Privacy Statement English

BMW Financial Services Nederland B.V. (trading under the name Alphabet) is a service provider in mobility solutions. BMW Financial Services (hereinafter BMW FS) collects and processes personal data, as well as controls the data processing if such is performed by a third party provider. Most of the processed data relates to the provision of our mobility solutions to customers, such as the possibility of leasing a car, LCV or even a bicycle, but also the provision of a mobility card and car rental. The data we process includes data of customers (employers), their employees and company directors and/or representatives of (potential) business partners. In the case of B2E (Business to Employee) and private lease, we also process data of our customers. This Privacy Statement applies to personal data we receive from and about these individuals.

Processing of your personal data already starts with the acquisition process for the lease vehicle, making a quotation for the lease vehicle and the decision to order/accept said lease vehicle. For this purpose, we receive personal data from your employer or from you yourself as an employee/private lease customer. This is followed by many other times when your personal data is processed, for example, if your vehicle is involved in an accident, if damage needs to be repaired or if we receive traffic fines for your vehicle. We also process your personal data for our additional services, such as the provision of a fuel card, mobility card, roadside assistance and car rental.

We understand that the use of your personal data requires your trust. We will therefore maintain the highest possible data privacy standard and use your data only for clearly described purposes and in accordance with your data privacy rights.
In the following sections this Privacy Statement describes how Alphabet collects, processes and uses the personal data of its (potential) customers and users of our mobility solutions. The present privacy statement is based on and fully aligned with the legal provisions contained in the General Data Protection Regulation (GDPR).

Alphabet may change this Privacy Statement (last update 05 November 2025). We recommend that you consult this Privacy Statement periodically, and whenever you provide personal data to Alphabet (again). When Alphabet makes an important change that has consequences for the processing of personal data by us, Alphabet will inform you of this by means of a notification on our website.

BMW Financial Services Nederland B.V. (trading under the name Alphabet), who has its registered office at Takkebijsters 59, 4802 HW Breda is the data controller of your personal data.

Alphabet also has various rent branches in Amsterdam, Boxtel, Breda, The Hague, Nieuwegein, Rotterdam and Zwolle. In addition, Alphabet uses a collection centre in Breda to collect all lease vehicles whose lease term has expired, or vehicles which are temporarily parked/suspended at the Breda location.

Alphabet and BMW FS are a part of the BMW Group AG. On this basis, we may share our customers’ data within the BMW Group. Alphabet International is the parent company of Alphabet. We may also share your data with this entity. Alphabet is responsible for the data processing of our customers’ data, which is processed through the following websites:

Corporate car-sharing websites:

Additionally, Alphabet processes the data collected from our customer portal My Alphabet and our mobile applications such as the Alphabet Carbon Tracker, Fleet Reporting and the Alphabet App.

Alphabet will process your personal data if it is transferred by Sales Partners and Service Partners such as service stations, breakdown assistance, dealerships. The Sales Partners and Service Partners are responsible for the processing of personal data provided by you in connection with the provision of services. Likewise, Alphabet may also provide your personal data to a Sales Partner or Service Partner if such is necessary. In addition, a Sales Partner or Service Partner may collect other personal data. We recommend that you consult the Privacy Statement of the relevant Sale Partner or Service Partner before providing your personal data.

Alphabet collects and processes your personal data, inter alia, in the following cases:

When your employer uses Alphabet as a leasing company and has communicated your personal data to us for the purchase of products or services;
When you contact us directly, for example via our website, via the drivers’ desk or via My Alphabet, via Alphabet Assistance for damage and SOS/breakdown assistance and if we have received your personal data via dealers/sales partners because you are interested, for example, in our products or services or if you have questions;
When you purchase products directly from us (e.g. via the Alphabet.com website, configurator.alphabet.com);
When you purchase mobility services from us (e.g. Alphabet Carbon Tracker, Carbon Manager, Fleet Reporting, Alphabet Flexible Fleet, Alphabet Bicycle Lease, Alphabet Share, Alphabet Private Lease or Pool management);
For maintenance and/or repair of your vehicle at a service partner's facility;
When you request information about our products and services (e.g. by sending a brochure or price request);
When you respond to our direct marketing actions, for example, when you fill out a reply card or provide your personal data online on one of our websites;
When your personal data is forwarded to us by service partners or third parties;
When we prepare (management) reports on the services your employer purchases from us we use your personal data in these reports (e.g. Fleet Reporting and the Alphabet Carbon Tracker.
When we receive personal data on fuel consumption, traffic and parking fines, claims management, or insurance information from you or our service partners as part of the provision of services;
When you provide us with your vehicle data (registration number/vehicle identification number), in the context of the services and maintenance and repair activities of our authorized workshops/dealer locations;
When other BMW Group entities or business partners provide us with your personal data in a permitted manner;
When third parties (such as authorized resellers) make personal data of you available in a permitted manner.

We kindly ask you to help us keep your personal data up to date by informing us of changes to your personal data, in particular your contact, name and address details. This allows us to remain compliant with the GDPR and ensure the appropriate security and safety of your personal data.

Alphabet may collect the following information from you:

Contact information: first name, last name, address, phone number, email address (and the one of the employer if applicable);
Interests: information you have provided about interests e.g. for vehicles;
Other personal data: information you have provided such as date of birth, gender, education, household size or occupation;
Contract data: customer number, contract number, lease amount, VIN number, license plate number, contract start and end date;
Additional examples: mobility vehicle fleet data in customer portal (e.g. Fleet Reporting, 360 Fleet Portal, Alphabet Carbon Tracker, Carbon Manager, Alphabet Flexible Fleet, or Alphabet Share) describing all your relevant contract-related data for (international) customer reporting services, such as contract number, license plate number, chassis number, make/model, contracted delivery period and mileage, CO2 emissions, customer cost centre, required IFRS 16 data, actual mileage incl. deviations, expected contract expiration date, fuel consumption (expected versus actual), penalty statistics, service and maintenance statistics).
Data related to your online account: account information in customer portal (My Alphabet) and payment data you have set up (e.g. bank account number);
Website use and communication: Information about how you use the website and whether you open or forward messages from us, including data collected through Cookies. More information about Cookies can be found in our Cookie statement.
Transaction and interaction data: Maintenance data, fuel consumption (in case of a fuel card), damage data, information about purchases of products and services, interaction with drivers’ desk and/or sales support (your requests and complaints) and (sales) partners and dealerships, as well as participation in market surveys;
Data relating to the assessment of your creditworthiness and identity*: data to establish your identity (e.g. driving license). For the assessment of creditworthiness we process your personal data such as a pay slip, IBAN data; information on fraud, criminal offenses, suspicious transactions, information on PEPs and sanction lists containing your data.

*Alphabet tests your financial position prior to accepting the application. We do this to form a picture of any payment risks. It helps us determine whether we can enter into an agreement with you and what terms and conditions apply.

For all natural persons (including owners of Sole Proprietorships, General Partnerships or Commercial Partnerships) we do a test at the Bureau of Credit Registration (Dutch: Bureau Krediet Registratie (BKR)). We also register your agreement with BKR if it has been concluded.

