BMW Personal Information Protection Policy

This Personal Information Protection Policy solely applies to the services (as set out in Part I hereof) provided to end users by NavInfo Co., Ltd. (“NavInfo” or the “Operator”), which is engaged by LingYue Digital Information Technology Co., Ltd. (“LingYue”), in respect of the certain features of My BMW product of BMW China (with respect to imported vehicles and domestic MINI vehicles, BMW China Automotive Trading Ltd.; with respect to other domestic vehicles, BMW-Brilliance Automotive Ltd.) (hereinafter “BMW China” or “we”). LingYue is the authorized developer and party responsible for business planning of the My BMW platform. BMW China Services Ltd. is the copyright owner and technology developer of My BMW. NavInfo Co., Ltd. is the party providing the service directly, which is engaged by us to collect and process your personal information for the purpose of this Personal Information Protection Policy.

Depending on the engaging party who concludes a contract with, or provides services or products to, or carries out marketing activities to you, BMW China Automotive Trading Ltd. and BMW-Brilliance Automotive Ltd. will respectively determine the purpose for and method of processing your personal information, and protect your personal information in accordance with the provisions of this Personal Information Protection Policy.

    Release date: April 18th, 2025.

This Personal Information Protection Policy was updated on April 18th, 2025.

If you have any questions or comments, please contact us at the contact information set out in Part IX hereof.

 

This Personal Information Protection Policy helps you understand the following information:

  1. Our business functions and how we collect and use your personal information
  2. How we use cookies and other similar technologies
  3. How we entrust, share, transfer and publicly disclose your personal information
  4. How we protect your personal information
  5. Your rights
  6. How we process personal information of children
  7. How your personal information will be transferred globally
  8. How this Personal Information Protection Policy will be updated
  9. How to contact us

 

We are fully aware of the importance of personal information to you and treat your personal information in accordance with the same high standards that you expect from BMW products and services. We are committed to creating and maintaining your trust in us and observe the following principles when protecting your personal information: consistency between rights and liabilities, clear purposes, solicitation of consent, minimum necessity, guarantee of security, involvement of personal information subjects, and openness and transparency. Meanwhile, we are committed to setting up necessary safeguards pursuant to well-developed security standards in order to protect your personal information.

By affixing your signature hereto, or clicking on “read”, “agree” or other similar options, or accepting the products or services that we provide, and submitting to us your personal information, it shall be deemed you have ensured that you have fully rights, abilities and authority to do the related operations, and have accepted this Personal Information Protection Policy. We will use and protect your personal information according to the relevant laws and regulations and this Personal Information Protection Policy. Please carefully read this Personal Information Protection Policy before ticking or clicking on “read”, “agree” or other similar options, accepting the products or services that we provide, filling in, confirming, authorizing the export and import of personal information, or signing the authorization document, and ensure a full understanding of the meaning of this Personal Information Protection Policy and the corresponding legal consequences.

 

 

I. Our business functions and how we collect and use your personal information

Personal information means any information saved in electronic or other forms that relates to an identified or identifiable natural person, including but not limited to name, date of birth, identification number, personal biometric information, address and telephone number, but excluding anonymised information.

Sensitive personal information means the personal information that is likely to infringe on the personal dignity of, or endanger the personal or property safety of, a natural person, once it is leaked, unlawfully used.  In general, biometric information, religious beliefs, particular identities, medical health, financial accounts, personal whereabouts and other information, as well as personal information of minors under the age of fourteen are regarded as sensitive personal information.  In this Personal Information Protection Policy, the terms and articles concerning sensitive personal information will be marked in bold for your special attention.  In scenarios where sensitive personal information is actually collected, we will further bring to your attention by means of an enhanced notification or an instant alert (such as a pop-up window) and obtain your authorization, or request you to otherwise click confirm or sign a Separate Consent.

We will collect and process your personal information solely for the purposes specified as below.

Unless otherwise indicated in below the purposes, we store your personal information only for as long as the relevant purpose requires it. If your personal information is processed for multiple purposes, your information will be deleted or stored in a form that cannot directly be traced back to you, as soon as the last specified purpose has been fulfilled.

