Legal information on data protection.

Published: July 2025

The high standards you expect from our products and services are our guideline for handling your data. Our aim is to create and maintain the basis for a trusting business relationship with our customers and prospects. The confidentiality and integrity of your personal data is top priority for us.

We will therefore process and use your data carefully, purposefully, and in accordance with applicable laws. The BMW M data protection notice describes in the following sections how BMW M collects, processes and uses personal data of its customers and prospects.

BMW M GmbH (hereinafter referred to as "BMW M"), Daimlerstr. 19, 85748 Garching-Hochbrück, Germany registered office and court: Munich HRB 44621 (hereinafter referred to as "BMW M" or "we") is the data controller within the meaning of the EU General Data Protection Regulation ("GDPR") for the processing of your personal data. BMW M is based in Garching-Hochbrück, Germany; it is a subsidiary of BMW AG.

BMW M is responsible for your data collected and processed through the website www.bmw-m.com, in the context of the BMW M Drivers Community, during newsletter registration or other marketing activities, as well as the BMW M Driving Experience. BMW M is also responsible for your data collected and processed in connection with vehicle usage contracts with BMW M or in connection with ticket purchases for BMW M events such as MotoGP events. Additionally, BMW M processes your data in the context of customer support, for example, for the order form for retrofitting the M Driver’s Package, provided that this data is transmitted to us by BMW M partners, when and to the extent that the necessary data protection requirements are met.

BMW M is generally not responsible for the distribution of BMW and BMW M automobiles, original BMW and BMW M parts, accessories, and related services. This is managed through BMW AG and the respective national companies and dealerships (hereinafter referred to as BMW M Partners). If you would like more information about the data protection practices of BMW AG or the respective national companies, you can find this on the website of the national sales company in your country.

BMW M Partners are responsible for processing the personal data that the partners themselves provide in connection with your inquiries and customer support in the areas of sales and service. BMW M Partners also process your data as independent controllers, provided that this data is transmitted to them by BMW M, when and to the extent that the necessary data protection requirements are met.

In these legal notice on data protection, some data processing activities by BMW M Partners are also described. However, BMW M Partners may collect additional personal data and have their own data protection notice. In this case, you can refer to the data protection notice of the respective BMW M Partner to see how your data is used.

BMW M collects and processes your personal data in the following cases:

• When you contact us directly, e.g., through our website, and you are interested in our products or services or have another inquiry.
• When you purchase services directly from us (e.g., a driving training).
• When you request information about our products and services (e.g., electronic transmission of brochures or price lists).
• When your personal data is transmitted to us by BMW M Partners or third parties, when and to the extent that the necessary data protection requirements are met.
• When other BMW Group companies and our business partners lawfully provide data about you.

Please help us keep your information up to date by informing us of any changes to your personal data – especially your contact details.

The following categories of personal data may be collected through the services and contact channels described in these data protection notices:

• Contact Details: Name, address, phone number, email address.
• Interests: Information you provide about your areas of interest, e.g., vehicles that interest you.
• Contract Data: Customer number, contract number.
• Website Usage and Communication: Information about how you use the website and whether you open or forward communications from us, including data collected through cookies and other tracking technologies. More information can be found in our BMW M Cookie Policy.
• Transaction and Interaction Data: Information about purchases of BMW M services.

BMW M provides certain services to customers under the designation "BMW M Services." The data collected in connection with the conclusion of the contract, or the provision of these services will be processed for the purposes mentioned below.

In the context of the contract conclusion, the following categories of data are processed:

• BMW M Driving Experience Booking System:
  • Contact details: Name, first name, address details, email address, etc.
  • Registration: BMW M Driving Experience Booking System
  • Registration data: Email address, password

• Vehicle Usage Contract:
  • Contact details: Name, first name, address details, email address
  • Additional information: Driver's license classes, driver's license number, issuing authority, date of issue
• Ticket Purchase for MotoGP Events or Other BMW M Events:
  • Contact details: Salutation, name, first name, address details, country, phone number, email address, ID number, company address, tax number

Contract data will be automatically deleted one year after the contract expires; booking receipts for financial transactions will be deleted in accordance with legal regulations after 10 years.

