1. What data do we process and for what purpose

Personal information means any information saved in electronic or other forms that can be used independently or together with other information to identify a natural person or reflect the activities of a natural person, including but not limited to name, date of birth, identification number, personal biometric information, address and telephone number.

Sensitive personal information means the personal information that may cause harm to personal or property security, or is very likely to result in damage to an individual’s personal reputation or physical or mental health or give rise to discriminatory treatment, once it is leaked, unlawfully provided or abused. In general, national ID number, bank account number, precise personal positioning information etc. are regarded as sensitive personal information. In this Privacy Policy, the terms and articles concerning sensitive personal information will be marked in bold for your special attention.

We collect and process your personal information solely for the following purposes as described in this policy to complete the business functions of My BMW mobile application (APP).

We will seek your consent if we use your information for purposes other than those stated in this Privacy Policy.

Unless otherwise indicated in below the purposes, we store your personal information only for as long as the relevant purpose requires it. If your personal information is processed for multiple purposes, your information will be automatically deleted or stored in a form that cannot directly be traced back to you, as soon as the last specified purpose has been fulfilled.

1.1. User registration

To complete user registration, we will collect the following information.

(1). Mobile number,

(2). My BMW account login information

The information stated in item (1) above is necessary for providing you with the basic business functions of My BMW. Without it, we may not be able to provide you with the relevant basic services.

To make full use of the My BMW services, you have to register on the My BMW account. After registration, you will receive an online customer account that also gives you access to other portals of the BMW China. At the same time, if you have registered an online account on other portals of BMW China, you can also use that account to log in on this portal. For registration purpose, we may need to collect information listed in item (2) above, including registered account, password, password authentication answers, user personal digital certificate, etc. Without such information, we will not be able to create the customer account for you and provide you with all services thereof.

When you are using our services, we will be authorized to use the above-said information you have provided. We will cease using and delete the above-said information (including personal information generated during your use of the customer account) in a timely manner after you cancel your user account. Neverthelessunder the circumstances clearly prescribed by laws and regulations and regulatory bodies, information related to the use of My BMW and financial transactions will still be stored within the legal time limit after the use or transaction is completed, and may be subject to inspection by the relevant regulatory agencies.

1.2. Provide services related to My BMW

In My BMW software, we will provide you with the following services:

1.2.1. Service of BMW Official Mall, including:

(1). We will provide you with new car sales services through the information of your car purchase intention reserved in the BMW Official Mall or through a third party.

(2). You can pay the car purchase intention money online for interested models in the BMW Official Mall.

(3). You can buy original BMW brand parts and BMW lifestyle products online in the BMW Official Mall.

(4). You can find relevant information about BMW authorized dealers online.

In order to provide the above services, BMW's official store may collect or process potential personal information generated during use, including:

(1). Online transaction order data, including name, mobile number, address.

(2). Reservation information of car purchase intention including name, mobile number.

(3). Logistics consignee address and contact information, including name, mobile number, address.

1.2.2. BMW China Membership Alliance Service

In the BMW China Membership Alliance service, you will be able to enjoy the benefits and rewards provided by BMW China and its dealers, as well as partners of BMW China.

In order to provide the above services, we may collect or process potential personal information generated during your use of BMW China Membership Alliance services, including:

(1). Address information, used to send you products when you use the points redemption service.

1.2.3. Test Drive Appointment Service

You can book a test drive service through My BMW. In order to provide the above services, we may collect or process potential personal information generated during your use of the test drive appointment service, including:

(1). Name

(2). Gender

(3). Mobile number

1.2.4. BMW Charging Wallbox Control Application Service

Some BMW Charging Wallbox support mobile phone control applications. If your Wallbox supports mobile phone control applications, you can connect to the mobile phone through the bluetooth wallbox through the service function of the APP, and use the functions to start charging, access charging data, account management, etc.

