Bayerische Motoren Werke Aktiengesellschaft (hereinafter “BMW AG”, “BMW” or “we”, “us”), Petuelring 130, 80788 Munich, Germany is the Controller for the processing of your personal data within the meaning of the European Union General Data Protection Regulation 2016/679 (hereinafter “GDPR”)

BMW AG is the parent company of the BMW Group and operates the website www.fuelforlife.bmw-motorrad.com (hereinafter “Fuel For Life”). Through Fuel For Life, participating providers (hereinafter “Fuel For Life Partners”) may offer various experiences from the categories “Rental” (Rent A Ride), “Travel”, “Trainings” (hereinafter each an “Experience”) to natural and legal persons (hereinafter each a “Customer”). On Fuel For Life, Customers can search and compare the various Experiences provided by Fuel For Life Partners.

Brokering of Rental Experiences (Rent A Ride).  Customers can book Experiences from the category “Rental” (Rent A Ride) directly on Fuel For Life. In this respect, BMW facilitates contracts between the Customer and the respective provider of Rental (Rent A Ride) Experiences. Fuel For Life Partners who offer Rental (Rent A Ride) Experiences are hereinafter also referred to as “Rent A Ride Partners”.

Contact Form for Travel and Trainings Experiences.  Experiences from the categories “Travel” and “Trainings” cannot be booked directly on Fuel For Life. Fuel For Life’s functionality is insofar limited to the provision of general information on Experiences provided by Fuel For Life Partners. If a Customer is interested in an Experience from the categories “Travel” and “Trainings”, BMW establishes, at the Customer’s request, contact between the Customer and the respective Fuel For Life Partner via a contact form. However, BMW does not broker or facilitate the contract for the provision of the respective Experience between the Customer and the respective Fuel For Life Partner.
Certain offers for Experiences are not provided by the respective Fuel For Life Partner directly, but instead by a third party company (hereinafter: “Third Party Provider”), whereas the respective Fuel For Life Partner acts as an agent or broker for those Experiences (hereinafter: “Experience(s) from Third Party Provider(s)”).

BMW AG is the Controller for your data as processed via Fuel For Life. BMW also processes your data to the extent it is transferred to BMW from Fuel For Life Partners, provided and to the extent that all data protection requirements in relation to this data are met.

Fuel For Life Partners are responsible for the processing of such personal data as you provide to them in connection with your enquiry and which you make available to customer support; in case of Experience(s) from Third Party Provider(s), this may include onward transfers of your personal data to the relevant Third Party Provider. Fuel For Life Partners also process your data independently as Controllers once your data has been transferred by BMW to them in accordance with your enquiry.

The present Fuel For Life Privacy Policy also describes certain ways in which your data is processed by Fuel For Life Partners. However, it is possible that Fuel For Life Partners may collect additional personal data. The privacy policy provided by the Fuel For Life Partner concerned will state how that Fuel For Life Partner uses your data. BMW does not determine the means and purposes for such additional processing activities by Fuel For Life Partners and, in case of Experience(s) from Third Party Provider(s), by the relevant Third Party Provider(s).

You can contact Fuel For Life using the following email address: fuelforlife@bmw-motorrad.com

The contact details for BMW AG’s Data Protection Officer are as follows:

BMW AG
Data Protection Officer
Petuelring 130
80788 Munich
Germany
E-Mail: datenschutz@bmw.de

We collect and process your personal data on Fuel For Life in a variety of circumstances including:

• If you contact us directly, e.g. via our website.
• If you provide your personal data for the purpose of completing a contact request to be sent to a Fuel For Life Partner selected by you.
• If you complete a booking process for a Rental (Rent A Ride) Experience from a Rent a Ride Partner on our website.
• If you respond to our direct marketing activities (e.g. if you fill in a reply card).
• If your personal data is transferred to us by Fuel For Life Partners, Third Party Providers, our BMW national distributors or third parties.
• If other BMW Group companies and our commercial partners provide data to us by permitted means.
• If third parties (e.g. certified address providers) provide us with your personal data by permitted means.

Please help us to keep your details up to date by informing us of any changes to your personal data, and in particular to your contact details.

