DATA PRIVACY POLICY.

C. CHRISTODOULOU LEFKOSIA PREMIER CARS LTD, located at Kilkis 1, Latsia, 2234, Cyprus (the "Repairer") is the person responsible for the processing of your personal data. The Dealer is an independent business and does not belong to the BMW Group, but operates by using the BMW Group's brands under the right to distribute and provide service in relation to the Group's products. Please consult the BMW Hellas Car Dealers SA Data Protection Policy. ("BMW Hellas") or the BMW Austria Bank GmbH - Athens branch ("BMW FS") in connection with the processing of personal data by such companies of the BMW Group. This Data Protection Policy and its terms may be updated from time to time, so you should keep up to date with its content and check for any changes.

The Repairer processes your personal data, including in the following cases:

• When you contact us directly, e.g. through the Merchant Website to request information about BMW Group products or services.
• If you buy a product or service directly from us.
• If you respond to our actions for direct marketing, e.g. by filling out a response card or entering web data into our site.
• If your personal data is transmitted to us by BMW Group companies or other third parties.
• If other business partners lawfully transmit your personal data to us.
• Occasionally, from third parties, who may legally provide us information about you or whose files we may legally have access to.

If you provide personal data on behalf of a third party, you should ensure that that third party is aware of this Privacy Policy beforehand.

If you are under 16, you should not give us any information about you unless you have the consent of the person in charge of your parental responsibility.

Please help us keep your information up-to-date by informing us of any changes to your personal data.

The following categories of data about you may be collected and processed:

• Contact Data ► - name, title, initial, address, telephone numbers, email address, no. fax.
• Personal Information ► - ID or passport number, tax ID, date of birth, gender, nationality, marital status, family members, driving license (type), education, occupation, test drive, hobby, preferred payment method , preferred communication channel, no. Chassis (VIN), company name.
• Interests ► - information you provide us about your interests, including the type of vehicle you are interested in.
• Use of Website & Contact ► - how you use our site and whether you open or promote our communications, including information collected through cookies (our Cookies Policy available here specifies the details).
• Sales and Service Information ► - information related to purchases, including customer ID, contract data (eg contract number, services offered such as support and repair services), information on receiving financing from BMW FS, data conduct of transactions (eg transactions, payments, complaints).
• Historical Client Information ► e.g. customer satisfaction rates, offers received, vehicle purchase data including model, configuration, purchase date, date of registration, license plate number, order date, delivery date, vehicle owner, purchase price, warranty information, residual value (residual value), optional insurance information (eg household vehicles, use of mobility services), purchase of spare parts, accessories and lifestyle products, data collected were selected during visits to the Merchant Store (eg requests, consulting, sales consultant, repair history), campaign history / campaign results, complaints history, repair history.
• Using Device and Service ► how to use your device (mobile or vehicle) and the service provided on the device.
• Vehicle Configuration Details ► information about the characteristics and current settings of your vehicle (as identified by Vehicle Chassis Number (VIN)).
• Vehicle Technical Information ► Information about the performance, today or in the past, of the engine and the systems in the vehicle, fuel level, remaining distance (free flow), RTTI data (navigation input data), outside temperature, mileage, average speed.
• Vehicle / Device Location Information ► the location of your vehicle or mobile device.
• Health data in the context of the sale of vehicles to people with disabilities, in accordance with the law.

The use of personal data in accordance with European Union data protection law must be based on one of the "legal bases" and we must identify the legal processing bases with respect to any use of data under this Privacy Policy. Data. An explanation of the legal processing bases is available at the bottom of this page. The legal basis for the processing of any use of your data is stated next to each processing purpose.

Customer Support & Marketing - to answer queries and keep up to date on our news and offers [Article 6 (1) (a) and 6 (1) (f) CPG]

κευ The Repairman collects Contact Data, Personal Information and Interests, Historical Customer Information, Website and Contact Usage Data and may use Sales and Service Information, Vehicle Configuration Details and Vehicle Technical Information to determine which news and trends they may also be more interested in contacting you about these offers, according to your marketing preferences. The Repairer may disclose this information to BMW Hellas and the BMW FS to respond to your requests and submit more specific - for you - bids.

Consensus on marketing can be revoked at any time, with effect for the future.

Vehicle Sales & Service - to process the sale, configuration and service of your vehicle to you [Article 6 (1) (b) and 6 (1) (f) CPC]

Επισ The Repairman will receive Contact Data, Vehicle Configuration Information, Vehicle Technical and Sales and Service Information, and Customer History Information when you purchase a vehicle or perform maintenance or repair work on it as part of the sale. or service, including warranty requirements and controls, and will use this information to provide you with the services you require and to inform you about issues related to your vehicle. BMW Hellas and BMW AG may access this information to resolve technical or other issues related to the provision of such services.

The above processors may also receive limited Vehicle Location Information during the service repair process, which will only be used in accordance with Location Information Security Measures .

Provision of personal data in the context of Sales & Service of Vehicles is a contractual obligation and failure to provide this will interfere with or make the contract improper.

Compliance with binding requests for your data - to comply with our legal obligations with police, regulatory and judicial authorities and services [Article 6 (1) (c) CCG]

► The Repairman is subject to the laws of Greece and is obliged to comply with those laws. This compliance includes providing your information to police, regulatory and court authorities, as well as third parties in connection with litigation or investigations anywhere in the world, when required. Where permitted, we will forward any such request to you or let you know before responding unless our risk would be to deter or detect criminal activity.

The provision of personal data for the purpose of complying with binding requests for your information is a legal obligation that is subject to that request.

Personal data may be transmitted to third parties, provided that the legality of the transfer is justified.

