As an individual whose data is subject to processing, you may assert certain rights against us in accordance with the GDPR and other relevant data protection regulations.
The following section contains explanations of your rights under the GDPR.
Rights of affected persons:
In accordance with the GDPR and in relation to BMW M, you, as an affected person, are entitled to the following rights in particular:
Right of access by the data subject (Art. 15 GDPR):
You may request information about the data we hold about you at any time. This information includes, but is not limited to, the categories of data we have processed, the purposes for which we have processed this data, the origin of the data if we did not collect it from you directly, and, if applicable, the recipients to whom we have transferred your data. You can request a copy of your data free of charge. If you are interested in obtaining additional copies, we reserve the right to charge you accordingly.
Right to rectification (Art. 16 GDPR):
You can ask us to rectify your data. We will take reasonable measures to keep the information we hold and process about you accurate, complete, and up to date, based on the most current information available to us.
Right to erasure (Art. 17 GDPR):
You can request the deletion of your data, provided there are legal requirements in place to support this. This may be the case under Art. 17 GDPR if:
- The data is no longer required for the purposes for which it was collected or otherwise processed;
- Your consent, which is the basis of data processing, is revoked and there is no other legal basis for the processing;
- You object to the processing of your data and there are no overriding legitimate grounds for processing, or you object to the processing of data for direct marketing purposes;
- The data was processed unlawfully,
unless processing is necessary
- to ensure compliance with a legal obligation that requires us to process your data;
- particularly with regard to legal retention periods;to enforce, exercise, or defend legal claims.
Right to restriction of processing (Art. 18 GDPR):
You may require us to restrict the processing of your data if
- You dispute the accuracy of the data for the period of time that we need to verify the accuracy of the data;
- The processing is unlawful but you refuse the deletion of your data and instead demand a restriction of use;
- We no longer need your information but you need it to enforce, exercise, or defend legal claims;
- You have lodged an objection against processing as long as it is not clear whether our justified reasons outweigh yours.
Right to data portability (Art. 20 GDPR):
At your request, we can transfer your data to another person in charge as far as technically possible. However, you are entitled to this right only if the data processing is based on your consent or is necessary to execute a contract. Rather than receive a copy of your data, you may also ask us to transfer the data directly to another person in charge specified by you.
Right to object (Art. 21 GDPR):
You may object to the processing of your data at any time for reasons that arise from your particular situation, if the data processing is based on your consent or on our legitimate interests or those of a third party. In this case, we will no longer process your data. The latter does not apply if we can provide compelling legitimate reasons for the processing that outweigh your interests or we need your data to enforce, exercise, or defend legal claims.
Time limits for the fulfillment of subject rights:
We make every effort to comply with all requests within 30 days. However, this period may be extended for reasons relating to the specific right of the affected person or complexity of your request.
Restriction of information in the fulfillment of subject rights:
In certain situations, we may be unable to provide you with information about all your data owing to legal requirements. If we have to refuse your request for information in such cases, we will inform you at the time of the reasons for the refusal.
Complaints to supervisory authorities:
BMW M takes your rights and concerns very seriously. However, if you believe that we have not adequately addressed your complaints or concerns, you are entitled to file a complaint with a competent data protection authority.