU (adequacy decision). No special contracts are required for these countries.

If you want to know in which countries your personal data is processed, please contact us at the e-mail address below:

• Datasecurity@seversbreeman.nl

Retention period of personal data
We do not retain your personal data longer than the statutory or fiscal retention period. The financial retention period is 7 years. If there is no statutory retention period, we will retain the data for a maximum of 5 years after the last contact or vehicle date.

If we have received your personal data for making an offer or to provide you with other information and you have never purchased anything from us, we will retain your data for a maximum of 5 years. If, after this period, you also want to be kept informed about our products and services, we will need your permission and must demonstrably register this permission.

Cookies
For the use of cookies, please refer to our cookie policy.

Your rights as a customer
When personal data about you are processed, you also have rights under the General Data Protection Regulation. These rights are:

• Right to information:

At the time we collect your personal data, we are obliged to let you know:

• Who we are;
  • What data of yours do we process;
  • For what purpose we process these data;
  • To whom we provide the data;
  • How long we keep the data;
  • How we secure the data;
  • what rights you have.

We will make this known to you by referring you to our privacy statement.

Right of inspection:
You have the right to inspect your personal data. This concerns the following data:

• the personal data that we process from you;
  • for what purpose we are processing them;
  • to whom we have provided the data;
  • from whom we have received the data;
  • How long we keep the data. 

You can gain access by looking into our systems or by receiving an overview from us.

• Request for rectification:
  If we have incorrect or incomplete information about you, you have the right to have it rectified. We will correct this data and also pass on the corrections to third parties who have your data.

• Request to delete data:
  You have the right for us to delete your personal data. We will comply with this request if:
  • we no longer need the data for the purpose for which it was collected;
  • You withdraw your consent to use the data (on the consent basis);
  • we use the personal data for a purpose other than that originally indicated;
  • when you object to the processing.

• Right to object:
  You can object to the processing of your personal data if we process the data on the basis of 'legitimate interest' or if you object to direct marketing. In the latter case, we will immediately stop the direct marketing. In all other cases, we will first carry out a balancing of interests.

• Right of restriction:
  You have the right to temporarily stop the processing of your data if:
  • you question the accuracy of your data;
  • the processing is unlawful;
  • we no longer need the personal data, but you need it for a legal claim;
  • you have objected to the processing and this request is still pending.
    
    
• Right to data portability:
  You have the right to receive your data in a digital file from us if you so request. This only applies to the data we process from you with the basis of agreement or consent.

For all the above rights, we must be able to establish that the request actually comes from you. This may mean that we ask you to come to our office to identify yourself. We do this because we do not want your data to fall into the hands of unauthorised persons.

You can apply for the above rights via:

• Datasecurity@seversbreeman.nl

We will give you a (written) confirmation of your request. We will comply with your request within 30 days. If we need more time, we will let you know within 30 days. The period for compliance may be extended by up to 2 months.

If we cannot comply with your request, we will let you know with a written motivation.

Withdrawal of consent
If we process your data on the basis of "consent", you can withdraw your consent at any time. You can do this at datasecurity@seversbreeman.nl. Withdrawal of consent does not have retroactive effect. This means that all processing of personal data that we previously carried out on the basis of consent will remain lawful. When you withdraw your permission, the processing will be discontinued by us, unless it is necessary because of a legal obligation.

Complaint
If you have any questions or wish to make a complaint regarding the processing of your personal data, please contact us first. You can do this via datasecurity@seversbreeman.nl.

If your question or complaint is not resolved to your satisfaction, please contact the Dutch Data Protection Authority, www.autoriteitpersoonsgegevens.nl.

Amendments privacy statement
We reserve the right to amend this privacy statement. You will, if necessary, be informed of a change. In this declaration, the latest date of amendment will always be indicated.

Date of Privacy Statement: 07 April 2021 - Version 1.0