We can collect the following categories of personal data using the services and communication channels described in the present Fuel For Life Privacy Policy:

When you use Fuel for Life in the context of “Rental” Experiences (Rent A Ride), we may collect the following categories of your personal data:

• Your contact details ► Gender, first name, last name, address (street, house number, post code, town/city, state/province, country), phone number, email address.
• Other personal data ► Information provided by you, i.e. your date of birth, driver’s licence category, how long you have held your driver’s licence.
• If the renting party and the rider are not identical: Rider’s first name, rider’s last name, rider’s date of birth, Rider’s driver’s licence category and how long the riders have held their driver’s licence.
• Contractual details ► Booking numbers, invoice numbers.
• Website and Communications Usage ► Information regarding how you use the website and whether you open or forward messages from us, including data collected using cookies and other tracking technologies. You can find more information about this here in our Fuel For Life Cookie Policy.y.
• Transaction and interaction data ► Information regarding rental of BMW motorcycles, vehicle equipment, rider equipment or insurance premiums, interactions with Rent A Ride customer support (your enquiries and complaints) and Rent A Ride Partners, and participation in market research.
• Credit record and identity information ► Data establishing your identity, e.g. national ID card or driving licences; transaction information, including any outstanding payments to our partners; information on cases of fraud, deliberate destruction of leased objects, criminal acts, suspicious transactions, politically exposed persons and sanctions lists in which your data may be included.

When you use Fuel For Life in the context of “Travel” and “Trainings” Experiences, we may collect the following categories of your personal data:

• Your contact details ► Gender, first name, last name, address (street, house number, address suffix/company (optional), post code, town/city, country), phone number (optional), email address, date of birth, nationality (optional).
• Other categories of your personal data that you wish to enter into the contact form for sharing with the relevant Fuel For Life Partner (such as your t-shirt size, your riding skills, rider licence information and other ancillary information).
• Website and Communications Usage ► Information regarding how you use the website and whether you open or forward messages from us, including data collected using cookies and other tracking technologies. You can find more information about this here in our Fuel For Life Cookie Policy.
• Transaction and interaction data ► Information regarding your contact request, interactions with Fuel For Life customer support (your enquiries and complaints) and Fuel For Life Partners, and participation in market research.

Data collected in connection with Fuel For Life is used for the following purposes and on the basis of the following legal bases.

A. Conclusion and performance of a contract

Brokering of “Rental” Experiences (Rent a Ride).  BMW acts via Fuel For Life as a broker for the rental offerings of Rent A Ride Partners. The customer concludes separate contracts with these Rent A Ride Partners which are merely brokered by BMW. In the event of a booking the rental contract is concluded exclusively between the customer and the Rent A Ride Partner concerned. BMW acts solely as a broker in this process.

In connection with the booking process and the conclusion of the contract between the customer and the Rent A Ride Partner concerned, we will process the following personal data:

• Your contact details ► Gender, first name, last name, address (street, house number, post code, town/city, state/province, country), phone number (optional), email address.
• Other personal data ► Date of birth, driver’s licence category, how long you have held your driver’s licence.
• If the renting party and the rider are not identical: Rider’s first name, rider’s last name, rider’s date of birth, Rider’s driver’s licence category and how long the riders have held their driver’s licence.

On the completion of the booking process for the relevant “Rental” Experience on Fuel For Life we will transfer your personal data to the Rent A Ride Partner concerned. 

Legal basis for the processing under the GDPR: The legal basis for the above processing activities carried out by BMW is “performance of a contract to which the data subject is party” or “steps at the request of the data subject prior to entering into a contract” (Article 6(1)(b) GDPR). 

Sending a contact request for “Travel” and “Trainings” Experiences to the relevant Fuel For Life Partner.  On Fuel For Life, it is not possible to directly book Experiences from the categories “Travel” and “Trainings” as offered by Fuel For Life Partners. However, BMW processes your personal data for forwarding your contact request to Fuel For Life Partners if you expressly request so.

When we collect and forward your contact request to the relevant Fuel for Life Partner, we will process the following personal data:

• Your contact details ► Gender, first name, last name, address (street, house number, address suffix/company (optional), post code, town/city, country), phone number (optional), email address, date of birth, nationality (optional).
• Other categories of your personal data that you wish to enter into the contact form for sharing with the relevant Fuel For Life Partner (e.g. t-shirt size, rider licence information and other ancillary information).

