Privacy Policy

Last updated: August 12, 2026

This Privacy Policy describes Our policies and procedures on the collection, use, and disclosure of Your information when You use the Service, and tells You about Your privacy rights under applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), and how the law protects You.

We use Your Personal Data to provide and improve the Service. We collect, use, and disclose Your information as described in this Privacy Policy and only where We have a valid legal basis to do so under the GDPR and applicable laws.

Data Controller Information

For the purposes of the GDPR and other applicable data protection regulations:

  • Data Controller: BimmerDash (“the Company”, “We”, “Us”, or “Our”).
  • Country/Jurisdiction: Lithuania (European Union).
  • Contact Email: inquiries@bimmerdash.com

Interpretation and Definitions

Interpretation

The words whose initial letters are capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

  • Account means a unique account created for You to access Our Service or parts of Our Service.
  • Affiliate means an entity that controls, is controlled by, or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest, or other securities entitled to vote for election of directors or other managing authority.
  • Company (referred to as either “the Company”, “We”, “Us” or “Our” in this Privacy Policy) refers to BimmerDash, located in Lithuania.
  • Cookies are small files placed on Your computer, mobile device, or any other device by a website, containing details of Your browsing history on that website, among its many uses.
  • Data Controller means the natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal information are, or are to be, processed. For the purpose of this Privacy Policy, We are the Data Controller of Your Personal Data.
  • Device means any device that can access the Service, such as a computer, a cell phone, or a digital tablet.
  • Personal Data (or “Personal Information”) is any information that relates to an identified or identifiable natural person (“Data Subject”) under the GDPR.
  • Service refers to the Website.
  • Service Provider (or “Data Processor”) means any natural or legal person who processes data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, provide the Service on behalf of the Company, perform services related to the Service, or assist the Company in analyzing how the Service is used.
  • Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
  • User / Data Subject means any individual who accesses or uses the Service.
  • Website refers to BimmerDash, accessible from http://bimmerdash.com/.
  • You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Information

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

  • Email address
  • Phone number (if You opt in to text messaging or support)
  • Account registration details

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device’s Internet Protocol address (e.g. IP address), browser type, browser version, the pages of Our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device’s unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers, and other diagnostic data.

Tracking Technologies and Cookies

We use tracking technologies (such as cookies and web beacons) to track activity and improve Our Service.

  • Cookies or Browser Cookies: A cookie is a small file placed on Your Device. You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of Our Service.
  • Web Beacons: Certain sections of Our Service may contain small electronic files known as web beacons (clear gifs, pixel tags, single-pixel gifs) that permit the Company to count users who have visited those pages and for other related website statistics.

Consent for Non-Essential Cookies

In compliance with the GDPR and ePrivacy Directive, We use non-essential cookies (such as functionality, analytics, or advertising cookies) only with Your explicit prior consent. You can manage or withdraw Your consent at any time via Our cookie management settings banner or through Your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out prior to withdrawal.

We use the following types of Cookies:

  1. Necessary / Essential Cookies
    • Type: Session Cookies | Administered by: Us
    • Legal Basis: Legitimate Interests / Contractual Necessity
    • Purpose: Essential to provide You with services available through the Website and to authenticate users, preventing fraudulent account use.
  2. Cookies Policy / Notice Acceptance Cookies
    • Type: Persistent Cookies | Administered by: Us
    • Legal Basis: Legal Obligation / Consent
    • Purpose: Identifies whether users have accepted or configured their cookie preferences.
  3. Functionality Cookies
    • Type: Persistent Cookies | Administered by: Us
    • Legal Basis: Consent (Article 6(1)(a) GDPR)
    • Purpose: Remembers choices You make (e.g., language preference or login details) to provide a personalized experience.

