DATA PROTECTION DECLARATION

1. Introduction.

2. Responsible body.

3. Personal data and its proper handling.

3.1. Data origin

3.2. What is personal data?

3.3. The proper handling of personal data.

3.4. How we handle your data (processing purpose)

3.5. Types of data collection and categories.

4. Our use of technology.

4.1. Use of app cookies.

4.2. How can you remove cookies?

4.3. Cookies and technologies used.

4.4. Use of social media plugins and integration of third-party offers.

5. Publication and transfer of data.

5.1. Transfer of personal data.

6. Protection of your personal data.

6.1. What do we do to protect it?

6.2. Storage of your data.

7. Sending emails to you, links to other websites.

7.1. Sending emails

8. Your rights in relation to personal data.

9. Order data processing.

9.1. Responsible body.

9.2. Supplementary provisions on order data processing.

10. Changes to this privacy policy.

1.

This privacy policy of Mark Huggett GmbH (hereinafter ‘MH GmbH’) informs you about the collection and processing of your data (both personal data and non-personal data; hereinafter also referred to as ‘data’). We also inform you about the duration of the processing of your data, the legal basis for the processing – if necessary – and your rights with regard to the processing of your personal data. This privacy policy applies to all your data that we already have or will have in the future.

Please read this privacy policy carefully. Terms such as ‘we’, ‘us’, ‘our’, etc. refer to MH GmbH. Terms such as ‘you’, ‘your’, etc. refer to you as the user of our website www.bmwbike.com. If you do not agree with the privacy policy, you should refrain from using our website.

2. Responsible body

Mark Huggett GmbH, CH-5113 Holderbank, is responsible for data processing in accordance with this privacy policy.

For concerns and enquiries relating to data protection, please contact our internal data protection officer at


mailto:datenschutz@bmwbike.com

Huggett@bmwbike.com. For concerns and questions from within the EU, you can contact Huggett@bmwbike.com

3. Personal data and proper handling

3.1. Data origin

When you use our platform and interact with us, e.g. when you visit our websites, use any of our other digital services, conclude a contract, register, log in or contact our employees, we collect certain data.

We generally collect this data directly from you. In certain cases, we may receive data from other persons, e.g. if a third party makes a recommendation or invites you to use our services, if your employer provides us with your contact details for the purpose of using our platform, or if a company or third party with whom you have a contractual relationship forwards your personal data to us.

3.2. What is personal data?

The term ‘personal data’ as used here includes all information that is assigned to you or can be assigned to you. This applies regardless of whether this data was entered by you, collected from you or obtained by us in any other way.

However, the term ‘personal data’ as used in this privacy policy does not include personal data that you enter yourself and manage yourself (hereinafter also referred to as ‘customer data’). Such customer data is therefore not subject to this privacy policy. If you provide us with personal data of other persons (e.g. email, name, etc.), please ensure that these persons are aware of this privacy policy and only share their personal data with us if you are authorised to do so in accordance with applicable data protection law.

3.3. Proper handling of personal data

We are responsible for monitoring all your personal data. This includes data that we collect, process and use in connection with your use of the platform or in any other way.

However, we are not responsible for monitoring customer data. We collect, process and use customer data exclusively in our capacity as a data processor on behalf of the respective user and in accordance with the applicable Swiss data protection laws.

If you use our services or invite third parties to participate, we also assume that you are the sole responsible party in relation to us with regard to the personal data in the areas you manage within the meaning of data protection law. You are therefore responsible for the legality of the collection, processing and use of customer data in accordance with the statutory provisions. You thereby ensure that you are authorised to commission us as a data processor and to transfer customer data to us in this context. The provisions on data processing can be found in section 9.

3.4 How we handle your data (processing purpose)

We collect, process and use your personal data for the following purposes:

  • To manage, operate, maintain and improve the platform;
  • To provide you with a customised, personalised experience when using the platform;
  • To assess your eligibility for certain types of offers;
  • To support the improvement and personalisation of our services;
  • For analysis and research into customer behaviour;
  • To respond to your enquiries in connection with the platform;
  • To communicate with you about other matters, such as sending reminders, technical messages, updates and service bulletins;
  • To comply with legal obligations; to prevent the unlawful use of our platform; to resolve disputes and enforce our contractual agreements;
  • For other purposes to which you have consented in individual cases;
  • In any other way within the scope of applicable law.

