M Performance Drive Analyser App Privacy
Last update: 22.02.2021

Who is the app developer?
The M Performance Drive Analyser app is designed and manufactured by INATRONIC GmbH & Co. KG for BMW AG Munich. Inatronic is committed to the highest standards of data privacy and will only use your information for clearly described purposes and in accordance with your data protection rights.

Who is responsible for data processing?
Inatronic GmbH & Co. KG, August-Schmieder-Str. 45a, 94377 Steinach, Germany, with its registered office in Steinach, is entered in the commercial register of the Local Court [Amtsgericht] of Straubing under HRA 6602. Personally liable partner: Inatronic Management GmbH with its registered office in Steinach, is entered in the commercial register of the Local Court [Amtsgericht] of Straubing under HRB 11541.
Contact via email to bmwsupport@inatronic.com

User permissions required by the app

Bluetooth
To transfer data from the vehicle (OBD stick), the app requires the device's Bluetooth.

Location data
GPS location data is required to record a trip and its starting location. The recording is started manually by the user and is stopped either manually or automatically (auto save). Location data recording continues while the app is in the background (iOS only).

Data storage
Access to the data storage is required to save trip data in the local memory of the device.

Microphone
Access to the mic is required to record audio signals for TrackDrive video recording of a trip.

Camera
Access to the camera is required to record video signals for TrackDrive video recording of a trip

The app user may cancel granted permissions in the settings menu of the device at any time.


Which data are saved?
Selected vehicle brand and model as well as the vehicle identification number are stored in the local memory of the device.

TestDrive
Location, date, time, speed, RPM, linear and lateral acceleration, elapsed time and distance data are stored in the local memory of the device. You may delete all stored data by executing the “erase” option in the app.

TrackDrive
Location, date, time, speed, RPM, linear and lateral acceleration, elapsed time and distance, throttle position, power, torque, engaged gear, altitude, fuel consumption and trip route data (GPS location data) are stored in the local memory of the device. You may delete all stored data by executing the “erase” option in the app.
Stored data may be exported and transferred to others by the user via data transfer services e.g. email.
You may erase all app data by erasing the Drive Analyser folder in the local memory of the device.

Data transfer to Inatronic GmbH & Co. KG
The data described below are transferred to an IT service provider commissioned by Inatronic and stored on a server hosted by the IT service provider. The IT service provider commissioned by Inatronic is committed to the highest standards of data privacy and will only use your information for clearly described purposes and in accordance with your data protection rights.

The 12-digit serial number of the OBD stick that you enter during the app installation process is sent to the server hosted by the IT service provider to verify the 12-digit number.

For quality assurance and support reasons the app transfers data when you select and save a car model. Following data is transferred to the server hosted by the IT service provider: App version, OS version, selected car model, vehicle identification number VIN, OBD stick serial number, OBD stick software version, OBD protocol. No other data are transferred.

An updated version of the vehicle database is downloaded from the server hosted by the IT service provider and stored in the local memory of your device when you execute the “vehicle database update” feature of the app.

Data transfer to third parties
No personal data is transferred to third parties. The App transfers anonymized location data to the map service providers Google Maps or Apple Maps to retrieve the map image in TrackDrive.

How do we keep your information safe?
We secure your data using state-of-the-art technology to protect your personal data against misuse or any other form of unauthorized processing. Access to personal data is restricted to only a limited number of authorized persons for specified purposes. The data is transferred and stored in encrypted form.

How long do we store your data?
We only store your personal data for as long as is required for the respective purpose.

Your data privacy rights, your right to complain and contacting Inatronic
According to the GDPR you are entitled to the following rights:

1. Right to information
You may request us to provide information about your personal data processed by us under Article 15 of the GDPR.

2. Right to rectification
If your personal data provided to us is not up to date or not accurate you have the right to ask for modifications to your personal data under Article 16 of the GDPR. You also have the right to request us to complete an incomplete data.

3. Right to erasure
You have the right to have your personal data erased and ask for deletion of your data under Article 17 of the GDPR.

4. Right to restriction of processing
You have the right to restrict the processing your personal data under Article 18 of the GDPR.

5. Right to data portability
You have the right referred to in Article 20 of the GDPR to receive your personal data provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.

6. Right to revoke the consent given under data protection law
You have the right referred to in paragraph 3 of Article 7 to withdraw your given consent based on the data protection provisions at any time. This does not affect the lawfulness of the processing based on consent before its withdrawal.

7. Right to lodge a complaint with a supervisory authority
If you consider that the processing of personal data relating to you infringes the GDPR, you have the right referring to in Article 77 of the GDPR to complain to the supervisory authority against the processing of your personal data (in particular in the Member State of your habitual residence, place of work or place of the alleged infringement ).

Please also note your right of objection under Article 21 GDPR:
a) In general: reasoned objection required
If the processing of personal data concerning you takes place in order
- to perform our overriding legitimate interest (legal basis: Article 6 (1f) GDPR) or
- to safeguard the public interest (legal basis: Article 6 (1e) GDPR),
you are entitled to object to the processing at any time for reasons arising from your particular situation; this also applies to profiling based on the provisions of the GDPR.

In the event of objection, we will no longer process the personal data concerning you unless we can prove compelling grounds for processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims;

b) Special case of direct marketing: simple objection is sufficient
If the personal data concerning you are processed for the purpose of direct marketing, you have the right to object at any time to the processing and without stating reasons; this includes profiling to the extent that it is related to such direct marketing.

If you object to the processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

Responsible for data processing:
Inatronic GmbH & Co. KG
August-Schmieder-Str. 45 a
94377 Steinach
Germany
bmwsupport@inatronic.com