Legal Bases for Processing Under the GDPR

In accordance with Article 6 of the GDPR, We will only collect and process Your Personal Data where We have a lawful basis. Depending on the processing activity, We rely on the following legal bases:

  1. Performance of a Contract (Art. 6(1)(b) GDPR): Processing is necessary to perform a contract with You, or to take steps at Your request prior to entering into a contract (e.g., setting up Your Account, providing access to the Website services).
  2. Consent (Art. 6(1)(a) GDPR): You have given clear consent for Us to process Your Personal Data for a specific purpose (e.g., non-essential cookies, SMS marketing, or email newsletters). You have the right to withdraw consent at any time.
  3. Legitimate Interests (Art. 6(1)(f) GDPR): Processing is necessary for Our legitimate commercial interests or those of a third party, provided those interests are not overridden by Your data protection rights. This includes maintaining security, technical troubleshooting, analytics, and service enhancements.
  4. Legal Obligation (Art. 6(1)(c) GDPR): Processing is necessary to comply with legal, regulatory, tax, or accounting requirements under EU or Lithuanian law.

How We Use Your Personal Data

The Company uses Personal Data for the following purposes:

  • To provide and maintain Our Service: Including monitoring usage (Legal basis: Contract Performance / Legitimate Interests).
  • To manage Your Account: To manage Your registration as a user of the Service (Legal basis: Contract Performance).
  • For the performance of a contract: Development, compliance, and execution of purchase or service contracts (Legal basis: Contract Performance).
  • To contact You: By email, SMS, push notifications, or other electronic communication regarding updates, security alerts, and customer service (Legal basis: Contract Performance / Legitimate Interests).
  • To send marketing communications: To provide news, special offers, and promotional information. Where required under GDPR, We send marketing communications only with Your express consent (Legal basis: Consent). You can opt out at any time via the “unsubscribe” link.
  • To manage Your requests: To handle and respond to Your customer support requests (Legal basis: Contract Performance / Legitimate Interests).
  • For business transfers: Evaluating or conducting mergers, sales, reorganizations, or asset transfers (Legal basis: Legitimate Interests).
  • For security and service optimization: Data analysis, fraud prevention, usage trend evaluation, and service safety (Legal basis: Legitimate Interests / Legal Obligation).

Text Messages (SMS) Privacy Notice

If You opt in to receive text (SMS) messages from Us:

  • We collect Your phone number, date/method of consent, and delivery status.
  • Legal Basis: Consent (Art. 6(1)(a) GDPR).
  • Third-Party Sharing: No mobile information or phone numbers will be shared with or sold to third parties or affiliates for marketing or promotional purposes. Information is shared strictly with authorized telecommunication Service Providers processing messages on Our behalf.
  • Opt-Out: Consent is not a condition of purchase. You can opt out at any time by replying STOP to any message or replying HELP for support.

Your Rights Under the GDPR

If You are located in the European Economic Area (EEA), You have specific statutory rights under Articles 12–22 of the GDPR regarding Your Personal Data:

  1. Right of Access (Art. 15 GDPR): You have the right to request access to Your Personal Data and obtain a copy of the personal information We hold about You.
  2. Right to Rectification (Art. 16 GDPR): You have the right to request that We correct incomplete, inaccurate, or outdated Personal Data.
  3. Right to Erasure / “Right to be Forgotten” (Art. 17 GDPR): You have the right to ask Us to delete Your Personal Data when it is no longer necessary for the purposes for which it was collected, or if You withdraw Your consent (where consent was the legal basis).
  4. Right to Restriction of Processing (Art. 18 GDPR): You have the right to request that We restrict the processing of Your Personal Data under certain conditions (e.g., while the accuracy of data is being contested).
  5. Right to Data Portability (Art. 20 GDPR): You have the right to receive Your Personal Data in a structured, commonly used, machine-readable format and to transfer that data to another controller without hindrance.
  6. Right to Object (Art. 21 GDPR): You have the right to object at any time to the processing of Your Personal Data based on legitimate interests or for direct marketing purposes.
  7. Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on consent, You have the right to withdraw Your consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.
  8. Right Not to be Subject to Automated Decision-Making (Art. 22 GDPR): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning You. (Note: BimmerDash does not perform automated decision-making or profiling that produces legal effects).