Is it a legal entity? Then we request access to your company data and provide the data of the underlying natural person (owner / UBO) to Economic Data Resources B.V.(EDR). EDR checks your personal and financial data and provides us with a credit information report with a risk profile.

Your personal data are stored by Alphabet, and it uses your data only for the purpose of providing a quotation. If you wish to convert the quotation into an application, your data will also be used for the application. We may request additional data from you during the application process.

Data relating to the use of Alphabet Apps and services: data relating to your use of Alphabet's apps (on your cell phone) Alphabet App/Alphabet Share.
Vehicle technical data: data created and/or processed in the vehicle used by you. To protect the privacy of our customers, the processing of technical data is generally specific, without direct reference to the customer.
Online services (from third parties): If your vehicle is connected to a cell phone network, this can be used to exchange data between your vehicle and other systems. Connection to the cell phone network is made possible by the vehicle's own transmitter and receiver or a mobile device (such as a smartphone) that you carry in the vehicle. Over this cell phone network, online functions can be used. This includes online services and applications/apps provided by the manufacturer or other providers. If you use these services, these services are the responsibility of the respective provider and are subject to the data protection terms and conditions of use of this provider. Alphabet has no influence on the data exchanged via these services. In this regard, you must obtain information from relevant third party from whom you purchase the service about the nature, scope and purpose of the collection and use of personal data as part of the service from these third parties.
Data for the purpose of locating the vehicle: If the agreements in the lease contract are not fulfilled or if there is a court order allowing us to retrieve the car, we have the right to search and locate the car using the functionality built into the car. Locating the car may mean that we process personal data. For example, a location or address.

Alphabet does not have access to operational data in the vehicle, data on comfort (e.g. position of seat and steering wheel) and infotainment. If you would like to access this data, please contact the make of your vehicle. Contact details can be found in the Privacy Statement of the respective brands.

* For all our business mobility solutions, Economic Data Resources B.V. is used for financial verification and acceptance.

More information about the processing of your personal data can also be found in EDR's privacy statement. This statement also explains how you can exercise your rights, such as rights of inspection, objection, correction and deletion.

Alphabet will only process your personal data if this is necessary for our services. We process your personal data based on the following lawful bases:

1. Consent (Article 6(1)(a) GDPR):

Marketing use - to promote Alphabet services and share news and offers with you and tailor them to your profile,
Research and development of our products and services to deliver even better services through surveys,
All uses for which we require your consent are listed in your dashboard in My Alphabet.

! You can always change or withdraw your consent towards individual data processing activities in your My Alphabet App!

2. For entering into or performing the agreement (Article 6(1)(b) GDPR):

(This also extends to the agreements with you or your employer)

Assessing your creditworthiness[1];
To deliver a mobility solution;
For properly handling repair, maintenance and tire change according to the agreement.
Research and development of our products and services to provide even better services;

[1] For our business mobility solutions, Economic Data Resources B.V. is used for financial verification and acceptance. More information on the processing of your personal data by EDR can be found in EDR's privacy statement. It also explains how you can exercise your rights, such as right to inspection, objection, correction and deletion

3. Legal obligation (Article 6(1)(c) GDPR):

To respond to binding requests from authorities or regulatory parties.

4. Vital interest (Article 6(1)(d) GDPR):

In the context of roadside assistance.

5. Legitimate interest (Article 6(1)(f) GDPR):

In connection with the prevention of fraud and criminal activity - to protect our organization and society from crime and its consequences.
Research and development of our products and services to provide even better services through surveys;
If the agreements in the lease contract are not fulfilled or if there is a court order allowing us to retrieve the car, we have the right to search for the car using the tracking systems built into the car.

Operational Lease (general)

This can involve the operational leasing of a car, but also an LCV, an Alphabet Bike (folding bike), scooter or motorcycle. Here the client pays an agreed monthly amount (which includes the lease period and number of miles driven). Full operational lease includes operational costs, such as maintenance, repair, insurance, replacement/change of tires, etc.

If you purchase this mobility solution, we process the following personal data:

From the customer (employer): name and address details company, company telephone number, company e-mail address, Chamber of Commerce number and bank account number, initials and surname, e-mail address and telephone number of contact persons.
From board members and/or signing agents: initials and last name, date of birth, address and residence, phone number, driver's license number. We use this personal data to contact you about your agreement with Alphabet, about the underlying individual lease contracts and to verify signing authority.
From the driver of the vehicle: initials and last name of rider, gender (optional), date of birth, address and residence, mobile number, e-mail address (business and/or private), cost centre, employee number, indication of business/private use, lease category, date in service and out of service, date of start of lease, distribution of annual mileage, as well as the registration number of your leased vehicle.

Sharing with third parties:

Personal data, such as initials and last name, address and city, mobile number, email address, employer, license plate number and lease contract are shared with dealers/sellers for delivery of your vehicle/LCV/bicycle.
Personal data such as information about the desired vehicle and pre-calculated lease price, your first and last name, address and residence, telephone number and e-mail address are shared with Economic Data Resources B.V.;

Basis for processing: We use this personal data for the performance of our lease contract with you, for providing reports to your employer, and for fulfilling our legal reporting obligations to the tax authorities.

Alphabet Carbon Manager

In collaboration with our Carbon Accounting Software partner Plan A, Alphabet has developed the Carbon Manager. This intuitive software solution is designed to accurately measure, document and manage a fleet's emissions. Our consultants can use this data and insights to help create strategic initiatives to reduce fleet carbon emissions and reduce the organization's carbon footprint.

If you use this mobility solution, we and the app provider process the following personal data:

From the customer (employer): contact details company, phone number company, email address company, VAT number and bank account number, first and last name, email address and phone number of contact persons.
From board members and or signing authorizations: initials and last name, email address, phone number and identification data, we use this personal data to contact you about our cooperation and to verify signing authority.

Basis for this processing: performance of our agreement with you and legitimate interest.

Purpose of processing: We use this personal data to register your reservation in the system, to settle our contractual agreements with the client (your employer) and to produce management reports. In doing so, we will of course handle privacy-sensitive data such as location data with care (see also Security measures and location data).

Alphabet Carbon Tracker

For organizations with 100 or more employees, it is mandatory to comply with the carbon reporting requirement, which includes the recording of staff commuting and business travel. With the Alphabet Carbon Tracker, Alphabet offers a simple solution to understand business mobility, allowing you to manage these obligations effortlessly.

If you use this mobility solution, we and the app provider process the following personal data:

From the customer (employer): contact details company, phone number company, email address company, VAT number and bank account number, first and last name, email address and phone number of contact persons.
From board members and or signing authorities: initials and last name, email address, phone number and identification data, we use this personal data to contact you about our cooperation and to verify signing authority.
Of the driver of the vehicle: initials and surname, date of birth, address data, mobile phone number, business email address, cost centre, employee number, photo, driving license number, as well as vehicle data such as license plate and VIN number.

Basis of processing: Performance of our agreement with you and legitimate interest.