The Fuel For Life Partner may use the above personal data to contact you following your contact request for the purpose of offering an Experience to you and negotiating, entering into and fulfilling a customer contract on the provision of the relevant Experience with you.
In case of Experience(s) from Third Party Provider(s), i.e. where the Fuel For Life Partner does not provide the Experience to you itself but acts as an agent or broker of a Third Party Provider, the Fuel For Life Partner may transfer the above personal data to the relevant Third Party Provider(s) for the purpose of offering the Experience(s) from Third Party Provider(s) to you and negotiating, entering into and fulfilling a customer contract on the provision of the relevant Experience(s) from Third Party Provider(s) with you.

Legal basis for the processing under the GDPR: The legal basis for the above processing activities carried out by BMW is “performance of a contract to which the data subject is party” or “steps at the request of the data subject prior to entering into a contract” (Article 6(1)(b) GDPR).

B. Customer support

BMW, the relevant Fuel For Life Partner and, in case of an Experience from Third Party Provider, the relevant Third Party Provider may use your personal data to contact you regarding the performance of your booking or contact request as described above or to handle an enquiry formulated by you (e.g. enquiries and complaints to BMW Motorrad customer services). We, the Fuel For Life Partner or, in case of an Experience from Third Party Provider, the relevant Third Party Provider, may contact you regarding any aspect of the performance of a contract or handling an enquiry. This may be in writing, by phone, using a messenger service or by email depending on the contact details you provided.

BMW will also process your personal data on this basis in order to further optimise your BMW Motorrad customer support experience and, for example, in order to clearly identify you when you contact us.

Legal basis for the processing under the GDPR: Depending on the specific circumstances, the legal basis for the above processing activities carried out by BMW is either (i) “performance of a contract to which the data subject is party” or “steps at the request of the data subject prior to entering into a contract” (Article 6(1)(b) GDPR) or (ii) “legitimate interests” pursued by BMW, your Fuel For Life Partner or, in case of an Experience from Third Party Provider, the relevant Third Party Provider (Article 6(1)(f) GDPR).

C. Marketing communications and market research on the basis of your consent

If you have given your consent for any further use of your personal data, your personal data (i) may be used to the extent described in your consent, including for direct marketing purposes (selected offers on products and services) and/or market research, and (ii) may be forwarded to some subsidiaries of BMW AG and selected BMW Motorrad partners. Further details can be found in the declaration of consent concerned. You may withdraw your consent at any time.

If you have given the appropriate consent for direct marketing communication, BMW collects and processes:

• Contact details (e.g. name, address, email address, telephone number).
• Additional personal details / preferences (e.g. Rider licence information, status of your privacy-related declaration of consent and selected/preferred means of communication).
• Identification details (e.g. customer number, contract number).
• Customer history (e.g. booking history including model, booking period, advertising campaign history and impact (customer and interested parties support programmes and direct marketing initiatives), participation in events).

Legal basis for the processing under the GDPR: The legal basis for the above processing activities is your “consent” (Article 6(1)(a) GDPR).

D. Compliance with legal obligations to which BMW is subject

Collected data is also processed as part of assuring the operation of IT systems. ‘Assurance’ includes without limitation the following activities:

• Securing and recovering data processed in IT systems.
• Logging and monitoring of transactions to ensure the correct functioning of IT systems.
• Detecting and preventing unauthorised access to personal data.
• Incident and problem management with a view to rectifying any disruption to IT systems.

BMW is subject to a variety of further legal obligations. In order to fulfil these obligations, we process your data to the extent required and provide it to the responsible authorities where required as part of our legal reporting obligations.

We will also process your data in the event of any legal dispute, should the nature of the dispute require such processing of your data.

Legal basis for the processing under the GDPR: The legal basis for the above processing activities is “compliance with a legal obligation” to which BMW is subject (Article 6(1)(c) GDPR).

E. Transfer of data within the BMW Group

BMW AG is part of the BMW Group. From time to time, and following careful checks, we will transfer your data to other BMW Group companies, which will then process this data themselves as the Controller. Such data transfers may occur under the following circumstances and for the following purposes:

• If it is necessary to answer your enquiries, or if you have given us your prior express consent to share your data with the BMW Group for advertising or marketing purposes, and specifically to share it with the BMW distributor and certain authorised dealers in your home market or the market in which you are currently resident. 

Please note that this does not constitute an exhaustive or definitive list of data transfer processes within the BMW Group, and serves merely to provide examples designed to make data transfer processes more transparent.