In the context of BMW M Services, the following categories of data are processed:

• BMW M Driving Experience Booking System:
  • Contact details: Name, first name, address details, email address, etc.
  • Registration: BMW M Driving Experience Booking System
  • Registration data: Email address, password
• Online Account of the BMW M Drivers Community:
  • Contact details: Salutation, name, first name, community username (nickname), phone number, date of birth, address details, country, vehicle identification number
  • Registration: BMW M Drivers Community
  • Registration data: Email address, password
• Submission of the Order Form for Retrofitting the M Driver’s Package, provided that this is transmitted to you by BMW M Partners:
  • Contact details: Name, first name, vehicle identification number, vehicle specification, vehicle model, mileage

BMW Group Login:
To fully utilize the BMW M Drivers Community, you must register online. With registration, you receive an online customer account that also gives you access to other BMW Group portals. The master data of the online customer account is stored by BMW AG.

BMW M Driving Experience Booking System Login:
To avoid providing personal information in the BMW M Driving Experience Booking System in the future, a login can be created. The login consists of an email address and a self-chosen password. Alternatively, a booking can be made through the guest access if this is not desired.

Beyond the mere provision of services, the above-mentioned data is also processed for quality assurance of the products and services offered by the BMW Group and for the development of new products and services. This processing serves the legitimate interest of meeting the high customer demands for the existing products and services and being able to fulfill future customer wishes through new, yet-to-be-developed products and services. The processing is carried out in a manner that protects the privacy of our customers, exclusively in a form that cannot be directly traced back to the customer or the vehicle.

BMW M is a company of the BMW Group. We process your data in part to manage the various companies within the BMW Group as efficiently and successfully as possible. This includes, for example, the joint group accounting according to international accounting standards for companies (such as the International Financial Reporting Standards – IFRS).

BMW M uses your personal data for communication in the context of contract processing mentioned above (e.g., BMW M Driving Experience) or for handling a request you have made (e.g., inquiries to BMW M Exclusive Customer Support). For all aspects of contract processing or handling a request, we will contact you without separate consent, e.g., in writing, by phone, via messenger services, or by email, depending on the contact media you have provided.

If you have separately given your consent for further use of your personal data, your personal data may be used in accordance with the scope described in the consent, for example, for advertising purposes (selected offers for products and services of the BMW Group or advertising partners) and, with your separate consent, also with high personalization based on an individual customer profile and/or market research, and may be passed on to certain BMW Group companies and selected BMW Partners. Details can be found in the respective consent declaration, which can be revoked at any time.

BMW M will also process personal data when there is a legal obligation to do so. Collected data will be processed, for example, in the context of ensuring the operation of IT systems. Ensuring includes, among other things, the following activities:

• Securing and restoring data processed in IT systems,
• Logging and monitoring transactions to check the correct functioning of IT systems
• Detecting and preventing unauthorized access to personal data
  
• Incident and problem management to resolve disruptions in IT systems

Collected data will also be processed in the context of internal compliance management, where we check, for example, whether you were adequately advised in the context of a contract conclusion and that the BMW Partner has complied with all legal obligations.

BMW M is subject to a variety of other legal obligations. To comply with these obligations, we process your data to the necessary extent and may pass it on to the responsible authorities in the context of legal reporting obligations. In the context of legal obligations, certain (so-called OBFCM data, such as fuel consumption and kilometers driven) will be collected about your vehicle during workshop visits and transmitted directly to the EU Commission by the manufacturer. You can refuse the collection and transmission of data for this purpose at BMW authorized workshops and dealerships. Furthermore, we may process your data in the event of a legal dispute if the legal dispute necessitates the processing of your data.