Where required by law, we will ask for your consent before collecting, processing and using your personal data for the above purposes. If we wish to use your personal data for any other purpose, we will also inform you of this. We will only use your personal data for these purposes if this is necessary and permitted under applicable law or if you have given your consent. Only we and, where applicable, subcontractors will have access to your personal data for the above-mentioned purposes.

In order to use our services, you may be required to provide certain personal data that is necessary or required by law for the establishment and execution of the contractual relationship and the fulfilment of the associated contractual obligations. Without this data, we will in most cases not be able to conclude and execute the contract. It is also necessary to log access to our digital services and the associated collection of connection data (such as your IP address). This happens automatically when you use our services and cannot be disabled for individual users. If you do not agree to the collection of such data, you should refrain from using our services.

If we change our structures and carry out a merger, acquisition, demerger or liquidation (‘transaction’) or sell shares or assets, your data may be passed on or transferred to a acquiring company or disclosed to it in the course of such a transaction or in the course of evaluating such a transaction (including letters of intent and/or due diligence). Such disclosure or transfer will in any case be secured by contracts or agreements to ensure that your data is used in accordance with applicable law.

3.5. Types of data collection and categories

Personal data that we collect, process and use includes not only information that we actively collect when you interact with us. It also includes information that you voluntarily provide to us on various occasions via the platform. Consequently, it is not possible to provide a complete list of all types of personal data. In general, it includes the following information:

  • Data provided to us when registering for our services, e.g. surname, first name, contact details, date of birth, job title, photo, employees, language and language settings, payment information, access data such as user name and password – stored in encrypted form, information on advertising, opt-ins and opt-outs, etc.
  • Data relating to offers and concluded contracts, e.g. contract date, type, content, product, parties, term, value, adjustments, payment details, contact details, contact persons, billing and correspondence addresses, customer feedback, cancellations, disputes, etc.
  • Data that is determined or made available when registered and non-registered users use our services. This includes, among other things, the IP and MAC address or device ID of the device used, cookies, pages accessed by users and search terms entered, dialogue box entries, calendar entries, ratings, time and duration of visits, clicks, responses to our offers or third parties, referrer/exit URL, information on the time of use, browser and device type, operating system and Internet service provider used, amount of data transferred. We may combine personal data from one of our services with data from another service.
  • Data exchanged in or in connection with contact with us, e.g. communication by letter, telephone, email, text and image messages (SMS/MMS), video messages or instant messaging, responses to communication and offers, preferred communication channels, etc.
  • Certain services may collect and store location-based data if the geolocation function of the device used is activated.
  • Data provided to us by third parties with whom we have business relationships, e.g. directory entries, address databases, changes to database entries, creditworthiness data, details of internal company contact persons, etc.
  • Data that you or third parties provide when participating in competitions, surveys and the like.
  • Data from public sources, e.g. commercial register entries, other telephone directories, etc.
4. How we use technology 4.1 Use of app cookies

We use various common technologies to collect, store and evaluate data when you use our services. These include, in particular, cookies that can be used to identify your browser or device. Cookies are small text files placed in your browser directory. When a website is accessed, a cookie placed on a device sends information to the browser. Cookies are very common and are used on a large number of websites. In addition to so-called session cookies, which are automatically deleted after you visit our services, we also use temporary and permanent cookies, which remain stored on your computer or mobile device for longer. The purpose of these cookies is to improve the performance of the website and the user experience. However, cookies may also be used for advertising purposes. You can change your cookie settings or refuse to accept cookies altogether. This will limit the amount of personal data we receive. However, please note that you may then not be able to benefit from some of the functions and features of our platform or, depending on your settings, you may not be able to use the solution at all.

4.2 How can you remove cookies?

It is possible to disable all or individual cookies in your browser. To do this, please refer to the user manual for your browser. Please note that disabling cookies may impair the functionality of our services.