F. Transfer of data to selected third parties

Provided and to the extent that the necessary data protection requirements are met, your data will be sent to companies such as:

• Fuel For Life Partners (other than Rent A Ride Partners) in order to forward your contact request. In case of Experience(s) from Third Party Provider(s), your Fuel For Life Partner may forward your data to the relevant Third Party Provider(s).
• Rent A Ride Partners in order to perform your contract with the Rent A Ride Partner concerned or to handle your request for a test ride or servicing, or in order to present specific offers to you.
• Rent A Ride Partners for the purpose of updating their data (for example your contact details). Data used to update your details will be sent to all Rent A Ride Partners which hold your address details in their databases.
• Carefully selected and tested service providers and commercial partners with whom we cooperate, in order to offer you products and services. We will only do this if we have imposed strict contractual obligations for so-called commissioned data processing on the third party recipient or on the basis of your express consent (e.g. forwarding to marketing specialists who then draw up a personalised offer for you).
• In the event that one or several of BMW AG’s business areas is/are sold to a company to which we transfer our rights, in compliance with all existing agreements with you.
• Other third parties (e.g. public bodies) to the extent we are legally required to do so.

We use a variety of security measures including state-of-the-art encryption and authentication tools in order to ensure and maintain the safety, integrity and availability of your data.

It is impossible to guarantee that any transfer of data over the Internet or via a website is completely protected against unauthorised access. However, together with our service providers and commercial partners, we do everything in our power to protect your personal data in accordance with applicable data protection legislation by physical, electronic and procedural means, in line with the current state of technology. The measures we implement include:

• Strict criteria for authorisation to access your data, allowing access on a ‘need to know’ basis (limiting authorisation to the minimum possible number of individuals) and for the given purpose only.
• Transfer of collected data in encrypted form only.
• Storage of confidential data (e.g. credit card data) in encrypted form only.
• Firewalled IT systems to protect against unauthorised access (e.g. by hackers) and
• Constant monitoring of access to IT systems to detect and prevent any misuse of personal data.

If you have received a password from us or have created one yourself which allows you to access certain areas of our website or other portals, apps or services operated by us, you are responsible for (i) ensuring that such password remains confidential and (ii) compliance with any and all other security procedures of which we may make you aware. Specifically we ask you not to share your password with anyone.

We will retain your data only for as long as is necessary for the purpose for which we process your data. If we process your data for several purposes, it will be automatically deleted, or saved in such a format that your data can no longer be directly attributed to you, as soon as the last specific purpose has been achieved. In order to ensure that all your data is deleted in accordance with the principle of data minimisation, BMW has drawn up an internal deletion plan. The fundamental principles according to which your personal data shall be deleted under this plan are set out below.

Use in order to perform a contract

We may store data collected from you for as long as the contract remains in force and, depending on the nature and scope of the contract, for 6 or 10 years thereafter, in order to comply with statutory storage requirements and to clarify any queries or claims which may arise following the expiry of the contract.

Use for the examination of claims

Data we deem necessary in order to examine or defend claims against us, or in order to initiate a prosecution against you, us or a third party, or in order to assert a claim, may be retained by us for as long as there is a likelihood of such proceedings being initiated.

Use for customer support and for marketing purposes

Data collected from you for purposes of customer support and marketing will be stored until such time as the relevant consent to do so is revoked. You may withdraw your declaration of consent to any future use of your data at any time. You are also entitled to demand this data be deleted, provided that no contractual or statutory retention periods prevent such deletion.

BMW is a global company. Personal data is processed by BMW employees, Fuel For Life Partners, and service providers processing your data on our behalf, where possible within the EU.

Legal basis for the processing under the GDPR: Where the relevant Rent A Ride Partner or Fuel For Life Partner (other than a Rent A Ride Partner), as selected by you, is based in a country outside the EU/EEA and the EU has not yet found that such country provides for a comparable (i.e. “adequate”) level of data protection (Article 45(3) and 45(9) GDPR), BMW can transfer your personal data to the Rent A Ride Partner or Fuel For Life Partner because such transfer is “necessary for the performance of a contract” between you and BMW and also “necessary for the implementation of pre-contractual measures” taken at your request (Article 49(1)(b) GDPR). BMW can also transfer your personal data to the Rent A Ride Partner or Fuel For Life Partner in case you have given your explicit consent (Article 49(1)(a) GDPR).
The EU has already determined that some countries outside the EU, such as Canada and Switzerland, offer an adequate level of data protection. Given this adequate level of data protection, data transfers to these countries do not require specific approvals or agreements.
Where personal data is otherwise transferred to countries outside the EU/EEA which have not been found to provide for an adequate level of data protection, BMW AG uses EU standard contracts which have been pre-approved by the European Commission (so-called standard contractual clauses), including appropriate technical and organisational measures, to ensure that your personal data is processed in accordance with European data protection standards.
If you would like to view the specific safeguards for data transfers to other countries, please contact us via the contact details provided below.