BMW M GmbH is part of the BMW Group. We may transmit your data to other companies within the BMW Group after careful review, which will process it as their own controllers. Such data transmission may occur under the following circumstances and for the following purposes:

Please note that this is not a complete or exhaustive list of data transmission processes within the BMW Group, but merely examples intended to make data transmissions more transparent:

• If you have previously given us your explicit consent to share your data for advertising or marketing purposes with other companies in the BMW Group. This concerns BMW M GmbH, Company for Individual Automobiles, and BMW M Driving Experience, Garching-Hochbrück. The contact details and information about a potential data protection officer can be viewed here.
• To fulfill the sales, service, and administrative processes of BMW M
• In the context of group reporting, we may transmit data, e.g., we transmit billing-relevant information regarding the respective vehicle identification numbers for leased vehicles in the context of assessing residual values.

BMW M is a globally operating company. Personal data is preferably processed by us and commissioned service providers within the EU. Should data be processed in countries outside the EU, EU standard contracts including appropriate technical and organizational measures ensure that your personal data is processed in accordance with the European data protection level. If you would like to see the specific protective measures for the transfer of data to other countries, please contact us using the communication channels provided below. For some countries outside the EU, such as Canada and Switzerland, the EU has already determined a comparable level of data protection. Due to the comparable level of data protection, the transfer of data to these countries does not require special approval or agreement.

In certain situations, we write or read information in or from your end device. This occurs, for example, in the form of cookies when using websites or the MyBMW APP or during a software update of your vehicle. This storage or access is based on your consent according to § 25 para. 1 TDDDG, or, to the extent that it is absolutely necessary according to § 25 para. 2 TTDSG, to provide you with a service explicitly requested by you, without your consent. The subsequent processing is based on the GDPR according to the purposes described above.

We will only retain your data for as long as is necessary for the respective purposes for which we process your data. If we process data for multiple purposes, it will be automatically deleted or stored in a format that does not allow direct conclusions about your person as soon as the last specific purpose has been fulfilled. To ensure that all your data is deleted in accordance with the principle of data minimization, BMW has developed an internal deletion concept. The basic principles according to which this deletion concept provides for the deletion of your personal data are outlined below.

Use for Contract Fulfillment
To fulfill contractual obligations, data collected from you may be retained as long as the contract is in effect, as well as for 6 or 10 years thereafter, depending on the nature and scope of the contract, to comply with legal retention obligations and to clarify any inquiries or claims after the contract has expired.

Additionally, there are contracts for the delivery of products and services that require longer retention periods, see also below "Use for Claims Assessment."

Use for Claims Assessment
Data that we deem necessary to assess, defend against, or initiate criminal prosecution against you, us, or third parties, or to assert claims, may be retained for as long as a corresponding procedure could be initiated.

Use for Customer Support and Marketing Purposes
For customer support and marketing purposes, the data collected from you may be retained for 3 to 10 years after collection, unless you request the deletion of this data and there are no contractual or legal retention obligations that oppose this deletion request.

We implement various security measures such as encryption and authentication tools according to the current state of technology to protect and maintain the security, integrity, and availability of your data.
A hundred percent protection against unauthorized access cannot be guaranteed for data transmissions over the Internet or a website, but we and our service providers and business partners strive to protect your personal data in accordance with applicable data protection regulations through physical, electronic, and procedural security measures according to the current state of technology. Among other things, we implement the following measures:

• Strict criteria for access authorization to your data based on the "Need-to-Know Principle" (limiting access to as few people as possible) and exclusively for the specified purpose,
• Transmission of collected data exclusively in encrypted form,
• Storage of confidential data, e.g., credit card data, exclusively in encrypted form,
• Firewall protection of IT systems to prevent unauthorized access, e.g., by hackers, and
• Continuous monitoring of access to IT systems to detect and prevent the misuse of personal data.