In order to provide the above services, we may collect or process potential personal information generated during your use of the BMW Charging Wallbox Control Application Service, including:

(1). The username and password of your charging wallbox;

(2). The charging record of your wallbox

In order to improve the quality of service and enhance your user experience of the product, we may collect the following personal information during the use of My BMW, including

(1). Terminal equipment information of MyBMW users;

(2). Account login information of MyBMW users;

(3). APP used history and operation history record;

Based on the information collected above, we will recommend, display or push information that may be of interest to you, or push specific functions, services or commercial advertisements that are more suitable for you， using indirect user profile. If you want to refuse to use this function, you can unsubscribe the service. The unsubscribe will not impact the normal use of MY BMW regular functions.

The provision of the above data is not required to use the basic functions of My BMW, but is necessary to provide specific services of My BMW. Therefore, if you do not provide and authorize us to use the above information, we will not be able to provide specific services related to My BMW, but it will not affect the basic services of My BMW.

The processed personal information will be automatically deleted after your My BMW account is cancelled, unless it is needed longer for the provision of the specified service and your further authorization and consent is obtained.

When you use the relevant business functions, our APP will apply to you for system permissions related to personal information: allow the program to connect to paired Bluetooth devices.

The above-mentioned system permissions are 1 items in total. Without your permissions we will not be able to provide the relevant business functions. Except for the above-mentioned system permissions, you may voluntary choose whether you would like to grant other system permissions to our APP.

System permissions and corresponding business modules are as follows:

(1). Allow the program to connect to Bluetooth devices (corresponding business module: BMW charging wallbox control application service)

1.3. Ensuring product quality and developing new products

Beyond the mere provision of services, the data collected under I.2 will also be processed to ensure the quality of the BMW products and services and to develop new BMW products and services. This kind of processing serves the legitimate interest of BMW to meet high customer demand for existing products and services and for BMW to be in a position to satisfy the future wishes of our customers with new products and services still to be developed. For the protection of customers’ privacy, the data will be processed exclusively in a form that cannot be directly or indirectly traced back to the specific customer or vehicle unless additional and separate consent of the customer is obtained.

1.4. Fulfillment of the sales, service, and administration processes

In order to continuously optimize the customer experience and cooperation with the BMW dealers, we may compile analyses and reports based on contract information, which we may share with the responsible BMW dealers. These analyses will primarily be used to introduce appropriate measures (e.g. training for sales staff) to improve the application and sales process. We may prepare the reports described above exclusively in aggregated and anonymized form, i.e. the recipients of the reports will not be able to identify you as an individual from the data contained in the reports.

Also, parts of the vehicle-specific data collected under I.2 will be processed to fulfill the service processes (e.g. repair, warranty, goodwill) of us, BMW China and authorized dealers. This kind of processing is in the legitimate interest of BMW to offer our customers the best possible service process. The technical vehicle data will be deleted in a timely manner at the end of the vehicle’s service life. However, if there are specific stipulations under the laws and regulations and required by the authorities, information related to contractual transactions will be retained within statutory time limit and may be inspected by the relevant authorities. See further information at “Section 3 How We Entrust, Share, Transfer and Publicly Disclose Your Personal Information” below.

1.5. Customer service

We use your personal information (i.e. your name, email address and phone number) to contact you in connection with the processing of contracts (e.g. booking of BMW Connected Drive services) or to process a request formulated by you (e.g. inquiries and complaints sent to BMW customer services). For all aspects of processing contracts or requests, we will contact you without obtaining separate consent, e.g. in writing, by telephone, messenger services, or email, depending on the contact media you specified. We may also share your name, email address and phone number to our affiliated companies and partners for the same purpose. See further information at “Section 3 How We Entrust, Share, Transfer and Publicly Disclose Your Personal Information” below.

1.6. Advertising communication and market research based on consent

If you have separately given your consent to the further use of your personal information, your personal information may be used in accordance with the scope described in the consent, e.g. for advertising purposes and/or market research, and may be passed on to third parties. Details on this can be found in the respective declaration of consent, which can be revoked at any time at your own discretion. See further information at “Section 3 How We Entrust, Share, Transfer and Publicly Disclose Your Personal Information” below.

1.7. Fulfillment of legal obligations

We process personal information if there is a legal obligation to do so. This may be the case if we need to contact you because your vehicle is affected by a recall or a technical action.