Your personal data may be transmitted to the following categories of recipients:

• Any person who may process your personal data under our instructions and on our behalf.
• BMW Group Companies, including BMW AG (München Petuelring 130, 80788 Munich, Germany), BMW Vertriebs GmbH, BMW Austria Leasing GmbH, BMW Austria Bank GmbH, Siegfried-Marcus-Straße 24, 5021 Salzburg, Austria, and other BMW Group companies, within their competence and in accordance with the law on international data transfers, if applicable.
• Partners and Authorized Workshops.
• Merchants that provide Merchant Services, such as IT Maintenance, IT Hosting, Customer Interaction Center providers.
• Any supervisory authority, as required by the applicable supervisory framework.
• Any public or judicial authority where required by law or judicial decision.

Although data transmission through the Internet or a web site cannot be guaranteed to be protected from cyber attacks, both we and our subcontractors and our partners work hard to maintain physical, electronic and procedural security measures for protect your data in accordance with applicable data protection requirements.

All information about you is stored on secure servers of ours or our subcontractors or affiliates (or secure hard copies) and access to and use of them is subject to our security policies and standards (or equivalent standards) of our subcontractors or partners).

We safeguard your data with the latest technology. For example, the following security measures are used to protect your personal data against unauthorized use or any other form of unauthorized processing:

• Access to personal data is limited to a limited number of authorized persons for these purposes only.
• The collected data is transmitted only in encrypted form.
• In addition, sensitive data is only stored in encrypted form.
• IT systems used to process data are technically isolated from other systems to prevent unauthorized access, for example through hacking.
• In addition, access to these IT systems is monitored on a permanent basis to detect and prevent illegal use at an early stage.

If we give you (or have selected) a code to access certain parts of our site or any other web portal, applications or services we offer, you are responsible for keeping that code confidential and complying with it. with any security procedures we have informed you about. We ask that you not share the password with anyone.

Some information can only be provided when you publish your location or the location of your vehicle. We take the privacy of such location information very seriously. The following security measures apply to Location Information (including information available as part of the vehicle service procedure):

• Keep them only in a form that is relevant to you or your vehicle for as long as necessary to fulfill the purpose to which you have consented.
• Only obtain or access them in such form, where necessary to provide the requested service or where required to comply with and / or provide by law (and where required to provide information to police authorities or to any other third party, we will notify you unless such action would jeopardize the prevention or detection of criminal activity or if we are not permitted to do so).
• Vehicle Location Information and Device Location Information are not linked unless required to provide the service requested.
• Any other use of the Location Information for analysis purposes will be made on data sets that have become anonymous.

BMW Hellas and the BMW FS may access Vehicle Location Information, and BMW AG may access Device Location Information through the services they provide (eg ConnectedDrive).

You will be given a detailed description of the location information obtained to provide location-dependent service when you first purchased the vehicle or activated or configured the service or application (e.g. ConnectedDrive or Connected App). Please note that we may be unable to provide you with some of our features if you restrict the collection of your location information.

We store your personal data for as long as it is required by the respective processing purpose and any other permitted linked purpose (for example, where it relates to a defense that has been filed against us). Therefore, in the event that data is used for two purposes, we will retain it for as long as the purpose expires, but we will stop using it for the purpose for the shortest possible time, as that time expires. Information that is no longer needed is either irreversibly anonymous (and information that has become anonymous can be retained) or is safely destroyed.

In particular, the data relating to you is maintained throughout your relationship with the Merchant and, after such termination, for as long as the applicable law provides that claims may be made by either party or , in the event of a claim being made, until any dispute is irrevocably resolved. Especially for data that we process about you with your consent (e.g. for marketing purposes), this is kept from receiving and until you withdraw your consent.

We restrict access to your data to anyone who needs to use it for this purpose.

Your personal data is preferably processed within the European Union. When processing data about you outside of the European Union, we will ensure that your personal data is processed under appropriate security guarantees.

Some countries outside the European Union, such as Canada and Switzerland, have already been formally regarded by the European Union as countries that provide an adequate and comparable level of data protection. Therefore, the transmission of data to these countries does not require any special authorization or agreement.

In countries for which no decision has been taken, such as India or Japan, we will either ask for your consent to the transfer or we will transmit the data on the basis of contractual clauses approved by the European Commission imposing corresponding protection obligations data directly to the recipient, unless permitted by applicable data protection laws, to make such transfers without complying with these formalities.

For any issues regarding the processing of your personal data and the exercise of the above rights, you may contact the Repairman by telephone at +357 22 815100 Monday - Friday 8:00 AM - 1:00 PM, 2:00 PM - 5:30 PM, by email: This email address is being protected from spambots. You need JavaScript enabled to view it. and by mail to: Kilkis 1, Latsia, 2234, Cyprus

You can also contact your data protection officer here .

You have the right to request access to your personal data, correction / deletion of your personal data, restriction of processing, the right to object to the processing and / or the exercise of your right to data portability.

If data processing is based on your consent, you can revoke your consent at any time, with future validity.

The Repairman will review your request and respond to you within one month of receiving the request or, given the complexity of the request and the number of requests, within two months.

If you are dissatisfied with our use of your data or our response to the exercise of your rights above, you are entitled to file a complaint with the Supervisory Authority.

If you have any questions about our use of the information regarding you, please contact:

Use of the information relating to you as described above is permitted under European Union data protection law under the following legal conditions:

• You have consented to the use (you will be given a consent form for any such use and you may revoke your consent).
• When necessary to conclude or enforce a contract between us.
• When used they are necessary to comply with our legal obligations.
• When they are needed for the purposes of our legitimate interests and our interests take precedence over your data protection rights (our legitimate interests include maintaining the highest level of product and service sales).
• When necessary to support, bring or bring legal action against you or a third party.

There may be uses permitted on other legal grounds. In this case, we will determine the legal basis and inform you as soon as we know of this new treatment base.