    1. User Registration and Login

    To enable your full use of the various services that LingYue provides and of the various features of My BMW App, you have to register a BMW ID. After registration, you will receive an online customer account, and log in with such account will enable you to access to all portals and online service platforms of the BMW China simultaneously. If you forget your account password, you can use the password retrieve service to retrieve your password. You can check your history login records by clicking “Profile”-“Settings”-“BMW ID”-“Login History”. In order to register, login and use the account, we will collect from you and use the following information:

(1)    mobile phone number

(2)    BMW ID (BMW account) login information

(3)    Message verification code

(4)    Password

If you do not provide such required information, you will not be able to obtain a BMW ID or log in with a BMW ID and further enjoy and fully use the various services provided by BMW China.

Meanwhile, if you have registered such online customer account with other BMW platforms, you may also log in on such platform with such account.

When you are using our services, we will be authorized to use the above-said information you have provided. We will cease using and delete the above-mentioned information (including the personal information generated during your use of the customer account) in a timely manner after you withdraw your consent, request deletion of your personal information pursuant to this Personal Information Protection Policy, or cancel your user account. Nevertheless, in accordance with the applicable legal or regulatory provisions, information related to use of My BMW and/or financial transactions will be retained for statutory time limit after the use is completed or the transaction is completed and be subject to reviews by the relevant authorities.

2. Providing relevant services of My BMW

In My BMW, we shall provide you with the following services and process the corresponding personal information:

(1)    Public charging information integration service (i.e. “public charging” service), including

(a)   In order to provide you with plug-and-charge information integration service (i.e. “Plug and Charge”), the following personal information will be collected and used with respect to the public charging information integration service:

(b)   In order to provide you with the charging card discount service with public charging service providers, the following personal information will be collected and used with respect to the public charging information integration service:

(c)   To facilitate the reduction of parking fees when you leave the parking lot, some public charging stations offer charging service to reduce parking fees. When scanning the QR code at certain public charging piles, you could input your personal information, which will be sent in encrypted form to the public charging operator and to the parking system where your vehicle is located. Information to be provided includes:

(d)    We will provide you with charging Joy coin issuance service according to your orders on the charging page, and your data will be collected as follows:

(e)    In order to provide you with the order invoice application service, you need to input the invoice name and the email address to receive the invoice, which will be sent encrypted to the actual service provider. The information you need to fill in includes:

(2)    Dedicated park and charging service, including:

(a)    In order to provide you with the appointment service, entry and exit, and billing case handling services at exclusive parking and charging service provider, the following information will be collected and used:

(b)    We will provide you with charging Joy coin issuance service according to your orders on the charging page, and your information will be collected as follows:

(c)    In order to provide you with the order invoice application service, please provide the information you need to issue a personal invoice and the email address to receive the invoice, which will be sent encrypted to the actual service provider. The information you need to fill in

includes:

(3)    BMW branded HPC service

BMW branded HPC stations are equipped with ultra-high-power charging equipment. Enjoy exclusive rights such as reservation, automatic locking, plug-and-charge, etc. The following information will be collected and used with respect to the BMW branded HPC service:

(4)    BMW charging wall-box installation and control application service

You can use the service of charging wall-box installation. Certain BMW charging wall-boxes support mobile control applications. If your charging wall-box supports mobile control applications, through this service feature of the App, you can connect Bluetooth wall-box and mobile phone, and start BMW wall-box functions for charging, access to charging data, account management. We will collect and use the following information:

(5)    Schedule service appointment online

You can schedule an appointment through My BMW for the after-sales service offered by a dealer. In order to provide the above-mentioned service, we will collect and process the following personal information during your use of schedule service appointment online:

(6)    Roadside assistance

You can book through My BMW the Roadside Assistance service offered by a third party. In order to provide the above-mentioned service, we will collect and process the following personal information during your use of Roadside Assistance:

(7)    App problem and feedback  

You can provide feedback on any issues encountered during the use of the app. You can quickly select the appropriate tag for the problem and upload up to three images to help you solve the problem quickly. We will collect or process the following personal information:

(8)    System push notification and message center

You can check all the notices and talks in Message Center page, also can browse the message in any time and distinguish which are new. You can also select top and delete your information. In order to provide notice push accurately, we will collect and process the following information：

(9)    Pop-up message

If the message already sent by operation team, the message will pop up directly in the main tab when the App start, and you can directly click the window to check the details. In order to provide notice push accurately, we will collect and process the following information：

(10) “My trip” related functions

You can check “My trip” information in the Vehicle module of App, and view the history trips’ information. “My trip” provides you with trip statistics, trip history, trip details, and monthly reports We will collect and process the following information：

