DATA PROTECTION

When do we acquire and process personal data?

We acquire and process your personal data in the following cases, including:

• When you contact us directly, for example via our website, via our Customer Care or our dealerships, and you are interested for example in our products or services or have any other concerns.
• When you log in to our website, purchase our products on our website, ask for any quotation or services via email, telephone, social media, cellphone, etc.
• When you ask us to deliver your goods.

Which data about you can be collected?

The following categories of personal data can be collected via the numerous services and contact channels described in this data protection information:

• Contact data: Name, address, telephone number, e-mail address.
• Other personal data: IP-address, serial number, browser language version, browser version.
• Use of websites and communication: Information on how you use the website, including data gathered via cookies and other tracking technologies. More information on this can be obtained here in our cookie policy.

Why do we need to collect your data?

The data acquired in the context of concluding contracts or the providing services are processed for the purposes stated below.

1. Customer care 

• According to (Article 6 Paragraph 1 b, g, f) of basic EU data protection regulations),
  We uses your personal data to handle any request you have submitted. We will contact you without separate consent, for example in writing, by telephone, per messenger service or per e-mail, depending on which contact data you have specified.
• We also process your personal data to optimize your experience with our Customer Care, e.g. to identify you correctly if you make contact with us.

2. Compliance with legal obligations

• According to (Article 6, Paragraph 1 c, f) of basic EU data protection regulations)
  We will also process personal data if there is a legal obligation to do so.
• We also process your data in the event of legal conflicts; if the legal conflict makes processing the data necessary.

 

3. Data transfer to selected third parties
   Data are forwarded to the following companies, among others, if and to the extent that the requirements in compliance with data protection legislation necessary for this are met:

• To a logistic company for your shipment.
• To dealerships
• To production facility
• To other third parties (for example public authorities) to the extent that we are legally obliged to do so.

How do we protect your personal data?

We employ various security measures such as encryption and authentication tools to protect and maintain the security, integrity, and availability of your data.

We try our best to protect your personal data in line with the prevailing data protection regulations by means of physical, electronic, and process-oriented security precautions in line with the current state of the art. Among other things, we use the following measures:

• Strict criteria for authorization to access your data according to the “need-to-know principle” and exclusively for the specified purpose.
• Transfer of acquired data exclusively in encrypted form.
• Storage of confidential data, exclusively in encrypted form.
• Permanent monitoring of accesses to IT systems to detect and prevent the misuse of personal data.

How long do we keep your data?

According to the  article 17 of the basic EU data protection regulations, we will keep your data only as long as necessary for the respective purposes for which we process your data.

To ensure that all of your data are deleted in line with the principle of data minimization and article 17 of the basic EU data protection regulations, we have created an internal deletion concept. The fundamental principles by which this deletion concept envisages the deletion of your personal data are described below.

Use for compliance with a contract
To comply with contractual obligations, data acquired from you can be kept for as long as the contract is in force and – depending on the nature and scope of the contract – for 2 years beyond this point in order to comply with legal requirements for record keeping and to ensure clarification of any queries or claims after the end of the contract.

Use for the assessment of claims
Data that in our opinion will be necessary to assess and avert claims against us or to initiate criminal proceedings or assert claims against you, us or third parties can be kept by us for as long as corresponding proceedings could be initiated.

Use for customer care
For customer care, the data acquired from you can be kept for 2 years, unless you wish to have these data deleted and there are no contractual or legal requirements for preservation that prevent this request for deletion.

Contact with us, your data privacy protection rights, and your right to file complaints with data privacy protection authorities

If you have any questions regarding the use of your personal data by us, please contact us via email, phone or letter.

As the person affected by the processing of your data, the basic EU data protection regulations and other relevant data privacy protection regulations enable you to assert certain rights in relation to us. The following section contains explanations of your rights as defined by the basic EU data protection regulations. Depending on the type and scope of your inquiry, we ask you to put the inquiry in writing.

