Data Protection Notice Alphabet Used Cars

As defined by the basic EU data protection regulations, AlphabetFuhrparkmanagement GmbH (hereinafter referred to as "Alphabet" and/or "we" and/or "us"), Lilienthalallee 26, 80939 München is responsible as a Data Controller for the processing of your personal data.

Alphabet acquires and processes your personal data in the following cases, among others:

• When you contact us directly, for example via our Alphabet Internet website, and you are interested in buying our used cars or have any other requests.
• When you register yourself as a buyer on our Alphabet Used Cars platform in order to participate in our online auctions for buying our used cars.
• When you respond to our direct marketing activities, for example when you complete a reply card, participate in our customer feedback research surveys or submit your data online on one of our websites (e.g. Alphabet.de) or mobile apps.
• When other BMW Group and Alphabet companies as well as our business partners provide data about you in a manner that is permitted.

Please help us to keep your details up to date by notifying us regarding changes to your personal data – in particular your contact data.

The following categories of personal data can be collected via the numerous services and contact channels described in this Data Protection notice:

• Contact data    ► e.g. name, address, telephone number, fax number, e-mail address, business function.
• Contract data ► e.g. customer ID, customer number, subscriptions, contracts: contract settlement and payment; contract master data such as contract number, retention period.
• Account data   ► e.g. payments and/or bank details, tax identification number.
• Customer Transaction Data ► bidding data online auctions, bought used cars, invoice data and arrears.

Customer Interaction Data ► user behavior (website visits, clicks), response data (to surveys), complaints, feedback, communication history, cookies – tracking or monitoring. More information on cookies can be obtained here in our Alphabet cookie policy. 

We only process your data if this is permitted by an applicable legal regulation. We will process your data in particular on the basis of Article 6 and Article 9 of the basic EU data protection regulations as well as on the basis of consent in line with Article 7 of the basic EU data protection regulations. Here, we will base the processing of your data on, among others, the following legal principles. Please bear in mind that this is not a complete or conclusive list of the legal principles, rather only examples intended to make the legal principles more transparent.

• Consent (Article 6 Paragraph 1 Page 1 a), Article 7 of the basic EU data protection regulation, or Article 9 Paragraph 2 a), Article 7 of the basic EU data protection regulations): We will process certain data only on the basis of the consent you have given expressly and voluntarily. You have the right to revoke your consent at any time with effect for the future.
• Fulfilment of a contract / pre-contractual measures (Article 6 Paragraph. 1 Page 1 b) of the basic EU data protection regulations): For initiation and/or execution of your contract with Alphabet and Alphabet partners, we require access to certain data.
• Fulfilment of a legal obligation (Article 6 Paragraph 1 Page 1 c) of the basic EU data protection regulations): Alphabet is subject to a number of legal specifications. We must process certain data to comply with these specifications.

Protection of legitimate interests (Article 6 Paragraph 1 Page 1 f) of the basic EU data protection regulations): Alphabet will process certain data in order to protect their legitimate interests or the interests of third parties. However, this only applies if your interests do not outweigh ours in individual cases.

The data acquired in the context of contract conclusion or the provision of services are processed for the purposes stated below.

A.    Compliance with contractual duties within the contractual agreement for buying and acquiring used cars (Article 6, Paragraph 1, b) of basic EU data protection regulations)

Alphabet, Alphabet affiliates and Alphabet partners acquire, process,and if required, to publish and use personal data within the framework for participating in online auctions in order to buy offered used cars, which includes:

• A personal user account to access Alphabet’s online used cars platform.
• Evaluation of submitted bidding’s in order to sell the used car to the best bid.
• Invoice the sold cars incl. arrears management
• Delivery of  the sold vehicles

 Regarding all aspects of contract administration or dealing with a concern, we will contact you without separate consent, for example in writing, by telephone, per messenger service, per e-mail, depending on which contact data you have specified.

B.    Ensuring product quality, research and development of new products (Article 6, Paragraph 1 f) of basic EU data protection regulations)

Alphabet Fuhrparkmanagement GmbH uses the data acquired as a result of the provision of services by Alphabet or Alphabet partners in a depersonalized form to ensure the quality of products and services as well as for the purposes of research and development. "Depersonalized" means that the data can no longer be traced directly to you.

This processing is based on the legitimate interest of Alphabet in meeting the high expectations of our customers with regard to high-quality products and services and taking account of the customer wish to have newly developed, innovative solutions. To protect your interests – alongside de-personalization – additional security precautions and controls are implemented as required, for example strict data access restrictions, restrictions in data use, security measures, retention periods, as well as data economy principles such as exclusively gathering relevant data.