(11) Customer record of acceptance to Personal Information Protection Policy

When you make operations in My BMW App and involve the personal information collection, you are required to check and agree relative privacy policy statement, and record your agree actions to the privacy policy statement, we will collect and process the following information：

(12)    Add My BMW

You can add your vehicle in “Vehicle” module of My BMW App. After that, you can obtain the information of your vehicle, and enjoy more services, thus we will collect and process the following information:

(13)  Login mapping merge (LMM)

The BMW ID owner can send a joint user invitation to other BMW ID owners through the invitation function in the user management of My BMW APP. After the invitee completes the invitation process, she/he can view and use the connected driving service and vehicle sharing vouchers of the invitee in his/her account. We will collect and process the following information：

(14)    First Time Use (Scan QR and Login)

You can use your phone camera or My BMW App to Scan the QR in vehicle for login your BMW ID. We will collect and process the following information：

(15)    Real-name registration service

You can complete the real-name registration for Connected driving service through App, we will collect and process the following information：

a)    Individual customer real name registration:

phone number, name, VIN, name in the vehicle ID, type of vehicle ID, customer valid identification information (including name, valid identification type, identification number, identification period, identification address) and identification image, facial information.

If it involves underage car owners under the age of 18, additional personal information of the underage is required, including name, valid identification information (same as above) and identification picture, facial information, the relationship evidence of guardians (include the Household registration booklet, birth certificate, only child certificate, police station certificate, adoption certificate, court judgment and effective certificate or other documents that can prove the guardianship relationship are sufficient.), VIN, name in the vehicle ID, type of vehicle ID. You confirm and promise that you are the legal guardian of a minor car owner and have the right to provide us with the personal information of the minor and carry out relevant operations.

b)    Business customer real name registration: Name of responsible person, phone number of responsible person, VIN, name in the vehicle ID, type of vehicle ID, responsible person's valid identification information (including name, valid identification type, identification number, identification period, identification address), identification image, facial information.

Meantime, we will also collect and use your BMW ID (BMW account) login information.

(16)    Connected driving service

You can enactive the Connected driving service in the vehicle authentication page of the “Vehicle” module in App.

You can set your emergency contact person’s information. When there is emergency, the customer calling center will contact you and your emergency contact person for dealing with your requests, such as asking for medical aids, calling police and firefighting police, or getting the optimal route to the nearest hospital. We will collect and process the following information：

(17)    App Service and Quality Guarantee

In order to provide stable operation of App services, we will collect and process the following information：

(18)    Other vehicle terminal features

Other vehicle terminal features under sections in My BMW App are involved.

The specific personal information protection policy is set out in the Personal Information

Protection Policy with respect to Connected Drive: https://myprofile.bmw.com.cn/api/gateway/views/legal-documents/privacy-policy-en_US.html

The above information is necessary for the fulfillment of various features or related specified services embedded in the My BMW App. Therefore, we cannot provide the specified services under the various features of My BMW App unless you have submitted the information and we are authorized to process it. For the sensitive information mentioned in the above features, if you do not agree or authorize, we cannot provide the specified services under the corresponding features.

You can click My BMW Personal Information Collection list to check the details of the personal information we processed.

The above personal information will be deleted when you cease to use the related feature of My BMW App and cancel the BMW ID, unless it is required to be retained under laws and regulations or your further authorization and consent is obtained.

Meantime, we will collect the following personal information during your use of My BMW:

  1. In order to complete your account information, we will collect the following personal information:

If you do not provide the information listed above, you cannot complete your App account information filling, but you can still use other products or services that we provide.

When you use the relevant business functions, My BMW will apply to you for system permissions related to personal information:

(1)    Camera permission

       We will seek your permission under any of the following circumstances:

(2)    Fingerprint or facial information permission

    We will seek your permission under the following circumstance:

(3)    Notification permission

    We will seek your permission under any of the following circumstances:

(4)    Network permission

    We will seek your permission under the following circumstance:

(5)    Access to network permission

    We will seek your permission under the following circumstance:

(6)    Access to network status permission

    We will seek your permission under the following circumstance:

(7)    Read device information permission

    We will seek your permission under the following circumstance:

(8)    Get Wifi information

We will seek your permission under the following circumstance:

(9)    Prohibit screen capture and recording

We will seek your permission under the following circumstance:

(10)  Vibration permission

We will seek your permission under the following circumstance:

(11) Get clipboard permission

We will seek your permission under the following circumstance:

The above-mentioned system permissions are 11 items in total. Without your permissions we will not be able to provide the relevant business functions. Except for the above-mentioned system permissions, you may voluntarily choose whether you would like to grant the App other system permissions.