Purpose of the processing: We use these personal data to register your reservation in the system, to settle our contractual agreements with the customer (your employer) and to produce management reports. In doing so, we will of course handle privacy-sensitive data such as location data with care (see also Security measures and location data).

Alphabet Consulting

Alphabet Consulting provides Alphabet client companies with expertise in the field of mobility. Our expert staff delves into a company's needs and informs about the latest laws and regulations.

If you use this mobility solution, we and the app provider process the following personal data:

From the customer (employer): contact details company, phone number company, email address company, VAT number and bank account number, first and last name, email address and phone number of contact persons.
From board members and or authorized signatories: initials and last name, email address, phone number and identification data, we use this personal data to contact you about our cooperation and to verify signing authority.

Basis of the processing: Performance of our agreement with you and the legitimate interest.

Purpose of processing: We use this personal data to register your reservation in the system, to settle our contractual agreements with the client (your employer) and to produce management reports. In doing so, we will of course handle privacy-sensitive data such as location data with care (see also Security measures and location data).

Alphabet Bicycle Lease

Bicycle leasing is an option to replace all or part of your travel allowance with a (electric) bicycle. The present product makes it possible to use a (electric) bicycle for commuting to and from work. The employee then does not have to buy a bicycle himself. Alphabet offers bicycle lease in cooperation with Fietsvoordeelshop.nl, one of the largest bicycle stores in the Netherlands with its own service network.

If you use this mobility solution, we and the supplier of the app process the following personal data:

From the customer (employer): contact details company, phone number company, email address company, VAT number and bank account number, first and last name, email address and phone number of contact persons.
From the driver of the vehicle: initials and last name, date of birth, address information, mobile phone number, business email address, cost centre, employee number, photo, driver's license number, as well as vehicle information such as license plate and VIN number.
Of board members and or signatories: initials and surname, email address, phone number and identification data, we use this personal data to contact you about our cooperation and to verify signatory authority.

Basis of the processing: Performance of our agreement with you and the legitimate interest.

Purpose of processing: We use this personal data to register your reservation in the system, to settle our contractual agreements with the client (your employer) and to produce management reports. In doing so, we will of course handle privacy-sensitive data such as location data with care (see also Security measures and location data).

Alphabet Financial Lease and Alphabet Flex Finance

Alphabet Financial Lease and Alphabet Flex Finance are business financing with a fixed term and interest rate. You can pay a fixed amount each month for your car. If you take out this mobility solution, we process the following personal data from you:

From the customer/driver of the vehicle: we may collect the following categories of personal data, among others:

Contact data: name, phone number and email address.
Contract details: customer number, contract number.
Vehicle data: license plate number, chassis number, make and model.
Other personal data: information you have provided regarding your date of birth and gender.
Transaction and interaction data: information about concluding and entering into products and services, interaction with our customer service (your requests and complaints) and dealers, as well as participation in market surveys.
Data relating to creditworthiness: information relating to your creditworthiness, transactions or payments that have not yet been made to us.
In the case of a legal entity? Then we request access to your company data and provide the data of the underlying natural person (owner / UBO) to Economic Data Resources B.V.(EDR). EDR checks your personal and financial data and provides us with a credit information report with risk profile.
Data related to geographical location vehicle: information related to the geographical location of your vehicle through vehicle tracking.

Sharing with third parties:

Personal data such as information about the desired vehicle and pre-calculated lease price, your first and last name, address and residence, telephone number and e-mail address are shared with Economic Data Resources B.V.;

Basis for processing: We use your personal data for the performance of the agreement with you, compliance with legal obligations and legitimate interest.

Purpose of processing: We process the mentioned data to be able to provide you with the requested service. Other purposes for processing personal data may include ensuring product quality, research and development of new products or services and promotional communications.

Alphabet Flexible Fleet

Alphabet Flexible Fleet is a Corporate Car Leasing product of Alphabet. Flexible Fleet makes it easier for employers to offer more flexibility to employees with employer leases. During the term of a lease agreement, Alphabet Flexible Fleet allows employees to change cars twice free of charge. Provided an employer has an agreement with Alphabet for Flexible Fleet, employees can use a web portal to log in to request a different car. All activities for this service are fully managed by Alphabet.

If you use this mobility solution, we and the app provider process the following personal data from you:

From the customer (employer): contact details company, phone number company, email address company, VAT number and bank account number, first and last name, email address and phone number of contact persons.
From board members and or signing agents: initials and last name, email address, phone number and identification data, we use this personal data to contact you about our cooperation and to verify signing authority. For all our business mobility solutions, Economic Data Resources B.V. is used for financial verification and acceptance.
From the driver of the vehicle: initials and last name, date of birth, address information, mobile phone number, business email address, cost centre, employee number, photo, driver's license number, as well as vehicle information such as license plate and VIN number.

While using an Alphabet Flexible Fleet vehicle, time of departure, arrival and mileage are recorded. Location data is recorded and can only be retrieved by the user for trip recording purposes. Unless your employer has a legitimate interest, as for example in case of suspicions of non-compliance with the terms of use, abuse or fraud.

Sharing with third parties:

Personal data such as information about the desired vehicle and pre-calculated lease price, your first and last name, address and residence, telephone number and e-mail address are shared with Economic Data Resources B.V.

Basis for processing: The basis for this processing is the performance of our agreement with you and the legitimate interest.

Purpose of the processing: We use this personal data to register your reservation in the system, to settle our contractual agreements with the client (your employer) and to produce management reports. In doing so, we will of course handle privacy-sensitive data such as location data with care (see also Security measures and location data).

Alphabet Fleet Reporting

The Alphabet Fleet Reporting tool gives fleet managers who have a contract with Alphabet and use Fleet Reporting instant insight into and about the fleet through intuitive reports and A-driven dashboards. The insights provided by the tool help companies save costs, increase efficiency and make the right strategic choices. The AI assistant within Fleet Reporting also allows you to navigate your fleet data smarter, faster and more efficiently.

If you use this mobility solution, we and the app provider process the following personal data:

From the customer (employer): contact details company, phone number company, email address company, VAT number and bank account number, first and last name, email address and phone number of contact persons.
From board members and or signing authorizations: initials and last name, email address, phone number and identification data, we use this personal data to contact you about our cooperation and to verify signing authority.

Basis of processing: Performance of our agreement with you and legitimate interest.

Purpose of processing: We use this personal data to register your reservation in the system, to settle our contractual agreements with the client (your employer) and to produce management reports. In doing so, we will of course handle privacy-sensitive data such as location data with care (see also Security measures and location data).

Alphabet Mobility Budget

This mobility solution gives you (via your employer) the option of a monthly budget. This allows you to choose how you will travel. You can use public transport, a shared car or scooter, a bicycle or a leased vehicle. The mobility budget moves with the need for transport which ensures flexibility and efficient use of means of transport. This mobility solution allows you (via your employer) to manage (or have managed) all types of mobility offered by Alphabet online. All types of mobility offered by Alphabet can be incorporated in this solution. It is also possible to manage mobility purchased from third parties (NS Business Card with services such as bus, streetcar, metro, OV-fiets, NS Bicycle Parking, cab, GreenWheels shared car and services that can be ordered separately, including a shared car, shared scooter, cab and cab app). Your employer can also use this mobility solution for workplace reservations or as carpool functionality.