If you receive a password from us or have chosen one yourself that provides you access to certain areas of our website or other portals, apps, or services operated by us, you are responsible for keeping this password confidential and for complying with all other security procedures of which we inform you. We particularly ask you not to share your password with anyone.

You can view and change data protection-related settings in the BMW M Drivers Community or the BMW M Driving Experience Booking System at any time or request a change.

If you have questions about the use of your personal data by us, you can contact BMW M Customer Support – either by email at customer.service@bmw-m.com or by phone at 0049 89 1250 160 16.

Additionally, you can contact the responsible data protection officer of BMW M:
BMW M GmbH
Data Protection Officer
Daimlerstraße 19
85748 Garching-Hochbrück
datenschutz@bmw.de

As data subject affected by the processing of your data, you can assert certain rights against us under the GDPR and other relevant data protection regulations. The following section contains explanations of your rights as a data subject under the GDPR. Depending on the nature and scope of your request, we will ask you to submit it in writing to us.

Rights of Data Subjects:
Under the GDPR, you have the following rights against BMW M as a data subject:

Right to Access (Art. 15 GDPR):
You can request information from us at any time about your data that we hold about you. This information includes, among other things, the categories of data we process, the purposes for which we process them, the source of the data if we did not collect it directly from you, and, if applicable, the recipients to whom we have transmitted your data. You can receive a free copy of your data from us. If you are interested in additional copies, we reserve the right to charge you for the additional copies.

Right to Rectification (Art. 16 GDPR):
You can request the rectification of your data from us. We will take appropriate measures to ensure that your data, which we hold and continuously process, is accurate, complete, and up to date, based on the most current information available to us.

Right to Deletion (Art. 17 GDPR):
You can request the deletion of your data from us, provided that the legal requirements are met. This may be the case under Art. 17 GDPR if:

• the data is no longer necessary for the purposes for which it was collected or otherwise processed;
• you withdraw your consent, which is the basis for the data processing, and there is no other legal basis for processing;
• you object to the processing of your data and there are no overriding legitimate grounds for processing, or you object to the processing of data for direct marketing purposes;
• the data has been unlawfully processed;

-  the processing is not necessary to comply with a legal obligation that requires us to process your data;

-  particularly with regard to legal retention periods;

- to assert, exercise, or defend legal claims.

Right to Restriction of Processing (Art. 18 GDPR):
You can request the restriction of the processing of your data from us if:
• you dispute the accuracy of the data for the period we need to verify the accuracy of the data;
• the processing is unlawful and you refuse the deletion of your data and instead request the restriction of use;
• we no longer need your data, but you need it to assert, exercise, or defend legal claims;
• you have lodged an objection to the processing as long as it is not yet clear whether our legitimate grounds outweigh yours.

Right to Data Portability (Art. 20 GDPR):
At your request, we will transfer your data – to the extent technically feasible – to another controller. However, this right only applies if the data processing is based on your consent or is necessary for the performance of a contract. Instead of receiving a copy of your data, you can also ask us to transmit the data directly to another controller specified by you.

Right to Object (Art. 21 GDPR):
You can object to the processing of your data at any time for reasons arising from your particular situation, provided that the data processing is based on your consent or on our legitimate interests or those of a third party. In this case, we will no longer process your data. The latter does not apply if we can demonstrate compelling legitimate grounds for the processing that override your interests or if we need your data to assert, exercise, or defend legal claims.

Deadlines for Fulfillment of Data Subject Rights:
We generally strive to respond to all requests within 30 days. However, this period may be extended for reasons related to the specific data subject right or the complexity of your request.

Limitation of Information in Fulfillment of Data Subject Rights:
In certain situations, we may not be able to provide you with information about all of your data due to legal requirements. If we must deny your request for information in such a case, we will inform you of the reasons for the denial at the same time.

Complaint to Supervisory Authorities:
BMW M takes your concerns and rights very seriously. However, if you believe that we have not adequately addressed your complaints or concerns, you have the right to lodge a complaint with a competent data protection authority.