If you want to revoke the permissions you granted, you can enter the permission control page through "Profile" - "Settings" - "Permissions" - enter your phone’s system permission management page to complete the permission revocation.

In order to ensure the implementation of App related features and stable operation of application, we may access the software development package (SDK) provided by a third party to achieve relevant purposes. Different versions of third-party SDKs may vary, which generally include push notifications, etc. We will carry out strict security monitoring on the software development package (SDK) for the partners to obtain information to protect data security. You can click this link to check the comprehensive instruction of third-party SDKs.

3. Ensuring product quality and developing new products

Beyond the mere provision of services, the information collected under I.1 and I.2 will also be processed to ensure the quality of the BMW products and services and to develop new BMW products and services. This kind of processing is related to BMW’s commitments to meet high customer demand for existing products and services and to satisfy the future wishes of our customers with new products and services still to be developed.

4. Fulfilment of the sales, service, and administration processes

In order to ensure the customer experience and cooperation with the BMW dealers, we may compile analyses and reports based on the information collected under I.1 and I.2, which we may share with the responsible BMW dealers. These analyses will primarily be used to introduce appropriate measures (training for sales staff) to improve the application and sales process.

Also, parts of the personal information and vehicle-specific data collected under I.1 and I.2 will be processed to fulfill the service processes (e.g. repair, warranty, goodwill) of BMW China and authorized dealers. This kind of processing is to offer our customers the best possible service process. The technical vehicle data will be deleted in a timely manner at the end of the vehicle’s service life. However, if there are specific stipulations under the laws and regulations and required by the authorities, we are still obligated to retain your personal information to the extent permitted by law (e.g. information related to contractual transactions will be retained within statutory time limit and may be inspected by the relevant authorities). 

5. Customer service

We use your personal information (i.e. your name, email address and phone number) to contact you in connection with the processing of contracts (e.g. booking of BMW Connected Drive services) or to process a request formulated by you (e.g. inquiries and complaints sent to BMW customer services). For all aspects of processing contracts or requests, we will contact you without obtaining separate consent, e.g. in writing, by telephone, messenger services, or email, depending on the contact media you specified.

6.  Customer activities, marketing campaign and market research

You acknowledge and agree that we may use your personal information for customer activities, marketing campaigns and/or market research purposes during your use of our services. For example, we will use your name, email and phone number to carry out customer group analysis and other market research to optimize and improve the services we provide. At the same time, your above information will also be used to carry out customer care and marketing activities, including information of our new cars, product promotions, holiday blessings and other promotional information. At present, we will communicate with you through three methods: internal messaging, push messages, and pop-up messages. Should you wish not to receive the push messages, you can unsubscribe the push notification service in app through the following steps: "Profile" - "Settings" - "Notification Settings" - "Allow Push Notifications" or operate in your phone's operating system setting, or contacting us. In addition, we will obtain your personal information from our dealers based on your authorization to do so. We will verify the legitimacy of the sources of such personal information and the scope of authorization and will further seek your authorization if your scope of authorization is exceeded. For details, please refer to the authorization statement under the specific scenario. You have the right to revoke such consent at any time at your own discretion.

In addition, we will collect and use your personal information required for your participation and for the purposes of I.3 to I.8 of this Personal Information Protection Policy (e.g. to optimize and improve the services we provide) during your participation in the online or offline activities held by us on an irregular basis. The types of personal information collected, and the content of the activities will be explained to you separately at the time of collection, and we will obtain your consent in the form of Statement on Personal Information Collection and Use. Under such scenarios, the Statement on Personal Information Collection and Use will remind you to read this Personal Information Protection Policy, and by participating in our online or offline activities, you will be deemed to have read and accepted this Personal Information Protection Policy. We will process your personal information in strict accordance with this Personal Information Protection Policy.

7.   Fulfilment of statutory obligations

We may process your personal information based on statutory and regulatory obligations, such as when we perform a recall obligation which involves your vehicle or carry out a technical activity.

Sometimes, parts of the vehicle information collected under I.2 are also processed to meet legal and regulatory requirements such as disclosure of repair and maintenance information request by the relevant regulation. To protect the privacy of our customers, the processing of technical information listed below is always vehicle-related and without direct or indirect connection to the specific customer.