If you use this mobility solution, we process the following personal data:

From the customer (employer): contact details company, company phone number, company email address, VAT number and bank account number, initials and surname, email address and phone number of contact persons.
From board members and/or signatories: initials and last name, email address, and phone number. We use this personal data to contact you and verify signing authority.
From the mobility user: first and last name, gender (optional), date of birth, address and residence, mobile number, e-mail address (business and/or private), cost centre, employee number. If a leased vehicle is used, this includes vehicle details such as registration number and VIN number.

Sharing with third parties:

We may share certain personal data such as company contact details and first and last name with external suppliers of mobility solutions (including Fynch, Mobility Concept, NS, MultiTankCard, Amber, Felyx, Uber, TCA cab). For more information, please contact relevant mobility providers.

Basis for processing: Performance of our agreement with you.

Purpose of processing: We process the mentioned data to execute the service you opted for.

Alphabet Pool Management

Alphabet Pool Management is a service that takes over the full management of a company's freely deployable lease cars. This applies to both cars and company cars. Alphabet takes care of all administrative tasks, transport, cleaning and maintenance of the cars so that they are ready for the next lease driver. The current supply of pool cars is available real-time online via MyAlphabet for both customer and drivers.

If you use this mobility solution, we process the following personal data:

From the customer (employer): contact details company, company phone number, company email address, VAT number and bank account number, first and last name, email address and contact phone number.
From the driver of the vehicle: initials and surname, date of birth, address details, mobile phone number, business email address, cost centre, employee number, photo, driving license number, as well as vehicle details such as license plate and VIN number.

Basis of processing: Performance of our agreement with you and legitimate interest.

Purpose of processing: The settlement of our contractual agreements with the customer (your employer) and the production of management reports.

Alphabet Private Finance

With Alphabet Private Finance, you finance your car privately for a fixed term and interest rate. This means that you pay the same fixed amount every month. You take care of matters such as maintenance, any repairs and insurance yourself.

If you purchase this mobility solution, we will process the following personal data:

From the customer/driver of the vehicle: we may collect and process the following categories of personal data, among others, for the performance of the agreement:

Contact data: name, phone number and email address.
Contract data: customer number, contract number.
Vehicle data: license plate number, chassis number, make and model.
Other personal data: information you have provided regarding your date of birth and gender.
Transaction and interaction data: information about the conclusion and conclusion of products and services, interaction with our customer service (your requests and complaints) and dealers, as well as information about participation in market surveys.
Credit data: information related to your creditworthiness, transactions or payments not yet made to us. It helps us determine whether we can enter into a contract with you and what terms and conditions apply.

For all natural persons (including owners of Sole Proprietorships / VOF / Partnership) we do a check with the Bureau of Credit Registration (Dutch: Bureau Krediet Registratie (BKR)). We also register your agreement with BKR if it has been concluded.

Is it a legal entity? Then we request access to your company data and provide the data of the underlying natural person (owner / UBO) to Economic Data Resources B.V. (EDR). EDR checks your personal and financial data and provides us with a credit information report with risk profile.

Data relating to geographical location vehicle: information relating to the geographical location of your vehicle through vehicle tracking.

Sharing with third parties:

Personal data such as information about the desired vehicle and pre-calculated lease price, your first and last name, address and residence, telephone number and e-mail address are shared with Economic Data Resources B.V.;

Basis for processing: Performance of the agreement with you, compliance with legal obligations and legitimate interest.

Other purposes for processing personal data may include ensuring product quality, research and development of new products or services and promotional communications.

Alphabet Rent

Alphabet also offers the option of renting a leased vehicle whether or not in conjunction with other products.

If you use this mobility solution, we process the following personal data:

From the customer (employer): company contact details, company telephone number, company e-mail address, VAT number and bank account number, first and last name, e-mail address and telephone number of contact persons.
From board members and/or signatories: initials and last name, email address, and phone number. We use this personal data to contact you and verify signing authority. All of our business mobility solutions use Economic Data Resources B.V. for financial verification and acceptance.
Of the driver of the vehicle: name, gender (optional), date of birth, mobile phone number, email address (business and/or private), cost center, employee number, as well as vehicle data such as the license plate and VIN data, rental period data.

Sharing with third parties:

We may share personal data such as contact information of customer (employer), first and last name and address information of driver of the vehicle with external rental companies engaged by us for rental (and possibly to deliver a rental vehicle).
Personal data such as information about the desired vehicle and precalculated lease price, your first and last name, address and place of residence, telephone number and e-mail address are shared with Economic Data Resources B.V.;

Basis for processing: We process these personal data for the performance of our agreement with you.

Alphabet Share

Alphabet Share is Alphabet's Corporate Car sharing product. Alphabet Share makes corporate car sharing easy and efficient. Employees can reserve and use an Alphabet Share car at any time using an app called Topology, provided by our partner Skopei. Key registration and other administrative actions associated with this process are automated. All activities are fully managed by Alphabet.

Alphabet is responsible for all your personal data processed through the websites:

If you use this mobility solution, we and the supplier of the app will process the following personal data:

From the customer (employer): contact details company, phone number company, email address company, VAT number and bank account number, first and last name, email address and phone number of contact persons.
From board members and or signing agents: initials and last name, email address, phone number and identification data, we use this personal data to contact you about our cooperation and to verify signing authority. For all our business mobility solutions, Economic Data Resources B.V. is used for financial verification and acceptance.
From the driver of the vehicle: initials and surname, date of birth, address details, mobile phone number, business email address, cost centre, employee number, photo, driving license number, as well as vehicle details such as license plate and VIN number.

While using an Alphabet Share vehicle: we record the time of departure, arrival and mileage driven. Location data is recorded and can only be retrieved by the user for trip recording purposes. Unless your employer has a legitimate interest, such as in case of suspicion of non-compliance with the terms of use, abuse or fraud.

For (management) reports: We provide monthly reservation statements to the employer on the use of the shared cars. We process only full name and business mail address.

Sharing with third parties:

Personal data such as information about the desired vehicle and pre-calculated lease price, your first and last name, address and residence, phone number and email address are shared with Economic Data Resources B.V.;

Basis for processing: The basis for this processing is the performance of our agreement with you and the legitimate interest.

Purpose of the processing: We use these personal data to register your reservation in the system, the settlement of our contractual agreements with the client (your employer) and the production of management reports. In doing so, we will of course handle privacy-sensitive data such as location data with care (see also Security measures and location data).

Alphabet Private Lease

With private lease, you can use a new car for a fixed amount per month. This monthly amount includes most of the costs associated with a car such as depreciation, repairs, maintenance, tires, insurance, vehicle tax, roadside assistance and, if necessary, replacement transportation.