C.    Customer care (Article 6 Paragraph 1 b, f) of basic EU data protection regulations)

Alphabet uses your personal data for used cars related contract administration or to handle any request you have submitted. Regarding all aspects of contract administration or dealing with a concern, we will contact you without separate consent, for example in writing, by telephone, per messenger service, per e-mail, depending on which contact data you have specified.

We will also contact you in carefully considered cases with promotional communication if and to the extent that the requirements in compliance with data protection legislation necessary for this are met and in full awareness of your right of objection you have not objected to the use of your data for the purpose of written communication.

Alphabet also processes your personal data on this basis to optimize your experience with Alphabet Customer Care, e.g. to identify you correctly if you make contact with us.

D.    Promotional communication as well as market research based on consent (Article 6, Paragraph 1 a) of basic EU data protection regulations)

Insofar as you have separately given your consent to further use of your personal data, your personal data may be used in accordance with the scope described in the consent declarations, for example for promotional purposes (selected offers of products and services), market and customer feedback research, and with your separate consent subsidiaries of Alphabet International GmbH and selected Alphabet partners. Details are included in the respective declaration of consent, which you can revoke at any time.

As a rule, data processing for promotional purposes takes place in the EU; under no circumstance are personal data transferred to a country outside the EU for promotional communication or market research purposes.

E.    Compliance with legal obligations to which Alphabet is subject (Article 6, Paragraph 1 c, f) of basic EU data protection regulations)

Alphabet will also process personal data if there is a legal obligation to do so. This can be the case, for example, for anti-money laundering.

Gathered data are also processed within the framework of ensuring the operation of IT systems. Ensuring operation involves the following activities:

• Backup and restore of data processed in IT systems;
• Logging and monitoring of transactions to check the correct function of IT systems;
• Detection and defense against unauthorized access to personal data;
• Incident and problem management to remedy malfunctions in IT systems.

Gathered data are also processed within the framework of internal compliance management in which we, for example, check whether you have been advised to an adequate extent within the framework of concluding a contract and that the Alphabet partner has complied with all legal obligations.

Alphabet is subject to a large number of other legal obligations. In order to fulfill these obligations, we process your data to the required extent and, if necessary, pass them on to the authorities responsible within the framework of legal obligations of notification.

We also process your data in the event of legal conflicts if the legal conflict makes processing the data necessary.

F. Data transfer within the BMW Group

Alphabet is a company of the BMW Group. In some cases, after a careful check, we send your data to other companies of the BMW Group, who are then responsible for further processing. Such a data transfer can occur under the following circumstance and for the following purposes:

Please bear in mind that this is not a complete or conclusive list of the data transfer operations within the BMW Group, rather only examples intended to make the data transfers more transparent.

• For compliance with the sales, service, and administration processes of Alphabet Fuhrparkmanagement GmbH, cf. point E.

 In the case Alphabet is auctioning vehicles on behalf of a BMW Group company for administration and invoice purposes.

G.    Data transfer to selected third parties

Data are forwarded to the following companies, among others, if and to the extent that the requirements in compliance with data protection legislation necessary for this are met:

• To carefully selected and checked service providers and business partners with whom we cooperate to be able to offer you products and services. (e.g. processing of complaints or the collection of vehicles) We do this for Alphabet only within the framework of the strict conditions of data processing on your behalf or on the basis of your express consent.
• In the event of the sale of a business unit or several business units of Alphabet to a company to which we assign our rights in compliance with all agreements that exist between us.
• To other third parties (for example public authorities) to the extent that we are legally obliged to do so.

In line with article 17 of the basic EU data protection regulations, we will keep your data only as long as necessary for the respective purposes for which we process your data. If we process data for a number of purposes, they are automatically deleted or stored in a format that does not permit conclusions to be drawn directly as regards your person as soon as the last specific task has been performed. To ensure that all of your data are deleted in line with the principle of data minimization and article 17 of the basic EU data protection regulations, Alphabet has created an internal deletion concept. The fundamental principles by which this deletion concept envisages the deletion of your personal data are described below.

Use for compliance with a contract

To comply with contractual obligations, data acquired from you can be kept for as long as the contract is in force and - depending on the nature and scope of the contract -  beyond this point in order to comply with legal requirements for preservation and to ensure clarification of any queries or claims after the end of the contract.

Over and above this, there are contracts for the delivery of products and services that necessitate longer retention periods, see also "Use for the assessment of claims" below.

Use for the assessment of claims

Data that in our opinion will be necessary to assess and avert claims against us or to initiate criminal proceedings or assert claims against you, us or third parties can be kept by us for as long as corresponding proceedings could be initiated.

If you have any questions regarding the use of your personal data, it is best to contact us using the following contact data:

Alphabet Remarketing

Alphabet Fuhrparkmanagement GmbH

Lilienthalallee 26, 80939 München

E-mail: UsedCarsAuction@alphabet.de

Data Protection: alphabet_datenschutz@alphabet.de