Privacy Policy of BMW Ville de Québec

September 19, 2023

(s.3.2)

Respecting the confidentiality of personal information is a central concern for BMW Ville de Québec. Therefore, we commit to adhering to this Privacy Policy (hereinafter "Policy") to ensure a high level of protection for the information collected from users of any of our services. We also pledge to establish consistent practices related to the protection of personal information and to clearly communicate these practices.

This Policy applies to users (hereinafter "you") of the services offered by BMW Ville de Québec (hereinafter "we"), including our website, bmwvilledequebec.com, and in our dealerships..

This Policy describes the various situations in which BMW Ville de Québec collects, uses, discloses, and stores users' personal information.

1. Consent

1.1. Personal Information

By browsing our website, you acknowledge that you have read, understood, and agreed to be bound by all the clauses contained in this Privacy Policy, as published on our website. You also affirm that you are of legal age according to Canadian and Quebec legislation or are legally authorized to browse this site. If you do not agree with any of the provisions herein or are not authorized to browse our site, it is your responsibility to discontinue navigation.

By voluntarily providing personal information about yourself on our website, you implicitly consent to us collecting, disclosing, using, and retaining this data for the purposes for which you initially consented to provide it for the duration necessary to achieve those purposes. (s.8.3 and 14) Only personal information that is necessary will be collected, disclosed, used, and retained unless the law allows for other processing.

Before using personal information for purposes other than those for which it was initially communicated, we commit to obtaining your consent. (s.12)

1.2. Sensitive Personal Information

For the collection and use of Sensitive Personal Information, each user must provide express consent; otherwise, we will not be authorized to use this information. For the purposes of this Policy and as defined in Article 12 al.4 (2) of the Private Sector Privacy Act, personal information is considered sensitive "when, by its nature or due to the context of its use or disclosure, it generates a high degree of reasonable privacy expectations."

You can refuse to provide all or some requested sensitive personal information, in which case we may not be able to provide certain services that require the requested information.

1.3. Withdrawing Consent

At any time, to withdraw your consent regarding any aspect related to the management of your personal information by BMW Ville de Québec, you can simply fill out the Communication Preferences form. Please note that it may be impossible to withdraw your consent if we are bound by legal or contractual requirements.

2. Collection of Personal Information

2.1. Forms

Personal information is collected through forms, whether electronic or paper forms. We use these forms for:

• Name
• Email address
• Identification numbers
• Phone number
• Physical address
• Date of birth
• Social insurance number
• Payment information (credit card or other payment methods)
• Interest in vehicle(s)
• Estimated budget for vehicle purchase in dollars per month
• Indicating whether you own a vehicle
• Estimated credit score
• Interest in a zero down payment option
• Type of residence
• Amount of monthly mortgage or rent
• Occupation
• Monthly income before taxes/deductions

The personal information we collect is gathered through forms and through the interaction between you and our website. Additionally, as indicated in the following section, we use cookies and/or log files to gather information about you.

Users can choose not to provide the requested personal information. However, this may affect their access to requested services.

2.2. Log Files

We collect certain information through log files and cookies. This primarily includes the following information:

• Your internet search
• Your IP address
• Your browser type and language
• Date and time of your connection
• The pages you visited
• One or more cookies to identify your browser

If you voluntarily provide personal information during your website visit, it will be associated with non-personal information collected in log files. All of this information may then be shared with the dealer.

2.3. Cookies

In order to provide certain services, we may collect information through cookies. Cookies are small documents containing information exchanged between a browser and a web server when a user visits a website. When you visit our website, we transmit one or more types of cookies to your computer as well as cookies from related or third-party services.

Some cookies allow us to collect non-personal information that does not identify, locate, or profile users and may be activated during your visit. These cookies allow, among other things, all users to efficiently navigate the website, analyze and compile data on features used by users in general, improve website performance, measure user engagement with specific content, track conversions, and manage marketing and advertising campaigns.

We also use cookies that can collect, identify, locate a user, and/or profile. These cookies will be disabled by default. Each user must enable these cookies when required upon entering our website. By enabling these cookies, you help us provide you with quality service. By refusing to enable these cookies, we cannot guarantee that you will have the expected customer experience.

Specifically, these cookies allow, among other things, customization of each user's experience, analysis of user behavior, and the delivery of targeted advertising.

2.3.1. Information Collected Through Cookies

Cookies allow the collection of information about your browsing, including:

• Basic Information: Cookies can store basic information such as the user's IP address, browser type, operating system, screen resolution, and approximate location.


• Session Identifier: Session cookies are temporary and are used to maintain the user's session state. They can store a unique identifier that allows the server to recognize the user during their visit to the site.


• User Preferences: Some cookies are used to store user preferences, such as preferred language, site theme, or layout settings.