If you use this mobility solution, only when there is a contract takeover, we process the following personal data:

From the customer/driver of the vehicle: initially data about the desired vehicle, your first and last name, address and residence, telephone number and e-mail address. We use this personal data to create an e-mail message in which we confirm your request for a private lease application and explain the next steps.

What do we need your data for?

Before we enter into an agreement with you, we want to form a picture of any payment risks. This is how we determine whether to enter into an agreement with you and what conditions we apply. For this purpose, we will also provide your personal data to EDR Credit Services B.V. , together with a lease price/lease term calculated by us on the basis of the car selected in the application form.

EDR Credit Services B.V. performs the financial assessment and acceptance for us. EDR uses the personal data we provide to send an e-mail message with a link to EDR's leasing portal - to upload personal data for this financial review. This review is subject to final acceptance by Alphabet.

For the financial review, EDR requires the following personal data from you:

Copy of driver's license;
Copy of named bank statements for the last month (showing income and living expenses);
Copy of most recent pay stub (if salaried);
Positive letter of intent/employer statement if temporary employment is involved;
Copy of benefit/pension statement if benefits and/or pension are involved,
Recent annual figures if there is income from own business;
If other income per month, proof of this:
Family situation;
Any financial obligations that are not apparent from BKR.

This personal data is stored in the Alphabet customer portal at EDR and are not forwarded to Alphabet.

We then collect the following personal data which we receive back from EDR: driving license number, date of birth, BKR score, application status, status change date, credit rating from EDR, advice from EDR, disposable income. In addition, we process data on your contract type (make, type of car and lease term) and after the conclusion of a lease agreement also vehicle data such as registration number and VIN number.

From your partner (as co-contractor) / guarantor (if applicable): first and last name, gender (optional), date of birth, address and place of residence. We process this personal data for completing the final acceptance after EDR's review and for entering into the lease contract with you.

Sharing with third parties:

Personal data such as information about the desired vehicle and pre-calculated lease price, your first and last name, address and residence, telephone number and e-mail address are shared with EDR Credit Services B.V. as described above;
Personal data such as name, registration number and vehicle details from the lease contract are shared with dealers/sellers for the delivery of your vehicle.
As a leasing company we are obliged, in case of entering into a private lease contract, to register the lease contract and your personal data and also those of your partner and/or guarantor (if applicable) with the Bureau of Credit Registration (Dutch: Bureau Krediet Registratie (BKR)).

Basis for processing: Basis for this processing is performance of our agreement with you, legitimate interest and compliance with our legal obligations.

Fuel card

If you take out a lease contract with Alphabet including fuel, you will receive a fuel card. We use both brand-related cards and non-brand-related cards.

If you use this product, we will process the following data:

From the customer (employer): company contact details.
From the driver of the vehicle: first and last name, email address, contract number, employee number, your fuel card number, vehicle registration number, refuelling date, information about the type of fuel, location of your refuelling, mileage and associated costs.

Sharing with third parties:

We share data such as company contact details, first and last name of mobility user with external suppliers of fuel cards. They are responsible for processing transaction data via the fuel card. You can find more information about this at the relevant fuel card suppliers.
We may share this personal data with our customer (your employer) through our customer portal / CRM system My Alphabet. In My Alphabet, reports will be made available to your employer containing information on the use of these services (except for location data - see 'How do we protect your personal data'); you yourself can also view your personal data on your refuelling transactions in My Alphabet.

Basis for processing: The basis for this processing is the performance of an agreement.

Mobility Pass

The Alphabet Mobility Pass is a card that allows your employer to allow you to use public transportation (train, cab, plane). This pass also serves as a fuel card. The Alphabet Mobility Pass is offered by Alphabet in cooperation with third parties. By using the card, all mobility costs are transparent. It is possible for your employer to set a budget per employee and to enable or disable modular services on the card. All transactions take place via the Alphabet Mobility Card and no declarations/receipts are required.

If you use this mobility solution, we will process the following personal data:

From the customer (employer): company contact details, company telephone number, company e-mail address, VAT number and bank account number, first and last name, e-mail address and telephone number of contact persons.
From board members and/or signatories: initials and last name, email address, and phone number. We use this personal data to contact you and verify signing authority.
From the mobility user: first and last name, gender (optional), date of birth, address and residence, mobile number, e-mail address (business and/or private), cost centre, employee number.

Sharing with third parties: We share data such as company contact details, first and last name of mobility user with external suppliers of mobility cards. They are responsible for processing transaction data via the mobility card or mobility budget. More information about this can be found at the respective mobility card suppliers.

Basis for processing: The basis for this processing is the performance of the agreement.

Purpose of processing: We use this personal data (with the exception of privacy-sensitive data such as location and check-in and check-out times) to settle our contractual agreements with your employer. In addition, this data will be processed in management reports to your employer. For you as a user, this information is visible in My Alphabet.

NS Business card

Through the NS Business card, you can use the public transport facilities of the NS.

If you use this mobility solution, we process the following personal:

From the customer (employer): contact details company, telephone number company, e-mail address company, VAT number and bank account number, first and last name, e-mail address and telephone number of contact persons.
From board members and/or signatories: initials and last name, email address, and phone number. We use this personal data to contact you and verify signing authority.
From the mobility user: initials and surname, address, place of residence, date of birth, passport photo, location data, check-in and check-out times and other travel information.

We process this personal data to apply for the card for you at NS and to report our contractual agreements with your employer on the use of this card. In the reports to our client (your employer), we take into account (if possible) the processing of privacy-sensitive personal data such as location data and check-out times.

Basis for processing: Performance of the agreement.

Maintenance and repair

To inform you about the maintenance and repair of your vehicle, we also use your personal data. When performing this mobility service, we process the following personal data from you:

From the driver of the vehicle: first and last name, address, e-mail address account data (customer number, registration number, bank details).
Service partners who handle your vehicle have access to license plate number, first and last name via a secure portal. You may provide further information (personal data) to service partner (garage / repair station) during your visit. Alphabet has neither access nor control over this personal data.

In the context of maintenance and/or repair work and/or services at Alphabet authorized workshops and dealerships, special diagnostic units are used to read out technical data relating to vehicle service from the electronic control units with which the vehicle is equipped. This personal data is processed in the workshops and used by technicians trained in diagnostics and repair of any malfunctions. These technical data related to the vehicle mainly consist of:

Basic vehicle data (such as vehicle identification number, vehicle type, year of construction, vehicle equipment);
Vehicle condition data (measured values, such as mileage);
Fault memory entries (such as indicator malfunction);
Maintenance and workshop data (such as maintenance requirements, work performed, parts fitted, warranty cases, workshop reports).

Basis for processing: Basis for this processing is performance of the agreement and legitimate interest.

Breakdown assistance

In case of a breakdown during your journey with your leased vehicle, including a flat tire or other technical problem, you can contact us for assistance. To perform this mobility service, we process the following personal data:

From the driver of the vehicle: your name and contact details, registration number and VIN number, make and model of car, the location from where this breakdown occurred and where assistance was provided.