Sometimes, parts of the vehicle-specific data collected under I.2 are also processed to meet legal and regulatory requirements such as disclosure of repair and maintenance information request by the relevant regulation. To protect the privacy of our customers, the processing of technical information listed below is always vehicle-related and without direct or indirect connection to the specific customer.

(1). Vehicle master data (vehicle type, color, equipment, etc.)

(2). Vehicle maintenance data (next service due date, oil level, brake wear, etc.)

(3). Vehicle status data (mileage, battery voltage, door and flap status, etc.)

The information collected is also processed to ensure the secured operation of IT systems. Smooth and secured operation of IT systems will be ensured with the following actions, among others:

(4). Backup and recovery of data processed in IT systems

(5). Logging and monitoring of transactions to check the correct functioning of IT systems

(6). Detection and prevention of unauthorized access to personal information

(7). Incident and problem management for troubleshooting IT systems

The information collected is also processed as part of internal compliance management by which we check, for example, whether you received sufficient advice when concluding a contract and that the dealer complied with all legal obligations.

We are subject to a variety of other legal obligations. In order to fulfill these obligations, we process your information to the required extent and, if necessary, pass it on to the responsible authorities in accordance with legal reporting requirements. See further information at “Section 3 How We Entrust, Share, Transfer and Publicly Disclose Your Personal Information” below.

2. How We Use Cookies and Other Similar Technologies

We do not use cookies and other similar technologies in My BMW services to collect your personal information.

3. How We Entrust, Share, Transfer and Publicly Disclose Your Personal Information

3.1. Entrusted processing

Certain modules or functions of My BMW service are provided by external providers.

In order to provide you with public charging information integration service, search function, community service, dealer search service, after-sales service appointment service, door-to-door pick-up and delivery service, we may provide or transmit the anonymous personal information collected in part 1 (2) above to the selected third party.

We will enter into strict non-disclosure agreements with all entrusted companies, organizations and individuals and require them to process personal information according to our instructions, this Privacy Policy and any other related measures for confidentiality and security.

3.2. Sharing

3.2.1. Sharing information with explicit consent. We will not share your personal information with any company, organization or individual outside of LingYue, unless we obtain your consent. At present, in the following circumstances we will ask you for authorization and consent to share your personal information:

(1). Sharing information with our affiliated companies: your personal information may be shared with affiliated companies of LingYue. We will share the necessary personal information only for the purposes specified in this Privacy Policy. If an affiliated company changes the purpose for processing your personal information, your further authorization and consent will be obtained. LingYue affiliated companies include: BMW AG, BMW China Automotive Trading Ltd., BMW Brilliance Automotive Ltd., BMW Automotive Finance (China) Co., Ltd., BMW China Services Ltd., Herald International Financial Leasing Co., Ltd., and any other companies or entities directly or indirectly controlling, controlled by or under common control with the aforementioned entities through the ownership of voting equity, shares or otherwise

(2). Sharing with authorized dealers. For the purpose of realizing the purposes specified in the Privacy Policy, we may share some of your personal information with our authorized dealers, in order to offer better client services and user experience.

We will enter into strict non-disclosure agreements with all companies, organizations and individuals with which we share information and require them to process personal information according to our instructions, this Privacy Policy and any other related measures for confidentiality and security.

3.2.2. We may share your personal information with external parties as required under laws or regulations or upon compulsory requirements of competent government authorities.

3.3. Transferring

We will not transfer your personal information to any other company, organization or individual, except under the following circumstances.

(1). Transferring information with explicit consent: we will transfer your personal information to other parties after obtaining your explicit consent.

(2). If your personal information has to be transferred in a merger, acquisition or bankruptcy liquidation, we will require the new company or organization that will hold your personal information to continue to observe this Privacy Policy. Otherwise, we will require the new company or organization to request for your authorization and consent before transferring your personal information.

3.4. Public disclosure

We will publicly disclose your personal information only under the following circumstances.

(1). After obtaining your explicit consent.

(2). Disclosure under the law: we may publicly disclose your personal information as required by laws, under legal procedures, in lawsuits or upon compulsory requirements of competent authorities under the government.

