MINI PRIVACY NOTICE.

BMW AG (hereinafter referred to as "MINI" or "We"), Petuelring 130, 80788 Munich, is responsible for the processing of your personal data within the meaning of the EU General Data Protection Regulation ("GDPR"). BMW AG is based in Munich.

BMW AG is the parent company of the BMW Group and, through the organizational division MINI Germany, coordinates the business activities for the sale of MINI automobiles, original MINI parts, parts and accessories and the associated services in Germany. The BMW branches also belong to MINI.

In accordance with MINI Germany, other organizational areas of BMW AG are also active in looking after customers and interested parties in Germany. These are essentially the areas of MINI Connected and MINI Online Shops.

MINI Germany authorizes MINI authorized dealers and MINI authorized workshops – hereinafter referred to as MINI partners, unless differentiation is necessary – provides support and support in technical and non-technical questions for customers, interested parties, contractual partners and other interest groups, operates the website www.mini. de, offers the option of online MINI accounts or MINI Connected and advertises the MINI brand in Germany.

Unless otherwise stated, MINI Partners are legally and economically independent companies and are not part of MINI. As a licensee, you use the MINI brand, depending on the authorization, for the sale of MINI automobiles, original MINI parts and accessories and for brand-related maintenance and repairs.

The BMW branches are authorized by MINI Germany in the same way as the MINI partners.

MINI is responsible for your data, which is collected via the website www.mini.de, your online MINI account, the MINI Connected services, the websites of the MINI locations of the BMW branches (e.g. www.muenchen.mini.de), the Customer/prospect portals (e.g. MINIbox.info) your contacts with MINI customer service and are processed as part of MINI direct marketing measures. MINI also processes your data if it is transmitted to you by MINI partners, if and to the extent that the necessary data protection requirements are met.

MINI partners are responsible for processing the personal data that you provide them with in connection with your concerns and customer support in the areas of sales and service. MINI partners also process your data if it is transmitted to them by MINI Germany, if and to the extent that the necessary data protection requirements are met.

Some of the processing of your data by MINI partners is also described in this data protection notice. However, MINI partners may collect additional personal data and have their own data protection notices. In this case, you can find out from the data protection information of the relevant MINI partner how your data is used there.

The contact details for MINI Customer Service from MINI Germany and for Group Data Protection at BMW AG can be viewed here.

MINI collects and processes your personal data in the following cases, among others:

If you contact us directly, e.g. via our website, via the MINI customer service or the BMW branches, and if you are interested in our products or services or have another concern.

If you buy products directly from us (e.g. in the MINI Lifestyle Shop on our website, in a BMW branch).

If you buy services directly from us (e.g. maintenance or repair of your vehicle in a BMW branch).

When you request information about our products and services (e.g. electronic transmission of brochures or price lists).

When you respond to our direct marketing activities, e.g. if you fill out a reply card or if you submit your data online on one of our websites (www.mini.de or landing page).

If your personal data is transmitted to us by MINI partners or third parties, if and to the extent that the necessary data protection requirements are met, e.g. you have given your consent or you are aware of your data being passed on to MINI for the purpose of customer service (e.g. recognizing you when you contact MINI customer service) and in writing (e.g. sending the MINI welcome package after purchasing the vehicle). Have not objected to the right of objection.

If your vehicle data (with the vehicle identification number) is transmitted to us as part of the service processes and maintenance and repair services of our authorized MINI workshops and BMW branches.

If other BMW Group companies and our business partners make data about you available to us in a permissible manner and when third parties (e.g. certified address providers) legitimately provide us with personal data about you.

Please help us to keep your information up to date by informing us of any changes to your personal data - in particular to your contact details.

The following categories of personal data may be collected through the various services and contact channels described in this privacy notice:

Contact details: name, address, telephone number, e-mail address.

Interests: Information you provide about your areas of interest, e.g. the vehicle you are interested in, preferred MINI partners or BMW branches, hobbies and other personal preferences.

Other personal data: Information you provide about your date of birth, education, household size or professional situation.

Contract data: Customer number, contract number, booked MINI Connected services.

Online account data: Account ID (“MINI ID”) Information on the MINI login area, MINI Connected, customer and prospect portals, payment information you have stored (e.g. credit card number).

Website Usage and Communications: Information about how you use the Website and whether you open or forward communications from us, including data collected via cookies and other tracking technologies. For more information, see our MINI Cookie Policy here.

Transaction and interaction data: Information on purchases of products and services, interactions with MINI customer service (your inquiries and complaints) and MINI partners or BMW branches as well as participation in market research studies.

Creditworthiness and identity information: Data to determine your identity, e.g.  driving licenses or registration certificate part one; also information on transactions, any payments not made to us; plus information on fraud, criminal acts, suspicious transactions, politically exposed persons and sanctions lists in which your data is included.