Third party use: To carry out this service, we use third parties (e.g. emergency call centre, towing services or breakdown services), with whom we will share the necessary data about your situation. We have made contractual agreements with these third parties to adequately protect your personal data.

Basis for processing: Performance of the agreement and legitimate interest.

Damage and accident reports / Insurance

When your vehicle is damaged as a result of a collision or otherwise or when reporting an accident involving your leased vehicle, you can approach us (or we will approach you) for repair of this damage or possible replacement transportation and the related settlement with insurance or repairer.

In performing this mobility service, we process the following personal data from you via our website www.mijnschademelding.nlen our supplier:

From the customer (employer): Name and address details company, company phone number, company email address, Chamber of Commerce number and bank account number, initials and surname, email address and contact phone number.
From the driver of the vehicle: your initials and last name, contact details, date of birth, vehicle details (registration number, make, model, etc.), accident details, any photos of the damage/accident, number of occupants (if relevant), any information from witnesses (if applicable) and any other information we receive from you about the damage and/or accident (information about injured persons).

We share this personal data depending on the agreements made with the customer regarding the applicable insurance with the insurance companies involved.

From third parties who were involved in the damage or accident, we may also process personal data, such as the identity of these third parties. We may also process information about witnesses, passengers involved, personal data from police (such as police reports and witness statements) and insurance data about the damage and/or accident, including information and claims from third parties.

We share this personal data with our client (your employer) in reports. We also share these personal data with damage repair companies, insurance companies (both our own insurance company and those of third parties) and, if necessary, with (damage) experts involved in settling the damage and/or accident.

Basis for processing: Performance of an agreement, legal obligation, legitimate interest.

Traffic and parking fines

In the case of operational leasing, Alphabet may be registered as the owner of the vehicle. Traffic and/or parking fines (both domestic and foreign) are therefore addressed directly to Alphabet by the authorities who have imposed these fines (police, judiciary, or municipality). We process the following personal data in order to process and manage payment of these fines and, if necessary, also have them reimbursed by our client (your employer):

Data mentioned on the fines: the personal data we receive from the CJIB, the police, municipality, or foreign authority, such as the license plate number of the vehicle, the nature of the offense, the place and time of the offense, and the amount of the fine imposed.
From the driver: first and last name, date of birth and license plate number of the vehicle.

In the invoice and statements to the customer (your employer) we will not report privacy-sensitive personal data (such as nature, place and time of the violation).

However, in certain situations we will have to share these personal data with our client (your employer), namely in case of car sharing (multiple drivers per lease vehicle) or if we do not know who the driver is at the time of the violation.

Basis for processing: Legal obligation or legitimate interest.

Driver training / Fleet management training

At the customer's request, Alphabet can offer driver training or Fleet management training. This is in combination with existing product purchase.

If you use this mobility service, we process the following personal data:

From the driver of the vehicle: Your first and last name, your e-mail address and possibly your date of birth.

Sharing with third parties:

We share this personal data with the training agency that provides the relevant training courses.

Basis for processing: The basis for this processing is the performance of the agreement.

Artificial Intelligence ("AI")

To welcome innovation and improve daily operations, Alphabet uses various AI solutions in some cases of personal data processing. These solutions may include machine learning algorithms, natural language processing or other AI-powered technologies. The intended functions of AI use is to help analyse, improve and categorize the personal data we process.

The purpose of using these AI solutions is to improve the accuracy and efficiency of our internal processes. By using the capabilities of AI, we strive to improve the quality of our services and provide a better-tailored customer support.

The use of AI solutions is subject to strict security and privacy measures. Your personal data is processed in accordance with applicable laws and regulations and in an ethical and responsible manner.

Basis for processing: legitimate interest, or consent.

My Alphabet

My Alphabet is the Customer Relation Management (CRM) system in which our customer, employees (drivers) and fleet managers can find their personal data. It also contains claim forms, forms to report your damage. Access to this system can be obtained by means of an authorization login code assigned to you. My Alphabet is operated by Alphabet, this site meets the requirements as explained under 'How we protect your personal data'.

If you use this mobility service, we will process the following personal data:

From the customer (employer): company contact details, company phone number, company email address, first and last name, contact email address and phone number.
From the driver of the vehicle: first and last name, gender (optional), date of birth, (mobile) phone number, email address (business and/or private), cost centre, employee number.
Also recorded here are all vehicle-related data such as registration number and VIN number, make and model of car. But also data that may arise in the course of the contract such as maintenance data, damage and refuelling.

Basis for processing: Performance of an agreement.

Drivers Desk / Customer Care:

We use your personal data for contract management (such as ordering vehicles, submitting workshop/repair requests and booking certain services) or to handle a request submitted by you (such as a quote request).

With respect to all aspects of contract management or settling a problem, we will contact you without consent, such as in writing, by telephone, by text message or by email, depending on the choice of contact you have indicated.

We will also contact you if your vehicle is affected by a so-called technical campaign or recall (usually measures of great importance to prevent danger to occupants or the vehicle, for example), so that we can fulfil our legal obligation to provide information.

We will also contact you in carefully considered cases of promotional communication (for example, for sending the welcome package or communication around the end of the lease term and a corresponding offer) if and to the extent that the requirements as named in the applicable privacy legislation are met and if you have not objected to the use of your personal data for these promotional purposes.

Alphabet also processes your personal data on this basis to optimize our customer service such as, for example, to correctly identify you when you contact us.

Basis for processing: Performance of an agreement and consent.

Management reports

To produce management reports, we may process personal data for statistical and scientific purposes, or to improve the quality of our products and services. This processing takes place on an anonymous basis and cannot be traced back to individual persons.

In addition, we provide our customer with basic reports for the purpose of giving customer insight into the fleet and possibly generating management information from it; in these reports we will treat privacy-sensitive personal data such as location data and nature of violations in accordance with what is stated in the section 'How do we protect your personal data'.

Basis for processing: Performance of an agreement and legitimate interest.

Compliance with legal obligations to which Alphabet is subject

Alphabet will also process personal data if required to do so by law. This may be the case, for example, when we contact you if your vehicle is the subject of a technical campaign or recall.

Personal data collected will also be processed within the scope of internal management and compliance monitoring, where we check, for example, whether the service partners we select meet requirements set by us.

If required by law, we transfer your personal data to the authorities (who are responsible within the framework of legal notification obligations) if necessary.

We also process your personal data in the event of a legal conflict, if this legal conflict necessitates the processing of personal data.

Visiting Alphabet locations - access controls and security

If you visit one of our locations, we may use your personal data to provide you with an access badge, for access controls and to ensure security at our locations.

For this purpose, we may process the following personal data from you: your name, your contact details and the name of the person within Alphabet that you visit.

Basis for processing: legitimate interest.

Visiting Alphabet locations - Video surveillance

In addition, Alphabet makes use of camera surveillance. The cameras in question are only set up to secure specific locations and personal data will also only be used for this purpose. Through the camera images, we can obtain information about your behaviour.

Basis for processing: It is within our legitimate interest to ensure the safety of our customers, employees and property and to use video recordings in the investigation of crimes or to prevent crimes. The retention period is no longer than one month unless it is necessary for further investigation.