You cannot view or alter your data on Fuel For Life online. If you have any questions on the use of your personal data by us, or if you wish to make changes to it, you can contact the Fuel For Life customer support by email at fuelforlife@bmw-motorrad.com.

If you have any questions regarding the use of your personal data by us, please contact the Fuel For Life customer support at fuelforlife@bmw-motorrad.com in the first instance.

You may also contact BMW AG’s Data Protection Officer who can be contacted using the details below:

BMW AG
Data Protection Officer
Petuelring 130
80788 Munich
Germany
E-Mail: datenschutz@bmw.de

As a data subject affected by the processing of your personal data, you are entitled to exercise certain rights against us under the GDPR and other relevant data protection legislation. The following section “Rights of data subjects” contains details of your rights as a data subject under the GDPR. Depending on the type and scope of your query, we may ask you to submit it to us in writing.

Rights of data subjects

According to the GDPR, as a data subject you have the following specific rights in relation to BMW:

Right to information (Article 15 GDPR): You are entitled to demand information from us about the data we hold about you at any time. This information includes, for example, the categories of data processed by us, the purposes for which we are processing it, the origin of the data (where we have not obtained it directly from you) and, if appropriate, the recipients to whom we have sent your data. You can obtain a copy of your data from us free of charge. If you are interested in obtaining any further copies, we reserve the right to charge you for these additional copies.

Right to rectification (Article 16 GDPR): You are entitled to demand we rectify your data. We will take proportionate measures to ensure the data we hold about you and are continuing to process is accurate, complete and up-to-date, based on the most recent information available to us.

Right to erasure (Article 17 GDPR): You are entitled to demand we erase your data provided that the legal conditions for such erasure apply. According to Article 17 GDPR, this may be the case where:

• the data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
• you withdraw the consent on which the processing is based and where there are no other legal grounds for the processing;
• you object to the processing of your data and there are no overriding legitimate grounds for the processing, or you object to the processing of the data for direct marketing purposes;
• The data has been unlawfully processed.

Right to restriction of processing (Article 18 GDPR): You may demand we restrict the processing of your data where:

• you contest the accuracy of the data, for a period of time that we require in order to verify the accuracy of the data;
• the processing is unlawful and you request the restriction of processing your data instead of deleting it;
• we no longer need the data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims;
• you have objected to processing where it has still to be determined whether our legitimate grounds override yours.

Right to data portability (Article 20 GDPR): At your request, we will transfer your data to another Controller, to the extent this is technically possible. However, you are entitled to exercise this right only where the data processing is based on your consent or is required in order to perform the contract. Instead of receiving a copy of your data, you may also request us to transfer your data directly to another Controller specified by you.

Right to object (Article 21 GDPR): You may object to the processing of your data at any time on grounds relating to your particular situation, provided the data processing is based on your consent or on our legitimate interests, or those of a third party. In this case we will stop processing the data. The latter shall not apply where we can demonstrate compelling legitimate grounds for the processing which override your interests, or where we require your data in order to establish, exercise or defend legal claims.

Timescales for granting rights of data subjects

We make every effort to handle all enquiries within 30 days. However, this timescale may be prolonged depending on the specific data subject right concerned or on the complexity of your enquiry.

Restriction of the right to information when granting rights of data subjects

In certain situations we may be unable to provide you with information about any or all of your data due to legal constraints. In the event we are forced to refuse a request to provide information in such a case, we will inform you of the reasons for the refusal at the same time as the refusal is issued.

Complaints to supervisory authorities

BMW AG takes your concerns and rights seriously. However, should you feel that we have not sufficiently addressed your complaints or concerns, you have the right to lodge a complaint with a supervisory data protection authority.

The average monthly number of active users of the FUEL FOR LIFE website in the European Union, calculated as an average of the past six months, is 33.250 (Article 24 Paragraph 2 of the Digital Services Act). As of 17.02.2023

If you are an individual located in Australia, the following additional special provisions are relevant to you:

Applicable law

In addition to the GDPR with which BMW AG must comply, the Privacy Act 1988 (Cth) also applies to your personal data which is collected or held by BMW AG in connection with Fuel For Life.