Rights of persons affected
In line with the basic EU data protection regulations, as the person affected you have the following rights:

Right to information (Article 15 of basic EU data protection regulations):
You can ask us for information regarding any data of yours that we keep at any time. This information concerns, among other things, the data categories we process, for which purposes we process them, the origin of the data if we did not acquire them directly from you and, if applicable, the recipients to whom we have sent your data. You can obtain a copy of your data from us free of charge. If you are interested in additional copies, we reserve the right to charge for the additional copies.

Right to correction (Article 16 of basic EU data protection regulations): 
You can request that we correct your data. We will initiate appropriate measures to keep the data of yours that we continuously process correct, complete, and up to date, based the latest information available to us.

Right to deletion (Article 17 of basic EU data protection regulations):
You can request that we delete your data provided the legal requirements have been met. In accordance with Article 17 of basic EU data protection regulations, this can be the case if:

• The data are no longer required for the purposes for which they were acquired or otherwise processed
• You revoke your consent, which is the basis of the data processing, and there is no other legal basis for the processing
• You object to the processing of your data and there are no legitimate reasons for the processing or you object to data processing for the purposes of direct advertising
• The data have been processed illegally

Right to restriction of processing (Article 18 of basic EU data protection regulations):
You can request that we restrict the processing of your data if

• You dispute the correctness of the data – for the period of time we need to check the correctness of the data
• The processing is illegal but you do not wish to have your data deleted and request a restriction of use instead
• We no longer need your data, but you need them to assert, exercise or defend against legal claims
• You have filed an objection to the processing, though it has not yet been decided whether our legitimate grounds outweigh yours.

Right to data transferability (Article 20 of basic EU data protection regulations):
At your request, we will transfer your data – where technically possible – to another responsible entity. However, this right only applies if the data processing is based on your consent or is required to fulfill a contract.

Right to objection (Article 21 of basic EU data protection regulations):
You can object to the processing of your data at any time for reasons that arise from your special situation provided the data processing is based on your consent or our legitimate interest or that of a third party. In this case, we will no longer process your data. The latter does not apply if we are able to prove there are compelling, defensible reasons for the processing that outweigh your interests or we require your data to assert, exercise or defend against legal claims.

Time limits for compliance with the rights the persons affected
As a general principle, we make every effort to comply with all requests within 30 days. This time limit, however, can be extended for reasons related to the specific rights of persons affected or the complexity of your request.

Restriction in the provision of information regarding the rights of persons affected
In certain situations, legal specifications might require us not to provide information regarding all of your data. If we have to refuse your request for information in such a case, we will inform you of the reasons for refusal at the same time.

Complaints to supervisory authorities
We takes your reservations and rights very seriously. However, if you are of the opinion that we have not dealt with your complaints or reservations adequately, you have the right to submit a complaint to the data privacy protection authorities responsible.    

 

Legal basis for the processing of personal data

We only process your data if this is permitted by an applicable legal regulation. We will process your data in particular on the basis of Article 6 and Article 9 of the basic EU data protection regulations as well as on the basis of consent in line with Article 7 of the basic EU data protection regulations. Here, we will base the processing of your data on, among others, the following legal principles. Please bear in mind that this is not a complete or conclusive list of the legal principles, rather only examples intended to make the legal principles more transparent.

• Consent (Article 6 Paragraph 1 Page 1 a), Article 7 of the basic EU data protection regulation, or Article 9 Paragraph 2 a), Article 7 of the basic EU data protection regulations): We will process certain data only on the basis of the consent you have given expressly and voluntarily. You have the right to revoke your consent at any time with effect for the future.
• Fulfillment of a contract / pre-contractual measures (Article 6 Paragraph. 1 Page 1 b) of the basic EU data protection regulations): For initiation and/or execution of your contract with B&A, B&A dealerships, and B&A partners, we require access to certain data.
• Fulfillment of a legal obligation (Article 6 Paragraph 1 Page 1 c) of the basic EU data protection regulations): We are subject to a number of legal specifications. We must process certain data to comply with these specifications.

Protection of legitimate interests (Article 6 Paragraph 1 Page 1 f) of the basic EU data protection regulations): We will process certain data in order to protect their legitimate interests or the interests of third parties. However, this only applies if your interests do not outweigh ours in individual cases.