Purposes of processing: The video recording is carried out for your own safety, the safety of our employees and to be used as evidence. The video recordings are used to ensure security, investigate complaints and to prevent and resolve theft and other harmful activities, such as vandalism and other acts aimed at damaging property or harming persons. If a crime is suspected, we may make the recordings available to prosecuting authorities.

Telephone communications with Alphabet

Alphabet may record telephone calls and/or store electronic communications.

The following personal data of yours may be processed for this purpose: your name, contact details, telephone number, mobile number, data about your vehicle (including your license plate number), other personal data such as data about a dispute, or claim.

Alphabet uses this personal data to evaluate the quality of service, for coaching and assessment purposes; to gather evidence in disputes and to conduct investigations and detect crimes.

Captured electronic communications may be provided by Alphabet to the public authorities or to that department within the BMW Group in charge of security matters and/or special employees concerned with the enforcement of company regulations.

Basis for processing: legitimate interest and/or legal obligation.

Communication via email or contact forms

Personal data entered in contact forms, chatbot or info email address or through messages or forms on our official social media channels will be transmitted to the appropriate departments within Alphabet.

Marketing communication and market research

We like to inform you personally and at the time relevant to you. This information may consist of newsletters, offers, customer satisfaction surveys, or otherwise. It is possible that there may be benefits for you; therefore, we would like to point out these benefits to you.

If you have consented to us using your personal data for direct marketing purposes, we may use your personal data for marketing-specific purposes only.

We may request your consent to offer you information about the following activities:

Alphabet events;
discounts or other offers at Alphabet;
Alphabet customer satisfaction and market surveys;
Alphabet's new products and services;
Alphabet's general newsletter.

You can give your consent in My Alphabet by making a specific choice in the product information you would like to receive from us. You can also revoke your consent just as easily.

We invoke the legitimate interest as the legal basis when we approach you for customer satisfaction surveys. This only occurs after you have used our service.

Basis for processing: Legitimate interest or consent.

Social media (personalized content).

We process personal data (IP address, social ID and cookie ID) and browsing behaviour in order to offer relevant content based on this data. We also use this to personalize ads through social media, such as Facebook, Instagram, LinkedIn, YouTube and Pinterest. We use customized target groups within social media for this purpose. These target groups are built based on browsing behaviour on our website and/or interactions with certain previously shown ads. We do this to best serve you and provide you with relevant content that matches your interests.

Compliance with sales - service and administration processes of Alphabet

To continuously optimize the customer experience and cooperation with partners and customer service, we compile assessments and reports based on contract information and share them with the responsible partners. The main purpose of these reviews is to improve application procedures and sales processes. We compile the reports described above in aggregated and anonymized form, i.e. the recipients of the reports cannot draw any conclusions regarding you as an individual from the data they receive.

Portions of the vehicle-specific data collected are also processed - if necessary - in order to comply with service processes (including repairs, warranty and goodwill). This processing is in Alphabet's legitimate interest to provide our customers with the best possible service processes. To protect the privacy of our customers, the processing of technical data is generally vehicle specific without direct reference to the customer.

Basis for processing: legitimate interest.

To protect your personal data, we take various security measures such as encryption and authentication tools in line with the current state of the art to protect and maintain the security, integrity and availability of your personal data.

We cannot guarantee 100% protection against unauthorized access in the event of data transmission via the Internet or a website, but we and our service providers and business partners make every effort to protect your personal data in accordance with applicable data protection regulations through physical, electronic and process-oriented security measures in line with the current state of the art. Among other things, we use the following provisions:

Strict criteria for consent to access your personal data in accordance with the principle of "need to know" (limitation to as few people as possible) and only for the specified purposes;
Only transmission of collected personal data in encrypted form;
Protection with a firewall of IT network to protect against unauthorized access, for example by hackers;
Permanent monitoring of access to IT systems to detect and prevent misuse of personal data.

If you have received a password from us or created your own password to access certain areas of our website or other portals, apps or services we operate, you are responsible for keeping this password confidential and for complying with any other security procedures we remind you of. In particular, we ask that you do not share your password with anyone else.

Security measures for location information

Certain services can only be offered if you reveal your location or disclose the location of your vehicle. We take the confidentiality of this location data extremely seriously.

Your location data (including data accessed as part of vehicle maintenance work) are therefore protected by the following security measures:

They are stored only in a form that can be traced back to you or your vehicle to the extent required to fulfil the intended purpose for which storage is necessary;
Personal data is collected and accessed in this form only when required to provide the requested services;
Personal data is also collected and accessed in this form to the extent we are required by law to store or transmit the personal data;
Personal data for locating the vehicle and personal data for locating a mobile device/your mobile device are linked only when required to provide the requested services;

Any other use of location data for the purpose of analysis will take place using data files that have been anonymized in advance.

In accordance with Article 17 of the GDPR, we keep your personal data only for the period necessary for the relevant purposes of data processing. If we process personal data for multiple purposes, it will be automatically deleted or stored in a format that does not allow this personal data to be directly traced back to you as an individual once the last task has been completed. To ensure that all your personal data is deleted in accordance with the principle of data minimization and Article 17 of the GDPR, Alphabet has developed internal procedures for deletion. The fundamental principles upon which your personal data will be deleted are described below.

Use for the performance of a contract

To comply with contractual obligations, personal data collected from you may be retained for as long as the contract is in effect and - depending on the nature and scope of the contract - for 5 to 15 years thereafter in order to comply with legal requirements for retention and to be able to answer any questions or resolve complaints after termination of the contract. Some contracts for the provision of products and services require longer retention periods; see also "Use for the assessment of claims" below.

Use for the assessment of claims

According to Article 17(3)(e) GDPR, the personal data that we believe is necessary to assess and prevent claims against us or to institute criminal proceedings or to prevent claims against you, us or third parties may be retained by us for as long as the relevant proceedings might be instituted.

Use for customer service and marketing purposes.

Personal data collected from you for customer service and marketing purposes may be retained for 3 to 10 years, unless you want this personal data to be deleted and there is no contractual or legal obligation for retention that prevents this request for deletion.

Use for training purposes

Your data collected via a phone call and email communication between you and Alphabet can be used for the purpose of training of our employees. We retain the phone call recordings and the email communication for no longer than 3 months after the date of collecting the data.

Use for application processing

We will retain your data if you decide to join the BMW team by send us a job application. If you as an applicant are successful in your application, the data you provided may be kept for up to 2 years after the employment termination. Yet, if it is not a match, your data will be deleted after 1 year in case you consent to data processing, and after 4 weeks if you do not consent to data processing, from the date of rejection.

Alphabet is part of the BMW Group. In some cases, after careful review, we transfer your personal data to BMW Group, which is then responsible for further processing. Such a data transfer may occur under the following circumstances and for the following purposes:

If you have previously given your express consent to share your personal data with other BMW Group companies for promotional or marketing purposes;
During group reporting, it is possible that we transfer personal data; for example, we transfer data for the respective vehicle identification numbers in the case of leased vehicles for the assessment of residual values. To protect your interests, additional security measures and controls are implemented where necessary, such as strict limitations on access to personal data, restrictions on data use, security measures, retention periods, as well as personal data saving measures such as collecting only relevant personal data;
In some cases it is necessary to process and retain your personal data for example due to joint consolidated accounting in accordance with International Financial Reporting Standards (IFRS) for companies.

Personal data processed by us and/or BMW Group is preferably processed within the EU.

If personal data is processed in countries outside the EU, Alphabet uses standard EU contracts, including appropriate technical and organizational measures, to ensure that your personal data is processed at the same level as applies under European data protection.

In some countries outside the EU, such as Canada and Switzerland, the EU has already established a level of data protection comparable to that of Europe. A comparable level of data protection means that no special consent or agreement is required for data transfers to these countries.

Basis for processing: consent, legal basis and legitimate interest.

You can access the personal data we hold about you through My Alphabet, our online CRM portal. If permitted, it is also possible to change your personal data there.

You can also view and possibly also change your consent for promotional communications, newsletters, and other marketing communications here.

However, the settings for the use of your personal data by service partners cannot be changed in your online account. To change them or if you have any questions about the use of this personal data here, you should therefore contact the respective service partners directly.

In accordance with the GDPR, you as an individual have the following rights that you may use in your relationship with us. The following section explains your rights as defined in the AVG. Depending on the type and scope of your request, we may ask you to submit your request in writing.

Your consent and changes to your preferences:

We offer you the possibility to indicate yourself whether we may use/process your personal data for commercial approach (offers) or analysis purposes (surveys). An overview of the choices we have registered from you can also be found in the My Alphabet portal. Here we also offer the possibility of easily changing your previously made choices at any time.

Right of inspection (Article (15 GDPR)

Under this right, you can always ask us about your personal data that we possess. In particular, you can inquire about the categories of data, processing activities, purpose of processing, origin of personal data, and, if applicable, the recipients to whom we forward your data to.

If you would like to understand the personal data that are processed about you by Alphabet, we would first refer you to the My Alphabet portal. Here you can view the personal data we have received from you and your personal data relating to your vehicle (such as refuelling, damage and traffic and parking fines).

If you cannot find the information you are looking for you can request to see it. This information is provided free of charge. If you are interested in additional overviews, we reserve the right to charge you a fee for these additional copies. You can receive this overview by sending a letter to:

BMW Financial Services Netherlands B.V.
Attn: Compliance Department/Data Protection Officer
Takkebijsters 59
P.O. Box 6890
4802 HW Breda

Please enclose a copy of a valid legal proof of identity; this should be provided in accordance with instructions from the central government (see attached link:

https://www.rijksoverheid.nl/onderwerpen/identiteitsfraude/vraag-en-antwoord/veilige-kopie-identiteitsbewijs).

Right to rectification (Article 16 GDPR)

If you found a mistake in your data, it got outdated, or changed, you can, and you are encouraged to ask us to correct your personal data. We will take appropriate measures to ensure that the personal data we hold about you are processed correctly and kept as up to date as possible, based on the latest information available to us.

Right to delete your personal data (Article 17 GDPR)

You can make a request to delete your personal data. We can comply with this request if one of the further listed legal requirements are met. In accordance with Article 17 of the AVG, we can delete your data if:

Your personal data are no longer necessary for the purpose for which they were obtained or processed,
You withdraw your consent, which was the basis for processing the personal data and there is no other legal basis for processing,
You object to the processing of your personal data and there is no other legitimate reason to process them or if you object to the processing of your personal data for direct marketing,
If the personal data have been processed unlawfully.
Or if the processing is not necessary

However, there are instances in which we can reserve the right to retain your personal data despite your deletion requests. We continue to process your personal data if is necessary for:

Exercising the right of freedom of expression and information
Compliance with a legal obligation
Reasons of public interest in the area of public health
Archiving purposes
Establishment, exercise or defence of legal claims.

Right to block your data / to restrict processing (Article 18 GDPR)

You can request us to restrict / block the processing of your personal data if:

You contest the accuracy of your personal data - this can only be done for the period we need to verify the accuracy of your data
Processing of the personal data is unlawful, but you do not wish to have the personal data deleted and instead request a restriction of use.
We no longer need your personal data, but you need the personal data to assert or exercise legal claims or defend against legal claims;
You have lodged an objection to the processing, but it has not yet been decided whether our lawful grounds outweigh your reasons.

Right to data portability (Article 20 GDPR)

At your request, and if technically feasible, we may transfer your personal data to another responsible entity, or you can obtain certain personal data from us on a transferable data carrier. This right applies only if the data processing is based on your consent or is required to perform a contract.

Right of objection (Article 21 GDPR)

You may object to the processing of your personal data at any time for reasons arising from a particular situation for you, provided that the data processing is based on your consent or our legitimate interest or that of a third party. In this case, we will no longer process your personal data. The latter does not apply if we can demonstrate that there are compelling, defensible reasons for processing that outweigh your interests. Or if we need your personal data to assert or exercise legal claims or defend against legal claims.

Rights with regards to automated decision-making (Article 22 GDPR)

When entering into or amending a financing and leasing contract, we process data using automated decision-making. We do this only for the purpose of assessing creditworthiness, to make a financing or leasing proposal, or an offer to change the instalment plan.

We may make automated decisions if the decision:

Is necessary for the performance of a contract (e.g. for the application for Alphabet Private Lease),
Is permitted under a provision of Union law or Member State law (e.g. for fraud detection) or
We have obtained your express consent to do so.

If you do not agree with the decision, you can contact us. You have the following options in doing so:

A request for a new assessment by one of Our employees (right to human intervention);
The right to express your point of view; and
The right to object to the decision.

Timelines to meet your individual rights

Generally, we will do our best to comply with your request within 30 days. However, this time limit may be extended for reasons related to the specific rights of data subjects / depending on the reason underlying a specific individual right, due to the complexity of your request or due to unforeseen circumstance which may prevent us from addressing your request

Limitation in providing information regarding your rights

If you make a request regarding the exercise of your rights to us, we will soon let you know whether and to what extent we can fulfil your request. In some cases, we may refuse this request, for example, if you ask us to delete personal data that we still need for tax reasons or other legal requirements. If this is the case, we will explain why we cannot fully comply with your request.

Contacting us

If you have any questions about our use of your personal data, how we handle it or about this Privacy Statement, please contact the responsible Data Privacy Protection Officer (DPPO) using the address details below:

Email address: data_privacy@bmw.nl

Complaint to the Personal Data Authority

Alphabet takes your comments/concerns and rights regarding the processing of personal data seriously. However, if you are of the opinion that we have not properly handled your comment or objection in this regard, you have the right to submit a complaint about this to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Data Protection Authority

P.O. Box 93374

2509 AJ The Hague

Hoe kunnen we helpen?

Privacy Statement BMW Financial Services Nederland B.V.

Mobiliteit oplossingen

Producten en diensten

Leaserijders

Over ons