Overseas Data Transfers

Personal data which is collected by BMW AG in connection with Fuel For Life is held outside Australia.

BMW AG, the operator of Fuel For Life, has its headquarters in Munich, Germany. Your personal data will be shared with, depending on the nature of your engagement with Fuel For Life, Rent A Ride Partners, Fuel for Life Partners and Third Party Providers, who may be located anywhere in the world.

Personal data is stored in an Amazon Web Services (“AWS”) cloud server within the European Union. AWS offers a broad set of global cloud-based products including computer, storage, databases, analytics, networking, mobile, developer tools, management tools, IoT, security and enterprise applications.

Your data protection rights

You have various rights under the Australian Privacy Principles ("APPs”) being Schedule 1 to the Privacy Act 1988:

Right to access and request correction

Under the APPs, you have the right to request access to and/or the correction of your personal data held by BMW AG. You can exercise these rights by contacting BMW AG’s Data Protection Officer:

BMW AG
Data Protection Officer
Petuelring 130
80788 Munich
Germany
E-Mail: datenschutz@bmw.de

The Data Protection Officer will respond to your request within a reasonable time. If the Data Protection Officer refuses your request, you will be provided with written reasons for the refusal and the mechanisms you can use to complain about the refusal.

Right to complain

You also have a right to make a privacy complaint to the Data Protection Officer.

The Data Protection Officer will first consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint. The Data Protection Officer will endeavour to complete the investigation into your complaint promptly. You may be asked to provide further information about your complaint and the outcome you are seeking. The Data Protection Officer will then typically gather relevant facts, locate and review relevant documents and speak with individuals involved.

In most cases, the Data Protection Officer will investigate and provide a written response to your complaint within 30 days of receipt of the complaint. If the matter is more complex or the investigation may take longer, the Data Protection Officer will let you know.

If you are not satisfied with BMW AG’s response to your complaint, a complaint may be made to the Office of the Australian Information Commissioner (“OAIC”). The OAIC can be contacted by telephone on 1300 363 992 or by using the contact details on the website www.oaic.gov.au.

If you are an individual located in Canada, the following additional special provisions are relevant to you:

Applicable Law

BMW AG is accountable for your personal information. The processing of your personal information by BMW AG is governed by federal and provincial privacy legislation in Canada, including the Personal Information Protection and Electronic Documents Act.

Transfer of Personal Data

Your personal information will be transferred (or otherwise made available) to third parties that provide services on our behalf. We use service providers to provide services, including but not limited to hosting the Website, sending communications, processing payments, and providing advertising, analytics and marketing services.

We and our service providers (including affiliates) may access, store and otherwise process personal data outside of Canada (and, for residents of Quebec, outside of Quebec), including in the United States of America and in the European Union. We, our affiliates and our service providers may disclose your personal data if we are required or permitted by applicable law or legal process, which may include lawful access by foreign courts, law enforcement or other government authorities in the jurisdictions in which we or our service providers operate.

For information about the manner in which we or our service providers (including service providers outside Canada) treat personal data, please contact us as set out in section "Contacting us, your data protection rights, and your right to lodge a complaint with a supervisory authority" above.

Your Rights

For residents of Quebec: Subject to limited exceptions under applicable law, you may, in addition to the rights set out in section “Rights of data subjects” above, have the right of cessation of dissemination, the right of de-indexing and the right of re-indexing. We may require certain personal data for the purpose of verifying the identity of the individual making the request.

BMW AG is providing the following supplemental information for individuals whose personal information is collected or held by BMW, www.rentaride.com, www.fuelforlife.bmw-motorrad.com or any of their affiliated companies, in or from Mexico:

Applicable law

The processing of your personal data by BMW AG is governed by the Personal Data Protection Law (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), and its secondary regulation and Guidelines (hereinafter the “Mexican Data Protection Regulation”).

Primary purposes of data processing

We inform you that your personal data may be used by BMW AG for the following purposes:

• Booking process and onboarding of the customer for the purpose of entering into a rental contract with the Rent A Ride Partner selected by the customer.
• Forwarding a contact request to the Fuel For Life Partner selected by the customer.
• Assuring the operation of IT systems.
• For any other related services.

