1. AN OVERVIEW OF DATA PROTECTION
Data collection on our website
Who is responsible for the data collection on this website?
The data collected on this website are processed by the website operator. The operator’s contact details can be found in the website’s required legal notice.
How do we collect your data?
Some data are collected when you provide it to us. This could, for example, be data you enter on a contact form. Other data are collected automatically by our IT systems when you visit the website. These data are primarily technical data such as the browser and operating system you are using or when you accessed the page. These data are collected automatically as soon as you enter our website.
What do we use your data for?
Part of the data is collected to ensure the proper functioning of the website. Other data can be used to analyze how visitors use the site.
What rights do you have regarding your data?br>You always have the right to request information about your stored data, its origin, its recipients, and the purpose of its collection at no charge. You also have the right to request that it be corrected, blocked, or deleted. You can contact us at any time using the address given in the legal notice if you have further questions about the issue of privacy and data protection. You may also, of course, file a complaint with the competent regulatory authorities.
Analytics and third-party tools
2. Legal information on data protection
We treat your data in accordance with the same high standards that you expect from our products and services. Our aim is to create and maintain the basis for a trusting business relationship with our customers and prospective customers. The confidentiality and integrity of your personal data is of particular concern to us.
WHO IS RESPONSIBLE FOR DATA PROCESSING?
Bayerische Motoren Werke Aktiengesellschaft, Petuelring 130, 80788 Munich, Germany; registered office and registered court: Munich HRB 42243 (hereinafter “BMW”) shall provide certain services to the guests and interested persons of the Concorso d’Eleganza Villa d’Este (e.g. the booking of packages and entry tickets) and is responsible for data processing in this context.
WHAT DATA DO WE PROCESS AND FOR WHAT PURPOSE?
The data collected in connection with the conclusion of the contract or the provision of the services is processed for the following purposes:
A. CONCLUSION OF CONTRACT (ARTICLE 6(1)(B) GDPR)
The following data categories are processed within the framework of the conclusion of a contract:
- Contact details (surname, first name, address, email address, telephone number etc.)
- Event-related data (booked package, arrival and departure dates, payment method, special requests etc.)
- Personal data of the accompanying person (name, arrival and departure dates, special requests etc.)
- If applicable, details of the submitted Historic Car, Concept Car or Motorcycle (owner, previous owner, serial number, history, covered value of the vehicle etc.)
The contract data is automatically deleted 1 year after the contract has expired; financial transactions are deleted after 10 years in accordance with legal provisions.
CUSTOMER SERVICE (ARTICLE 6 (1)(B), (F) GDPR)
BMW and BMW partners use your personal data to contact you in connection with the processing of contracts related to the Concorso d’Eleganza Villa d’Este or to process a request formulated by you (e.g. inquiries sent to the Guest Relation Team of the Concorso d’Eleganza Villa d’Este). For all aspects of processing contracts or requests, we will contact you without obtaining separate consent, e.g. in writing, by telephone, messenger services, or email, depending on the contact media you specified.
ADVERTISING COMMUNICATION AND MARKET RESEARCH BASED ON CONSENT (ARTICLE 6 (1)(A) GDPR)
If you have separately given your consent to the further use of your personal data, your personal data may be used in accordance with the scope described in the consent, e.g. for advertising purposes and/or market research, and may be passed on to third parties. Details on this can be found in the respective declaration of consent, which can be revoked at any time.
D. FULFILLMENT OF LEGAL OBLIGATIONS IMPOSED ON BMW (ARTICLE 6 (1)(C) GDPR)
In addition, BMW also processes personal data if there is a legal obligation to do so.
The data collected is also processed to ensure the operation of IT systems. Smooth operation is ensured with the following actions, among others:
- Backup and recovery of data processed in IT systems
- Logging and monitoring of transactions to check the correct functioning of IT systems
- Detection and prevention of unauthorized access to personal data
- Incident and problem management for troubleshooting IT systems
The data collected is also processed as part of internal compliance management.
BMW is subject to a variety of other legal obligations. In order to fulfill these obligations, we process your data to the required extent and, if necessary, pass it on to the responsible authorities in accordance with legal reporting requirements.
E. DATA TRANSMISSION TO SELECTED THIRD PARTIES
BMW may provide the data collected under point B to third parties in anonymous form for the purpose of use for e.g. booking of hotels and shuttle tours.
How long do we store your data for?
We store your personal data only for as long as the relevant purpose requires it. If data is processed for multiple purposes, the data will be automatically deleted or stored in a form that cannot directly be traced back to you, as soon as the last specified purpose has been fulfilled.
How is your data stored?
We store your data based on the state of the art. For example, the following safeguards are used to protect your personal information from misuse or any other unauthorized processing:
- Access to personal data is restricted to a limited number of authorized persons for the stated purposes only.
- The data collected will only be transmitted in encrypted form.
- Sensitive data is stored only in encrypted form.
- The IT systems for processing the data are technically isolated from other systems to prevent unauthorized access, e.g. through hacking.
- In addition, access to these IT systems is continuously monitored to detect and ward off misuse at an early stage.
Who do we share information with and how do we protect it?
BMW is a company with an international presence. Personal data is preferably processed within the EU by BMW employees and service providers commissioned by us.
If data is processed in countries outside the EU, BMW will ensure that your personal data is processed in accordance with European data protection standards thanks to EU-standard agreements, including the appropriate technical and organizational measures. If you would like to see the specific safeguards for the transfer of data to other countries, please contact us using the communication channels listed below.