Use of MINI apps and services: Information on your use of MINI apps (on your mobile device) and MINI Connected services.

Information about vehicle functions and settings: Information about the functions and current settings of your vehicle (identified by the vehicle identification number), e.g. MINI TeleServices, MINI Connected Services or MINI CarData.

Technical data on the vehicle: data that is generated or processed in the vehicle.

Operating data in the vehicle

Control units process data to operate the vehicle.

These include, for example:

Vehicle status information (e.g. speed, movement delay, lateral acceleration, number of wheel revolutions, display of fastened seat belts, consumption data),

Ambient conditions (e.g. temperature, rain sensor, distance sensor).

As a rule, this data is volatile and is not stored beyond the operating time and is only processed in the vehicle itself. Control units often contain data memory (including the vehicle key). These are used to be able to temporarily or permanently document information about the vehicle condition, component stress, maintenance requirements as well as technical events and errors.

Depending on the technical equipment, the following are stored:

Operating states of system components (e.g. filling levels, tire pressure, battery status),

Malfunctions and defects in important system components (e.g. lights, brakes),

Reactions of the systems in special driving situations (e.g. deployment of an airbag, deployment of the stability control systems),information on vehicle-damaging events.

For electric vehicles, state of charge of the high-voltage battery, estimated range.

In special cases (e.g. if the vehicle has detected a malfunction) itmay be necessary to store data that would actually only be volatile.

If you make use of services (e.g. repairs, maintenance work), the stored operating data can, if necessary, be read out and used together with the vehicle identification number. Employees of the MINI partner or the BMW branch or third parties (e.g. breakdown services) can read out the data from the vehicle. The same applies to warranty cases and quality assurance measures.

Reading is usually carried out via the legally required connection for OBD (“on-board diagnosis”) in the vehicle. The operating data that is read out documents the technical status of the vehicle or individual components, helps with fault diagnosis, compliance with warranty obligations and quality improvement. This data, in particular information about component stress, technical events, operating errors and other errors, may be sent to MINI together with the vehicle identification number. In addition, MINI is subject to product liability. MINI also uses operating data from vehicles for this, for example for recall campaigns. This data can also be used to assess customer warranty and rectification claims.

The data collected in connection with the conclusion of the contract or the provision of the services will be processed for the purposes stated below. An explanation of the scope of the available legal bases can be found here.

A. Fulfillment of the contractual obligation within the framework of the sale, maintenance and repair of vehicles

(Art. 6 para. 1 lit. b) GDPR)

MINI, BMW branches and MINI partners collect, process and use personal data as part of the sales process or for maintenance or repairs in the car dealership.

As part of the sales process, personal data is used by MINI, MINI authorized dealers and BMW branches to process the purchase contract, carry out test drives and transmit information in connection with your vehicle purchase.

The following categories of data are processed as part of these activities

Contact details (surname, first name, address, e-mail address, etc.)

Account data (MINI Connected or MINI Account, bank details, etc.)

MINI, BMW branches and MINI partners use your personal data to address i. R. the contract processing (e.g. vehicle order, workshop/repair order, booking MINI Connected services) or for processing a request formulated by you (e.g. offer, test drive request). We will speak to you about all aspects of contract processing or the processing of a request without separate consent, e.g. in writing, by telephone, via messenger services, by e-mail, depending on which contact details you have provided.

As part of the maintenance and repair processes and services at the MINI authorized workshops and BMW branches, technical vehicle data relevant for the vehicle service is read out from the built-in electronic control units using special diagnostic devices. This data is processed and used in the workshop by trained technicians to diagnose and rectify any malfunctions. This technical data on the vehicle is essentially made up of

Vehicle master data (e.g. vehicle identification number, vehicle type, production date, vehicle equipment),

Vehicle condition data (measured values ​​such as mileage),

Error memory entries (e.g. malfunction of direction indicators),

Load collectives,

Software versions as well

Service and workshop data (e.g. service requirements, work carried out, spare parts installed, warranty cases, workshop logs)

together.

The above information can be accessed by MINI to assist with technical or other service delivery challenges by MINI Authorized Workshops and BMW branches.

The above-mentioned persons responsible may also receive limited data for locating the vehicle, insofar as this is necessary for the purpose of fulfilling a contract (e.g. as part of the MINI Mobile Service breakdown service). The data will only be used in accordance with the security measures for location data.

Fulfillment of the contractual obligation to provide digital vehicle-related services

(Art. 6 para. 1 lit. b) GDPR)

For the purpose of fulfilling any connected contract concluded between you and MINI, MINI provides various services, e.g. Intelligent Emergency Call, Concierge Service, Real Time Traffic Information (RTTI), TeleServices etc.