• Browsing History: Cookies can record the pages visited by the user, clicks made, and actions taken on the site. This can be used to generate user activity analysis.


• Authentication Information: Cookies can store temporary authentication information, allowing the user to remain logged in to the site without entering their credentials again.


• Advertising Preferences: Cookies used for advertising purposes can store user preferences regarding ads, such as preferred ad types or viewed products.


• Social Media Data: Some cookies are used to track user interactions on social media, including share buttons and comments.


• Conversion Data: Cookies can track user actions, such as newsletter sign-ups or product purchases, to measure the effectiveness of marketing campaigns.


• Tracking Data: Tracking cookies can record the websites visited by the user and their browsing activities. This can be used to generate interest profiles and deliver targeted ads.

2.3.2. Types of Cookies Used

We use various types of cookies listed in this subsection.

Cookies can be either temporary or permanent. Temporary cookies are stored on your device only while you browse our website, and they are automatically deleted when you close your browser. Permanent cookies are not deleted when you close your browser, allowing us to save your preferences.

2.3.3. Modify Your Cookie Preferences

Only necessary cookies are enabled by default. Each user has the option to allow or refuse other cookies. To modify your consent regarding the use of cookies, please click the following link Cookie Preferences or the Cookie Preferences tab displayed at the bottom of our website. Please note that not allowing certain cookies may result in suboptimal service quality.

You can also modify your cookie preferences through your browser or electronic device settings.

2.4. User Communications with Us

When you send an email or any other communication to BMW Ville de Québec, we may retain them to process your requests, answer your questions, and improve our services.

2.5. Other Information Collection

We also collect personal information in dealership locations. When you meet one of our representatives, you will be asked certain questions to provide the necessary information for us to offer you service. For example, we may ask for your contact details, payment information, or any other information relevant to vehicle purchase.

We collect certain personal information when you participate in one of our loyalty programs. When you sign up for such a program, you voluntarily provide personal information such as your contact details so that we can communicate rewards offers to you.

3. Use and Processing of Personal Information

We use personal information only for the purposes for which a user has consented to their collection. We do not rent, sell, or share any personal information about users of our websites.

We may need personal information in the following situations, for example:

• Opening a record file during the acquisition of a vehicle.
• Establishing, maintaining, and improving our relationship with you and offering you offers, advertising programs, or promotional materials about us and our products and services.
• Contacting you to provide information about your purchase, rental, warranty, or maintenance program.
• Complying with our legal requirements.
• Honoring our contractual agreements regarding market orders or services.
• Conducting analyses to improve our products and services.

4. Disclosure of Personal Information

We reserve the right to share your personal information with certain affiliated companies, vendors, agents, or other trusted companies or individuals who process them on our behalf for the purpose of offering you personalized products and services, including financing. We also disclose personal information, among other things, when we have obtained your consent, for audit, research, and analysis to ensure the maintenance and improvement of our services, to ensure the technical maintenance of our network, and to develop new services.

4.1. Disclosure in the Context of a Commercial Transaction

Additionally, BMW Ville de Québec may share information that you have voluntarily provided in the context of a commercial transaction, including transactions involving the modification of the legal structure of the business through merger, acquisition, or other means. Any other form of asset disposition or financing, in whole or in part, of the business, the loan application process, security, or financing by the business are also considered commercial transactions. In such an event, you will be notified in advance of the transfer of your personal information, and you will be informed of the new privacy policy that will apply to it. (s.18.4)

4.2. Disclosure to a Third Party

We may also share with third parties certain non-personal information in aggregate form, for example, the number of users who searched for a specific car model or clicked on a particular ad. This information does not allow for your identification.

We may also transmit personal information collected through one of our forms directly to a CRM or digital program manager of the manufacturer, which are third parties. Third parties have their own privacy policy regarding the personal information we provide to them. We encourage you to consult their privacy policy to learn about their practices for protecting personal information, since once you leave our website, you are subject to the policies and terms of the third-party website. Please keep in mind that some third parties may be located outside of Quebec or Canada and may be subject to different laws regarding the protection of your personal information.

We may also provide personal information in response to valid legal proceedings such as subpoenas, search warrants, court orders, or to establish or exercise our rights or defend against legal claims, or in any other circumstances as required or permitted by law. (s.18 et seq. )

4.3. Disclosure of Personal Information from Affiliate Websites

Some of our services are offered in connection with other websites. The personal information you provide to these sites may be sent to BMW Ville de Québec for the purpose of providing the service. This information is processed in accordance with this Policy. Affiliate sites may have different privacy practices, so we recommend reviewing them.

5. Retention and Destruction of Personal Information

Initially, we retain personal information for the period for which we need it to provide the requested service, i.e., for the purpose for which the user has consented to provide such information. If consent has been given for multiple purposes, we will retain the information until the purpose requiring the longest period is accomplished, without using it for any other purpose than those for which consent has been given.

We also retain this information for any period required to comply with our legal obligations.

5.1. Destruction or Anonymization

When personal information has been used for the purposes for which the user gave consent, we will proceed with the anonymization or destruction of the information while respecting the retention periods prescribed by law (23).

6. Security and Confidentiality of Personal Information

We take all necessary security measures to prevent unauthorized access, modification, disclosure, or destruction of data. These measures include internal audits of data collection, storage, processing, and physical or software security measures designed to prevent unauthorized access to the systems where personal information is stored (s.10). Personal information is encrypted at rest and always encrypted during backups.

To ensure the security of your personal data, we implement precautionary measures in accordance with industry standards to prevent loss, misuse, unauthorized access, disclosure, alteration, or inappropriate destruction of this information.

When you provide us with credit card data, it is encrypted. Although the transmission of data over the Internet or their electronic storage cannot be guaranteed to be 100% secure, we comply with industry security requirements and apply additional security measures recognized within the industry.

We use TLS encryption and employ a secure SSH protocol when a user fills out an online form. To securely store data, we use MySQL databases exclusively located in Quebec with restricted access. Furthermore, with the visitor's consent, in order to understand user behavior on our sites and better understand their interests in our various vehicle models offered on our site, we may sometimes associate a unique identifier with each user containing personally identifiable information (PII), including but not limited to IP address, name, address, and phone number. This unique identifier is also securely stored in a MySQL database located in Quebec.

Access to personal information is strictly limited to employees, agents, subcontractors, and agents acting on behalf of BMW Ville de Québec who need access to operate, develop, or improve our services. These individuals are bound by confidentiality obligations and may be subject to sanctions, including dismissal and legal action, for breaches of these obligations (s.20). To control access to personal information, each authorized person has a username and password.

However, it is important to keep in mind that no data collection, communication, or storage system can guarantee 100% security. Therefore, it is also your responsibility to ensure that your information is transmitted securely, especially by notifying us if you suspect the security of your information is at risk (See Section 11 for the contact details of the Data Protection Officer).

7. User Rights Regarding Disclosed Personal Information

A user may, at any time, request access or rectification of the record containing the personal information we hold about them if any information is inaccurate, incomplete, or ambiguous. We aim to obtain accurate information to provide you with the best service. Please feel free to request access or rectification by contacting our Data Protection Officer (see Section 11). This request must be made in writing and must contain evidence confirming the identity of the user or their representative (s.30).

A user may also request more information about how we use personal information.

Any user may request that we provide them with computerized personal information we hold about them in a technologically accessible and readable format (s.27).

A user can also request that we delete information that we no longer deem necessary to fulfill the purposes for which it was provided and consented to or that no longer has a legal basis for use.

As mentioned earlier, any user can also change their consent regarding the use of personal information.

A user can also file a complaint with our Data Protection Officer (see Section 11) and request that we limit the use of their information while processing the complaint.

A user also has the right not to be subject to a decision based solely on automated processing of their personal information. Incidents related to personal information.

If we have reason to believe that an incident involving users' personal information has occurred, we undertake to take reasonable measures to limit the risk of harm and to be proactive in creating preventive measures.

If we believe that serious harm may result from an incident related to personal information, we will notify the Access to Information Commission and any user whose personal information is affected by the incident in accordance with the law (s.3.5).

We also commit to maintaining a privacy incident register (s.3.8).

8. Links to Other Sites

When a user clicks on a link that takes them to a website that does not belong to us, it is their responsibility to check the privacy and cookie policies applicable to that site. This Policy applies only to our website, and we are not responsible for the content of third-party websites.

9. Third-Party Privacy Policies

By interacting with the Youtube videos on this website, users are agreeing to be bound by the Youtube Terms of Service. Please refer also to the Google Privacy Policy.

10. Changes to the Policy

Please note that this Policy may be changed at any time. No change, even minor, that diminishes your rights under these terms can occur without your express consent.

Regardless of the above, any changes to this Policy will be published on this page. The date of the Policy update will be indicated at the top of the page (s.8.2).

11. Contact Information for the Data Protection Officer

Responsible person at BMW Ville de Québec has been designated as the responsible party at BMW Ville de Québec for the protection of personal information. For any questions or comments, please contact the responsible person using one of the following options (s.3.1).

Data Protection Officer: Jean-Francois Tremblay
By phone: 418-681-5000
By email: jftremblay@bmwvilledequebec.ca
Physical address:
215 Rue Étienne Dubreuil
Quebec, Quebec
G1M 4A6

Thank you for trusting BMW Ville de Québec.