4. How We Protect Your Personal Information

4.1. We store your information based on the state of the art and we take the following safeguards to protect your personal information from misuse or any other unauthorized processing, disclosing, using, rectifying, or destroying. Access to personal information is restricted to a limited number of authorized persons for the stated purposes only. The data collected will only be transmitted in encrypted form. Sensitive data is stored only in encrypted form. The IT systems for processing the data are technically isolated from other systems to prevent unauthorized access, e.g. through hacking. In addition, access to these IT systems is continuously monitored to detect and ward off misuse at an early stage.

4.2. We will take all reasonable and feasible measures to ensure that we have not collected irrelevant personal information. We will only retain your personal information for a limited period necessary for realizing the purposes specified in this Privacy Policy, unless it is necessary to extend the retention period or it is protected under the law.

4.3. The Internet is not an absolutely safe environment. We will do our utmost to ensure the security of any information you send to us. If damage to our physical, technical or management safeguards results in your information being accessed, publicly disclosed, falsified or damaged without authority, which causes damage to your legal rights and interests, we will bear the legal liability.

4.4. In the case of any incident in respect of personal information security, we will, pursuant to requirements set out in laws and regulations, inform you promptly of the particulars, including basic information about the security incident and the likely impact, what measures we have taken or will take to respond to such incident, suggestions on what measures you may take yourself to guard against and lower risks, remedial actions we offer to you, etc. We will brief you on the progress of the incident by email, correspondence, phone or by sending notifications, and we will release announcements for this purpose in a reasonable and effective manner even when it is difficult to notify personal information subjects one by one.

Meanwhile, we will actively report how the personal information security incident is being handled pursuant to the requirement of the regulator.

5. Your Rights

You are entitled to the following rights over your own personal information according to applicable Chinese laws, regulations and standards, and common practices in other countries and regions.

5.1. Accessing your personal information

You have the right to access your own personal information, unless there are exceptions in laws and regulations. You can contact 400-800-6666 to consult the specific correction process.

We will respond to your request within 15 working days upon authentication of your identity.

5.2. Rectifying your personal information

If you find that your personal information we process is inaccurate, you have the right to request us to rectify your information. You can contact 400-800-6666 to consult the specific correction process.

Upon authentication of your identity, we will respond to your request within 15 working days.

5.3. Deleting your personal information

You may request the deletion of your personal information under any of the following circumstances:

(1). When our processing of personal information violates laws or regulations;

(2). When we collect or use your personal information without your consent;

(3). When our processing of personal information violates our agreement with you;

(4). When you no longer use our products or services, or cancel your user account; or

(5). When we no longer provide you with the products or services.

If we agree with your request to delete information, we will also notify entities that obtain your personal information from us to require them to delete the information concerned in a timely manner, unless otherwise stipulated by laws and regulations or such entity has obtained your separate authorization.

Once your information has been removed from our services, we may not immediately delete the corresponding information from the backup system, but we will delete the information when the backup is updated.

5.4. Changing the scope of your authorization

Each business function cannot be realized without some basic personal information (see Part I of this Privacy Policy). In terms of the collection and use of additionally collected personal information, you may grant or revoke your authorization and consent at any time.

You can change your authorization consent at any time by calling 400-800-6666.

After you have revoked your consent, we will not process the corresponding personal information any more. But your decision to withdraw your consent does not affect the previous processing of personal information based on your authorization.

If you do not want to receive the commercial advertisements you choose to receive, you may unsubscribe by calling 400-800-6666 at any time.

5.5. Cancelling user accounts

You may cancel at any time the account you registered for by calling 400-800-6666.

After your account is cancelled, we will cease providing you with products or services, and delete your personal information in a timely manner, unless otherwise stipulated by laws and regulations.

5.6. Obtaining copies of your personal information

You have the right to obtain copies of your personal information by sending the email at any time to connecteddrive@bmw.com.cn.

At your request, we can transfer the copies of your personal information to designated third party as long as technologies permit, such as data interface matching.

5.7. Use of automatic decision-making of the information system

Our decisions will not only rely on the automatic decision-making mechanisms, such as the information system and algorithms.