For the provision of these services, the following, possibly personal information from the vehicle is processed for provision by MINI and commissioned service providers:

Vehicle status data (mileage, battery voltage, door and lid status, etc.)

Position and movement data (time, position, speed, etc.)

Vehicle maintenance data (next service due, oil level, brake wear, etc.)

Dynamic traffic information (traffic jams, obstacles, signs, parking lots, etc.)

Environmental information (temperature, rain, etc.)

User profile (configured news, email, audio provider, etc.)

Sensor information (radar, ultrasound, gestures, speech, etc.)

MINI Connected's data protection notices can be found here; a complete list and detailed description of the services and the data used in each case can be found here.

The processed personal data will be automatically deleted after 4 weeks, unless they are needed longer for the provision of the special service.

You can activate or deactivate the services and functions (some of which are subject to a fee) and in some cases the entire mobile network connection of the vehicle. Excluded from this are - as far as technically possible - legally required functions and services, such as an emergency call system.

The following personal data is processed to provide the services of the MINI App:

We use various security measures such as state-of-the-art encryption and authentication tools to protect and maintain the security, integrity and availability of your data.

No data transmission over the Internet or any website can be guaranteed to be 100% secure from unauthorized access, but we and our service providers and business partners use our best efforts to protect your personal information by physical, electronic and procedural safeguards consistent with applicable data protection laws to protect the current state of the art. Among other things, we use the following measures:

Strict criteria for authorization to access your data on a "need-to-know" basis (restriction to as few people as possible) and only for the stated purpose.

Transfer of collected data exclusively in encrypted form,

Storage of confidential data, e.g. Credit card data exclusively in encrypted form.

Firewall protection of IT systems to protect against unauthorized access, e.g. by hackers and permanent monitoring of access to IT systems to detect and prevent misuse of personal data.

If you have been given a password by us, or have assigned one yourself, that allows you to access certain areas of our website or any other portal, app or service operated by us, you are responsible for keeping that password confidential and for complying with all other security procedures, about which we will inform you. In particular, we ask that you do not share your password with anyone.

Security Precautions for Location Data

Certain Services can only be offered if you disclose your location or the location of your vehicle. We take the confidentiality of this location data very seriously.

Therefore, your location data (including data accessed as part of vehicle maintenance) is protected with the following safeguards:

It will only be stored in a form traceable to you or your vehicle for as long as is necessary to fulfill the purpose to which you have consented.

Data is only collected and accessed in this form if this is necessary to provide the requested service.

Data collection and access to it in this form also takes place if we are legally obliged to store and/or hand over the data.

Data for locating the vehicle and data for locating a/your mobile device are only linked to one another if this is necessary to provide the requested service.

Any other use of location data for analysis purposes is done on datasets that have been previously anonymized.

We, your BMW branch and your MINI partner may have access to the data for locating the vehicle and BMW AG may have access to the data for locating your mobile device via the services it provides (e.g. MINI Connected). .

When purchasing the vehicle or when activating or configuring the MINI Connected services or the MINI app, you will receive a detailed description of the location data transmitted for the provision of location-specific services.

You can use the MINI App or directly in the vehicle – as far as technically possible – to set whether we may continue to collect and process this data and thus prevent future data collection. Please note that if you restrict the collection of location data, we may no longer be able to provide certain aspects of our services.

We will only keep your data for as long as is necessary for the relevant purposes for which we process your data. If we process data for several purposes, they are automatically deleted or stored in a format that does not allow any direct conclusions to be drawn about your person as soon as the last specific purpose has been fulfilled. To ensure that all of your data is deleted again in accordance with the principle of data minimization, MINI has designed an internal deletion concept. The basic principles according to which this deletion concept provides for the deletion of your personal data are presented below.

Use to perform a contract

In order to fulfill contractual obligations, data collected from you can be stored for as long as the contract is in force and, depending on the nature and scope of the contract, for 6 or 10 years more in order to comply with statutory storage obligations and to deal with any inquiries or claims to clarify the expiry of the contract.

In addition, there are contracts for the delivery of products and services that require longer retention periods, see also "Use to verify claims" below.

Use to verify claims

Information that we deem necessary to investigate or defend against claims against us, or to institute criminal proceedings or assert claims against you, us or third parties, may be retained by us for as long as appropriate proceedings may be instituted.

Use for customer support and marketing purposes

For customer care and marketing purposes, the data collected from you can be stored for 3 to 10 years after collection, unless you wish this data to be deleted and there are no contractual or legal storage obligations that conflict with this request for deletion.

Your data will be stored by us or by service providers commissioned by us exclusively in the EU.

BMW is a global company. Personal data is preferably processed within the EU by BMW employees, national sales companies, MINI partners and service providers commissioned by us.