For certain countries outside the EU, such as Canada and Switzerland, the EU has already determined a comparable level of data protection. Given the comparable level of data protection, data transmission to these countries does not require any special approval or agreement.
How can you view and change your data protection settings?
You can view and change the settings relevant to data protection at any time.
Contact details, subject rights, and your right to complain to a supervisory authority.
If you have any questions about the way we use your personal data, please contact the Guest Relation Team of the Concorso d’Eleganza Villa d’Este either by email at firstname.lastname@example.org or by calling +49 89 127 644 527 (Monday to Friday 9 am – 6 pm).
You can also contact the responsible data protection officer:
80788 Munich, Germany
As an individual whose data is subject to processing, you may assert certain rights against us in accordance with the GDPR and other relevant data protection regulations. The following section contains explanations of your rights under the GDPR.
Rights of affected persons
In accordance with the GDPR, you, as an affected person, are entitled to the following rights in particular:
Right of access by the data subject (Art. 15 GDPR):
You may request information about the data we hold about you at any time. This information includes, but is not limited to, the categories of data we have processed, the purposes for which we have processed this data, the origin of the data if we did not collect it from you directly, and, if applicable, the recipients to whom we have transferred your data. You can request a copy of your data free of charge. If you are interested in obtaining additional copies, we reserve the right to charge you accordingly.
Right to rectification (Art. 16 GDPR)
You can ask us to rectify your data. We will take reasonable measures to keep the information we hold and process about you accurate, complete, and up to date, based on the most current information available to us.
Right to erasure (Art. 17 GDPR)
You can request the deletion of your data, provided there are legal requirements in place to support this. This may be the case under Art. 17 GDPR if:
- The data is no longer required for the purposes for which it was collected or otherwise processed;
- Your consent, which is the basis of data processing, is revoked and there is no other legal basis for the processing;
- You object to the processing of your data and there are no overriding legitimate grounds for processing, or you object to the processing of data for direct marketing purposes;
- The data was processed unlawfully,
unless processing is necessary
- to ensure compliance with a legal obligation that requires us to process your data;
- particularly with regard to legal retention periods;
- to enforce, exercise, or defend legal claims.
Right to restriction of processing (Art. 18 GDPR):
You may require us to restrict the processing of your data if
- You dispute the accuracy of the data for the period of time that we need to verify the accuracy of the data;
- The processing is unlawful but you refuse the deletion of your data and instead demand a restriction of use;
- We no longer need your information but you need it to enforce, exercise, or defend legal claims;
- You have lodged an objection against processing as long as it is not clear whether our justified reasons outweigh yours.
Right to data portability (Art. 20 GDPR):
At your request, we can transfer your data to another person in charge as far as technically possible. However, you are entitled to this right only if the data processing is based on your consent or is necessary to execute a contract. Rather than receive a copy of your data, you may also ask us to transfer the data directly to another person in charge specified by you.
Right to object (Art. 21 GDPR):
You may object to the processing of your data at any time for reasons that arise from your particular situation, if the data processing is based on your consent or on our legitimate interests or those of a third party. In this case, we will no longer process your data. The latter does not apply if we can provide compelling legitimate reasons for the processing that outweigh your interests or we need your data to enforce, exercise, or defend legal claims.
Time limits for the fulfillment of subject rights
We make every effort to comply with all requests within 30 days. However, this period may be extended for reasons relating to the specific subject right or complexity of your request.
Restriction of information in the fulfillment of subject rights
In certain situations, we may be unable to provide you with information about all your data owing to legal requirements. If we have to refuse your request for information in such cases, we will inform you at the time of the reasons for the refusal.
Complaints to supervisory authorities
BMW takes your rights and concerns very seriously. However, if you believe that we have not adequately addressed your complaints or concerns, you are entitled to file a complaint with a competent data protection authority.
3. Data collection on our website
SERVER LOG FILES
The website provider automatically collects and stores information that your browser automatically transmits to us in „server log files“. These are:
- Browser type and browser version
- Operating system used
- Referrer URL
- Host name of the accessing computer
- Time of the server request
- IP address
These data will not be combined with data from other sources. The basis for data processing is Art. 6 (1) (f) DSGVO, which allows the processing of data to fulfill a contract or for measures preliminary to a contract.
Should you send us questions via the contact form, we will collect the data entered on the form, including the contact details you provide, to answer your question and any follow-up questions. We do not share this information without your permission.
We will, therefore, process any data you enter onto the contact form only with your consent per Art. 6 (1)(a) DSGVO. You may revoke your consent at any time. An informal email making this request is sufficient. The data processed before we receive your request may still be legally processed. We will retain the data you provide on the contact form until you request its deletion, revoke your consent for its storage, or the purpose for its storage no longer pertains (e.g. after fulfilling your request). Any mandatory statutory provisions, especially those regarding mandatory data retention periods, remain unaffected by this provision.
4. Plugins and tools
This site uses the Google Maps map service via an API. It is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. To use Google Maps, it is necessary to save your IP address. This information is generally transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer. The use of Google Maps is in the interest of making our website appealing and to facilitate the location of places specified by us on the website. This constitutes a justified interest pursuant to Art. 6 (1) (f) DSGVO. Further information about handling user data, can be found in the data protection declaration of Google at https://www.google.de/intl/de/policies/privacy/.