Secondary purposes of data processing

We inform you that your personal data may be used for purposes other than the required for the provision of services, such as:

• Marketing and advertising purposes.
• To evaluate the quality of products and services.
• To provide support for the products and services.
• To determine usage patterns or trends of consumers of our products.
• To receive advertising in print or through electronic means, including communications for online marketing purposes or telemarketing about products and services.
• To participate in surveys.
• To commercialize new products.

Sensitive Personal Data

BMW AG may collect the following personal data:

• Personal Data: the personal data described in section “What data can be collected about you?” above.
• Financial or Patrimonial Data: transaction information, including any outstanding payments to our partners and suspicious transactions. 

Rights of data subjects

According to the Mexican Data Protection Regulation, as a data subject you have at all times the right to access, rectify, cancel or oppose to the data processing of your personal data (hereinafter the “ARCO Rights”), as well as to revoke the given consent for the processing of the data. This right may be exercised via an application to BMW AG’s Data Protection Officer through the contact information shown in the section “Contacting us, your data protection rights, and your right to lodge a complaint with a supervisory authority” above. Please note that while the exercise of the ARCO Rights is free, BMW AG may bill the justified expenses regarding the shipping and reproductions costs.

Your application must include, at least, your name, complete home address and any other mean to communicate our reply to your application, documents that acknowledge your identity, specifying, in a clear and precise manner, the personal data to which you require access, rectification, update or cancellation, the elements or documents where the personal data may be, and indicate the reasons for which you wish to access your personal data, or the reasons for which you consider that your personal data needs to be updated, rectified or cancelled.

Please consider that it is possible that BMW AG may deny you access to your personal data or may not be able to rectify, cancel, block, or oppose the processing of all your personal data in accordance with applicable Mexican Data Protection Regulation, particularly in the following cases:

• When the applicant is not the owner of the personal data, or the legal representative is not duly authorized to do so.
• When the applicant's personal data are not found in its database.
• When third parties rights are infringed.
• When there is a legal prohibition, or the decision of a competent authority, that restricts access to personal data, or does not allow the rectification, cancellation or opposition of the same.
• When the rectification, cancellation or opposition has been previously made.

BMW AG, in a maximum of 20 days counted as of the date in which your application for access, rectification or objection is received, will provide its decision. If the decision confirms that your request is valid, your request shall become effective within the next 15 days after our reply is provided.

Changes to the Fuel For Life Privacy Policy

Any changes to this Privacy Notice will be made available to the general public on BMW website and in our offices. It is the responsibility of the data subject to periodically review the contents of the Fuel For Life Privacy Policy at www.fuelforlife.bmw-motorrad.com.

Contact us

You may contact us or make a complaint about a breach of the Mexican Data Protection Regulation, by using the contact details of BMW AG’s Data Protection Officer, as set out in the section “Contacting us, your data protection rights, and your right to lodge a complaint with a supervisory authority” above of this Fuel For Life Privacy Policy. We will respond to your queries, investigate your complaints and endeavor to resolve any issue to your satisfaction.

National Institute of Access to Information and Data Protection

You have the right to make a complaint or initiate the procedure of protection of ARCO Rights with the National Institute of Access to Information and Data Protection (Instituto Nacional de Acceso a la Información y Protección de Datos Personales) (hereinafter “INAI”) if you consider that your personal data rights are affected. The INAI’s contact details are available at the following address: www.inai.org.mx. Please consider contacting us first to address your concerns directly.

Data transfer to third countries

If personal data are transferred out of the Republic of Serbia to one of the countries which do not ensure an adequate level of personal data protection in accordance with the Serbian Law on Personal Data Protection, then the following provisions of this paragraph shall apply: BMW will fulfil all relevant conditions and undertake all measures necessary to ensure (i) adequate warranties with regard to the processing of the personal data and (ii) an adequate level of protection. If such measures are necessary, these measures may include (a) application of standard contractual clauses approved by the Commissioner for Information of Public Importance and Personal Data Protection, (b) binding corporate rules or (c) similar measures. For further details, please contact the Fuel For Life customer support by email at fuelforlife@bmw-motorrad.com.

Competent supervisory authority

In case of any unlawful processing of personal data by BMW, data subjects may exercise statutory data subject rights, including the right to lodge a complaint to the Commissioner for Information of Public Importance and Personal Data Protection – https://www.poverenik.rs/.