In the context of IT services, in particular for support purposes, commissioned service providers based outside the EU may also have to access personal data. We select these service providers carefully and ensure an appropriate level of data protection through contractual, technical and organizational measures. As a rule, we agree on the EU standard contractual clauses, if necessary with additional contractual rules.

For some countries outside the EU, such as. Israel and Switzerland, the EU has already established a comparable level of data protection. Due to the comparable level of data protection, data transmission to these countries does not require any special approval or agreement.

Contact us here if you would like to see the specific protective measures for the transfer of your data to other countries.

You can change your settings for the use of your data in MINI Online Accounts yourself at any time using the relevant options in your Online MINI Account (where available), in your MINI Connected Account or in the MINI App.

You can access and, where possible, change the following data:

Consent to advertising communication - here you can (if available) select your desired communication channels (address by post, e-mail, etc.) and agree to the use of statistical processes to create an individual customer profile in order to provide you with personalized offers for products and services to receive services

MINI Login - After logging in, you can view and download or transfer your vehicle data under "My Vehicles" > "Vehicle Details" > "To MINI CarData".

MINI Connected Account – here you can view and change your detailed settings for MINI Connected. Some settings for MINI Connected can only be changed via the MINI app or only in the vehicle. To do this, we ask that you use the relevant options in the app or in the vehicle.

If you have any questions about how we use your personal data or want to change it, you can also contact MINI Customer Service – either by email at minikundenberatung@mini.de or by phone on +49 89 1250-16060.

However, the settings for the use of your data by MINI partners cannot be changed in your online account, in the BMW AG data protection portal area. For such a change or if you have any questions about the use of your data, you must therefore contact the relevant MINI partner directly.

If you have any questions about how we use your personal data, it is best to contact MINI customer service first – either by email at minikundenberatung@mini.de or by phone on +49 89 1250-16060.

In addition, you can contact the responsible data protection officer. A list of data protection officers can be found here.

As the person affected by the processing of your data, you can assert certain rights with us under the GDPR and other relevant data protection regulations. The following section contains explanations of your data subject rights under the GDPR. Depending on the type and scope of your request, we will ask you to send it to us in writing.

Data subject rights

According to the GDPR, you have the following rights in relation to MINI in particular as the data subject

Right to information (Art. 15 GDPR): You can request information from us about your data that we hold about you at any time. This information concerns, among other things, the categories of data we process, the purposes for which we process them, the origin of the data if we have not collected it directly from you, and, if applicable, the recipients to whom we have transmitted your data. You can get a free copy of your data from us. If you are interested in additional copies, we reserve the right to charge you for the additional copies.

Right to rectification (Art. 16 GDPR): You can request us to rectify your data. We will take reasonable steps to keep the information we hold about you and process on an ongoing basis accurate, complete and up to date based on the most recent information available to us.

Right to erasure (Art. 17 GDPR): You can request us to erase your data if the legal requirements for this are met. According to Art. 17 GDPR, this can be the case if

The data are no longer necessary for the purposes for which they were collected or otherwise processed;

You revoke your consent, which is the basis for the data processing, and there is no other legal basis for the processing;

You object to the processing of your data and there are no overriding legitimate reasons for the processing, or you object to data processing for direct marketing purposes;

The data have been processed unlawfully;

The processing is not necessary to ensure compliance with a legal obligation which requires us to process your data; in particular with regard to statutory retention periods; around

Establish, exercise or defend legal claims.

Right to restriction of processing (Art. 18 GDPR): You can request us to restrict the processing of your data if you contest the accuracy of the data for the period of time it takes us to verify the accuracy of the data;

The processing is unlawful and you refuse the deletion of your data and instead request the restriction of use;

We no longer need your data but you need it to establish, exercise or defend legal claims;

You have lodged an objection to the processing, as long as it is not certain whether our legitimate reasons outweigh yours.

Right to data transferability (Art. 20 GDPR): At your request, we will transfer your data to another person responsible - insofar as this is technically possible. However, you only have this right if the data processing is based on your consent or is necessary to carry out a contract. Instead of receiving a copy of your data, you can also ask us to transfer the data directly to another controller specified by you.

Right to object (Art. 21 GDPR): You can object to the processing of your data at any time for reasons that arise from your particular situation, provided that the data processing is based on your consent or on our legitimate interests or those of a third party. In this case we will no longer process your data. The latter does not apply if we can demonstrate compelling legitimate grounds for processing that outweigh your interests or if we need your data to assert, exercise or defend legal claims.

Deadlines for the fulfillment of data subject rights

We always aim to respond to all requests within 30 days. However, this period may be extended for reasons related to the specific right of the data subject or the complexity of your request.

Restriction of information when fulfilling the rights of data subjects

In certain situations