4.3 Cookies and technologies used

In addition to cookies, we may also use other technologies (e.g. pixels, web beacons, tags, advertising IDs) to analyse the use of our services, personalise our services and display offers and advertising tailored to you. When sending newsletters and emails, for example, we may use technologies that allow us to analyse which content is of interest to our users and whether, when and how you respond to our offers (e.g. by downloading images in an email, clicking on URLs in an email or on a website, filling out form data, etc.). We assume that by using such functions, you consent to the use of the corresponding technologies.

Finally, we use various common web analysis and tracking tools to measure and evaluate the use of our services. Such tools, which are mostly provided by third parties, provide us with information and statistics about the use of our services, which help us to better understand the use of our services and adapt them to user needs.

A list and all further information on the individual cookies, the technologies used and the web analysis and tracking tools used, as well as any options for deactivating or blocking their use, can be found on the home page of our website.

5. Publication and forwarding of data

5.1. Forwarding of personal data

We may commission third parties to provide certain services, e.g. in the areas of IT, application operation, administration, printing, shipping, etc., and to process and store data (so-called ‘contract data processors’). Contract data processors may have access to personal data and process it on our behalf. We oblige contract processors to comply with data protection law and to process data only as we ourselves do. Contract data processors who may receive personal data may be located in any country, in particular in Switzerland, in countries of the EU and the EEA or in the USA and Canada. In doing so, we take into account the recommendations and information provided by the national data protection officer, the Federal Data Protection and Information Commissioner (FDPIC).

We do not sell, trade or rent your personal data. Any disclosure of personal data is made in strict compliance with the applicable legal provisions. The following is a list of possible recipients of your personal data (not exhaustive):

  • Mark Huggett GmbH
  • Third-party service providers and subcontractors
  • Courts, enforcement and supervisory authorities
  • We share personal data if we believe it is necessary to comply with the law or to protect the security of our website or third parties from fraud.

6. Protection of your personal data

6.1 What do we do to protect your data?

We are aware of the importance of data security and data protection. We have therefore designed the platform to be as secure as possible. We have put in place appropriate security measures. This includes technical and organisational measures against unauthorised access, improper use, alteration, unlawful or accidental destruction and accidental loss, both online and offline.

If personal data that is not already public is transferred to a country without adequate data protection, we ensure adequate data protection by using sufficient contractual guarantees, namely on the basis of the EU standard contractual clauses, binding corporate rules, or we rely on the exception of consent, contract performance, the establishment, exercise or enforcement of legal claims, overriding public interests or because it is necessary to protect the integrity of a data subject. Where applicable data protection law provides for this, you can obtain a copy of the contractual guarantees relating to your personal data from our data protection officer at Huggett@bmwbike.com or find out where such a copy can be obtained. We reserve the right to redact such copies for data protection or confidentiality reasons.

Furthermore, we must point out that, despite all our efforts to protect your personal data from possible risks and dangers on the Internet, there is no absolute security. We therefore ask you to support our IT security efforts and not to disclose any sensitive data or data that is not required in a specific case. You can also help us protect your personal data by logging out when you leave an area protected by user login.

6.2 Storage of your data

We store personal data for as long as it is necessary for the purpose for which we collected it. Individual pieces of personal data are also subject to legally binding retention obligations of ten or more years, which we are required to comply with. We may also store personal data for at least the duration of the applicable limitation periods, which are generally five or ten years. Personal data that is collected in connection with the use of our software (e.g. logs, analyses, etc.) and that is not subject to such retention or limitation periods is generally deleted earlier, as soon as we no longer have an interest in processing it. Data may also be stored in anonymised form for longer periods. Unless expressly agreed in a contract, we are not obliged to store data for a specific period of time.

7. Sending emails to you, links to other websites

7.1 Sending emails

We may send you emails for various reasons, for example:

  • You have registered on the platform and will receive notifications about course registrations, course announcements and course implementation, etc.
  • We contact you regarding an enquiry you have made to us.
  • We would like to send you important information, such as updates, data protection notices, warnings, etc.
  • You have subscribed to our newsletter and/or registered to receive other marketing information.

8. Your rights in relation to personal data

You have the right to obtain information about the personal data we hold about you free of charge upon request. In addition, you have the right to correct inaccurate data and the right to delete your personal data, provided that there is no legal obligation to retain it or a legal basis that allows us to process the data. The exercise of such rights generally requires that the data subject can clearly prove their identity.