In order to ensure the secured operation of IT systems, we may need to use your information. Smooth and secured operation of IT systems will be ensured with the following actions, among others:

The information collected is also processed as part of internal compliance management by which we check, for example, whether you received sufficient advice when concluding a contract and that the dealer complied with all statutory obligations.

We are subject to a variety of other statutory obligations. In order to fulfill these obligations, we process your information to the extent required by laws, regulations and regulatory requirements.

8. Exceptions to acquire authorization and consent for collection and use of personal information

In accordance with relevant laws, regulations, and national standards, we may collect and use your personal information without your consent in the following scenarios:

(1)    where it is required to enter into and perform a contract to which you are a party;

(2)    where it is required for us to perform statutory duties or statutory obligations;

(3)    where it is required to respond to public health emergencies or protect the life, health and property safety of you and others;

(4)    processing of your personal information to a reasonable extent in order to implement news reporting, public opinion supervision or other acts for the public interest;

(5)    lawfully processing of your personal information disclosed by you or otherwise lawfully disclosed to a reasonable extent;

(6)    other scenarios stipulated in laws and administrative regulations.

Please note that in accordance with applicable laws, if we take technical measures to process personal information so that such information cannot re-identify particular individuals and cannot be restored, such information shall no longer be personal information. We may use such information for research, statistics and analysis so as to improve the content of BMW products, provide support to business decisions and improve our products and services, and may share such statistics with the public or a third party to show the overall usage trends of our products and/or services. It is not necessary to otherwise inform you or obtain your consent for such use.

 

II. How We Use Cookies and Other Similar Technologies

We do not use cookies and other similar technologies in My BMW product/service to collect your personal information.

 

III. How We Entrust, Share, Transfer and Publicly Disclose Your Personal Information

1. Entrusted processing

In order to provide you with professional and high-quality products and services, certain modules or functions of My BMW App are provided by external providers engaged by us. For example, we engage NavInfo to provide you with certain services of My BMW App. In addition, in order to provide you with public charging information integration service, and dedicated parking and charging service, we may provide or transfer to certain selected third parties the information collected under I.2 which have been encrypted or de-identification:

Public charging information integration service: charging service providers, e.g. UNIEV, State Grid, Star Charge, TELD, Anyo Charging, Potevio and EV Power

Dedicated parking and charging service: Beijing Huahang Yuexing Network Technology Co., Ltd. MALLSHARE (Beijing)Media Technology Co., Ltd., TELD New Energy Co., Ltd.

In such circumstances, in order to provide you with relevant services and support, we have to entrust such affiliated companies, BMW authorized dealers and/or external providers with the processing of your personal information. In the case of entrusted processing, we will, to the extent of this Personal Information Protection Policy, determine the method of and purpose for processing your personal information, and the entrusted party will process your personal information as instructed by us. If you have questions regarding the processing of personal information for such modules or functions, or seek a complaint, you can contact us directly through the contact means set out in IX.

In the case of entrusted processing, we will based on your scope of authorization agree with all companies, organizations and individuals entrusted by us with the processing of personal information on the purpose, term and method of processing, types of personal information, protection measures and rights and obligations of us and them, and supervise their processing of personal information. We will ensure that the entrusted companies, organizations and individuals process your personal information in accordance with our agreements with them and will not process your personal information beyond the agreed purpose for and method of processing. We will enter into strict non-disclosure agreements with all entrusted companies, organizations and individuals and require them to process personal information according to our instructions, this Personal Information Protection Policy and any other related measures for confidentiality and security.

2. Sharing

 (1) Sharing information with the affiliated companies of BMW China and the BMW authorized dealers

Save for the case of entrusted processing, we may share your personal information with our affiliated companies and dealers from time to time. Different from entrusted processing, in the case of sharing your personal information, our affiliated companies and dealers as the receiving party will independently determine the purpose for and method of processing your personal information. Therefore, in the case of sharing your personal information, we will inform you of the details of such sharing and obtain your separate consent.

(a) Sharing information with our affiliated companies. To realize the purposes specified in this Personal Information Protection Policy, when you authorize and agree to the services provided by our affiliated companies, your personal information may be shared with our affiliated companies.

If an affiliated company changes the purpose for processing your personal information, your further authorization and consent will be obtained.

(b) Sharing with authorized dealers. To realize the purposes specified in this Personal Information Protection Policy only, subject to your authorization or separate consent, we may share some of your personal information with our authorized dealers, in order to offer you more convenient client services and to enhance your user experience.