How to Exercise Your GDPR Rights

To exercise any of these rights, please submit a request to Us at:

We may ask You to verify Your identity before responding to such requests to ensure data safety. We will respond to Your request within one month of receipt, as required by the GDPR.

Right to Lodge a Complaint

If You are located in the European Union and believe that Our processing of Your Personal Data infringes the GDPR, You have the statutory right to lodge a complaint with a Data Protection Authority.

Because the Company is established in Lithuania, Our primary Lead Supervisory Authority is:

  • State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija – VDAI)

You also have the right to lodge a complaint with the local Data Protection Authority in the EU Member State of Your habitual residence, place of work, or place of the alleged infringement.

Retention of Your Personal Data

We will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy, or as required by EU/Lithuanian law.

Where possible, We apply shorter retention periods or anonymize data when it is no longer required:

  • Account Data: Retained for the duration of Your Account relationship plus up to 24 months following account closure to resolve disputes or post-termination issues.
  • Customer Support & Communications: Retained up to 24 months from ticket closure for quality assurance and legal defense against potential claims.
  • Usage & Analytics Data: Retained up to 24 months from the date of collection.
  • Server Logs: Retained up to 24 months for security monitoring and troubleshooting.

Data may be retained beyond these periods if required by legal obligations (e.g. tax and accounting laws), or to establish, exercise, or defend legal claims.

Upon expiration of retention periods, data is permanently erased from active systems or anonymized. Residual copies in encrypted backups are routinely deleted in accordance with backup deletion schedules.

International Data Transfers (Transfers Outside the EEA)

Your information, including Personal Data, may be processed at the Company’s operating offices in Lithuania and in places where third-party Service Providers are located. This means Your data may be transferred to — and maintained on — computers located outside the European Economic Area (EEA).

When transferring Personal Data outside the EEA, We ensure appropriate safeguards are implemented in compliance with Chapter V of the GDPR, such as:

  • Transferring data to countries recognized by the European Commission as providing an adequate level of data protection (Adequacy Decisions).
  • Implementing European Commission Standard Contractual Clauses (SCCs) with third-party service providers.
  • Utilizing valid framework certifications, such as the EU-U.S. Data Privacy Framework.

You may request further information or copies of the transfer mechanisms implemented by contacting Us at inquiries@bimmerdash.com.

Sharing and Disclosure of Personal Data

We share Personal Data under the following limited circumstances:

  • With Service Providers (Processors): Trusted third-party vendors who assist with hosting, web analytics, SMS delivery, and customer support under strict Data Processing Agreements (DPAs) compliant with Art. 28 GDPR.
  • Business Transfers: In connection with any merger, sale of assets, or acquisition, provided the acquiring party respects GDPR obligations.
  • Law Enforcement & Legal Authorities: Where required under EU or national laws, court orders, or enforceable public requests.
  • With Your Explicit Consent: For any other specific purpose requested or authorized by You.

Security of Your Personal Data

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in compliance with Article 32 of the GDPR. These measures include encryption in transit and at rest, regular security evaluations, access restrictions, and administrative controls. However, please note that no method of electronic transmission or storage is 100% secure.

Children’s Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect Personal Data from children under 16. If We become aware that We have collected Personal Data from a child under 16 without parental consent, We will take immediate steps to delete that information.

Links to Other Websites

Our Service may contain links to third-party websites not operated by Us. We have no control over and assume no responsibility for the content, privacy policies, or practices of third-party sites. We advise You to review the Privacy Policy of every site You visit.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any material changes by posting the new Privacy Policy on this page, updating the “Last updated” date, and sending an email notice or displaying a prominent banner on Our Service prior to the changes taking effect.

Contact Us

If You have any questions, wish to exercise Your GDPR rights, or need further details regarding Our Privacy Policy, You can contact Us: