BMW Innovation Lab 2020 – PRIVACY NOTICE

This is the privacy notice for “BMW Innovation Lab 2020” (the Programme).

The Programme is organised by L Marks Limited (the Administrator of the Programme), in conjunction with BMW Financial Services (GB) Limited (the Sponsor of the Programme). Any reference to we, us or our in this notice is a reference to both the Administrator and the Sponsor unless otherwise stated.

We are committed to respecting the privacy of individuals as users of the Programme website (bmwinnovationlab.co.uk) (the Website) and individuals as applicants to the Programme. This privacy policy applies to personal data we hold about individuals. It does not apply to information we hold about companies or other organisations. The following statement explains how we may use the personal data we collect from you in connection with your use of our Website and the application process.

The Administrator is registered in England and Wales with company number 7756651. The Administrator’s registered office address is 20 Broad Lane, Hale, Altrincham, Cheshire, WA15 0DF.

The Sponsor is registered in England and Wales with company number 01288537. BMW (UK) Limited and Alphabet (GB) Limited, registered in England and Wales with company numbers 1378137 and 03282075 respectively, may also be involved in this programme and, where it processes any personal data any reference to the Sponsor should also be read as a reference to BMW (UK) Limited and Alphabet (GB) Limited. The registered office address of BMW Financial Services (GB) Limited and BMW (UK) Limited is Summit One, Summit Avenue, Farnborough, Hampshire, GU14 0FB. The registered office address of Alphabet (GB) Limited is Alphabet House, Summit Avenue, Farnborough, Hampshire, GU14 0FB.

APPLICABILITY OF THIS NOTICE

1.1 This notice applies to any person accessing our Website and to any person submitting an application to participate in the Programme. This notice does not apply to participation in the Programme itself, which is governed by separate terms and conditions which will be notified to you if you are invited to participate.

1.2 The Administrator and the Sponsor are separate entities, and each is separately responsible for how it deals with your personal data.

1.3 Where you submit an application, this privacy notice applies in addition to our application terms. The submission of an application is conditional upon you agreeing to the terms of this privacy notice.

1.4 Applications are made through the Administrator’s application portal, The Bridge. The Bridge has its own privacy notice which you should read in addition to this notice.

2. PERSONAL DATA ABOUT YOURSELF (AS AN INDIVIDUAL)

2.1 If you are an individual, when using our Website, completing and submitting an application form and participating in the selection process you may provide us with personal data about you such as your name, address, date of birth, telephone numbers (including mobile number) and email address (personal data).

2.2 We are committed to protecting your privacy, and will only use your personal data in accordance with applicable data protection legislation, for example the General Data Protection Regulation and the Data Protection Act 2018.

2.3 To properly complete our application form we require you to provide some basic data about yourself. This is information that we consider necessary so that we can properly consider your application. If you do not agree to us holding this information about you, please do not complete an application.

2.4 In completing the application form or participating in the application process you may choose to provide further information about yourself, team members or other associated people. It is entirely your decision as to whether you provide this type of information to us and you should only provide this information if you are comfortable with us storing it and using it to process your application as described in this privacy notice.

2.5 You are entitled by law to ask for a copy of your personal data at any time. Please contact us using the contact details in paragraph 12. You are entitled to ask us to correct or update your personal data at any time by contacting us at the address above.

3. PERSONAL DATA RELATING TO OTHER INDIVIDUALS

3.1 If you are a company or another organisation, it is possible that during the application process, for example whilst completing the application form or participating in pitch day, you may provide us with personal data relating to other individuals, such as team members or other people involved in your business or business idea.

3.2 Where you do provide us with personal data relating to other people, it is essential that you:

3.2.1 inform those people that you will be providing their personal data to us;

3.2.2 provide them with a copy of this notice so that they are aware of how their personal data may be used and their rights in respect of it; and

3.2.3 obtain their written consent (for example by way of email) to you providing the information to us.

3.3 By submitting information relating to other people, you agree to indemnify us for any claim, fine or penalty that we may suffer (including any associated costs or expenses that we incur) as a result of your failure to comply with paragraph 3.2.

4. USES MADE OF THE INFORMATION

4.1 We (and our representatives) may use your personal data as follows, subject always to your consent where required:

4.1.1 to perform our contractual obligations in respect of the handling of your application, including:

(a) registering you on our database;

(b) considering your application to participate in the Programme; and

4.1.2 where you have expressly consented to us doing so, including responding to any enquiry that you submit to us (whether via our Website enquiry form or otherwise);

4.1.3 where it is necessary for compliance with legal obligations, including for record keeping and regulatory compliance purposes; and

4.1.4 where we otherwise have a legitimate interest in doing so which is not overridden by your interests or fundamental rights and freedoms which require protection of personal data, for example our legitimate interest in:

(a) promoting the Programme, to increase awareness of the Programme, our products, services and brands and your business;

(b) updating you on relevant Programmes in addition to the one applied for, to promote awareness of those Programmes and encourage applications;

(d) notifying you about a change to our Website or the application process to ensure the effective administration of the application process.

4.2 Provided you have given us your prior consent to marketing we may also contact you regarding investment or commercial opportunities that we consider may be of interest to you. The Administrator works with a wide range of companies and investors and, where it considers that a company or investor it is working with might be interested in learning more about you and your business or business idea it may pass non-personal information (such as information about your business) onto that company or investor.

4.3 If that company or investor is interested in learning more about you then the Administrator may request your permission to pass your personal data onto that company or investor, but will not pass your personal data on unless and until you have agreed to this.

4.4 Personal data and non-personal data that you submit may also be used for analytical or reporting purposes and anonymised reports may be published or otherwise provided to third parties.

4.5 Please be aware that any part of pitch day, including the pitches and the interviews, may be recorded and a copy of any recordings we make may be publicised and circulated as we consider appropriate subject always to full compliance with applicable data protection laws. If you take part in any relevant events and would prefer not to be recorded please let us know and we’ll ensure you are not included in any content.

4.6 Where our processing of your personal data is based on consent, you have the right to withdraw this consent at any time, which you may do by contacting us as described in paragraph 13. Please note however that the withdrawal of your consent will not affect any use of the data made before you withdrew your consent.

5. DISCLOSURE OF YOUR INFORMATION

5.1 We may disclose your personal data to third parties:

5.1.1 for completing due diligence on you and your business or business idea (and, where appropriate, on your team or company);

5.1.2 to help find investment and commercial opportunities for you, as described in paragraph 4.2;

5.1.3 in publicity material, as described in the application terms;

5.1.4 to suppliers involved in the operation of the Programme, for example the operator of the venue where pitch day is held to make arrangements regarding your attendance or a creative agency involved in publicising the Programme;

5.1.5 if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply such other terms as apply to our relationship, or to protect the rights, property, or safety of our customers, ourselves or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction;

5.1.6 if we determine that such disclosure is necessary in connection with any investigation or complaint regarding your use of the Website or your application; and

5.2 The Administrator and the Sponsor may also share your personal data between them and with other companies in the Sponsor’s group for the purposes of assessing and processing your application and arranging your participation in pitch day.

6. INCOMPLETE APPLICATIONS

6.1 The Bridge offers you the opportunity to save incomplete applications prior to submission. It is important to be aware that where you save an incomplete application we can access that application and the information within it, even if you have not submitted it. It is therefore important that you do not save any information in the application form that you would not be comfortable with us seeing.

6.2 If your application remains unsubmitted after the closing date we may nonetheless access your application and consider admitting it to the application process even though it was not submitted.

7. RETENTION, UPDATING AND REMOVAL OF YOUR PERSONAL DATA

7.1 Where you provide us with personal data during the course of your usage of the Website, in the application form or during the application process we may retain this information for future use, including:

7.1.1 to speed up your future use of the Website and application form;

7.1.2 for compliance purposes;

7.1.3 for informing you about upcoming programmes;

7.1.4 for exercising our rights set out in the application terms;

7.2 The duration for which we retain your personal data will differ depending on the type of information, the reason why it was submitted and the legal basis for its processing. In some cases personal data may be retained on a long term basis: for example, personal data that we need to retain for legal purposes will normally be retained for at least six years in accordance with usual commercial practice and regulatory requirements.

7.3 You are responsible for ensuring that the personal data that we hold about you is accurate and up-to-date, and you should check it on a regular basis. Until the closing date you will be able to update information via the application form on The Bridge, so where this personal data changes you can update it yourself. Following closure of the application process, or if you are otherwise unable to do this, you can contact us using the details in paragraph 12 and, where appropriate, we will update the relevant personal data for you.

7.4 If you want to withdraw your application at any time please contact the Administrator. Your withdrawal will result in the deletion of some of the personal data that we hold about you, but we may still retain some personal data, for example for record keeping purposes. If you would also like to close your account on The Bridge, you should confirm this in your request in which case this part of your request will be handled in accordance with The Bridge privacy notice.

7.5 You may in certain circumstances be entitled to request the erasure of personal data that we hold on you. To make a request of this nature, please contact us, providing full details of the personal data you want to be erased and the reason(s) for your request. We will consider all requests upon receipt and confirm to you whether we are able to agree to your request.

7.6 Please be aware that the erasure of personal data that we hold about you may affect our ability to provide the Website and/or process your application and in some cases our acceptance of an erasure request may require us to cease considering your application.

8. COOKIES

8.1 A cookie is a small data file that certain websites may store in your device’s memory when you visit such websites. Certain parts of Our website use cookies to collect information about your visit and use of the webpage to give you the best possible experience, shown you the most relevant features and make it easier for you to use and interact with the website. They also help us continually improve our site and provide you with offers tailored to your interests. Some cookies are essential as we cannot provide all our services without them as they enable features without which you would not be able to use the website as intended. Other cookies, including those set by third parties, are not essential, although our site might not work quite as well without them – and certain content might not be tailored to your specific interests.

8.2 When you visit Our webpage, a pop-up field will ask for your cookie preferences which you can adjust and amend at any time. You can also find further details and information on cookies on our website. We will use cookies only in line with your latest cookie preferences settings.

9. LOG FILES

9.1 In common with most websites, our Website logs various information about visitors, including internet protocol (IP) addresses, browser type, internet service provider (ISP) information, referring / exit pages and date / time stamp.

9.2 We may use this information to analyse trends, administer the Website, track your movement around the Website and gather broad demographic information.

10. RESPONSIBILITY FOR THIRD PARTY WEBSITES

Our Website may, from time to time, contain links to and from other websites. If you follow a link to any of these websites, please note that these websites have their own privacy notices and that we do not accept any responsibility or liability for these notices. Please check these notices before you submit any personal data to these websites.

11. ISSUES AND COMPLAINTS

11.1 If you have any concerns about how your personal data is being used, please contact us as described in paragraph 13. This includes situations where you want to request the rectification or erasure of your personal data, restrictions to be placed around how we use your personal data, or to object to a particular use.

11.2 If you make a complaint about our handling of your personal data, it will be dealt with in accordance with our complaints handling procedure.

11.3 In the first instance your complaint will be reviewed by an employee of the Administrator or Sponsor (depending on which of us you make your complaint to) within 28 days (we will use best endeavours to review it sooner).

11.4 If you are dissatisfied with the response to our initial review you may request that your complaint be escalated, in which case it will be passed to a senior person within the relevant business who will review your complaint and the initial response and provide a further response within 28 days (we will use best endeavours to review it sooner) of your request to escalate the matter.

11.5 We will endeavour to provide a full response within the relevant review period. However, in some cases further investigation may be necessary (for example, you may submit a complaint to the Administrator but it may have to discuss certain aspects of your complaint with the Sponsor or vice versa).

11.6 If we cannot provide a final response within the relevant review period then we will provide an initial response acknowledging your complaint, explaining the reason for the delay and giving an estimate as to when a full response can be provided, and will aim to provide that full response as soon as we reasonably can following the expiry of the relevant review period.

11.7 We will at all times take all reasonable efforts to resolve your complaint to your full satisfaction. Irrespective thereof, you may make a complaint to the Information Commissioner’s Office at any time. Please see https://ico.org.uk/make-a-complaint for more information.

12. CHANGES TO THE PRIVACY NOTICE

12.1 We reserve the right to alter this privacy notice at any time. Such alterations will be posted on the Website by us (if you have submitted an application we will also send you a copy of the updated notice using the details you have provided to us).

12.2 It is important that you read any alterations as and when they are posted on the Website by us and should you object to any alteration, please contact us as described in paragraph 12.

13. CONTACTING US

13.1 If you have a general query about this notice or the handling of your personal data, or if you have an issue regarding the use or retention of your personal data by the Administrator, please contact the Administrator’s Data Protection Officer Daniel Saunders at 72 Acton Street, Kings Cross, London, WC1X 9NB or by email at Daniel@lmarks.com.

13.2 If you have an issue regarding the use or retention of your personal data by the Sponsor, please contact the Sponsor at Sara Dawes at Summit One, Summit Avenue, Farnborough, Hampshire, GU14 0FB or by email at sara.da.dawes@bmwfin.com

14. FURTHER INFORMATION

14.1 We hope that the contents of this privacy notice address any queries that you may have about the personal data we may hold about you and how we may use it. However, if you do have any further queries, comments or requests, please contact us as described in paragraph 13 above.

14.2 Whilst this privacy notice sets out a general summary of your legal rights in respect of personal data, this is a very complex area of law. More information about your legal rights can be found on the Information Commissioner’s website at https://ico.org.uk/your-data-matters.