We will enter into strict non-disclosure agreements with all companies, organizations and individuals with which we share information and require them to process personal information according to our instructions, this Personal Information Protection Policy and any other related measures for confidentiality and security.

 (2) We may share your personal information with external parties as required under laws or regulations or upon compulsory requirements of competent government authorities.

(3) We will share the necessary personal information only for the purposes specified in this Personal Information Protection Policy. Before sharing your personal information, we will remind you again by means of pop-ups and obtain your authorization, or request you to otherwise click confirm or sign a Separate Consent.

3. Provision

We will not provide your personal information to any other company, organization or individual, except under the following circumstances.

(1) Providing information with explicit consent: we will provide your personal information to other parties after obtaining your explicit consent.

(2) If your personal information has to be provided to the successor of the rights and obligations of a company in a merger, acquisition or bankruptcy liquidation, we will inform you separately and require the new company or organization that will hold your personal information to continue to observe this Personal Information Protection Policy. Otherwise, we will require the new company or organization to request for your authorization and consent before transferring your personal information.

4. Disclosure

We will disclose your personal information only under the following circumstances.

(1)  Where it is necessary for our business and after obtaining your separate consent.

(2)  Disclosure under the law: we may publicly disclose your personal information as required by laws,  under legal procedures, in lawsuits or upon compulsory requirements of competent authorities under the government.

5. Exceptions to acquire authorization and consent for sharing, provision and disclosure of personal information

In accordance with relevant laws, regulations, and national standards, we may share, transfer, or disclose to the public your personal information without your prior authorization and consent if:

(1)    where it is required to enter into and perform a contract to which you are a party;

(2)    where it is required for us to perform statutory duties or statutory obligations;

(3)    where it is required to respond to public health emergencies or protect the life, health and property safety of you and others;

(4)    processing of your personal information to a reasonable extent in order to implement news reporting, public opinion supervision or other acts for the public interest;

(5)    lawfully processing of your personal information disclosed by you or otherwise lawfully disclosed to a reasonable extent;

(6)    other scenarios stipulated in laws and administrative regulations.

 

IV. How We Protect Your Personal Information

1. We store your information based on the state of the art and we take the following safeguards to protect your personal information from misuse or any other unauthorized processing of disclosing, using, rectifying, or destroying. We will take all reasonable and feasible measures to protect your personal information. For example, we will use encryption technology to ensure the confidentiality of data, and we provide HTTPS encryption protocol to ensure the security of data transmission. We will use trusted protection mechanisms to prevent data from being maliciously attacked; We will deploy access control mechanisms to ensure that only authorized personnel can access personal information; And we will regularly hold security and privacy protection training courses to enhance employees' awareness of the importance of protecting personal information.

2. We will take all reasonable and feasible measures to ensure that we only collect such personal information as required to realize the purposes specified in this Personal Information Protection Policy. We will only retain your personal information for a limited period necessary for realizing the purposes specified in this Personal Information Protection Policy, unless it is necessary to extend the retention period or it is protected under the law. Otherwise, we will delete or anonymize your personal information according to lawful regulations in case of the storage duration for your personal information expired.

3. The Internet is not an absolutely safe environment. Although we are committed to protecting your personal information, we cannot guarantee or warrant that it is absolutely secure. Therefore, you shall also take active measures to ensure the security of your personal information, e.g. changing your account password on a regular basis, and not disclosing your account password information to others.

4. In the case of any incident in respect of personal information security, we will, pursuant to requirements set out in laws and regulations, inform you promptly of the particulars, including basic information about the security incident and the likely impact, what measures we have taken or will take to respond to such incident, suggestions on what measures you may take yourself to guard against and lower risks, remedial actions we offer to you, etc. We will brief you on the progress of the incident by email, correspondence, phone or by sending notifications, and we will release announcements for this purpose in a reasonable and effective manner even when it is difficult to notify personal information subjects one by one.

Meanwhile, we will actively report how the personal information security incident is being handled pursuant to the requirement of the regulator.

5. My BMW App may contain network links that are operated and maintained by third parties, but we have no control over such third parties. Please note that any information that you provide to a third party will be protected by the provisions of the Personal Information Protection Policy of such third party. We recommend that you enquire before providing any information to a third party. The presence of a third-party link on My BMW App does not imply that we endorse the contents, acts or policies of such third party.