If the processing of personal data is based on consent, you as the data subject can revoke your consent at any time. In EU or EEA countries, you have the right in certain cases to receive the data generated when using online services in a structured, commonly used and machine-readable format that allows for further use and transfer. Requests relating to these rights should be sent to hugget@bmwbike.com (see section 2 above).

We reserve the right to restrict your rights within the scope of the applicable law and, for example, not to provide complete information or not to delete data. We also draw your attention to the fact that if you delete your personal data, our services will no longer be available or usable in whole or in part.

Every data subject has the right to lodge a complaint with the competent data protection authority. In the case of a controller in Switzerland, this is the Federal Data Protection and Information Commissioner (


http://www.edoeb.admin.ch

http://www.edoeb.admin.ch).

9. Data processing

9.1 Responsible body

If you provide us with personal data that we process as a data processor, you remain the sole responsible party in relation to us within the meaning of data protection law. You are therefore responsible for the legality of the collection, processing and use of this personal data in accordance with the statutory provisions.

9.2. Additional provisions on order data processing

9.2.1. We process the personal data you provide us with for processing (in particular names and contact details, data on the relationship between you and your contractual partner, other characteristics relating to these persons and any other personal data you provide us with in connection with the contractual use of our services) during the term of the contract for the purpose of providing the contractual services. We store and process this personal data on our systems on your behalf.

9.2.2. Subject to mandatory legal provisions, we process personal data exclusively for the performance of the contract, only for the purposes and only in accordance with your documented instructions. Your instructions are primarily derived from the contract between us and you and from the manner in which you use our services.

9.2.3 We ensure that all persons authorised by us and by third-party service providers to process personal data are bound to confidentiality unless they are subject to an appropriate statutory duty of confidentiality.

9.2.4 We implement appropriate technical and organisational measures to protect personal data in accordance with the requirements of the Swiss Data Protection Act and Art. 32 of the European General Data Protection Regulation (GDPR).

9.2.5 We will support you, as far as reasonably possible, with appropriate technical and organisational measures in fulfilling the information obligations towards the data subject in accordance with the applicable data protection law. We will also respond to your enquiries regarding the rights of the data subject.

9.2.6 We will inform you immediately if we believe that any of your instructions regarding the processing of personal data may violate applicable data protection law.

9.2.7 We will support you in relation to your obligations under applicable data protection law, for example Articles 32 to 36 GDPR or the corresponding provisions of Swiss data protection law. We will also inform you immediately of any data breach within our area of responsibility.

9.2.8 We will provide you with the information you reasonably require to enable you to adequately document our compliance with the provisions of this Section 9.2. Where this is mandatory under applicable data protection law and the information provided by us is not sufficient, we will allow you, to the extent required by law, to carry out inspections yourself or through an auditor accepted by us, appointed by you and bound to secrecy, at your expense. You agree that such inspections shall not interfere with the normal course of business at our premises and those of the subcontractors concerned. Such inspections shall also only be carried out after prior consultation with us and during normal business hours. Finally, such inspections must not compromise the protection of secrets and personal data of other customers of ours.

9.2.9 We may outsource the processing of personal data to third parties (‘subcontractors’), in particular for the purposes of operating, developing and maintaining the IT infrastructure used to provide the services. You hereby consent to such outsourcing. A current list of the subcontractors we use is available here. We are entitled to make changes to this list and will inform you of such changes in an appropriate manner (e.g. by publishing a revised list on our website). If you do not object to such a change within 15 days (or within a shorter period specified by us in urgent cases) of the date of notification, your consent to the change shall be deemed to have been given. If you object to a change notified by us in good time, we may, at our discretion, either refrain from implementing the change you have not accepted or terminate the contract with you with immediate effect.

10 Changes to this privacy policy

As our business activities are subject to constant change, we will regularly revise our privacy policy. We may amend the privacy policy at any time to reflect changes in the law, changes in the way we handle data or adjustments to our business activities. The updated privacy policy will be published at


http://www.bmwbike.com

www.bmwbike.com.

© Mark Huggett GmbH, Version 001.02 / March 2022

Only the German version is valid.