In this notice, we provide you with information on the collection and processing of your personal data if you have concluded a purchase contract for a new car with us or if you are our contact person for such a contract. If you are the contact person of our contracting party, but not our contracting party itself, we only process your contact data.

If the agreement is related to other services, the data protection notices of these other services also apply. 

The controller for the processing of personal data as set forth below (unless another controller is expressly listed) is: 

Mercedes-Benz AG
Mercedesstrasse 120
70372 Stuttgart
Germany
dialog@mercedes-benz.com

The contact person for your data protection questions is our data protection officer:

Mercedes-Benz Group AG
Chief Officer Corporate Data Protection
HPC E600
70546 Stuttgart
Germany
data.protection@mercedes-benz.com

We process personal data ("data") in accordance with the principles of data avoidance and data economy and only to the extent required and permitted of us under the applicable legal provisions, or to the extent we are forced to in such processing.

Unless specified otherwise below, the terms "process" and "processing" include, but are not limited to, the collection, use, disclosure and transfer of personal data. 

General data from the business relationship

We first collect, process and use the data that you provide us with as part of our business relationship. This includes the following data in particular: 

• Master data of the customer or contact person, particularly their name
• Contact information of the customer, particularly current address, telephone numbers and e-mail addresses
• Contract data such as delivery, order, and confirmation dates, order and customer account numbers
• Vehicle data, particularly vehicle identification number
• Purchase-related data, such as dispatch date;
• If authorized representatives are appointed: their master data, especially name, date of birth, current address;
  
• Data contained on the personal ID card or other proof of identity submitted;
• Any other data relating to performance of the respective business relationship. 

Collection and processing to fulfill legal obligations

We collect and process your personal data described in greater detail in Section 3 as part of the initiation of a contractual relationship and in order to fulfill our contractual obligations to you. For example, we process your contact data when we contact you regarding the conclusion of a purchase agreement.

Processing based on legitimate interest

Furthermore, we process your personal data when necessary to protect the legitimate interests of Mercedes-Benz AG or a third party. This is especially the case in the following instances:

• When necessary for the assertion of legal claims and defense in legal disputes.
• In individual cases, for business management and risk control within the Group.
• If necessary under the framework of applicable sanctions regimes.
• For accounting purposes: For the purpose of risk prevention and for the preparation of the balance sheet of Mercedes-Benz AG and the consolidated balance sheet of the Mercedes-Benz Group AG, to which Mercedes-Benz AG belongs, certain master data from your purchase agreement will be processed – in particular your name, your address, the contract term, the contract number and the chassis number. To prepare the aforementioned balance sheets, certain document data, including payment and booking information, will also be processed by Mercedes-Benz AG exclusively for these purposes. 

Processing based on legal requirements

Your personal data is also collected and processed on the basis of legal requirements. For example, we are subject to the provisions of the German Money Laundering Act. 

We do not share your data with third parties unless we are authorized or obliged to do so based on legal requirements and/or official or court orders.

Data sharing with processors on our behalf

We engage external data processors (e.g. IT service providers) in order to perform our services. The transfer of your data to these third parties is carried out in strict compliance with the criteria of the GDPR and the German Federal Act on Data Protection. The data processors commissioned by us, who may only process the data for us and not for their own purposes, are obligated to comply with the strict standards of Mercedes-Benz AG.

Data transfer to suppliers

We also transfer your data – especially your first name and last name, your address, the order number and customer account number, the vehicle identification number and the number of your contract – to suppliers that we have tasked with the manufacturing or delivery of equipment agreed with you and/or the delivery of your vehicle as part of the purchase agreement. Our suppliers mainly use your data for identifying and assigning the commissioned equipment to your vehicle and/or for the delivery of your vehicle.

Data transfer to workshops

If you decide to use one of our service products, we also transfer your data – especially your first name and last name, the data on your purchase agreement, the date of the initial registration of the vehicle you purchased, the vehicle identification number, vehicle type and brand and license plate number – to our licensed workshops, since they require this data in order to carry out your service orders.

Data transfer to body manufacturers

We transfer your data – especially your first name and last name, your address, the order number and the vehicle identification number – to body manufacturers in the event that your chassis is to receive any installations, removals or bodywork. The body manufacturers use your data in the context of your placement of an order for the identification and assignment of the ordered installations, removals or bodywork in order to finalize your vehicle as a whole. 

We also transfer or grant access to data to service providers outside the European Economic Area (EEA) for maintenance and support for IT systems. Because countries outside the EEA usually do not have the same level of data privacy as the EU, we ensure by way of contract that the service providers take measures to protect the data under EEA standards. The Mercedes-Benz Group AG companies are also governed by the strict data privacy requirements of the Mercedes-Benz Group AG. 

We process and store your personal data only as long as we need it to meet our contractual or legal obligations. If there is no longer a legitimate interest, we will erase the data. We usually delete your data ten years after the end of the contractual relationship at the latest. If a contract is not concluded, the data is deleted after six months. 

You have extensive rights regarding the processing of your personal data. Making you aware of these rights is very important to us:

• Right of access: You have a right to information regarding the data stored with us, especially for the purpose of the processing and the duration of the data storage (Article 15 GDPR).
• Right to rectification of inaccurate data: You have a right to demand from us the immediate correction of your personal data, should it be inaccurate (Article 16 GDPR).
• Right to erasure: You have the right to demand that we erase your personal data. The criteria allow you to demand the deletion of your personal data if we, for instance, no longer need the personal data for the purposes for which it was collected or otherwise processed, if we unlawfully process the data, or if you have rightfully objected to the use of your data, revoked your consent to the same or there is a legal obligation to delete (Article 17 GDPR).
• Right to restriction of processing: You have the right to demand a restriction of the processing of your data. This right especially applies for the duration of the review if you have disputed the accuracy of your personal data, as well as in the case that, for an existing right to deletion, you request restricted processing instead of erasure. Furthermore, there will be restricted processing if the data is no longer required for our purposes, but you still need the data in order to assert, exercise or defend legal rights, as well as if the successful assertion of an objection is in dispute between you and us (Article 18 GDPR).
• Right to data portability: You have the right to receive the personal data you have provided us with in a structured, common, machine-readable format from us (Article 20 GDPR), provided said data has not already been deleted. 

If you would like to assert any of your rights or receive more information about them, please send an e-mail to dialog@mercedes-benz.com or write to Mercedes-Benz Group AG, HPC E600, 70546 Stuttgart, Germany

If you feel that we are violating the GDPR by processing personal data about you, you have the right to lodge a complaint with a supervisory authority, e.g. a data protection agency responsible for your place of residence, workplace or location where the alleged data protection violation occurred.

1. To whom does this data protection notice apply?
2. Who controls the processing of my data and whom can I contact about data protection? 
3. Where does my data come from and what data is processed?
4. What is my data used for (purpose of processing) and on what basis (legal basis) does this take place?
5. Will my data be shared?
6. Will my data be sent to a third country or an international organization?
7. How long will my data be stored?
8. What rights do I have with respect to Mercedes-Benz AG? 
9. Right to lodge a complaint with the supervisory authority