 

V. Your Rights

According to applicable Chinese laws, regulations and standards, and common practices in other countries and regions, we guarantee that you can exercise the following rights with respect to your personal information:

1. Accessing, check and copy your personal information

You have the right to access your own personal information, unless there are exceptions in laws and regulations. If you want to exercise your right to access personal information, you can make a request via email to BMW_Helpdesk@navinfo.com. We will process your request after verifying your identity, then check and deal with the request within 15 working days.

You have the right to copy your personal information or obtain a copy of your information. You can receive your personal information output result by following the steps of “Profile”-“Privacy Settings”-Click “Personal information output”, then enter your email address and set a file password, or through sending an email at any time to BMW_Helpdesk@navinfo.com applying for personal information output.

Meantime, we provide users with the ways to check your personal information through App, and the operational methods are as follows,

Check personal information by clicking “Profile”-“Settings”-“profile picture”

Check account information by clicking “Profile”-“Settings”-“BMW ID”-phone number, password, identify information

Check order information by clicking “Profile”-“My Order”

If it is technically feasible, such as matching of data interface, and is in line with the conditions stipulated by the national cyberspace administration, we also can directly transfer a copy of your personal information to the third party designated by you.

2. Rectifying your personal information

If you find that your personal information we process is inaccurate, you have the right to request us to rectify your information. You can request the detailed process of rectification via email to BMW_Helpdesk@navinfo.com. We will process your request after verifying your identity, then check and deal with the request within 15 working days.

Meantime, we provide users with the ways to rectify your personal information through App, and the operational methods are as follows,

Rectify personal information by clicking “Profile”-“Settings”-edit “profile picture”

Rectify account information by clicking “Profile”-“Settings”-“BMW ID”-edit phone number, password, identify information

3. Deleting your personal information

We provide users with the ways to delete your personal information through App, and the operational methods are as follows,

Delete My dealer by clicking “Profile”-“My dealer”-remove from My dealer

You may request the deletion of your personal information under any of the following circumstances:

(1) When our processing of personal information violates laws or regulations;

(2) When we collect or use your personal information without your consent;

(3) When our processing of personal information violates our agreement with you;

(4) When you have achieved, or find it impossible or unnecessary to achieve, the purpose of processing your information (for example, you no longer use our products or services, or you cancel your account);

(5) When you revoke your consent to our processing your personal information.

If you want to delete your personal information, you can make a request via email to BMW_Helpdesk@navinfo.com. We will process your request after verifying your identity, then check and deal with the request within 15 working days.

If we agree with your request to delete information, we will also notify entities that obtain your personal information from us to require them to delete the information concerned in a timely manner, unless otherwise stipulated by laws and regulations or such entity has obtained your separate authorization.

Once your information has been removed from our services, due to the restrictions under the applicable laws and regulations, we may not immediately delete the corresponding information from the backup system, but we will store the information safely without further processing until the backup could be eliminated or anonymized. To fully protect your personal rights and interests, we may retain the necessary information in the backup system whilst keep such information unsearchable or inaccessible through technical means.

4. Changing the scope of your authorization or revoking your consent
    You may at any time grant or revoke your authorization or consent for our collection and use of your personal information. You may revoke your consent via email to BMW_Helpdesk@navinfo.com. Please note that each business function cannot be realized without some basic personal information (see Part I of this Personal Information Protection Policy); thus, we cannot continue to provide the relevant services to you if you revoke your consent for our collection and use of your personal information required for the business function.

After you have revoked your consent, we will no longer process the personal information in respect of which your consent is revoked. But your decision to revoke your consent does not affect the previous processing of personal information based on your authorization.

If you do not want to receive commercial advertisements and other marketing and promotion information we send, you may unsubscribe at any time via email to BMW_Helpdesk@navinfo.com.

5. Cancelling user accounts

The service NavInfo providing is based on BMW ID. You may cancel your account by following the steps of “Profile” – “Settings” – “BMW ID” – “Account Cancellation” - check the account cancellation prompt, click "Confirm Cancellation", and then apply for account cancellation, or emailing us at servicecenter@bmw.com.cn at any time. We will process your request after verifying your identity and complete the verification and processing within ten working days.

After your account is cancelled, we will cease providing you with products or services, and delete your personal information in a timely manner, unless otherwise stipulated by laws and regulations.

6. Use of automatic decision-making of the information system

Our decisions will not only rely on the automatic decision-making mechanisms, such as the information system and algorithms.