5.8. Responding to your requests

For the sake of security, you may be required to file written requests or prove your identity in other ways. We may request authentication of your identity before responding to your requests.

We will reply within 15 working days. If you are dissatisfied with our reply, you may lodge a complaint through the following means: 400-800-6666.

In principle, we will not charge fees for your reasonable requests. However, if your requests are lodged repeatedly or beyond a reasonable extent, we will charge fees of a proper amount depending on the cost. We may refuse your requests if they are repeated without reason, need to be replied to through excessive technical methods (for example, a new system needs to be developed or the existing common practices need to be fundamentally reformed), pose risks to others’ legal rights or interests, or are fairly unrealistic (for example, it involves information stored on backup tapes).

We will not respond to your requests under any of the following circumstances.

(1). Where requests are in relation to the performance by the personal information controller of obligations specified in laws and regulations;

(2). Where requests are in direct relation to the national security or national defense security;

(3). Where requests are in direct relation to the public security, public sanitation, or major public benefits;

(4). Where requests are in direct relation to investigations into crimes, prosecutions, court trials, execution of rulings, etc.;

(5). Where the personal information controller has sufficient evidence that the personal information subject is subjectively malicious or abusing his/her rights;

(6). Where personal information collecting and processing are for the sake of safeguarding significant legal rights and interests, such as the life and property of personal information subjects or other individuals, but it is difficult to obtain their consent;

(7). Where responses to the requests of the personal information subject will give rise to serious damage to the legal rights and interests of the personal information subject or any other individual or organization; or

(8). Where requests involve trade secrets.

6. How We Deal with Children’s Personal Information

Our products and services are designed primarily for adults. No child is allowed to create a user account by himself or herself, without the consent of his or her parent or guardian. Where personal information of a child is collected with the explicit consent of his or her parent, we will use or publicly disclose such information only when it is permitted under the law, the child’s parent or guardian grants explicit consent or it is necessary to do so to protect the child.

We regard any minor who is under the age of 14 as a child, no matter whether the child is defined differently under local laws and by local customs. If we find that we have collected the personal information of a child without prior and provable consent from the child’s parent, we will do our best to delete the relevant information as soon as possible.

7. How Your Personal Information Will Be Transferred Globally

The personal information we collect and generate within the territory of the People’s Republic of China (PRC) will be stored within the territory of the PRC. Therefore, your personal information will not be transferred to other jurisdictions outside the PRC or be accessed by these overseas jurisdictions.

8. How the Privacy Policy Will Be Updated

Our Privacy Policy may be changed from time to time. We will not reduce your rights under the Privacy Policy without your explicit consent. We will publish any change to the Privacy Policy at this page. We will keep the former versions of this Privacy Policy available to you for ease of reference.

In the case of major changes, we will release clear notices (including, for some services, the mail messages that inform you of what specific changes are introduced to this Privacy Policy).

For the purpose of this Privacy Policy, major changes include but are not limited to:

8.1. Significant changes to our service mode, such as the purposes of processing personal information, categories of personal information to be processed, the ways to use personal information, etc.;

8.2. Substantial changes to the ownership structure, organizational structure, etc., such as changes to the owners as a result of business adjustments, bankruptcy, mergers and acquisitions;

8.3. Changes to the subjects we share with, transfer to or publicly disclose personal information;

8.4. Significant changes to your rights in respect of your participation in personal information processing and to the ways in which you can exercise such rights;

8.5. Changes to our department responsible for the security of personal information, contact information of such department, or complaint channels; and

8.6. Changes made due to high risks revealed in the security impact assessment report for personal information.

9. How to Contact Us

If you have any concerns or comments on this Privacy Policy, or if you have any questions about the way we use your personal information please contact us through the following means:

Email: connecteddrive@bmw.com.cn

Hotline: 400-800-6666

LingYue Digital Information Technology Co., Ltd, registered address: 28F, Tower B, Gateway Plaza, No. 18 Xia Guang Li, North Road East Third Ring, Chaoyang District, Beijing 100027.

We make every effort to reply all requests within 15 working days. If you are dissatisfied with our response and especially if our conduct of processing personal information harm your legitimate interest, you may consult the relevant government authorities and seek solutions.