7. Responding to your requests

You may make requests in respect of your personal information by the above said methods. For the sake of security, you may be required to submit your request in writing or otherwise prove your identity. We may request authentication of your identity before responding to your requests.

We will process your request after verifying your identity, then check and deal with the request within 15 working days. If you are dissatisfied with our reply, you may lodge a complaint via email to BMW_Helpdesk@navinfo.com.

In principle, we will not charge fees for your reasonable requests. However, if your requests are lodged repeatedly or beyond a reasonable extent, we will charge fees of a proper amount depending on the cost. We may refuse your requests if they are repeated without reason, need to be replied to through excessive technical methods (for example, a new system needs to be developed or the existing common practices need to be fundamentally reformed), pose risks to others’ legal rights or interests, or are fairly unrealistic (for example, it involves information stored on backup tapes).

We will not respond to your requests under any of the following circumstances.

(1) Where requests are in relation to our performance of the obligations specified in laws and regulations;

(2) Where requests are in direct relation to the national security or national defence security;

(3) Where requests are in direct relation to the public security, public sanitation, or major public benefits;

(4) Where requests are in direct relation to investigations into crimes, prosecutions, court trials, execution of rulings, etc.;

(5) Where we have sufficient evidence that you are intentionally malicious or abusing his/her rights;

(6) Where personal information collecting and processing are for the sake of safeguarding significant legal rights and interests, such as the life and property of you or other individuals, but it is difficult to obtain your or their consent;

(7) Where responses to your requests will give rise to serious damage to the legal rights and interests of you or any other individual or organization; or

(8) Where requests involve business secrets.

 

VI. How We Deal with Children’s Personal Information

Our products and services are designed primarily for adults. We will not create a BMW ID for children, nor collect or use the personal information of children. If it is necessary to collect and use the personal information of children, we will inform their guardians beforehand to obtain their separate consent.

For the purpose of this Personal Information Protection Policy, we regard any minor who is under the age of 14 as a child.

If we find that we have created a BMW ID for children or collected the personal information of children without prior, provable and separate consent from the children’s guardians, we will do our best to delete the relevant account and information as soon as possible.

 

VII.  How Your Personal Information Will Be Transferred Globally

The personal information we collect and generate within the territory of the People’s Republic of China (PRC) will be stored within the territory of the PRC. Therefore, your personal information will not be transferred to other jurisdictions outside the PRC or be accessed by these overseas jurisdictions. If cross-border data transfer is required in the future, we will otherwise ask for your permission, comply with the applicable laws and regulations, and make sure that your information will be under the same and equal protection as in the PRC.

 

VIII.  How this Personal Information Protection Policy Will Be Updated

Our Personal Information Protection Policy may be changed. We will not reduce your rights under this Personal Information Protection Policy without your explicit consent. We will publish any change to this Personal Information Protection Policy at this page. We will keep the former versions of this Personal Information Protection Policy.

In the case of major changes, we will release clear notices (including, for some services, the pop-up window will be set to remind you and obtain your authorization again.)

The major changes in this Personal Information Protection Policy include but are not limited to:

1. Significant changes to our service mode, such as the purposes of processing personal information, categories of personal information to be processed, the ways to use personal information, etc.;

2. Substantial changes to the ownership structure, organizational structure, etc., such as changes to the owners as a result of business adjustments, bankruptcy, mergers and acquisitions;

3. Changes to the subjects we share with, transfer to or publicly disclose personal information;

4. Significant changes to your rights in respect of your participation in personal information processing and to the ways in which you can exercise such rights;

5. Changes to our department responsible for the security of personal information, contact information of such department, or complaint channels.

 

  1. How to Contact Us

You can contact us via below means. We will process your request after verifying your identity, then check and deal with the request within 15 working days.

  1. If you have any concerns or comments on this Personal Information Protection Policy, you can email BMW_Helpdesk@navinfo.com.
  2. We have set a specific team for personal information protection, Data Governance and Compliance Department of BMW China Automotive Trading Ltd. Registered address: 28F, Tower B, Gateway Plaza, No. 18 Xia Guang Li, North Road East Third Ring, Chaoyang District, Beijing 100027. You can contact them via email servicecenter@bmw.com.cn or call the BMW customer hot line: 400-800-6666.

If you are not satisfied with our response, especially if you believe that our processing of personal information has harmed your legitimate rights and interests, you can also seek a solution through the following external channels: file a lawsuit in the court with jurisdiction in the location of the defendant.

CONFIDENTIAL